Page 10 of 10 FirstFirst ... 5678910
Results 136 to 148 of 148

Thread: OBD2 LT1 XDF $EE EEX creation

  1. #136
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by kur4o View Post
    If there is no space just use what is possible, In the end it will be much easier to add different reading format on the app side than mod the pcm side to cover the existing one.
    Done. Here is my proposed code. Execute and it sends 447 $80 byte messages with the reply $06 $55 and the last one is marked $06 $A0

    Code:
    D_SEND_ALDL    EQU    $0008            ; SEND ALDL MESSAGE
    D_RESET_COP    EQU    $000B            ; RESET COP TIMERS
    D_F_OE_ACTIVE    EQU    $000E            ; MAKE FLASH OE ACTIVE
    D_F_OE_INACTIVE    EQU    $0011            ; MAKE FLASH OE INACTIVE
    D_N_X_1MS_DELAY    EQU    $0014            ; DELAY: 1MS * ACCA
    D_D10MS_DELAY    EQU    $0017            ; 10MS DELAY
    D_CHK_CLR_OC1    EQU    $001A            ; CHECK AND CLEAR OC1
    D_INIT_OC1_20MS    EQU    $001D            ; INITIALIZE OC1: 20MS
    D_SUCCESS_MSG    EQU    $0020            ; SEND SUCCESS MESSAGE
    D_SET_VPPH    EQU    $0023            ; SET VPP TO VPPH: 12V
    D_SET_VPPL    EQU    $0026            ; SET VPP TO VPPL
    D_FLASH_IDMC    EQU    $0029            ; READ FLASH ID, MANUFACTURE CODES
    
    
            ORG    $0000            ; SET ORIGIN
    
    START        DB    $E4            ; TARGET DEVICE
            DB    $8A            ; LENGTH
            DB    $06            ; UPLOAD AND EXECUTE PROGRAM SEGMENT
            DB    $18            ; ADDRESS H
            DB    $10            ; ADDRESS L
    
            LDY    #$2000            ; INITIAL LOCATION LESS $80
    
    NEXT_BLOCK    LDX    #$1F7E            ; BUFFER
    
            LDD    #$06AA            ; MODE:MESSAGE SUCCESS
            CPY    #$FF80            ; 
            BEQ    XFER_LAST        ; 
    
            LDD    #$0655            ; MODE:MESSAGE PENDING
    XFER_LAST    STD    $00,X            ; SET MESSAGE CONTENT
    
            LDAB    #$80            ; SET THE BYTE COUNT
    
            CPY    #$0000            ; TEST FOR COMPLETE
            BEQ    COMPLETE        ;
    
    
    XFER_LOOP    LDAA    $00,Y            ; READ FLASH
            STAA    $02,X            ; SAVE TO BUFFER
    
            INY                ; INCREMENT SOURCE
            INX                ; INCREMENT DESTINATION
    
            DECB                ; DECREMENT COUNT
            BNE    XFER_LOOP        ; LOOP TILL ZERO
    
            LDX    #$1F7E            ; BUFFER HEAD
    
            LDAB    #$82            ; MESSAGE CONTENT LENGTH
            JSR    $0008            ; D_SEND_ALDL
    
            BRA    NEXT_BLOCK        ; 
    
    COMPLETE    RTS                ; 
    
            DB    $69            ; CHECKSUM
    
            END    START
    -Tom

  2. #137
    Fuel Injected!
    Join Date
    Nov 2017
    Location
    Californiacation
    Age
    57
    Posts
    811
    Here's some bit/bang stuff we wrote many many years ago to dump some stuff that had intentional clock jitter. Maybe give some ideas.

    Code:
    SaveA:          equ     $XX        ;IO Register address
    
    BTDelay:        equ     $F0             ;bit delay this can be any value ya like
    
    ;
    ;BootStrap code starts here
    ;
                    sei            ;enable interrupts, not really necessary
                    lda     #$55        ;55h is the response that basically says you are
                                ;running this bootstrap, can be any value you like
                    bra     Start           ;run dumper
    
    SendByte:       sta     SaveA
                    clra
                    bsr     DecA            ;Inter-Byte delay
                    ldx     #$0A
                    coma                    ;invert byte
    
                    bclr0   $00             ;5 Zero Bit        
                    bsr     DelayBit        ;1st Start Bit
                    bra     SetIO           ;3
    
    SetIO:          bset    $00, #0         ;5 One Bit
                    bsr     DelayBit
                    clc                     ;2nd Start Bit
    
    SendBit:        bcs     Send1           ;3
    
                    bclr0   $00             ;5 Zero Bit     |    
                    bra     bitdelay        ;3              |count this for timing calc
    
