C5 Corvette support, eventually...

Obeisance · **Joined:** Wed Jul 09, 2014 4:11 pm **Posts:** 24

NSFW wrote:

Do you have a web site or a forum thread [...] where I could read more?

I've cataloged my progress in a forum thread:

https://www.lotustalk.com/forums/f171/d ... ly-352193/

mind you, that thread is a black hole. Lotustalk has a 30 day lockout for editing old posts, so when I made mistakes they remain forever. My notes are very cryptic as I published them before I understood what was going on. Similarly, I looked at a few different binary files along the way and left many disassembly mistakes in them as I moved on to newer versions. The later disassembly posts in that thread contain more accurate (but still error containing) versions.

I started my project with no knowledge of assembly language or tuning. I still know nothing about tuning, but remain interested in engine controls. I expect you to be much more familiar with this kind of activity, so hopefully you can recognize disassembly or interpretation mistakes and ignore them.

I also have two other threads detailing things I noticed in my ROM and notes to accompany the RomRaider definitions:

https://www.lotustalk.com/forums/f171/n ... ol-463664/

https://www.lotustalk.com/forums/f171/q ... ol-464730/

I'm not intending to make a plug for my work, rather, when I found your post I thought about volunteering to help since I'm familiar with the microcontroller architecture. However, I think that may be biting off more than I can handle. In any case, I enjoy talking about this topic.

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

Cool, I'll give those a read.

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

I have to salute you for starting from scratch and by yourself. I don't know that I could have done this for the LS platform without standing on the shoulders of a couple guys who had already made a ton of progress a couple/few years ago. All of the really hard problems were already solved, I just had to write some code.

Over the last year or so, I might have learned enough to try doing it from scratch, but I'm still in awe of people who try it (and succeed!).

I don't know if you've used IDA yet, but you should give it try if you haven't already. It's the most expensive piece of software I've ever bought, but it was worth it.

The Corvette reflashing project feels like it's almost done. I just pushed out a release that adds some code to try to make it harder to shoot yourself in the foot by flashing an incompatible file, and I'm sure we'll find a few more little things we can do to make it safer or more reliable, but it feels pretty solid already. One of my co-conspirators is close to adding support for a couple more model years - that's probably the biggest missing piece, but it's still small. The flash chip is different, everything else is the same.

Obeisance · **Joined:** Wed Jul 09, 2014 4:11 pm **Posts:** 24

NSFW wrote:

I don't know if you've used IDA yet, but you should give it try if you haven't already. It's the most expensive piece of software I've ever bought, but it was worth it.

A bunch of people along the way have told me that IDA is really great. I've seen a few screenshots, but otherwise I have no idea what I'm missing because I have no firsthand experience. At some point, I may meet someone in person who can show me how great it is in order to convince me that it's worth the expense. Otherwise, I'm trying to keep this a cheap hobby.. heh.

NSFW wrote:

The Corvette reflashing project feels like it's almost done. I just pushed out a release that adds some code to try to make it harder to shoot yourself in the foot by flashing an incompatible file, and I'm sure we'll find a few more little things we can do to make it safer or more reliable, but it feels pretty solid already. One of my co-conspirators is close to adding support for a couple more model years - that's probably the biggest missing piece, but it's still small. The flash chip is different, everything else is the same.

Every now and then I've been looking at the long ls1tech thread you linked to: thanks for sharing your project. I like to read about this kind of thing.

iamanonymous · **Joined:** Fri Dec 14, 2012 4:39 am **Posts:** 242

Subscribing! Bring on the L59 5.3L flashing next!

Sent from my iPhone using Tapatalk

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

iamanonymous wrote:

Subscribing! Bring on the L59 5.3L flashing next!

Which vehicle? And most importantly, which PCM?

GM engine codes are still alphabet soup to me.

iamanonymous · **Joined:** Fri Dec 14, 2012 4:39 am **Posts:** 242

03 Tahoe with the flex fuel motor. Iron block, aluminum heads, 9.x:1 compression. The most common ls swap these days.

Sent from my iPhone using Tapatalk

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

iamanonymous wrote:

03 Tahoe with the flex fuel motor. Iron block, aluminum heads, 9.x:1 compression. The most common ls swap these days.

I'm pretty sure that means you have the P59, 1 megabyte PCM. You can probably read the whole PCM to a .bin file with the current version, but we don't support writes yet.

There were two kinds of flash chips used in those - Intel and AMD - and we haven't figured out how to get the AMD chip to work. The documentation is clear as mud. The Intel version might be really easy, if the protocol is the same as for the 512kb version in my Corvette's PCM. But I don't have an Intel P59 to test with yet. It's just a matter of time though.

