'99 Saturn Dissassembly

Posts: 67
Joined: Thu Jan 14, 2010 1:03 am

'99 Saturn Dissassembly

Postby sabercatpuck » Thu Jan 14, 2010 3:35 pm

This is the bin files for the '99 Saturn DOHC Auto box I am working on. By the way do not try flashing these directly to the eeprom and then put them in cause they wont work as they are in these files. The Saturn engineers did something clever and swapped 4 pairs of address lines so that when you unsolder the flash and put it in the eeprom burner to read it it comes out garbage, but the system doesn't care so long as the lines are correct. These were done after making a modified carrier to unscramble the lines before the willem programmer.
Attachments
saturnBIN.zip
99 Saturn DOHC BIN file
(101.33 KiB) Downloaded 406 times
Last edited by sabercatpuck on Thu Jan 14, 2010 3:51 pm, edited 1 time in total.

Posts: 67
Joined: Thu Jan 14, 2010 1:03 am

Re: GNU assembler for HC11

Postby sabercatpuck » Thu Jan 14, 2010 3:43 pm

This is the dissasembly for the flash (quadrents 1+2), note still very raw so no comments and I still need to figure out what is happening in the ram for good annotations (waiting on cables for the logic analyzer). Again the code in the area of $5666 is where the page switching is happening.
Attachments
ESATURN3.zip
Quadrent 3, physically located from $18000 to $1ffff
(51.44 KiB) Downloaded 387 times
ESATURN2.zip
Quadrent 2, physically located from $10000 to $17fff
(52.81 KiB) Downloaded 359 times
ESATURN1.zip
The first half of the flash disassembled (from $2000 to $ffff)
(131.26 KiB) Downloaded 402 times

Posts: 67
Joined: Thu Jan 14, 2010 1:03 am

Re: GNU assembler for HC11

Postby sabercatpuck » Thu Jan 14, 2010 3:45 pm

And finally the tranny side of the ECM. It only uses the lower 64k so no page swapping needed.
Attachments
T99SATURN.zip
Tranny dissasembly of 99 Saturn
(113.23 KiB) Downloaded 360 times

Site Admin
Online
User avatar
Posts: 6394
Joined: Sat Feb 28, 2009 8:34 pm

Re: '99 Saturn Dissassembly

Postby antus » Thu Jan 14, 2010 4:01 pm

Interesting stuff to read. It sounds like the bank switching mechanism works the same as the holden ecus here. Interesting that they swap the address pins. Ive not heard of that before on GM based vehicles, only the software seed/key challenges on some of the later ecus. Welcome to the forums, its always good to have more reverse engineers around 8-)

PS I split your topic in to a thread of its own to keep the 99 saturn info findable.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

Posts: 67
Joined: Thu Jan 14, 2010 1:03 am

Re: '99 Saturn Dissassembly

Postby sabercatpuck » Thu Jan 14, 2010 4:26 pm

In my opinion there is nothing more fun han reverse engineering something. You get to play detective, psycologist, and technician all at once. Gotta do something productive with that BSEET degree :ugeek: I am just waiting for a couple cables to get in for a couple of logicwave logic analyzers that I picked up off ebay and then I can start going to town with these things (well after I finish finishing the basement, wife project must come first :lol: i have mentioned the project to a few people and they think I am a nut, I figure I am just re-aquainting myself with my inner engineer. One other project I had recently was designing a method of getting the seed key pair out, very simple program for a really simple lock. All seemed to be going well on EFI live, forum mods egging me on etc, untill they started getting calls and all the sudden the whole thread was gone. Ohh well, luckily there were a few that directed me this way.

Posts: 67
Joined: Thu Jan 14, 2010 1:03 am

Re: '99 Saturn Dissassembly

Postby sabercatpuck » Thu Jan 14, 2010 4:29 pm

by the way specifically it was the A1-A13, A2-A12, A3-A11, and A10-A14 pairs that were swapped

Posts: 67
Joined: Thu Jan 14, 2010 1:03 am

Re: '99 Saturn Dissassembly

Postby sabercatpuck » Thu Jan 14, 2010 4:35 pm

ohh one more post script before I head to bed, I also snagged the SDM(airbag), ABS and RKE modules from the same junk yard car and eventually plan to get to them too. SDM might be a bit easier just because I know what processor it has, I have not been able to cross the one in the abs yet, but agin that is what the logic analyzer is for

User avatar
Posts: 4991
Joined: Sun Mar 01, 2009 2:54 pm
Location: Perth, WA

Re: '99 Saturn Dissassembly

Postby VL400 » Thu Jan 14, 2010 4:37 pm

Welcome aboard, some great info you have posted so far. The seed/key stuff is just what I am looking at now actually :)

Posts: 67
Joined: Thu Jan 14, 2010 1:03 am

Re: '99 Saturn Dissassembly

Postby sabercatpuck » Fri Jan 15, 2010 9:39 am

The really funny thing is that I don't have much of a clue about this stuff yet. I am only an OK mechanic, and have little to no experience knowing what a spark table looks like compared to a MAF table (or if they are even the same), I am sure I will pick that up as I go allong. What I am though is a real good electronics guy. I can mentally take something appart in my head and figure out what it is doing or why it isn't working (I think I irritate allot of the other ET's at work because of it though).
Oh well, my logic analyzer cables arrived today so hopefully I will be able to add some stuff to my knowledge base soon (64 channels of data and 4 clocks between the two of them, ohh yeah :thumbup: )

Posts: 67
Joined: Thu Jan 14, 2010 1:03 am

Re: '99 Saturn Dissassembly

Postby sabercatpuck » Fri Jan 15, 2010 2:58 pm

there is a 40 pin headder on the boards. Edited in pins 7 and 11 as going to the flash pins A15 and A16. A15 on pin 27 still goes directly to the A15 on the HC11. It goes as follows
Code: Select all
 
          A4  1 2
          A3  3 4  Ground
          A2  5 6
   Flash A15  7 8  A1
              9 10 A0
   Flash A16 11 12 A5
          A6 13 14 A8
          A7 15 16 A9
         A10 17 18 D7
         A11 19 20 D6
         A12 21 22 D5
         A13 23 24 D4
         A14 24 25 D0
         A15 27 28 D1
         R/W 29 30 D2
       Reset 31 32 D3
    Moda/LIR 33 34 PD1/TXTD
     PD1/RXD 35 36 E
  ModB/Vstby 37 38 ground
        XIRQ 39 40
Last edited by sabercatpuck on Sat Jan 16, 2010 1:18 am, edited 3 times in total.

Next

Return to Disassembly and Reassembly

Who is online

Users browsing this forum: No registered users and 3 guests