OBD2 LT1 XDF $EE EEX creation

**Tom H** · 06-02-2020

Originally Posted by kur4o

If there is no space just use what is possible, In the end it will be much easier to add different reading format on the app side than mod the pcm side to cover the existing one.

Done. Here is my proposed code. Execute and it sends 447 $80 byte messages with the reply $06 $55 and the last one is marked $06 $A0

Code:

D_SEND_ALDL    EQU    $0008            ; SEND ALDL MESSAGE
D_RESET_COP    EQU    $000B            ; RESET COP TIMERS
D_F_OE_ACTIVE    EQU    $000E            ; MAKE FLASH OE ACTIVE
D_F_OE_INACTIVE    EQU    $0011            ; MAKE FLASH OE INACTIVE
D_N_X_1MS_DELAY    EQU    $0014            ; DELAY: 1MS * ACCA
D_D10MS_DELAY    EQU    $0017            ; 10MS DELAY
D_CHK_CLR_OC1    EQU    $001A            ; CHECK AND CLEAR OC1
D_INIT_OC1_20MS    EQU    $001D            ; INITIALIZE OC1: 20MS
D_SUCCESS_MSG    EQU    $0020            ; SEND SUCCESS MESSAGE
D_SET_VPPH    EQU    $0023            ; SET VPP TO VPPH: 12V
D_SET_VPPL    EQU    $0026            ; SET VPP TO VPPL
D_FLASH_IDMC    EQU    $0029            ; READ FLASH ID, MANUFACTURE CODES


        ORG    $0000            ; SET ORIGIN

START        DB    $E4            ; TARGET DEVICE
        DB    $8A            ; LENGTH
        DB    $06            ; UPLOAD AND EXECUTE PROGRAM SEGMENT
        DB    $18            ; ADDRESS H
        DB    $10            ; ADDRESS L

        LDY    #$2000            ; INITIAL LOCATION LESS $80

NEXT_BLOCK    LDX    #$1F7E            ; BUFFER

        LDD    #$06AA            ; MODE:MESSAGE SUCCESS
        CPY    #$FF80            ; 
        BEQ    XFER_LAST        ; 

        LDD    #$0655            ; MODE:MESSAGE PENDING
XFER_LAST    STD    $00,X            ; SET MESSAGE CONTENT

        LDAB    #$80            ; SET THE BYTE COUNT

        CPY    #$0000            ; TEST FOR COMPLETE
        BEQ    COMPLETE        ;


XFER_LOOP    LDAA    $00,Y            ; READ FLASH
        STAA    $02,X            ; SAVE TO BUFFER

        INY                ; INCREMENT SOURCE
        INX                ; INCREMENT DESTINATION

        DECB                ; DECREMENT COUNT
        BNE    XFER_LOOP        ; LOOP TILL ZERO

        LDX    #$1F7E            ; BUFFER HEAD

        LDAB    #$82            ; MESSAGE CONTENT LENGTH
        JSR    $0008            ; D_SEND_ALDL

        BRA    NEXT_BLOCK        ; 

COMPLETE    RTS                ; 

        DB    $69            ; CHECKSUM

        END    START

-Tom

**In-Tech** · 06-03-2020

Here's some bit/bang stuff we wrote many many years ago to dump some stuff that had intentional clock jitter. Maybe give some ideas.

Code:

SaveA:          equ     $XX        ;IO Register address

BTDelay:        equ     $F0             ;bit delay this can be any value ya like

;
;BootStrap code starts here
;
                sei            ;enable interrupts, not really necessary
                lda     #$55        ;55h is the response that basically says you are
                            ;running this bootstrap, can be any value you like
                bra     Start           ;run dumper

SendByte:       sta     SaveA
                clra
                bsr     DecA            ;Inter-Byte delay
                ldx     #$0A
                coma                    ;invert byte

                bclr0   $00             ;5 Zero Bit        
                bsr     DelayBit        ;1st Start Bit
                bra     SetIO           ;3

SetIO:          bset    $00, #0         ;5 One Bit
                bsr     DelayBit
                clc                     ;2nd Start Bit

SendBit:        bcs     Send1           ;3

                bclr0   $00             ;5 Zero Bit     |    
                bra     bitdelay        ;3              |count this for timing calc

Send1:          bset    $00, #0         ;5 One Bit      |but not this
                bra     bitdelay        ;3        |

bitdelay:       bsr     DelayBit
                asla    a               ;3
                decx                    ;3
                bne     SendBit         ;3
                bset    $00, #0         ;Parity = 0, Stop bits = 1
                rts                     ;6

DelayBit:                               ;standard 8 bit delay loop
                sta     SaveA
                lda     #BTDelay    
DecA:           deca
                bne     DecA
                lda     $XX             ;SaveA  This is the IO register
                rts
                                                  
Start:          bsr     SendByte
LongDelay:      deca
                bsr     DelayBit
                bne     LongDelay    
                lda     #$30        ;Start address of 3000
                sta     $47        ;Now address stored at 47,48 in ram
                lda     #$00
                sta     $48
; ---------------------------------------------------------------------------
                dw $7180        ;Change page to eeprom
; ---------------------------------------------------------------------------
Loop:           dw      $92C6        ;Load A with the value of this next byte address 92C647
                    ;Haven't fixed assembler to allow this new opcode yet
                db      $47
                bsr     SendByte        
                inc     $48
                bne     Loop
                inc     $47
                bne     Loop
;need to create "reversible" idling loop here or rts
;
;                  | 1 STB  |        | 2 STB  |
;
;I/O Pin >---------+        +--------+        
;           |        |         |           ..... data bits
;           +--------+        +--------+

**kur4o** · 06-05-2020

I just tested the eside vpp apply and it works flawless. It reads both voltages vpp and ign. Now I have to fix a vpp_remove eside one that will allow separate side flashing.

**Tom H** · 06-05-2020

Originally Posted by kur4o

I just tested the eside vpp apply and it works flawless. It reads both voltages vpp and ign. Now I have to fix a vpp_remove eside one that will allow separate side flashing.

Great news. I have tested routines for checking the ID, programming along with VPP On and Off. I assume that you have some different need but if not, I can just send you the VPP off.

Still waiting on parts from China. My hair is growing faster than things are moving.

I can now work with someone on "UnBrick for ESide". TSide should be easy once we have that experience. Wonder if anyone has a brick and some time on their hands??

-Tom

P.S. It would be even better if we had two volunteers: one with 94/5 and one with 96/7!

**In-Tech** · 06-05-2020

Hi Tom,
I'm still waiting on my '94/95 pcm to show up but I have a couple '96/97's that are bricked. I have flash chips(E and T), sockets, and programming equipment. I've been playing a little with software attacks but I have no need for these pcm's is why I haven't repaired them yet and plenty of other crapola to do :D Anyway, I can be a tester if you like as time permits.

**Tom H** · 06-06-2020

Originally Posted by In-Tech

Hi Tom,
I'm still waiting on my '94/95 pcm to show up but I have a couple '96/97's that are bricked. I have flash chips(E and T), sockets, and programming equipment. I've been playing a little with software attacks but I have no need for these pcm's is why I haven't repaired them yet and plenty of other crapola to do :D Anyway, I can be a tester if you like as time permits.

Hi Carl,
Sounds OK. I will start working on instructions. Plan is that we will never need flash chips, sockets or programming equipment. I want to keep the conformal coating intact. Let's program in place!

This process is best managed in layers. Let's start with recovering an Eside board from your 96/7 PCM. On your side there are a number of things and setups needed:

- Bricked 96/7 PCM (which you have)
- Bench setup to power it
- USB-serial cable
- Various tools like soldering iron, pliers and so on
- Various electronic bits like resistors and hookup wire
- A PC with a terminal program with the capability to set baud rate to 1890 baud, send binary files to the port, receive and interpret incoming hex characters. I have been using Realterm but I am sure there are a bunch of terminals that will work.
It is also preferred that the terminal display when things like break are present.

I will get to work and post in a day or two. Q for you: Should this be in a separate thread in the forum? Continue here??

-Tom