PCM Hammer P01 and P59 flash tool v015

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Post by gmtech825 »

Thanks to everyone who has worked on this. I've been trying to learn even a slight amount of this stuff and it isn't easy. I was able to successfully read my 2005 p59 OS 12606961 with both MDI and MDI 2. I have a couple files, one with it programmed as a Holden and one as GMT800(using HP). I've been using ghidra to try and decipher and find how It enables lean cruise but I think the lack of cpu32 support is holding me back. I found where the platform type is stored and multiple references pointing to it but I'm not confident enough to make the changes.

Anyways, If I'm able to make the changes is it safe to write to the p59? I see it says full write isn't supported but does that include any OS changes. Any advice on verifying the Checksum afterwards would be a real help also.

Thanks everyone!
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: PCM Hammer - new ls1 flash tool

Post by antus »

The latest version can write P59 OS. You will need a way to update the OS checksum before you flash if you have patched the OS. Its also worth familiarising yourself with which pin to ground on the main pcb to force recovery mode incase your mods crash the OS and you get a boot loop.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Post by gmtech825 »

antus wrote:The latest version can write P59 OS. You will need a way to update the OS checksum before you flash if you have patched the OS. Its also worth familiarising yourself with which pin to ground on the main pcb to force recovery mode incase your mods crash the OS and you get a boot loop.
Thanks, If I ever get this figured out I'll try it. If tunerpro shows the checksum numbers haven't changed after editing the .bin am I good to go?? I figured it out on a different OS just fine, but this OS seems to have a completely different strategy...Unless I'm missing it somewhere.
In case anyone's interested in what I'm looking at (DAT_0001f76d is where the platform is stored):

switchD_00033f6c::caseD_c XREF[2]: 00033f6c (j) , 000913a2 (*)
0008628e 42 38 a0 d8 clr.b (DAT_ffffa0d8 ).w
00086292 0c 39 00 cmpi.b #0x2 ,(DAT_0001f76d ).l = 07h
.............. 02 00 01
.............. f7 6d
0008629a 66 06 bne.b LAB_000862a2
0008629c 36 3c 14 00 move.w #0x1400 ,D3w
000862a0 60 04 bra.b LAB_000862a6
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: PCM Hammer - new ls1 flash tool

Post by Vampyre »

how do i change the crc checks? i see they check differently for p01 and p59, so can i just add a new case for p04?

AVT: no message waiting.
[10:36:48:538] TX: 6C 10 F0 3D 02 00 40 00 00 00 00
[10:36:49:545] Waited 2seconds.. no data present
[10:36:49:548] AVT: no message waiting.
[10:36:49:673] Unable to get CRC for memory range 00000000 / 00004000
[10:36:49:676] Sending 'test device present' notification.
[10:36:49:682] TX: 8C FE F0 3F
[10:36:49:694] ##############################################################################
[10:36:49:698] There are errors in the data that was read from the PCM. Do not use this file.
[10:36:49:702] ##############################################################################
[10:36:49:707] Halting the kernel.
[10:36:49:762] TX: 6C 10 F0 20
[10:36:49:765] AVT setting VPW 1X
[10:36:49:769] TX: 6C 10 F0 20
[10:36:49:774] Clearing trouble codes.
[10:36:50:077] TX: 68 6A F0 04
[10:36:50:347] TX: 68 6A F0 04
[10:36:50:612] TX: 8C FE F0 14
[10:36:50:869] TX: 8C FE F0 14
[10:36:50:877] Halting the kernel.
[10:36:50:936] AVT setting VPW 4X
[10:36:50:945] TX: 6C 10 F0 20
[10:36:50:952] AVT setting VPW 1X
[10:36:50:959] TX: 6C 10 F0 20
[10:36:50:965] Clearing trouble codes.
[10:36:51:283] TX: 68 6A F0 04
[10:36:51:548] TX: 68 6A F0 04
[10:36:51:807] TX: 8C FE F0 14
[10:36:52:063] TX: 8C FE F0 14
[10:36:52:070] Elapsed time 00:05:16.0060745
[10:36:52:075] Saving contents to C:\Users\jay\Documents\calsand bins\p04test.bin
User avatar
joukoy
Posts: 392
Joined: Tue Dec 17, 2019 3:27 am
cars: Pontiac Firebird 1978

