RomRaider

I mentioned in another thread that I bought a 2002 Corvette a few months ago. I still have my Subaru, but the Corvette has been rather distracting.

I was surprised to see that their is nothing analogous to EcuFlash for inexpensive and unobfuscated access to the Corvette ECU (which General Motors calls a PCM, or Powertrain Control Module). There's a commercial product that works a lot like Cobb's stuff, but it doesn't provide access to the actual firmware, so you can't do the sort of hacking that we've been doing with EcuFlash and RomRaider. However there are a few people who have put a lot of work into reverse engineering the same PCM that's in my Corvette, and all they needed was a new Windows app. Which was perfect, because I have no idea how to start from scratch on this kind of thing, but I can do Windows.

So at this point we have an app that can read the contents of a PCM - as long as you're willing to rip it out of the car and wire it up to an OBD2 port and a power supply:

https://www.youtube.com/watch?v=jn7YkZcD_mo

A complete read of the PCM takes about 8 minutes using the USB version of this OBD2 adapter. (The adapter itself is a open-source hardware with open-source software, which is really cool!) We can probably shave a couple minutes off of that time, but at this point I mostly just want it to work in an actual car. Every time I've tried that so far, it has failed for one reason or another. It's getting closer though.

And after we get reading to work reliably, we'll do writing. Fortunately, there are already some definition files for a lot of the ROM versions that we care about. There is still a lot of work to do on them, because they haven't gotten a lot of use, because the tools to write your changes back to the PCM are hard to come by, but that is about to change. (Incidentally, I suspect that there are some people and companies out there using hacked GM service software to reflash PCMs via postal mail.)

There's a free/cheap app called Tuner Pro that is to General Motors what RomRaider is to Subaru, but I prefer RomRaider and EcuFlash, so I'm pretty sure I'll be converting the Tuner Pro definitions to XML before long.

Also, while I personally just want this for my Corvette, GM used the same PCM in several V8 and V6 cars and trucks in the late 1990s and early 2000s, so our stuff should work for those too. The guys I'm collaborating with have Chevy trucks and Holden cars.

What processor is installed into PCM ?
There should not be a great probem to reflash old known chips.

The CPU is a Motorola 68332, the flash chip is an Intel AB28F400B. We have data sheets for both. They switched to AMD AT28F800B flash chips later (1mb rather than 512kb), and we should be able to work with those as well, which would take us up around the 2004 model year. (Edit: maybe 2007 for the Express van?)

They switched to CAN after that, and then PowerPC a couple years later.

The same guy who wrote the kernel that was running in that video has already written one that can write, and after we get reading to work more consistently we'll start trying writes. The problems we have right now are mostly just issues with the Windows app (or perhaps the interface device) getting confused by messages from other modules on the OBD2 bus while we're talking to the PCM. It shouldn't be too hard to handle that stuff though.

I used to substitute a factory bootloader during a primary bench reflash in order to avoid unpredicted complications later at customers cars.
That allows a robust reflash at customer locations to be done later.

So far we've been doing OK with custom kernels, which I'm really thankful for, because I don't think Chevrolet would be happy about us putting their kernels up on github.

We got a complete read from my Corvette today, which is a major milestone. There's still more work to be done to make it more reliable, but we're almost to the point where we can invite random people to give it a try.

We have a tool that can read the ECU:

https://github.com/LegacyNsfw/PcmHacks/ ... /PcmHammer

...so now we gotta get writing to work.

Not sure exactly which models it will work on, but 2002-2004 ought to be pretty solid (I have a 2002), and other Chevy V8s from around that time period should also work (like Camaros and trucks).

When do you think this program will see the light of day, NSFW?

I can't make any promises, but I have a bunch of vacation days that I need to use in December, and I plan to spend most of them working on this. With luck it might be doing reflashing by New Year's day.

My first attempt to write data to the Corvette ECU failed a couple weeks ago and left it in a half-broken state. It wasn't completely bricked, but it was in "recovery mode" which would still leave your car stuck where it sits.

A few minutes ago I was able to bring it back to life. My teammates on this project did the hard work for this stage, and one of them put a video on an LS1 forum. It's not the most exciting thing to watch, but it's real progress.

You'll have to click the "Show spoiler" button: https://ls1tech.com/forums/pcm-diagnost ... st20011744

There is a lot more work to do, but like I said I have some free time coming up. I'm optimistic about getting this ready by the end of the month.

I have been doing them for a while using OS software in Asutralia. It even bypasses the EFI-Live/HPT locks since they use their own software to prevent other tuners reading the tune etc

Let me know if you want a ccopy of what I am using

I'm guessing you're talking about LS1Flash, by Antus @ pcmhacking.net? (Edit: .net!)

We're working together on this new thing, he wrote the kernel that's doing the reading.

Major milestone.

We've released a version that can write to the flash in 12200411 PCMs (that's what's in my 2002 C5Z), and we're working on support for a couple of closely related PCMs from the same era (because it shouldn't take much).

https://github.com/LegacyNsfw/PcmHacks/ ... 8.12.30.01

The amount of interest from the Corvette community is stunning...
https://www.corvetteforum.com/forums/c5 ... ammer.html
...because there isn't any.

Meanwhile the thread at LS1Tech.com is up to 330 posts and counting.
https://ls1tech.com/forums/pcm-diagnost ... st20023572

I just noticed your thread.. I'm excited to read that others are playing with the motorola MC683xx based ECUs.

I've spent a lot of time reading the ROM from my 2005 Lotus- this uses an MC68376 (so I am familiar with the TPU that drives engine speed/position reading, cam position measurement, and injector and ignition control as well as some of the peripheral functions like the SIM, QADC, QSPI, TouCAN, etc.). The Lotus ECUs also followed a similar development path by switching to PowerPC architecture later (I think they may still use this, even).

I adopted RomRaider so that I would not have to write a program that could visualize and modify the calibration ROM. I had to write my own flashing tool, though. I used a Vag Com cable because it is cheap (and since I had bought one for the Subaru to use with the RomRaider Logger).

By now, I've patched in some code that enables read-write over k-line (whereas the OEM ROM didn't support read, and write in the bootloader only works for flash memory rather than RAM) and am preparing to add sensors (UEGO and manifold pressure) as I keep playing with the ECU.

That's really cool! Do you have a web site or a forum thread / Facebook page / whatever where I could read more?