    Send1:          bset    $00, #0         ;5 One Bit      |but not this
                    bra     bitdelay        ;3        |
    
    bitdelay:       bsr     DelayBit
                    asla    a               ;3
                    decx                    ;3
                    bne     SendBit         ;3
                    bset    $00, #0         ;Parity = 0, Stop bits = 1
                    rts                     ;6
    
    DelayBit:                               ;standard 8 bit delay loop
                    sta     SaveA
                    lda     #BTDelay    
    DecA:           deca
                    bne     DecA
                    lda     $XX             ;SaveA  This is the IO register
                    rts
                                                      
    Start:          bsr     SendByte
    LongDelay:      deca
                    bsr     DelayBit
                    bne     LongDelay    
                    lda     #$30        ;Start address of 3000
                    sta     $47        ;Now address stored at 47,48 in ram
                    lda     #$00
                    sta     $48
    ; ---------------------------------------------------------------------------
                    dw $7180        ;Change page to eeprom
    ; ---------------------------------------------------------------------------
    Loop:           dw      $92C6        ;Load A with the value of this next byte address 92C647
                        ;Haven't fixed assembler to allow this new opcode yet
                    db      $47
                    bsr     SendByte        
                    inc     $48
                    bne     Loop
                    inc     $47
                    bne     Loop
    ;need to create "reversible" idling loop here or rts
    ;
    ;                  | 1 STB  |        | 2 STB  |
    ;
    ;I/O Pin >---------+        +--------+        
    ;           |        |         |           ..... data bits
    ;           +--------+        +--------+
    -Carl

  3. #138
    Fuel Injected!
    Join Date
    Mar 2013
    Posts
    1,470
    I just tested the eside vpp apply and it works flawless. It reads both voltages vpp and ign. Now I have to fix a vpp_remove eside one that will allow separate side flashing.

  4. #139
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by kur4o View Post
    I just tested the eside vpp apply and it works flawless. It reads both voltages vpp and ign. Now I have to fix a vpp_remove eside one that will allow separate side flashing.
    Great news. I have tested routines for checking the ID, programming along with VPP On and Off. I assume that you have some different need but if not, I can just send you the VPP off.

    Still waiting on parts from China. My hair is growing faster than things are moving.

    I can now work with someone on "UnBrick for ESide". TSide should be easy once we have that experience. Wonder if anyone has a brick and some time on their hands??

    -Tom

    P.S. It would be even better if we had two volunteers: one with 94/5 and one with 96/7!

  5. #140
    Fuel Injected!
    Join Date
    Nov 2017
    Location
    Californiacation
    Age
    57
    Posts
    811
    Hi Tom,
    I'm still waiting on my '94/95 pcm to show up but I have a couple '96/97's that are bricked. I have flash chips(E and T), sockets, and programming equipment. I've been playing a little with software attacks but I have no need for these pcm's is why I haven't repaired them yet and plenty of other crapola to do :D Anyway, I can be a tester if you like as time permits.
    -Carl

  6. #141
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by In-Tech View Post
    Hi Tom,
    I'm still waiting on my '94/95 pcm to show up but I have a couple '96/97's that are bricked. I have flash chips(E and T), sockets, and programming equipment. I've been playing a little with software attacks but I have no need for these pcm's is why I haven't repaired them yet and plenty of other crapola to do :D Anyway, I can be a tester if you like as time permits.
    Hi Carl,
    Sounds OK. I will start working on instructions. Plan is that we will never need flash chips, sockets or programming equipment. I want to keep the conformal coating intact. Let's program in place!

    This process is best managed in layers. Let's start with recovering an Eside board from your 96/7 PCM. On your side there are a number of things and setups needed:

    - Bricked 96/7 PCM (which you have)
    - Bench setup to power it
    - USB-serial cable
    - Various tools like soldering iron, pliers and so on
    - Various electronic bits like resistors and hookup wire
    - A PC with a terminal program with the capability to set baud rate to 1890 baud, send binary files to the port, receive and interpret incoming hex characters. I have been using Realterm but I am sure there are a bunch of terminals that will work.
    It is also preferred that the terminal display when things like break are present.

    I will get to work and post in a day or two. Q for you: Should this be in a separate thread in the forum? Continue here??

    -Tom

  7. #142
    Fuel Injected!
    Join Date
    Sep 2012
    Location
    Huntsville, AL
    Posts
    237
    Given the overall content so far, I suggest we get an admin to rename this thread and then I'll start another thread about the XDF. I've made progress on the XDF but life got in the way. Hopefully soon here I can get back to it.

