PCM Hammer P01 and P59 flash tool v015

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: PCM Hammer - new ls1 flash tool

Post by NSFW »

Also, before flashing it should check the voltage. If you want a bite-sized piece of work to get started with, this is probably it. We'd need a GetVoltage() in the Device base class, with overrides in the derived classes. Plus a GetVoltage in the Vehicle class that just calls this.device.GetVoltage(). And then have the GUI call vehicle.GetVoltage and check the results before kicking off the thread that does the reading or writing.

Implementing GetVoltage for each device might take some research but you'll have help.

This is probably the highest priority. I'll be very sad if someone's PCM gets bricked because their battery died mid-flash...
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
renat
Posts: 3
Joined: Fri May 22, 2020 3:33 am
cars: 2001 Chevy corvette
1988 Mazda rx7 LQ4 swapped
2009 Nissan 370z

Re: PCM Hammer - new ls1 flash tool

Post by renat »

NSFW wrote:
renat wrote:Hey everyone, just found the PCM Hammer soft on github today, I've ordered VXDIAG VCX straight away to check the soft out. I've got two LS cars and I'm a C# developer, hopefully I can be pretty useful here.
Cool! The logger needs a ton of work, how much time do you have? :)

Here comes a brain-dump that I've been meaning to put into writing for a while...

Right now you have to edit XML files by hand to tell the logger which parameters to use, and that's not user-friendly at all. To fix that, I'd like to reduce the log profile files to just a list of parameter IDs and units, like:

<profile>
<parameter id="VehicleSpeed" units="mph" />
<parameter id="EngineSpeed" units="RPM" />
</profile>

Then we'd have separate XML files to keep track of how the parameters are really defined.
There would be one to describe the standard PIDs that every PCM supports:

<parameters>
<parameter id="VehicleSpeed" name="Vehicle Speed" pid="0xD" length="1">
<conversion units="mph" expression="x*0.61" />
<conversion units="kph" expression="x" />
</parameter>
</parameters>

And there would be one XML file per operating system, containing the "extended" parameters whose addresses need to be reverse-engineered for each operating system:

<parameters OS="12593358">
<parameter id="ThrottleFollowerAir" name="Throttle Follower Airflow" address="0xFF980A" length="2">
<conversion units="g/s" expression="x/1024" />
<conversion units="lb/min" expression="x/24" />
</parameter>
<parameter id="ThrottleCrackerAir" name="Throttle Cracker Airflow" address="0xFF97F0" length="2">
<conversion units="g/s" expression="x/1024" />
<conversion units="lb/min" expression="x/24" />
</parameter>
</parameters>

(Half of the numbers in the XML examples are totally made up.)

With these XML files to describe what parameters exist, the logger UI could give users a list of parameters to choose from. So users could click an "edit profile" button which would open a dialog box with a DataGridView table that has a column of checkboxes to add/remove parameters, and a column of parameter names, and a column of drop-lists to pick the preferred units.
I can't tell you how many hours I can spend per week, but I can definitely dedicate a considerable amount of time for the project. "Needs a ton of work" sounds like a cool motivation for me. :) I can work on a GUI for the "edit profile" part if needed.
Last edited by renat on Sat May 23, 2020 1:00 am, edited 1 time in total.
renat
Posts: 3
Joined: Fri May 22, 2020 3:33 am
cars: 2001 Chevy corvette
1988 Mazda rx7 LQ4 swapped
2009 Nissan 370z

Re: PCM Hammer - new ls1 flash tool

Post by renat »

NSFW wrote:Also, before flashing it should check the voltage. If you want a bite-sized piece of work to get started with, this is probably it. We'd need a GetVoltage() in the Device base class, with overrides in the derived classes. Plus a GetVoltage in the Vehicle class that just calls this.device.GetVoltage(). And then have the GUI call vehicle.GetVoltage and check the results before kicking off the thread that does the reading or writing.

Implementing GetVoltage for each device might take some research but you'll have help.

This is probably the highest priority. I'll be very sad if someone's PCM gets bricked because their battery died mid-flash...
Yeah, I can work on that piece for sure. Have you ever had such an experience? :lol:
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: PCM Hammer - new ls1 flash tool

Post by NSFW »

I haven't bricked a PCM that way, but I did have a close call... I flashed and then couldn't start my car because the battery was too dead. Had to call my wife to come out with jumper cables. Fortunately I was only a couple miles from home. :) (And I replaced the battery after that, too.)

