'99 Saturn Dissassembly

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
sabercatpuck
Posts: 67
Joined: Thu Jan 14, 2010 1:03 am
cars: 1999 Saturn SL1
2003 Monte Carlo

'99 Saturn Dissassembly

Post by sabercatpuck »

This is the bin files for the '99 Saturn DOHC Auto box I am working on. By the way do not try flashing these directly to the eeprom and then put them in cause they wont work as they are in these files. The Saturn engineers did something clever and swapped 4 pairs of address lines so that when you unsolder the flash and put it in the eeprom burner to read it it comes out garbage, but the system doesn't care so long as the lines are correct. These were done after making a modified carrier to unscramble the lines before the willem programmer.
Attachments
saturnBIN.zip
99 Saturn DOHC BIN file
(101.33 KiB) Downloaded 619 times
Last edited by sabercatpuck on Thu Jan 14, 2010 3:51 pm, edited 1 time in total.
sabercatpuck
Posts: 67
Joined: Thu Jan 14, 2010 1:03 am
cars: 1999 Saturn SL1
2003 Monte Carlo

Re: GNU assembler for HC11

Post by sabercatpuck »

This is the dissasembly for the flash (quadrents 1+2), note still very raw so no comments and I still need to figure out what is happening in the ram for good annotations (waiting on cables for the logic analyzer). Again the code in the area of $5666 is where the page switching is happening.
Attachments
ESATURN3.zip
Quadrent 3, physically located from $18000 to $1ffff
(51.44 KiB) Downloaded 593 times
ESATURN2.zip
Quadrent 2, physically located from $10000 to $17fff
(52.81 KiB) Downloaded 575 times
ESATURN1.zip
The first half of the flash disassembled (from $2000 to $ffff)
(131.26 KiB) Downloaded 614 times
sabercatpuck
Posts: 67
Joined: Thu Jan 14, 2010 1:03 am
cars: 1999 Saturn SL1
2003 Monte Carlo

Re: GNU assembler for HC11

Post by sabercatpuck »

And finally the tranny side of the ECM. It only uses the lower 64k so no page swapping needed.
Attachments
T99SATURN.zip
Tranny dissasembly of 99 Saturn
(113.23 KiB) Downloaded 579 times
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: '99 Saturn Dissassembly

Post by antus »

Interesting stuff to read. It sounds like the bank switching mechanism works the same as the holden ecus here. Interesting that they swap the address pins. Ive not heard of that before on GM based vehicles, only the software seed/key challenges on some of the later ecus. Welcome to the forums, its always good to have more reverse engineers around 8-)

PS I split your topic in to a thread of its own to keep the 99 saturn info findable.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
sabercatpuck
Posts: 67
Joined: Thu Jan 14, 2010 1:03 am
cars: 1999 Saturn SL1
2003 Monte Carlo

Re: '99 Saturn Dissassembly

Post by sabercatpuck »

In my opinion there is nothing more fun han reverse engineering something. You get to play detective, psycologist, and technician all at once. Gotta do something productive with that BSEET degree :ugeek: I am just waiting for a couple cables to get in for a couple of logicwave logic analyzers that I picked up off ebay and then I can start going to town with these things (well after I finish finishing the basement, wife project must come first :lol: i have mentioned the project to a few people and they think I am a nut, I figure I am just re-aquainting myself with my inner engineer. One other project I had recently was designing a method of getting the seed key pair out, very simple program for a really simple lock. All seemed to be going well on EFI live, forum mods egging me on etc, untill they started getting calls and all the sudden the whole thread was gone. Ohh well, luckily there were a few that directed me this way.
sabercatpuck
Posts: 67
Joined: Thu Jan 14, 2010 1:03 am
cars: 1999 Saturn SL1
2003 Monte Carlo

Re: '99 Saturn Dissassembly

Post by sabercatpuck »

by the way specifically it was the A1-A13, A2-A12, A3-A11, and A10-A14 pairs that were swapped
sabercatpuck
Posts: 67
Joined: Thu Jan 14, 2010 1:03 am
cars: 1999 Saturn SL1
2003 Monte Carlo

Re: '99 Saturn Dissassembly

Post by sabercatpuck »

ohh one more post script before I head to bed, I also snagged the SDM(airbag), ABS and RKE modules from the same junk yard car and eventually plan to get to them too. SDM might be a bit easier just because I know what processor it has, I have not been able to cross the one in the abs yet, but agin that is what the logic analyzer is for
User avatar
VL400
Posts: 4991
Joined: Sun Mar 01, 2009 2:54 pm
cars: VL Calais and Toyota Landcruiser. Plus some toys :)
Location: Perth, WA
Contact:

Re: '99 Saturn Dissassembly

Post by VL400 »

Welcome aboard, some great info you have posted so far. The seed/key stuff is just what I am looking at now actually :)
sabercatpuck
Posts: 67
Joined: Thu Jan 14, 2010 1:03 am
cars: 1999 Saturn SL1
2003 Monte Carlo

Re: '99 Saturn Dissassembly

Post by sabercatpuck »

The really funny thing is that I don't have much of a clue about this stuff yet. I am only an OK mechanic, and have little to no experience knowing what a spark table looks like compared to a MAF table (or if they are even the same), I am sure I will pick that up as I go allong. What I am though is a real good electronics guy. I can mentally take something appart in my head and figure out what it is doing or why it isn't working (I think I irritate allot of the other ET's at work because of it though).
Oh well, my logic analyzer cables arrived today so hopefully I will be able to add some stuff to my knowledge base soon (64 channels of data and 4 clocks between the two of them, ohh yeah :thumbup: )
sabercatpuck
Posts: 67
Joined: Thu Jan 14, 2010 1:03 am
cars: 1999 Saturn SL1
2003 Monte Carlo

Re: '99 Saturn Dissassembly

Post by sabercatpuck »

there is a 40 pin headder on the boards. Edited in pins 7 and 11 as going to the flash pins A15 and A16. A15 on pin 27 still goes directly to the A15 on the HC11. It goes as follows

Code: Select all

 
          A4  1 2
          A3  3 4  Ground
          A2  5 6 
   Flash A15  7 8  A1
              9 10 A0
   Flash A16 11 12 A5
          A6 13 14 A8
          A7 15 16 A9
         A10 17 18 D7
         A11 19 20 D6
         A12 21 22 D5
         A13 23 24 D4
         A14 24 25 D0
         A15 27 28 D1
         R/W 29 30 D2
       Reset 31 32 D3
    Moda/LIR 33 34 PD1/TXTD
     PD1/RXD 35 36 E
  ModB/Vstby 37 38 ground
        XIRQ 39 40
Last edited by sabercatpuck on Sat Jan 16, 2010 1:18 am, edited 3 times in total.
Post Reply