Vetronix Tech 1

Programs / Tools / Scripts
User avatar
The1
Posts: 4694
Joined: Mon Jan 04, 2010 10:23 am

Re: Vetronix Tech 1

Post by The1 »

WOW good work there mate! Youve delved much deeper than we ever have. The MSC Cartridges wern't a thing here in Aus as the Holdens basicly could do all models with a normal 512kb eeprom i think.

For now i rarely use the tech1a i use a vpecker instead which can do all the same things a tech1 can do. Not sure if Brazil is covered or not is it Opel cars? i can check if you like to see if your car is covered if you want to look into vpecker.
danrmp
Posts: 8
Joined: Wed Aug 16, 2017 1:02 am
cars: 1994 Chevrolet Omega 3.0
1996 Chevrolet Omega 4.1
2004 Chevrolet Vectra 2.2

Re: Vetronix Tech 1

Post by danrmp »

Hello The1. I think I came across some posts written by you or some other mate (sorry, can't remember the name. Tazy?) on Just Commodores. I remember someone mentioning a special T1 with Lilbug monitor ROM.

Anyway, GMB Tech1's covered from 1991 to 1998 and I don't know what size a regular cartridge would be. I think all were replaced by MSC's. And even those, are very, VERY hard to find. I just bought mine and I am reluctant to make any attempt of reading it, because I'm afraid of damaging or erasing it.

I have a spare GM/FORD/CHRYSLER PT cartridge that uses a larger AMD Flash (don't remember the size now) that may be useful to write this dump. Probably it is in the 512kB-1MB area. As I said before, the challenge is to fit the data in the right pages, because code runs from the cartridge and any wrong byte could crash the application.

I will take a look at vpecker. Didn't know about it.

GM Brazil from the 90's are most based on Opel designs under the Chevrolet brand (Corsa, Kadett, Vectra/Cavalier, Monza/Ascona, Omega), but with a few differences. I have two Omega-A I've been able to use an Opel cartridge to both, one with the regular option (basically the same car) and another, which was sold only in Brazil, with the Motronic 2.8.1 from the Omega B. Most of then (maybe all) runs on KW71/KW82 protocol instead of the widespread ALDL.

I also own a 2004 Vectra that has its modules updated from the original 1997 Opel Vectra, so an Opel program will just connect to Climate Control, ECU, TCM and Immo. I bougth a VCX Tech2Win clone for it (And still had to make some reverse engineering on it. Basically it cannot switch the various DLC pins used and do not work with the 200-baud init. Only 5-baud and KW2000).

By the way, from 1998 to 2011 we had Holden Comodores (VT, VZ and VE) rebadges as Chevrolet Omega here :)
Attachments
WhatsApp Image 2020-07-08 at 14.55.59.jpeg
WhatsApp Image 2020-07-08 at 14.55.59 (1).jpeg
danrmp
Posts: 8
Joined: Wed Aug 16, 2017 1:02 am
cars: 1994 Chevrolet Omega 3.0
1996 Chevrolet Omega 4.1
2004 Chevrolet Vectra 2.2

Re: Vetronix Tech 1

Post by danrmp »

By the way, the code that spits out data through the serial port runs from the Mass Storage Cartridge itself. Tried with other cartridges and it does not reply (at least to the same commands).

Don't know if any other cartridge allows this memory dump, but considering them as read-only, I think it is highly unlikely.
User avatar
The1
Posts: 4694
Joined: Mon Jan 04, 2010 10:23 am

Re: Vetronix Tech 1

Post by The1 »

I figure this maybe of interest, i never had any luck with it and it is public if you dig for it.

Lilbug as far as i can see was written to copy a cartridge to a MSC cartridge, using both slots. I dont have photos of the internals but the tech1a was modified as in hardware like added circuits and components, the lilbug was on the tech1a's internal rom. I tried on mine but it wouldn't boot.

Once tech1a boots it showed something like "lilbug monitor for MSC".

