GM Reverse Engineering

160 And 8192 Baud Aldl
Post Reply
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

GM Reverse Engineering

Post by Tazzi »

G'day guys,

Iv been logging alot of the tech'2 info for VY's under the "Body" category. And was hoping someone could shed some light on what the "telematics module" is and occupant climate control?
Guessing the climate control is only for commy's with the digital climate control?

So the choices I have are:
Image

Now when logging so far I can get responses for bcm,srs and instrument although cannot get responses for occupant climate control, telematics module and audio system (have aftermarket headunit).

ALthough Iv logged the "request" from the tech2 for all of them.
The requests are:
Body control module: F1,57,01,00,B7
PIM: F3,57,01,00,B5
SRS: FB,57,01,00,AD
Instrument: F2,57,01,00,B6
Occupant Climate control: EA,57,01,00,BE
Telematics module: E4,57,01,00,C4
Audio System: EB,57,01,00,BD

I can probably get the audio system response since I have a stock radio here except its pulled apart and cbf putting together :thumbup:

Im trying to recreate each module so that I can parrot it back to the tech2 and understand what each byte in each frame is.
So far iv made a little VY bcm simulator to simulate the car chatter to the tech2 so it works outside of car. And have built a little app to catch the tech2 request and then resend the desired frame.

Just looking for some "real" responses to work off of. Anychance anyone can grab responses for PIM,Occupant climate control, telematics module and audio system? :D
Last edited by Tazzi on Mon Nov 13, 2017 3:44 pm, edited 1 time in total.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
charlay86
Posts: 584
Joined: Thu Sep 17, 2009 2:00 pm
cars: VT S1 SS (L67)
Location: Perth, WA

Re: TECH2 Logging

Post by charlay86 »

I think telematics is for holden assist
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: TECH2 Logging

Post by VX L67 Getrag »

I have a feeling the PIM was only introduced on VY V8's could be wrong though or on VZ onwards?

I can log info of what Audio responds back & when a car comes in with OTHER modules I can log that too!

Do you just want responses from mode 1 table 0?
User avatar
VL400
Posts: 4991
Joined: Sun Mar 01, 2009 2:54 pm
cars: VL Calais and Toyota Landcruiser. Plus some toys :)
Location: Perth, WA
Contact:

Re: TECH2 Logging

Post by VL400 »

The PIM was first used on VT LS1s so all the ALDL devices and the OBDII PCM could talk to each other.
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: TECH2 Logging

Post by VX L67 Getrag »

Oh sorry yeah didn't mean was introduced on VY meant only found I think in the V8 model's before VZ & then once VZ they all had them?
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: TECH2 Logging

Post by antus »

They're in the cars with VPW data bus (LS1), they are the bridge between VPW and ALDL though they dont just pass through the data bytes, they do protocol translation so they process entire packets.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: TECH2 Logging

Post by VX L67 Getrag »

Ahh cool didn't know technical tools & lingo but was what I thought it did, gone a bit off topic in a way but hopefully helps Tazzi out!
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: TECH2 Logging

Post by Tazzi »

charlay86 wrote:I think telematics is for holden assist
Yeah, I found a couple images/mentions of telematics is holden assist but isnt much said/mentioned about it all. May be a trial and error situation for responses till the tech2 likes the response and gives useful info.
VX L67 Getrag wrote:I have a feeling the PIM was only introduced on VY V8's could be wrong though or on VZ onwards?
I can log info of what Audio responds back & when a car comes in with OTHER modules I can log that too!
Do you just want responses from mode 1 table 0?
When the tech2 is only requesting mode 1 table 0, generally indicates the "general" info of the module including part number, vap ect. And I think it will request either/and table 2,3,4 depending what it then looks for eg. fault codes, reprogramming ect. But for the moment table 0 would be great!
VL400 wrote:The PIM was first used on VT LS1s so all the ALDL devices and the OBDII PCM could talk to each other.
Why couldnt they just stick to the same protocol/language *sigh* I figured it wouldnt work on my v6 since its for the v8 devices. Although since im simply sending frames back to the tech2 without the car, I can hopefully just send the frames back and itll open up the pim options :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: TECH2 Logging

Post by Tazzi »

Looks like after some time of fiddling and spamming various replies back, tech2 will only accept "Valid" responses other wise it ignores and gives the "no communication detected". This includes if the frame sent is the correct size although the message is invalid.
So looks like only way is to go grab some real responses to use as a template.

Also and finding that it looks for table 0 then once it gets a responses it then moves on for getting tables 1,2,3,4,5 (what ever the module has).
Once all valid responses are found, its just a matter of changed individual bytes to see what the tech2 then spits out.

Have had alot of success with the bcm info, instrument and srs. Am very interested in the radio since would like to see if I cant get the radios pin directly from the radio, and also understand how to enable/disable rear speakers.

On a side note (guess its kinda obvious), the bcm chatter must match that of the cars model. eg Cant open up anything in VZ menus when using VY chatter even though they seem similar. Guess i'll need to grab some logs from vt - vz and check that they work with the tech2.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
VL400
Posts: 4991
Joined: Sun Mar 01, 2009 2:54 pm
cars: VL Calais and Toyota Landcruiser. Plus some toys :)
Location: Perth, WA
Contact:

Re: TECH2 Logging

Post by VL400 »

Did you want a PIM to play with? I have one you can use if you do.
Post Reply