V6 ability for pcm hammer.
V6 ability for pcm hammer.
Going to keep This post updated with info so ppl dont have to search for it.
Kernel can be loaded at FF9090
Needs to be smaller than 4018byte
correct size kernel loads
Darkhorizon provided the keyalgo file
gampy found how to implement it
The Code for the P01,P59 is 40
The Code for the P04 is 14
Works like a champ.
key algo is up and running
-Enjoy[/quote]
watchdog info
move.b #$55,($FFFFFA27).w ; 'U'
move.b #$AA,($FFFFFA27).w
bclr #7,($FFFFC006).w
bset #7,($FFFFC006).w
DLC Register info
#define DLC_TRANSMIT_COMMAND (*(unsigned char *)0x00FFE800)
#define DLC_TRANSMIT_FIFO (*(unsigned char *)0x00FFE801)
#define DLC_STATUS (*(unsigned char *)0x00FFF800
#define DLC_RECEIVE_FIFO (*(unsigned char *)0x00FFF801)
Kernel can be loaded at FF9090
Needs to be smaller than 4018byte
correct size kernel loads
Darkhorizon provided the keyalgo file
gampy found how to implement it
The Code for the P01,P59 is 40
The Code for the P04 is 14
Works like a champ.
key algo is up and running
-Enjoy[/quote]
watchdog info
move.b #$55,($FFFFFA27).w ; 'U'
move.b #$AA,($FFFFFA27).w
bclr #7,($FFFFC006).w
bset #7,($FFFFC006).w
DLC Register info
#define DLC_TRANSMIT_COMMAND (*(unsigned char *)0x00FFE800)
#define DLC_TRANSMIT_FIFO (*(unsigned char *)0x00FFE801)
#define DLC_STATUS (*(unsigned char *)0x00FFF800
#define DLC_RECEIVE_FIFO (*(unsigned char *)0x00FFF801)
- Attachments
-
KeyAlgorithm.txt
- (26.04 KiB) Downloaded 153 times
Last edited by Vampyre on Sun May 17, 2020 6:44 am, edited 5 times in total.
Re: V6 ability for pcm hammer.
Since I have multiple seeds and corresponding keys plus all the dif algorithms saved is there a way to build a small program with all the algorithm data and just input seed to see which comes up with correct key.
Sorry if none of this makes since new to the world software side of things. Ive done just enough research so far to have a vague understanding of whats going on with pcm
Sorry if none of this makes since new to the world software side of things. Ive done just enough research so far to have a vague understanding of whats going on with pcm
Re: V6 ability for pcm hammer.
Yep the algorithms are known, dont bother spending long on that. I can tell you which one if you post up a couple of samples. But you can hard code your key and see if you can get the read working, and contribute v6 support to the flash kernel if you can. In that case we can make it official with credit to you.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396
Re: V6 ability for pcm hammer.
Where/how does one hardcode the algo/key?
Windows 10 is like an off idle flat spot ... It stumbles when it's time to go!
Re: V6 ability for pcm hammer.
Antus im new to coding so have no idea how to do that part but I can post a few seed key combos to help out
Re: V6 ability for pcm hammer.
these are all from hw# 9357440 which is standard 99-05 v6 pcm
seed key
254a 8259
450a 8357
51ef abbe
I can get more if need I have friends that own a junkyard
seed key
254a 8259
450a 8357
51ef abbe
I can get more if need I have friends that own a junkyard
Re: V6 ability for pcm hammer.
successfully wrote new vin to v6 pcm this morning
AVT filter configured
[11:19:34:674] TX: 6C 10 F0 3C 0A
[11:19:34:690] RX: 6C F0 10 7C 0A 00 BA 2D F7
[11:19:34:768] TX: 6C 10 F0 3C 01
[11:19:34:784] RX: 6C F0 10 7C 01 00 31 47 32 4E 56
[11:19:34:784] TX: 6C 10 F0 3C 02
[11:19:34:815] RX: 6C F0 10 7C 02 31 32 45 33 59 4D
[11:19:34:815] TX: 6C 10 F0 3C 03
[11:19:34:830] RX: 6C F0 10 7C 03 37 38 37 31 37 30
[11:19:37:048] Sending seed request.