  8. #143
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by sherlock9c1 View Post
    Given the overall content so far, I suggest we get an admin to rename this thread and then I'll start another thread about the XDF. I've made progress on the XDF but life got in the way. Hopefully soon here I can get back to it.
    I will just start another thread. Regret the hijack actually. Somehow I inserted a focus of mine and the XDF is an important topic. Did you get anywhere understanding the vectors?

    -Tom

  9. #144
    Fuel Injected!
    Join Date
    Sep 2012
    Location
    Huntsville, AL
    Posts
    237
    I was getting my feet wet in the disassembly and then life got in the way. Not sure when I can get back to it but I'll update when I can.

  10. #145
    Fuel Injected!
    Join Date
    Jan 2020
    Posts
    25
    Quote Originally Posted by sherlock9c1 View Post
    I was getting my feet wet in the disassembly and then life got in the way. Not sure when I can get back to it but I'll update when I can.

    Hello guys...
    I just read a couple of posts here (didnt haad time to read all completly but will try to) and for what i could read it seems that you guys are worrking on OBD2 LT1 ECMs...
    If you allow me i can join the "test team" for the OBD2 LT1 ECMs...
    I have one here that i would like to read / flash and see what we can do...
    So, if you guys can point me out on where do i start, i will appreciate...
    I also have a 95 LT1 ECM here, but there's some internal issues that dont allow to flash. I can read but when it comes to flash i have a VPP Error and it doesnt continue to flash...
    For the OBD2 LT1, can we use the same USB-TTL cable or do we need anything else?

    Thanks and i hope i can join in with the testing...

    Thanks

  11. #146
    Fuel Injected!
    Join Date
    Sep 2012
    Location
    Huntsville, AL
    Posts
    237
    Hey boxsport, there's really three parts of the approach here; one is the unbricking, for which more info can be found here: LT1 UnBrick. The read/write flash routine I think is figured out but not implemented (i'm leaving that up to Tom H, steveo and kur4o). The third part is actually defining where all the parameters are in the data files ("bin files"). I was brute force reverse engineering and quickly found the spark, VE, MAF, injector, and some transmission tables. Seeing as I had hundreds more parameters to go, I decided to write an automated finder tool (which then life pulled me away from). This will only find identical tables and non-zero scalars between '95 and '96 files; it won't work for scalars that are 00 or flags. So..

    The last piece of the puzzle is actually learning disassembly and piecing through all the memory locations to figure out what scalars and flags are where. This part has the steepest learning curve; kur4o has provided me disassembly to work from but I'm not yet at the point of proficiency, and haven't had time.

    If your OBD2 PCM is in a vehicle, you can buy any of these to communicate with it: OBDX PRO VT/. Be aware that every run is quickly selling out so you may have to get on the mailing list to get one.

  12. #147
    Fuel Injected!
    Join Date
    Jan 2020
    Posts
    25
    Quote Originally Posted by sherlock9c1 View Post
    Hey boxsport, there's really three parts of the approach here; one is the unbricking, for which more info can be found here: LT1 UnBrick. The read/write flash routine I think is figured out but not implemented (i'm leaving that up to Tom H, steveo and kur4o). The third part is actually defining where all the parameters are in the data files ("bin files"). I was brute force reverse engineering and quickly found the spark, VE, MAF, injector, and some transmission tables. Seeing as I had hundreds more parameters to go, I decided to write an automated finder tool (which then life pulled me away from). This will only find identical tables and non-zero scalars between '95 and '96 files; it won't work for scalars that are 00 or flags. So..

    The last piece of the puzzle is actually learning disassembly and piecing through all the memory locations to figure out what scalars and flags are where. This part has the steepest learning curve; kur4o has provided me disassembly to work from but I'm not yet at the point of proficiency, and haven't had time.

    If your OBD2 PCM is in a vehicle, you can buy any of these to communicate with it: OBDX PRO VT/. Be aware that every run is quickly selling out so you may have to get on the mailing list to get one.
    Thanks for the tips / answers...
    Honestly most of the stuff you told me i'm not aware because this is also new to me and i´m trying to learn day by day.
    i live in mexico and i´m trying to setup a business mainly for ECM / ECU / TCM / PCM programming / tune, but the learnign curve is VERY BIG... I´m still in the "nobb/dumm" stage...
    I mentioned the ECMs i have, but they are not in the car. Its in my small "lab" at home so all the work i do, will be on the bench...
    But i´m very interested in helping in anyway a can on your projects...
    If i can use these ECMs as "Guinea Pigs" for your project i will be more than happy...
    A couple of months ago Steveo and other users helped e out trying to program a 95 LT1 ECM, and for that i´m very thankfull (at the end i was not able to test the ECM on the car 100% because there were some other issues and the guy didnt wanted to spend more time and money on the car)
    I'm trying to "fix" the 95 ECM i have here but i cant seem to find the reason for not allowing the Flash.
    But the 97 ECM, it seems to be ok. And like i said, if you guys need a "Guinea Pig" for tests, you can count with me and with this ECM.
    Regarging the Reading, do you guys have already any file i could use to start making some tests?
    Because i´m also finishing my ECU/ECM tester / simulator, and it would be nice for me to test it with the ECM to...
    This way i could do the bench test read/flash and try it with my "tester/simulator" to see if the flash work OK and if it works like it should (probably would need to do some updated to my project, but that would be fine).