The guy i got a copy of this from got the tech1a from an auction. :wtf:

Ive included copies from my tech1 and tech1a internal rom to compair.
Attachments
Internal Tech1 v2.0.bin
(8 KiB) Downloaded 224 times
internal tech1a V4.0.bin
(32 KiB) Downloaded 224 times
lilbug.bin
(31.45 KiB) Downloaded 235 times
danrmp
Posts: 8
Joined: Wed Aug 16, 2017 1:02 am
cars: 1994 Chevrolet Omega 3.0
1996 Chevrolet Omega 4.1
2004 Chevrolet Vectra 2.2

Re: Vetronix Tech 1

Post by danrmp »

Nice info!

I already had the Tech1A ROM downloaded somewhere else.

Interesting to see that the Tech1 only uses 8kB. I thought that it would be somewhere near 16kB. The Tech1A serial and multimeter routines takes a lot!

I didn't saved but I remember the Reset vector being 0xE100, just like the ROM you posted.

Another line of investigation can be the "Tech1.dlll" that TIS2k uses to communicate. Unfortunely I'm terrible at disassembly, and can't make any meaningful information loading in IDAPro.

In the Log you can see some address belonging to each file. The addresses match when you run the "learn dir" funtion of MSC (holding F7).
Attachments
tech1.dll
(304.5 KiB) Downloaded 209 times
Tech1-2.LOG
Log programming NAO
(14.71 KiB) Downloaded 223 times
Tech1-1.LOG
Log programming an Opel87-97
(30.11 KiB) Downloaded 213 times
User avatar
The1
Posts: 4694
Joined: Mon Jan 04, 2010 10:23 am

Re: Vetronix Tech 1

Post by The1 »

You can see the lilbug menu system when you take a look inside the binary.

Code: Select all

DISPLAY MSC REGISTERS
TEST AND DISPLAY MSC REGISTERS
DISPLAY BOOT AND FLASH MEMORY, ALL PAGES
DISPLAY FLASH MEMORY BASE PAGE
VERIFY FLASH MEMORY
READ [BOOT/FLASH] ID CODE
READ [BOOT/FLASH] ID CODE ALL PARTS
ERASE AND LOAD BOOT FROM $6000 - $7FFF
ERASE BOOT FLASH ALL PAGE 0 TO F
ERASE ALL FLASH PAGES 60 THRU FF
LOAD ALL FLASH WITH PAGE NUMBER AND ADDRESSES
ERASE BOOT FLASH
ERASE FLASH
LOAD FLASH WITH PAGE NUMBER AND ADDRESSES
LOAD BOOT WITH PAGE NUMBER AND ADDRESSES
MOVE BLOCK BOOT
MOVE BLOCK FLASH
MEMORY EXAMINE/CHANGE BOOT ADDRESS
MEMORY EXAMINE/CHANGE FLASH ADDRESS
TOGGLE VPP
DUMP MEMORY BOUNDARIES (8K BLOCKS)
DISPLAY A BLOCK OF MEMORY
JUMP TO SUBROUTINE
JUMP TO USER ROUTINE AND EXECUTE
CALCULATE OFFSET FROM <SSSS> TO <EEEE>
MEMORY EXAMINE/CHANGE ADDRESS
LOAD S19 FILE WITH OFFSET
VERIFY S19 FILE WITH OFFSET
WRITE S19 FILE WITH OFFSET
SEARCH FOR A BYTE
SEARCH FOR A WORD
CLEAR MEMORY
MOVE MEMORY BLOCK
TEST MEMORY UNIQUE ADDRESS
TEST MEMORY DATA BITS
CONVERT ASCII
HEX DIFFERENCE
danrmp
Posts: 8
Joined: Wed Aug 16, 2017 1:02 am
cars: 1994 Chevrolet Omega 3.0
1996 Chevrolet Omega 4.1
2004 Chevrolet Vectra 2.2

Re: Vetronix Tech 1

Post by danrmp »

Yeah! And the Reset Vector pointing to 0x4000 explains why it needs a cartridge in the Slave position to boot..
Post Reply