GM E38 E67 E40 Kernel/Bootloader Development Extravaganza

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Done some research on some of the newer ecus such as E87, E92 and E98.

They all use a NXP SGMPPC chip set. I cant find anything about them, like absolutely nothing. Im assuming it still continues the standard powerpc architecture.. but no data sheet makes for an interesting development.

I assume all major routines can be understood and extracted from understanding the GM kernel, cause as far as Im aware.. NXP does not have the chips data sheets public.

*Edit
Ok, so seems they are a newer version of the MPC55XX style chip set I think. So.. I imagine the reference manuals wouldnt stray toooooo far from them.
Iv emailed to NXP to see if they will actually send information... but I have a feeling these must be a GM only kinda thing
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Yep, its a customer specific product. Just spoke to a NXP sales rep just now.

With the correct connections, seems you can get your hands on the reference manual, but he did say they are based on the main series of chips.. so that confirms that at least.

*Edit
I have to become a distributor to be allowed access to moderated documents of customer specific items :lol:
Haha.. so... I have applied :lol: :lol: :lol:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Drenno
Posts: 8
Joined: Wed Feb 26, 2020 3:42 am
cars: 1984 ford bronco
1998 chevrolet suburban
2007 ve ss commodore
2004 toyota hilux

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by Drenno »

Tazzi wrote:Yep, its a customer specific product. Just spoke to a NXP sales rep just now.

With the correct connections, seems you can get your hands on the reference manual, but he did say they are based on the main series of chips.. so that confirms that at least.

*Edit
I have to become a distributor to be allowed access to moderated documents of customer specific items :lol:
Haha.. so... I have applied :lol: :lol: :lol:
You can start selling chips as a side hustle now :lol: :lol:
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Drenno wrote:You can start selling chips as a side hustle now :lol: :lol:
:lol: considering the quantities they will probably want, it'll be more a information gathering event.

Tracking down some of those new ecus now, will also investigate what the GM kernel does, see which data sheet it follows closest for its can/ram/flash ect
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

VE V6, E77.. uses MPC562 also... that should fall inline to being supported also.

Currently tracking down the following ecus:
E39 (VE V6 ECU)
E39a (VF V6 ECU)
E92 (Colorado)
E98 (Colorado)

I have an E98 here, although unfortunately is not mine to strip apart, being held for a conversion. I can use it to get a SPS log but thats about it.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Drenno
Posts: 8
Joined: Wed Feb 26, 2020 3:42 am
cars: 1984 ford bronco
1998 chevrolet suburban
2007 ve ss commodore
2004 toyota hilux

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by Drenno »

Tazzi wrote:VE V6, E77.. uses MPC562 also... that should fall inline to being supported also.

Currently tracking down the following ecus:
E39 (VE V6 ECU)
E39a (VF V6 ECU)
E92 (Colorado)
E98 (Colorado)

I have an E98 here, although unfortunately is not mine to strip apart, being held for a conversion. I can use it to get a SPS log but thats about it.
I may be able to get you the V6 commodore ECU's. Leave it with me for a few days and I'll ask and see if they've been thrown out or not
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Drenno wrote:I may be able to get you the V6 commodore ECU's. Leave it with me for a few days and I'll ask and see if they've been thrown out or not
Got an E39 and E39a on the way now.

*Edit
Ok I went a little silly with purchases from US.. so we have a E39,E39a,E37,E78,E92 and E98 on the way now.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by ironduke »

Sorry, I didn't know you were looking for donor ecu's... How much is shipping from the USA to you?? I'll try and get a list of ecu's I have, I save all the ecu's in the shop that don't get returned for core or warranty, think I have 10 or so.. scattered around everywhere though, lol.. Keep on saving them and stashing them telling myself some day they will come in handy..

If you feel the urge to binge buy again it might be cheaper if I dig them up around here either from local scrap yards or ebay and send them to you direct?? Just trying to help any way I can, lol..

My only interest in the moment is the E38 ecu, that's what I have in my truck and that's what my interest kinda peaks, lol..
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

ironduke wrote:Sorry, I didn't know you were looking for donor ecu's... How much is shipping from the USA to you?? I'll try and get a list of ecu's I have, I save all the ecu's in the shop that don't get returned for core or warranty, think I have 10 or so.. scattered around everywhere though, lol.. Keep on saving them and stashing them telling myself some day they will come in handy..

If you feel the urge to binge buy again it might be cheaper if I dig them up around here either from local scrap yards or ebay and send them to you direct?? Just trying to help any way I can, lol..

My only interest in the moment is the E38 ecu, that's what I have in my truck and that's what my interest kinda peaks, lol..
I believe I averaged about $40-60aud an ecu including shipping, so it wasnt toooooo bad. Shipping was about $100usd all up for all ecus. But thankyou for the offer anyways.

Yeah the E38's are certainly popular, I have one in my own car too (Holden VE SS). So its been good to test on the bench and then test in car to ensure it all works nicely in vehicle.

Basically everything I would want in a kernel is now implemented, few things left are:
1) Add variable range for 32bit sum calculation
2) Add variable range for CRC calculation (I think this is easier to just have OS and cal as the two options)
3) Fix erase/writing

Waiting on an in-circuit pushon clip to program the flash in the event I kill it. I have stripped another E38 PCB so I can access the flash from the front for recovery in that event.

Having way too much fun pulling apart ECUs though. Stripped down an T42 yesterday, although it is like the E55 which has no visible writing on the CPU, there is on the flash chip but will need a microscope to make that one out.

Was also reading up on some of the newer ECUs, some of the services to 'unlock' these ecus are incredible expensive. One of the forums had a comment saying that they are having to replace the CPU to then allow tuning. Thats a pretty invasive and intensive task. Wouldnt want to be that person pulling chips!
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Erasing and writing now working correctly, upped the erase time to 1second per sector and that now reports as erased each time. Also managed to narrow down the write bug, which Im surprised it even compiled as it was completely invalid. :roll:

Sample layout of the app currently.

Will have to try lookup all OSIDs or partnumbers for E38/E67s to identify PCM automatically, be nice to do that over manually selecting.
ecuflash.PNG
ecuflash.PNG (25.65 KiB) Viewed 9548 times
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Post Reply