    Anyway, i´m glad i found this thread and i will be reading all the info to learn something with you guys...
    PS: I have some tools / cables that might also work for testing (OBDLink SX / OBDLink EX, VagCom HexV2, Kess V2, Ktag, and some others) and see what we could use for this reading / flash / logging...

    Cheers
    Last edited by boxsport; 06-11-2020 at 06:15 AM.

  13. #148
    Fuel Injected!
    Join Date
    Jan 2019
    Location
    Canada
    Posts
    477
    Quote Originally Posted by boxsport View Post
    Hello guys...
    I just read a couple of posts here (didnt haad time to read all completly but will try to) and for what i could read it seems that you guys are worrking on OBD2 LT1 ECMs...
    If you allow me i can join the "test team" for the OBD2 LT1 ECMs...
    I have one here that i would like to read / flash and see what we can do...
    So, if you guys can point me out on where do i start, i will appreciate...
    I also have a 95 LT1 ECM here, but there's some internal issues that dont allow to flash. I can read but when it comes to flash i have a VPP Error and it doesnt continue to flash...
    For the OBD2 LT1, can we use the same USB-TTL cable or do we need anything else?

    Thanks and i hope i can join in with the testing...

    Thanks
    Hi,
    You are most welcome to the test team for both the LT1 ECMs. The procedure is for bricked (broken) ECMs and if your OBDII unit isn't broken, I think that there are much better tools to tune/work with the unit. Still if you want to try the UnBrick on it you absolutely can. So far I have just addressed the Eside, but that's a good start. I have not worked with the Tside because my test unit suffered a lobotomy. That is to say the ribbon cable that joins the two sides broke. I have been waiting for months for parts from china (now told that they are with Canada customs).
    Regarding your '95 ecm with the VPP fault, this is interesting.You can use the UnBrick software to turn on VPP and debug the problem. The source of the problem may only be the A/D circuit that reads the value of VPP or it could be the actual level. A DVM reading from pin 13 of the ribbon cable will tell you quickly. Use the UnBrick and send the binary file that turns on VPP then take a reading on pin13. I have not yet discovered the part number for the regulator that produces VPP (perhaps someone knows??).

    Code:
    ESide Red/Black: Component side
    
        |
        |  29                             1
        |    0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 
        |    0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 
        |  30                             2
        |
         -----------------------------------
    
    TSide Blue/Gray: Component side
    
        
            1                             29  |
             0 0 0 0 0 0 0 0 0 0 0 0 0 0 0    |
             0 0 0 0 0 0 0 0 0 0 0 0 0 0 0    |
            2                             30  |
                                              |
         -------------------------------------
    There is a PDF among the files attached to the UnBrick discussion. Get the latest instruction pdf and work through it.

    -Tom

    PS: I should qualify the above, My info is based on a '97 unit. I believe the pin number will be the same. You can verify by testing for connection to the flash chip pin 1 on T or E side.
    Last edited by Tom H; 06-11-2020 at 01:11 PM.

Similar Threads

  1. XDF Creation / Editing - How To????
    By B52Bombardier1 in forum OBDII Tuning
    Replies: 5
    Last Post: 02-28-2020, 02:04 AM
  2. new to obd2
    By myburb in forum OBDII Tuning
    Replies: 0
    Last Post: 05-28-2018, 05:54 AM
  3. DHP/AVT-852-002 Rev L OBD2 programmer $250
    By SappySE107 in forum Buy - Sell - Trade - Wanted
    Replies: 2
    Last Post: 02-03-2018, 09:25 AM
  4. flashing OBD2 ECU?
    By vwnut8392 in forum OBDII Tuning
    Replies: 4
    Last Post: 11-25-2017, 01:43 AM
  5. WTB TunerCats II (OBD2)
    By XRelapse13 in forum Buy - Sell - Trade - Wanted
    Replies: 0
    Last Post: 12-16-2014, 08:26 PM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •