Open source GM OBD2 flash tool using a ELM327 device

[durahax]

This is a great post, so glad I found this site! I'm new to all this, but I'm down to help anyway I can. I was wondering, did anyone ever find a cheap board or has started a board design that can dump/flash in "block mode" over 4x VPW? I found two designs at the following link - http://www.diy-efi.org/twiki/bin/view/G ... tualComVPW Has anyone tried these? I see other people tried M2-ATX's and they all have problems, no support, and cost way to much. I don't know, I guess I'm sol till I have some hardware that can dump the ECM over a ALDL connection.

[EagleMark]

Tons of intersting products on this available here:
http://www.obd2tool.com/

Requested they build one for GM OBDII products and they are trying to find one in china to work on...

[durahax]

Still trying to find some hardware I'm in contact with the guys at scantool.net, they can up the stn1110 max message length to around 1.5k!

Let me ask a few questions so I'm up to speed here.....

1. I hear 1k is the default packet size, so 1.5k is fine?

2. I see some people say block mode supports unlimited number of bytes, another said 4092 bytes, anyone know for sure? (I realize stn1110 won't support it, just curious)

3. What chips do they use in the tech2 or aftermarket tuners? Or even just how much RAM they have?

4. What's the ideal amount of RAM for reading/writing the ECM?

5. Block Transfer Mode only opperates in 41.6k baud?

6. When high speed is requested in normal mode we have 5secs to respond on 41.6k baud?

7. You can only read/write 0x5000-0x7FFF in normal speed, so writing cal data is impossible at normal speed?

8. Cal data is located at 0x8000-0x1FFFF?

[antus]

1) Thats good to hear. I tried them and they expressed some interest but didnt end up coming to the party. Hopefully with enough interest they will. Is that 1.5k both ways?

2) I think its unlimited, but in practice when I was testing I never went above 4k which is the limit of the avt device I was using, which was ample.

5) This seems to be true. I could only get block mode working in 4x mode. I suspect there would be a way to mod the OS to support it in 1x, but you would still need a way to put a different OS on the pcm, and doing something out of spec like this might be opening a can of worms with the other devices on the bus.

6) Something like that. It does time out on its own and return to normal speed.

7) Writing cal data is impossible without uploading routines to the pcm in block mode that allow writing and dont range check the address. See point 5, and attached screenshot from the flash memory data sheet. I think there is 2 copies of the paramter blocks. When you write via vpw a 2nd copy is used, and only written to flash at keyoff. If you remove b+ and ign together the changes dont stick. If you leave b+ and disconnect ignition the changes are written to flash.

8) For a 512k '0411 pcm. The first 2 bytes of the calibration segments are checksums

Code: Select all

OS Segments:

vectors:                  000000->0004FF
boot segment:             000500->003FFF
main os:                  020000->07FFFD
ram:                      FF8000->FFCDFF

Calibration Segments:

engine:                   080000->013FFF
engine diagnostics:       014000->016DFF
transmission:             016E00->01BDFF
transmission diagnostics: 01BE00->01C7FF
fuel:                     01C800->01E51F
system:                   01E520->01EE9F
speedo:                   01EEA0->01EF9F

[durahax]

First off thank you for clearing that up. I just sent another email to make sure it's 1.5k both ways. What board are you using? The one you posted a few pages back? How much memory does it have? I see 1k in the data sheet for the mega8. Btw so people know I'm working with a 2003 GMC Sierra 2500HD - 6.6 Duramax LB7 - Allison 1000 - Delphi ECM E54 #12210729. I think it's Freescale 68xxx family. I'm sure it will be extra fun for me, wondering how different diesel/gas cals are atm.

[durahax]

Okay I just received a response from scantool.net guys. We should be able to transmit up to 1k messages and receive up to 3k.

So in block mode can you specify the amount of bytes to read/write? To sum it up if they added 4x and upped the message length to 1k Tx and 3k Rx would that work?

[antus]

Yes, that would work! Bring it on!

Its about 850 bytes in one hit to upload to get the process running, then you can rx whatever size chunks you want.

[durahax]

Yes, that would work! Bring it on!

Its about 850 bytes in one hit to upload to get the process running, then you can rx whatever size chunks you want.

Thank you! That's the best news I heard all month, lol. This weekend I'm gonna use BDM and dump my ECM and TCM so I have some dumps I can flash back to if things go south. I'll also post a guide for using BDM, I don't see any on here.

[dynoboy]

Hi guys, I too looked into making a GM flash tool a couple of years ago, i purchased a Drew-tech GM can Mongoose and it came with some Software
which enabled you to view the commands and responses on the data line.
I made a bench programming cable with 2 OBD11 connectors and with a friends HP Tuners was able to capture all the command and response data up to high speed Mode.
But as my business grew i ran out of time to play.

If any one is interested i can try and dig up some of the logs .

Keep up the good work!

[robertisaar]

FWIW: the hardware tunercat sells for flashing the PCMs is a relabeled AVT-852. current cost of ~$230+ for it, if you can get the company to sell it to you(i guess they only like to sell to high-volume people).

if nothing else, that's one option, if you can get ahold of them.