Vetronix Tech 1
Vetronix Tech 1
Hello,
Is anybody here have experience with Tech 1 Mass Storage Cartridge?
Is it possible to copy software inside MSC to put in another MSC, I think need to erase MSC before put in the software?
Thanks
Is anybody here have experience with Tech 1 Mass Storage Cartridge?
Is it possible to copy software inside MSC to put in another MSC, I think need to erase MSC before put in the software?
Thanks
Re: Vetronix Tech 1
just pull it apart, standard eprom inside.
Re: Vetronix Tech 1
But I have opened the MSC and the inside not use single EPROM like specific cartridge (i.e ABS,RWAL cartridge)
Re: Vetronix Tech 1
no idea just assumed it would be a 4Mbit eprom, i havn't seen inside of one, only standard cartridges.
Re: Vetronix Tech 1
Here pic inside MSC (both side), any idea???
- Attachments
-
- DSC_0959.jpg (1.56 MiB) Viewed 8783 times
-
- DSC_0958.jpg (1.77 MiB) Viewed 8783 times
Re: Vetronix Tech 1
yeh good luck with that
- antus
- Site Admin
- Posts: 8253
- Joined: Sat Feb 28, 2009 8:34 pm
- cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B - Contact:
Re: Vetronix Tech 1
It looks like flash memory wired in parallel prolly using the ce line to select which one. But yeah will be proprietry.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Re: Vetronix Tech 1
Any info to extract the software inside flash memory and burn to new memory like standard EPROM/EEPROM?antus wrote:It looks like flash memory wired in parallel prolly using the ce line to select which one. But yeah will be proprietry.
I'm really new with flash memory...
- antus
- Site Admin
- Posts: 8253
- Joined: Sat Feb 28, 2009 8:34 pm
- cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B - Contact:
Re: Vetronix Tech 1
You'll have to come up with something custom. I dont think there is any information about how the data is mapped on there and thats after you buy sockets for those chips to suit your programmer and then successfully desolder them without causing any damage.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
-
- Posts: 8
- Joined: Wed Aug 16, 2017 1:02 am
- cars: 1994 Chevrolet Omega 3.0
1996 Chevrolet Omega 4.1
2004 Chevrolet Vectra 2.2
Re: Vetronix Tech 1
Hey guys, pretty old thread but I had a similar question.
In Brazil GM had its specific Tech1 software. The individual cartridges are long gone, and the very few Tech1's that show up are equipped with a MSC. TIS2000 Brazil packages are know, but no one can put the hands on it.
So I came with the idea of dumping an MSC and programming into another one or a regular type (EPROM-based), which would be desirable since it is much cheaper.
So I fired up a TIS2000 programing on a spare MSC with a serial monitor running and got plenty of information.
The computer send the following data to check if a Tech1 is connected:
and the Tech1 echo back the reply.
there is another set of data, but I think that the most interesting one is this:
and the reply is:
When writing to a MSC, the computer send a lot of blocks like these:
After a few educated guesses, I came up what seems to be the comunication protocol. Taking ef 5a 01 9e 00 80 0f 89 as an example:
sending the data above throug the serial port returns the following:
Which matches the resident part of the MSC cartridge.
Observing the data written to it, seems like the writable data sits between 0x8000 and 0x9FFF, in pages from 0x01 to 0xff (in case of NAO package, about 1.1MB in size according to TIS). Seems plausible, since we'll have 255 pages of 8kB data for a total of 2MB addressable. The picture posted shows 6x F28F020 Intel flash chips, 256kB each, 1.2MB total
Page 0x0E looks like the directory index and page 0x0F seem to return any address in the 64kB space of Tech1's memory map. I was able to dump the internal RAM (used as a buffer for the diplay) and the higher parts of the internal ROM (0xFF80-0xFFFF), with the reset and interrupt vectors.
My guess is that Master Cartridge sits between 0x8000 ans 0xBFFF
I think that the challenge from now on is:
-Know the exact memory location that a Master Cartridge lives;
-Know how the memory banks are switched;
-Have a reliable MSC Resident dump or build a custom one;
-Extract only the relevant part of the software, or develop a hardware to do the flash-eeprom bank switching (CPLD will do the job)
OR
-Dump the entire MSC and replace the commands from "Read" to "Write" and send to another MSC, after sending the commands to erase all and write enable.
Regards,
Danniel
In Brazil GM had its specific Tech1 software. The individual cartridges are long gone, and the very few Tech1's that show up are equipped with a MSC. TIS2000 Brazil packages are know, but no one can put the hands on it.