Obeisance · **Joined:** Wed Jul 09, 2014 4:11 pm **Posts:** 24

NSFW wrote:

There were two kinds of flash chips used in those - Intel and AMD - and we haven't figured out how to get the AMD chip to work.

The Lotus ECU uses an AMD flash chip, and the same reflashing command sequence shows up in the manual for the AM29F800 (see P18 of the datasheet. This was the only reference to an AMD flash chip I found in the LS1tech.com thread), so I expect it to work somewhat similarly:

https://www.mouser.com/datasheet/2/100/ ... 161252.pdf

I don't understand all of the chip-select parts of the reflashing commands, but I would recommend searching the relevant ROM for similar command sequences: if you find code in your ROM for writes of 0xAAAA to address 0xAAAA and writes of 0x5555 to address 0x5554 (or something similar), I'd expect these routines should contain all that is necessary to run the flash chip. I also expect that these routines can be copied from the ROM and repurposed in case you're not reflashing through the OE processes.

Here are what the routines look like in the Lotus:

Code:

   ;subroutine: command flash memory be completely cleared:
   ;command structure: set word at 0xAAAA to $AAAA, at 0x5554 to $5555, at 0xAAAA to $8080, at 0xAAAA to $AAAA,
   ;at 0x5554 to $5555, at 0xAAAA to 1010
0x009f80:   LINK.W A6,$fff8
0x009f84:   MOVE.L D2,(A7)
0x009f86:   MOVE.W #$AAAA,($aaaa).L
0x009f8e:   MOVE.W #$5555,($5554).W
0x009f94:   MOVE.W #$8080,($aaaa).L   
0x009f9c:   MOVE.W #$AAAA,($aaaa).L   
0x009fa4:   MOVE.W #$5555,($5554).W   
0x009faa:   MOVE.W #$1010,($aaaa).L   
0x009fb2:   MOVE.L #5000000,D2   ;loop and wait for the erase to finish
0x009fb8:   TST.L D2   
0x009fba:   BNE.B $4   
0x009fbc:   MOVEQ #0,D0   ;return 0 if we failed
0x009fbe:   BRA.B $a   
0x009fc0:   CMPI.W #$FFFF,($0).W    ;check to see if the ROM word at 0x000000 is erased
0x009fc6:   BNE.B $8   
0x009fc8:   MOVEQ #1,D0   ;return 1 if success
0x009fca:   MOVE.L (A7),D2   
0x009fcc:   UNLK A6   
0x009fce:   RTS   

0x009fd0:   SUBQ.L #1,D2   
0x009fd2:   BRA.B

Code:

   ;command flash memory sector erase:
   ;set words at 0xAAAA to AAAA, 0x5554 to 0x5555, 0xAAAA to 0x8080, 0xAAAA to 0xAAAA, 0x5554 to 0x5555
   ;and word at sector beginning address to 0x3030
   ;when the word at the indexed address is written to 0xFFFF, set D0 = 1 to signal success
   ;else D0 = 0
0x009f0e:   LINK.W A6,$fff0   
0x009f12:   MOVEM.L A2/D3/D2,(A7)   
0x009f16:   MOVE.L ($8,A6),D3   ;index of flash sector to erase
0x009f1a:   LEA ($85fe0).L,A2   ;pointer to array of flash sector start addresses
   ;these six commands result in a 'sector erase' function
0x009f20:   MOVE.W #$AAAA,($aaaa).L   
0x009f28:   MOVE.W #$5555,($5554).W   
0x009f2e:   MOVE.W #$8080,($aaaa).L   
0x009f36:   MOVE.W #$AAAA,($aaaa).L   
0x009f3e:   MOVE.W #$5555,($5554).W   
0x009f44:   MOVE.L D3,D0   
0x009f46:   LSL.L #2,D0   
0x009f48:   MOVEA.L D0,A0   
0x009f4a:   ADDA.L A2,A0   
   ;this loads up a value from the table at $85fe0
   ;memory sector   beginning address
   ;   0   00000000
   ;   1   00004000
   ;   2   00006000
   ;   3   00008000
   ;   4   00010000
   ;   5   00020000
   ;   6   00030000
   ;   7   00040000
   ;   8   00050000
   ;   9   00060000
   ;   10   00070000
0x009f4c:   MOVEA.L (A0),A0   
0x009f4e:   MOVE.W #$3030,(A0)   
0x009f52:   MOVE.L #5000000,D2   ;loop to wait for the erase to finish
0x009f58:   TST.L D2   
0x009f5a:   BNE.B $4   
0x009f5c:   MOVEQ #0,D0   
0x009f5e:   BRA.B $14   
0x009f60:   MOVE.L D3,D0   
0x009f62:   LSL.L #2,D0   
0x009f64:   MOVEA.L D0,A0   
0x009f66:   ADDA.L A2,A0   
0x009f68:   MOVEA.L (A0),A0   
0x009f6a:   MOVE.W (A0),D0   
0x009f6c:   CMPI.W #$FFFF,D0   
0x009f70:   BNE.B $a   
0x009f72:   MOVEQ #1,D0   
0x009f74:   MOVEM.L (A7),A2/D3/D2   
0x009f78:   UNLK A6   
0x009f7a:   RTS   