If anybody wants to get deep into the microcontroller side of things... Solving this problem will make you a hero:

https://github.com/NationalSecurityAgen ... ssues/1244

Ghidra is a free / open-source alternative to IDA Pro for reverse-engineering. It supports the Motorola 68k instruction set, but the CPU in the P01 and P59 has a few additional instructions in it, which Ghidra does not support. If that was fixed, it would open up reverse engineering to a lot more people, partly because Ghidra is free, and partly beause Ghidra has a decompiler in addition to a disassembler.
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Post by gmtech825 »

I tried to write the OS on my 2002 P01 ecm and got a kernal error:
02:06:11:138] Requesting permission to upload kernel.
[02:06:11:147] TX: 6C 10 F0 34 00 10 00 FF 80 00
[02:06:11:164] RX: 6C F0 10 7F 34 00 10 00 FF 80 33
[02:06:11:165] Found response, Refused

I tried again in 1x:

2:09:47:197] Found response, Success
[02:09:47:198] Upload permission granted.
[02:09:47:244] Going to load a 7930 byte kernel to 0xFF8000
[02:09:47:245] Sending end block payload with offset 0x1000, start address 0xFF9000, length 0xEFA.
[02:09:47:249] Sending 'test device present' notification.
[02:09:47:250] TX: 8C FE F0 3F...

[02:10:17:516] WritePayload: Unable to send message.
[02:10:17:517] WritePayload: Giving up.
[02:10:17:519] Could not upload kernel to PCM, remainder payload not accepted.
[02:10:17:520] Failed to upload kernel to PCM
[02:10:17:562] Elapsed time 00:00:30.4556660

I have the whole log if you want, I just didn't want to paste it all here.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: PCM Hammer - new ls1 flash tool

Post by Tazzi »

doesnt look like it ever finishes uploading the kernel.

Are you running this in car or on bench?
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: PCM Hammer - new ls1 flash tool

Post by antus »

There is a bit too much snipped out the debug log. We cant see what interface you have, or what went wrong with the upload. Whether its a tool error of data collision on bus or something else. You can attach the whole debug log as a file, or if you want to do another snippet take the tool setup stuff at the start of the flash and the last page before the error aborts.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Post by gmtech825 »

This was in vehicle, using a Bosch MDI2. I have A MDI I used on my p59 successfully that I can try.

log is attached.
Attachments
p01 write error.txt
(133.38 KiB) Downloaded 147 times
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: PCM Hammer - new ls1 flash tool

Post by antus »

I think there are two things going on here. Firstly there is something wrong with the computer which is stopping it from accepting the 4x speed upload. Running at 1x seems like a working workaround. We have seen this before with one of the core developers computer. In his case it was working originally but then for reasons unknown it started rejecting the uploads. We didnt try at 1x. He was able to restore the paramter block from his first read and then the PCM started operating normally again. You could probably ignore this and just continue to use 1x, or you could clone another pcm in, and reset the vin, and either disable vats or re-learn the security IF you wanted to change it.

As for the flash not working at 1x it does seem to be a limitation of the device. I know the MDI2 have less RAM than the original MDI, and pcmhammer was developed and tested against the original MDI. I think your MDI will work if you run at 1x, and we will probably need to put something in future pcmhammer versions to run a smaller packet size when the MDI2 is detected.

I've logged this issue on github here: https://github.com/LegacyNsfw/PcmHacks/issues/201
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: PCM Hammer - new ls1 flash tool

Post by Tazzi »

antus wrote:I think there are two things going on here. Firstly there is something wrong with the computer which is stopping it from accepting the 4x speed upload. Running at 1x seems like a working workaround. We have seen this before with one of the core developers computer. In his case it was working originally but then for reasons unknown it started rejecting the uploads. We didnt try at 1x. He was able to restore the paramter block from his first read and then the PCM started operating normally again. You could probably ignore this and just continue to use 1x, or you could clone another pcm in, and reset the vin, and either disable vats or re-learn the security IF you wanted to change it.

As for the flash not working at 1x it does seem to be a limitation of the device. I know the MDI2 have less RAM than the original MDI, and pcmhammer was developed and tested against the original MDI. I think your MDI will work if you run at 1x, and we will probably need to put something in future pcmhammer versions to run a smaller packet size when the MDI2 is detected.

I've logged this issue on github here: https://github.com/LegacyNsfw/PcmHacks/issues/201
I think your spot on there Antus, response saying unable to send message must be related to an error code back from the J2534 write message command, which Id say would be a buffer full/overfull error.

Odd that its doing that though since to be J2534 compliant... it needs to support the 0x1000 bytes.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Post Reply