Bin Decoder (xdf file creater and more)

[DethRattles]

Im working at getting at trying to get myself a bin file and seen you mentioned P04 for a 3400. My car is a 2004 grand am gt and was wondering if you still needed os codes 12584933 is from mine. i'm only working with a vcx nano and cant get the bin file, only a bit of read from pcmhammer. If you think that you can help me in anyway i'd be much appreciative. thanks. viewtopic.php?f=8&t=8169 thats the current situation

[DWS]

I'm no expert, I'm still learning myself. P04 is the 3100/3400 computer used up to around 2005 so yours should be the same type. There's at least 3 physical flash chips that were used in different models which probably changed the os number. I've been told there's 300+ OS's for those computers which is why they are a bit more of a challenge to work out from scratch.

Here's one with an Intel flash chip AB28F400B5, there's another flash chip model and an AMD one that I've seen so far and I haven't done a whole lot with these yet. I'm more on the hardware/firmware side on things than the actual tuning or software used for tuning, even OBD2 based readers I'm not using since I'm using the BDM/JTAG pins on the CPU to talk to the flash chip.

[Gampy]

I'm using the BDM/JTAG pins on the CPU to talk to the flash chip.

Are you willing to share the BDM/JTAG pinout for the P04 ??
And any others ...

Thanks
-Enjoy

[DethRattles]

This is a 2004 grand am gt osid 12589762 here is from an 03 gt 12584933

[DWS]

I'm using the BDM/JTAG pins on the CPU to talk to the flash chip.

Are you willing to share the BDM/JTAG pinout for the P04 ??
And any others ...

Thanks
-Enjoy

I actually worked it out with the help of another person that's pretty deep in the hardware stuff, but I don't think he would mind me sharing the pinout. I traced them to the bottom side of the board so it's easier to get to with out having to take the whole computer apart, however the flash type needs to be identified unless you are working with a bunch of the exact same part numbers (maybe just certain models of cars it didn't change?).

The 12v note is for intel flash chips, put 12v to it, write, then remove the 12v, see the intel flash chip datasheet for more info.



I actually got away from the P04 computers a bit, but in the next year or so I'd like to poke around them a bit more again. I've learned a lot more about hardware since I last poked at these, I think I can reverse engineer the assembly a bit better with my new understanding of things. I don't think anyone has identified the analog to digital converter yet (assuming there is one, I haven't traced the pins out yet). Pretty sure injector control and I think IAC control are done directly off CPU pins though. I do remember the ignition control output signal to the ignition module is directly to a cpu pin, I was baffled there was no resistor or any kind of over current protection. I've been looking at Toyota computers and they are like over engineered for protecting the circuits lol.

I also added a pic of the AMD flash chip, probably hard to read, but if I remember right there's no 12v stuff required to flash it.

Btw, https://derbyws.com is my site, I make demo derby harnesses and such. Making the computers not have immo, pats, passkey, etc is part of what my desires are in my products. Things have blown up fast, but I still want to dig a bit deeper in these computers. I've actually worked out more on a camry v6 computer, thinking about replacing the cpus in it with my own and use the already existing circuitry to read and control the engine for the demo derby guys. A lot of them want a tunable computer with out spending the $1000+ for the dedicated hardware.

[Gampy]

Totally Awesome!

Thank you!
-Enjoy

[DethRattles]

Where can i find what the abbreviations stand for? One looks like freeze? another reset? Amazing work btw. Any news on your app about turning bins into xdf's?

[DWS]

Where can i find what the abbreviations stand for? One looks like freeze? another reset? Amazing work btw. Any news on your app about turning bins into xdf's?

The terms change sometimes, those are the terms the tool I used was looking for. I didn't make it or anything so I don't know the terms exactly but should be something like:

RST - Reset
FRZ - Freeze
DSI - Data Serial Input?
DSO - Data Serial Output?
DSCLK - Clock
BERR - Something to do with errors/interrupts I think, would have to look at the spec sheet again.

I kind of changed gears on the program idea, I jumped in the Toyota side of things and the security data was right in your face, like 256 bytes of data on the chip most of which is security related so it was super easy and I went full into Toyota stuff. I do plan to hit GM again some. My concept is kind of changing though, the idea is to find out what the pin on the cpu is now, and have the program trace back to where it's referenced in the code and ideally trace back to what storage locations relate to it and the if statements and such. I think most versions of the code on the computers could be worked out for the ones with the exact same hardware. Another factor could be to do some custom coding on them if the other chips can be figured out and such. Anything directly on the CPU should be somewhat easy to work out though I would think.

My future plans for flashing them is to use a chip clip and directly read/write the eeprom instead of trying to take over the CPU. The P04's aren't really a problem, but I ran into watchdog issues with the P11 cavi ecotec computers. I think direct flash reading/writing is probably more reliable, but I'd like to work out how to flash them over OBD2 but I know that's a big project on it's own.

Once I get time, I actually have a fairly quick project in theory to make an adapter to read a 60-2 GM crank sensor and have it output a 3x signal as an adapter, then take in the 3x signal from a different computer and output to the correct coil signal to run a newer engine using an older computer. If it works out I suspect there will be a hand full of people interested in that setup, and of course the P04 computer is the one to be used for the tuning etc. It's more of a side project just to delete DBW, security, etc on the newer engines and open up the derby guys to more vehicles instead of just the 90's era stuff.

[antus]

Yep. Those terms are for the Motorola BDM (Background Debug Mode) interface. Its like a predecessor to JTAG. You can use u-link nt from http://www.usbjtag.com/ to read and write the flash. It was formerly called usb-bdm-nt as well. The owners youtube channel has lots of information. We have done it on P01 and P59, but did not have the P04 pinouts until now. Thanks!

Note that P04 support is in development in pcmhammer. We cant say when it'll be finished, but you can load and build the development branch from github now, make sure your OSID is listed with the right chip sizes, and it should read it over OBD2. Also note that you dont need BDM to get the key out, you can brute force it over a number of days, or it might be possible possible to attack the hardware and ground an address pin so that it doesnt see the calibration magic numbers and thinks its on the factory floor when it boots and opens up for initial calibration load. That does work for P01 and P59, but they have newer boot code the P04 may be missing.

[DWS]

Totally Awesome!

Thank you!
-Enjoy

Not a problem. Probably should post the P11 one as well. I actually killed a good computer to work out the pinout, fun tracing them out, pretty sure all of the BDM/JTAG pins end up on the pads at the edge of the board, probably how it's factory programmed and tested. P59 or P01 has a similar interface if I remember right. When I was working on this computer, there was next to nothing known about them, not sure how much progress there has been since then. Some don't have a watchdog and they can be read/wrote over that interface easily, some others do have the watchdog enabled and I haven't dug into it deep enough on how to get around that issue, like what's different with the older vs newer ones. It's been a while but if you hold reset low I think it was you're able to read the flash data, but can't write it on the one with the watchdog. I think I ran across a 3rd version that wouldn't read or write even with the reset trick. Knowing what I know now, probably easiest to pop the flash chip off and interface to it directly and check what is setup differently in the code between the two. I think that's where the watchdog is activated if I recall correctly. This was around a year ago though.

FYI, this P11 was super super picky about wire lengths. For sure do things at slow speeds to ensure the data isn't corrupted.

I could be wrong, but I think 12571650 with serv number 12576162 was one of the ones I could read/write with no issues.

Pretty sure the F pins are for the flash chip.