0x009f7c:   SUBQ.L #1,D2   
0x009f7e:   BRA.B $d8

Code:

   ;subroutine: command flash memory to reprogram input word to input address:
   ;command structure: set word at 0xAAAA to $AAAA, at 0x5554 to $5555, at 0xAAAA to $A0A0, at input address to input word
   ;if success, D0 = 1, if failure D0 = 0
0x009fd4:   LINK.W A6,$fff0   
0x009fd8:   MOVEM.L A2/D3/D2,(A7)   
0x009fdc:   MOVEA.L ($8,A6),A2    ;address of flash ROM to write to
0x009fe0:   MOVE.W ($e,A6),D3     ;word data to write to flash ROM
0x009fe4:   MOVE.W #$AAAA,($aaaa).L   
0x009fec:   MOVE.W #$5555,($5554).W   
0x009ff2:   MOVE.W #$A0A0,($aaaa).L   
0x009ffa:   MOVE.W D3,(A2)        ;write the word to the address to write to flash
0x009ffc:   MOVE.L #500000,D2   ;loop and wait for the procedure to finish
0x00a002:   TST.L D2   
   ;when the counter runs out, set D0 = 0, end routine
0x00a004:   BNE.B $4   
0x00a006:   MOVEQ #0,D0   
0x00a008:   BRA.B $8   
0x00a00a:   MOVE.W (A2),D0   
0x00a00c:   CMP.W D3,D0   
0x00a00e:   BNE.B $a   
0x00a010:   MOVEQ #1,D0   
0x00a012:   MOVEM.L (A7),A2/D3/D2   
0x00a016:   UNLK A6   
0x00a018:   RTS   

0x00a01a:   SUBQ.L #1,D2   
0x00a01c:   BRA.B $e4   

Maybe the code is somewhat similar in your ECUs?

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

THANKS! I bet it's very similar for our chips.

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

It's the same chip, but the code is slightly different. Searching for the values led to the code in GM's firmware, and it writes to $AAA and $554 instead of $AAAA and $5554 as in the Lotus firmware. The values are the same though.

There's more work to do before we can erase and rewrite, but the rest of it should be pretty straightforward now that we can talk to the chip.

Edit: I should have mentioned that that I got the flash chip to report its ID, so the command sequence is definitely working.

Thanks again, I never would have figured this out with the data sheet alone.

fastblueufo · **Posted:** Fri Mar 15, 2019 11:17 pm

Can you convert a tuner pri. XDF cile fpr bmw n54 yo a ecuflash definition for editing?

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

Not yet, but I would like to, so I'll probably take a shot at creating a conversion tool at some point. I'd prefer to use EcuFlash or RomRaider myself, so I've looked into it a bit and seems like it should be possible.

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

PCM Hammer Release 6 is out: https://github.com/LegacyNsfw/PcmHacks/ ... 9.06.22.01

There's now a "Write OS and Calibration" button that replaces everything but the parameter blocks, which is useful if you want to update the operating system in your vehicle. Leaving the parameter blocks unchanged means the PCM will still be recognized by the other devices in your car.

If you want to replace your PCM, do a full read from the current/old PCM, then "Write OS and Calibration" then "Write Parameters (Clone)" to the new PCM. The entire flash memory of the new PCM will then be completely identical to that of the old PCM.

This works for the "P01" PCMs that were used in 2001 and 2002 Corvettes, and some other V8 cars and trucks from around that time. We're still working on the "P59" PCMs that came after that. Those were used in 2003-2004 Corvettes, and in some other vehicles until 2007.

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

I forgot to update this thread with new releases, but we're up to #11 now. This version can do calibration writes and/or rewrite the operating system for the 512kb PCMs, and it can reflash the calibration sector for 1mb AMD-based PCMs, but we can't do full writes on the 1mb PCMs yet (e.g. to turn a Corvette PCM into a truck or van PCM). We're still trying to figure that out though.

https://github.com/LegacyNsfw/PcmHacks/releases

https://github.com/LegacyNsfw/PcmHacks/ ... ng-Started

http://pcmhammer.org - just forwards to https://github.com/LegacyNsfw/PcmHacks

RomRaider

Forum rules

C5 Corvette support, eventually...

Who is online