Re: PCM Hammer - new ls1 flash tool

Post by joukoy »

gmtech825 wrote:
antus wrote:The latest version can write P59 OS. You will need a way to update the OS checksum before you flash if you have patched the OS. Its also worth familiarising yourself with which pin to ground on the main pcb to force recovery mode incase your mods crash the OS and you get a boot loop.
Thanks, If I ever get this figured out I'll try it. If tunerpro shows the checksum numbers haven't changed after editing the .bin am I good to go?? I figured it out on a different OS just fine, but this OS seems to have a completely different strategy...Unless I'm missing it somewhere.
In case anyone's interested in what I'm looking at (DAT_0001f76d is where the platform is stored):

switchD_00033f6c::caseD_c XREF[2]: 00033f6c (j) , 000913a2 (*)
0008628e 42 38 a0 d8 clr.b (DAT_ffffa0d8 ).w
00086292 0c 39 00 cmpi.b #0x2 ,(DAT_0001f76d ).l = 07h
.............. 02 00 01
.............. f7 6d
0008629a 66 06 bne.b LAB_000862a2
0008629c 36 3c 14 00 move.w #0x1400 ,D3w
000862a0 60 04 bra.b LAB_000862a6
You can fix checksums with:
- PCMBinBuilder
- UniversalPatcher
- Tunerpro plugin
https://github.com/joukoy/
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Post by gmtech825 »

joukoy wrote:
gmtech825 wrote:
antus wrote:SNIP
You can fix checksums with:
- PCMBinBuilder
- UniversalPatcher
- Tunerpro plugin
https://github.com/joukoy/
hey that bin builder tool is really handy. Thanks :thumbup:
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Post by gmtech825 »

Just wanted to give an update, I did the OS write after editing the bin OS successfully on the p59 using a Bosch MDI. Thank you guys. I'm willing to help out with any time consuming grunt work needed on this project if there is any. My abilities are limited obviously, but let me know. I also work for a GM dealer and have access to Tis if that helps in any way.
renat
Posts: 3
Joined: Fri May 22, 2020 3:33 am
cars: 2001 Chevy corvette
1988 Mazda rx7 LQ4 swapped
2009 Nissan 370z

Re: PCM Hammer - new ls1 flash tool

Post by renat »

Hey everyone, just found the PCM Hammer soft on github today, I've ordered VXDIAG VCX straight away to check the soft out. I've got two LS cars and I'm a C# developer, hopefully I can be pretty useful here.
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: PCM Hammer - new ls1 flash tool

Post by NSFW »

renat wrote:Hey everyone, just found the PCM Hammer soft on github today, I've ordered VXDIAG VCX straight away to check the soft out. I've got two LS cars and I'm a C# developer, hopefully I can be pretty useful here.
Cool! The logger needs a ton of work, how much time do you have? :)

Here comes a brain-dump that I've been meaning to put into writing for a while...

Right now you have to edit XML files by hand to tell the logger which parameters to use, and that's not user-friendly at all. To fix that, I'd like to reduce the log profile files to just a list of parameter IDs and units, like:

<profile>
<parameter id="VehicleSpeed" units="mph" />
<parameter id="EngineSpeed" units="RPM" />
</profile>

Then we'd have separate XML files to keep track of how the parameters are really defined.
There would be one to describe the standard PIDs that every PCM supports:

<parameters>
<parameter id="VehicleSpeed" name="Vehicle Speed" pid="0xD" length="1">
<conversion units="mph" expression="x*0.61" />
<conversion units="kph" expression="x" />
</parameter>
</parameters>

And there would be one XML file per operating system, containing the "extended" parameters whose addresses need to be reverse-engineered for each operating system:

<parameters OS="12593358">
<parameter id="ThrottleFollowerAir" name="Throttle Follower Airflow" address="0xFF980A" length="2">
<conversion units="g/s" expression="x/1024" />
<conversion units="lb/min" expression="x/24" />
</parameter>
<parameter id="ThrottleCrackerAir" name="Throttle Cracker Airflow" address="0xFF97F0" length="2">
<conversion units="g/s" expression="x/1024" />
<conversion units="lb/min" expression="x/24" />
</parameter>
</parameters>

(Half of the numbers in the XML examples are totally made up.)

With these XML files to describe what parameters exist, the logger UI could give users a list of parameters to choose from. So users could click an "edit profile" button which would open a dialog box with a DataGridView table that has a column of checkboxes to add/remove parameters, and a column of parameter names, and a column of drop-lists to pick the preferred units.
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: PCM Hammer - new ls1 flash tool

Post by NSFW »

Also, the way the logger actually pulls data from the PCM is probably not optimal. Right now it sends one request for every row of data. At one point I had it sending a single request with parameter that told the PCM to send data continuously, but that didn't work very reliably. I still think it's probably the right approach to use (sending fewer requests = receiving more responses per second), but it's going to take some experimenting to get it working reliably.

And it might end up being necessary to use the current approach with ELM devices and a continuous-streaming approach with better devices (all of the non-ELM stuff).
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
Post Reply