GM E38 E67 E40 Kernel/Bootloader Development Extravaganza

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Ok soooo.. first things first. To begin development on a new ECU.. will need to take a looksy at the GM kernel used.

I have soooooooo many ecus here now.. really dont know where to start. I think majority have pointed at the E92 as the next go to.

E92 still uses powerPC, but its the newer variant which uses VLE (variable length encoded) which bascially optimises the coding with some shorter commands. The compiler I was looking into would allow me to write completely in standard PPC, and then would optimise and use VLE variants on complication to reduce size. From my testing it turned a 1000byte file into 600bytes.

Anyways... being that it uses VLE, it makes decomplication of gm kernel a little interesting... will have to check ALL possible commands between PPC and VLE and see if there isnt a method to identify the difference easier otherwise its gonna be a fuckload of trial and error to get a clean decompile to understand whats happening.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
In-Tech
Posts: 779
Joined: Mon Mar 09, 2020 4:35 pm
Location: California

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by In-Tech »

Tazzi wrote:Ok soooo.. first things first. To begin development on a new ECU.. will need to take a looksy at the GM kernel used.

I have soooooooo many ecus here now.. really dont know where to start. I think majority have pointed at the E92 as the next go to.

E92 still uses powerPC, but its the newer variant which uses VLE (variable length encoded) which bascially optimises the coding with some shorter commands. The compiler I was looking into would allow me to write completely in standard PPC, and then would optimise and use VLE variants on complication to reduce size. From my testing it turned a 1000byte file into 600bytes.

Anyways... being that it uses VLE, it makes decomplication of gm kernel a little interesting... will have to check ALL possible commands between PPC and VLE and see if there isnt a method to identify the difference easier otherwise its gonna be a fuckload of trial and error to get a clean decompile to understand whats happening.
For me, I'd like to be able to clone e67 and e78 for repairs and of course e92 in the future too. I've never disassembled a kernel so if you have some suggestions for reading up on it or an example I am all ears. This is fun stuff :thumbup:

>>>>>>>>>>>>>>
edit, re-reading the beginning of this thread has a lot of info :study:
User avatar
Gatecrasher
Posts: 272
Joined: Sat Apr 25, 2020 6:09 am

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Gatecrasher »

I've got a 2014 Corvette, an SPS subscription, a legit MDI, and about a third of the car's modules duplicated on a bench setup. Including an E92 ECM, thought it isn't cloned (hence my interest in this project). I've also got some background in hobby level reverse engineering from my Mitsubishi days. I'm anxious to help if I can.
User avatar
delcowizzid
Posts: 5493
Joined: Sat Feb 28, 2009 8:38 pm
Location: Wellington NZ
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by delcowizzid »

E55 lol
If Its Got Gas Or Ass Count Me In.if it cant be fixed with a hammer you have an electrical problem
kur4o
Posts: 948
Joined: Sun Apr 10, 2016 9:20 pm

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by kur4o »

Gatecrasher wrote:I've got a 2014 Corvette, an SPS subscription, a legit MDI, and about a third of the car's modules duplicated on a bench setup. Including an E92 ECM, thought it isn't cloned (hence my interest in this project). I've also got some background in hobby level reverse engineering from my Mitsubishi days. I'm anxious to help if I can.

You can definitely help speed things up. Some of the cache file from the SPS programming event can help alot.
I will be really glad if you can post all the files you have in the cache folder. The folder should be named SPS and will be located in documents and settings on xp or users in win7[or some of the program data file].


I was looking at some e78 files and they look identical to e39a pcm. So are these the same pair as e38 and e67. If so adding support for both will be one shot deal.
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by ironduke »

I was under the impression that the cache files were encrypted, I remember looking at them a while ago and comparing them to a bin and couldn't find any correlation between the bin and cals contained in the bin..

If cache files help I can dump my sps cache folders, I did reinstall windows 10 not that long ago but I do a lot of reprogramming..
kur4o
Posts: 948
Joined: Sun Apr 10, 2016 9:20 pm

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by kur4o »

ironduke wrote:I was under the impression that the cache files were encrypted, I remember looking at them a while ago and comparing them to a bin and couldn't find any correlation between the bin and cals contained in the bin..

If cache files help I can dump my sps cache folders, I did reinstall windows 10 not that long ago but I do a lot of reprogramming..
That will be great. They do need some form of conversion to make it usable.
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by ironduke »

Not sure if I can upload a zipped file that's a 180mb?? I uploaded it to media fire, if someone has a better upload site let me know... I didn't know it was that loaded that bad with spam and bad links until I tried to download my own link, lol..
Just click on the " DOWNLOAD (183.86MB) " box and it'll start the download.. I did have 1 popup i had to kill..
This is one of my desktops, I can do a few more, didn't think sps cache held any secrets, lol..

https://www.mediafire.com/file/rcd87tfk ... he.7z/file


http://www.mediafire.com/folder/icpbe2h171uns/wcache2

If you want the second batch all zipped up, here's a link for those.. http://www.mediafire.com/file/oyy9qm403 ... e2.7z/file


edited to add a second link, almost a gig of files.. I uploaded it not zipped so you can pick and choose or download the whole folder..
Last edited by ironduke on Mon Jun 22, 2020 11:54 pm, edited 2 times in total.
User avatar
Gatecrasher
Posts: 272
Joined: Sat Apr 25, 2020 6:09 am

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Gatecrasher »

I'll get my cache files posted soon.
ironduke wrote:I was under the impression that the cache files were encrypted, I remember looking at them a while ago and comparing them to a bin and couldn't find any correlation between the bin and cals contained in the bin..

If cache files help I can dump my sps cache folders, I did reinstall windows 10 not that long ago but I do a lot of reprogramming..
They're all ZIP files. They don't have an extension. Unzip them and you'll get a .bin you can use. There's also some useful log files buried in there. I'll get the exact path when I pull my cache data.
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by ironduke »

Gatecrasher wrote:I'll get my cache files posted soon.


They're all ZIP files. They don't have an extension. Unzip them and you'll get a .bin you can use. There's also some useful log files buried in there. I'll get the exact path when I pull my cache data.
I swear I had tried that and they weren't .bin files but I did try a few last night and found they were plain .bin files when I unzipped them.. I did find a immo learn file which is NOT a bin file, that may be what I had found before when I was messing around with them..
Post Reply