So I came with the idea of dumping an MSC and programming into another one or a regular type (EPROM-based), which would be desirable since it is much cheaper.
So I fired up a TIS2000 programing on a spare MSC with a serial monitor running and got plenty of information.
The computer send the following data to check if a Tech1 is connected:
Code: Select all
ef 58 50 11 00 58
there is another set of data, but I think that the most interesting one is this:
Code: Select all
ef 5a 01 90 84 41 0e 53
Code: Select all
ef 97 01 4f 50 38 37 2d 39 34 20 47 42 20 20 20 Ôó.OP87-94 GB
4f 50 45 4c 2f 56 41 55 58 48 41 4c 4c 20 38 37 OPEL/VAUXHALL 87
2d 39 34 20 45 43 55 20 28 56 33 2e 32 29 20 20 -94 ECU (V3.2)
20 20 20 20 20 20 20 20 a0 17 f2 00 76 02 02 26 †.Ú.v..&
96 60 ff 7f 87
Code: Select all
ef da 02 87 80 80 05 65 20 52 50 4d 40 20 20 54 Ô⁄.áÄÄ.e RPM@ T
65 73 74 20 61 62 6f 72 74 65 64 2c 20 20 56 65 est aborted, Ve
68 69 63 6c 65 20 6e 6f 74 20 69 6e 20 20 20 50 hicle not in P
61 72 6b 2f 4e 65 75 74 72 61 6c 2e 40 20 20 54 ark/Neutral.@ T
65 73 74 20 61 62 6f 72 74 65 64 2c 20 20 20 43 est aborted, C
6c 75 74 63 68 20 50 65 64 61 6c 20 20 20 20 20 lutch Pedal
64 65 70 72 65 73 73 65 64 2e 40 00 20 3d 20 49 depressed.@. = I
6e 63 72 65 61 73 65 20 45 47 52 20 20 53 6f 6c ncrease EGR Sol
2e 20 70 6f 73 69 74 e7 . positÁ
Code: Select all
EF 5A 01 = Read Memory
9E 00 = Base address
80 = number of bytes to be read (128 maximum)
0f = Memory bank? yet to be confirmed
89 = 2's complement checksum
Code: Select all
ef d6 01 52 20 20 20 20 46 31 3a 52 45 4f 52 47 Ô÷.R F1:REORG
2e 20 4d 45 4d 4f 52 59 46 32 3a 45 4e 41 42 4c . MEMORYF2:ENABL
45 20 55 50 44 41 54 45 46 33 3a 44 49 53 41 42 E UPDATEF3:DISAB
4c 45 20 55 50 44 41 54 40 52 45 53 49 44 45 4e LE UPDAT@RESIDEN
54 20 55 50 44 41 54 45 40 20 44 49 53 41 42 4c T UPDATE@ DISABL
45 44 40 20 45 4e 41 42 4c 45 44 20 40 20 20 20 ED@ ENABLED @
52 45 4f 52 47 41 4e 49 5a 45 20 20 20 20 20 4e REORGANIZE N
4f 54 20 50 4f 53 53 49 42 4c 45 40 20 2a 2a 2a OT POSSIBLE@ ***
20 45 52 cf ERœ
Observing the data written to it, seems like the writable data sits between 0x8000 and 0x9FFF, in pages from 0x01 to 0xff (in case of NAO package, about 1.1MB in size according to TIS). Seems plausible, since we'll have 255 pages of 8kB data for a total of 2MB addressable. The picture posted shows 6x F28F020 Intel flash chips, 256kB each, 1.2MB total
Page 0x0E looks like the directory index and page 0x0F seem to return any address in the 64kB space of Tech1's memory map. I was able to dump the internal RAM (used as a buffer for the diplay) and the higher parts of the internal ROM (0xFF80-0xFFFF), with the reset and interrupt vectors.
My guess is that Master Cartridge sits between 0x8000 ans 0xBFFF
I think that the challenge from now on is:
-Know the exact memory location that a Master Cartridge lives;
-Know how the memory banks are switched;
-Have a reliable MSC Resident dump or build a custom one;
-Extract only the relevant part of the software, or develop a hardware to do the flash-eeprom bank switching (CPLD will do the job)
OR
-Dump the entire MSC and replace the commands from "Read" to "Write" and send to another MSC, after sending the commands to erase all and write enable.
Regards,
Danniel
- Attachments
-
- GM NAO MSC Programming.txt
- (6.94 MiB) Downloaded 268 times