[11:19:37:048] TX: 6C 10 F0 27 01
[11:19:37:064] RX: 6C F0 10 67 01 25 4A
[11:19:37:080] Parsing seed value.
[11:19:37:080] Sending unlock request (4A25, 8259)
[11:19:37:080] TX: 6C 10 F0 27 02 82 59
[11:19:37:111] RX: 6C F0 10 67 02 34
[11:19:37:173] Changing VIN to 1G2NV12E3YM787170
[11:19:37:173] Block 1
[11:19:37:189] TX: 6C 10 F0 3B 01 00 31 47 32 4E 56
[11:19:37:189] Successful write to block 1
[11:19:37:189] Block 2
[11:19:37:205] TX: 6C 10 F0 3B 02 31 32 45 33 59 4D
[11:19:37:205] Successful write to block 2
[11:19:37:205] Block 3
[11:19:37:220] TX: 6C 10 F0 3B 03 37 38 37 31 37 30
[11:19:37:220] Successful write to block 3
[11:19:37:220] VIN successfully updated to 1G2NV12E3YM787170
now issue is program is trying to validate file, but since its got different check sums comes back as invalid file so cant write or clone.
[11:22:41:268] E:\cals\v6\2000gagt1factoryourvinserial.bin
[11:22:41:393] Validating 512k file.
[11:22:41:393] This file does not contain the expected signature at 0x1FFFE.
[11:22:41:408] Start End Stored Needed Verdict Segment Name
[11:22:41:471] Checksum table is corrupt.
[11:22:41:487] This file is corrupt. It would render your PCM unusable.
AVT filter configured
[11:19:34:674] TX: 6C 10 F0 3C 0A
[11:19:34:690] RX: 6C F0 10 7C 0A 00 BA 2D F7
[11:19:34:768] TX: 6C 10 F0 3C 01
[11:19:34:784] RX: 6C F0 10 7C 01 00 31 47 32 4E 56
[11:19:34:784] TX: 6C 10 F0 3C 02
[11:19:34:815] RX: 6C F0 10 7C 02 31 32 45 33 59 4D
[11:19:34:815] TX: 6C 10 F0 3C 03
[11:19:34:830] RX: 6C F0 10 7C 03 37 38 37 31 37 30
[11:19:37:048] Sending seed request.
[11:19:37:048] TX: 6C 10 F0 27 01
[11:19:37:064] RX: 6C F0 10 67 01 25 4A
[11:19:37:080] Parsing seed value.
[11:19:37:080] Sending unlock request (4A25, 8259)
[11:19:37:080] TX: 6C 10 F0 27 02 82 59
[11:19:37:111] RX: 6C F0 10 67 02 34
[11:19:37:173] Changing VIN to 1G2NV12E3YM787170
[11:19:37:173] Block 1
[11:19:37:189] TX: 6C 10 F0 3B 01 00 31 47 32 4E 56
[11:19:37:189] Successful write to block 1
[11:19:37:189] Block 2
[11:19:37:205] TX: 6C 10 F0 3B 02 31 32 45 33 59 4D
[11:19:37:205] Successful write to block 2
[11:19:37:205] Block 3
[11:19:37:220] TX: 6C 10 F0 3B 03 37 38 37 31 37 30
[11:19:37:220] Successful write to block 3
[11:19:37:220] VIN successfully updated to 1G2NV12E3YM787170
now issue is program is trying to validate file, but since its got different check sums comes back as invalid file so cant write or clone.
[11:22:41:268] E:\cals\v6\2000gagt1factoryourvinserial.bin
[11:22:41:393] Validating 512k file.
[11:22:41:393] This file does not contain the expected signature at 0x1FFFE.
[11:22:41:408] Start End Stored Needed Verdict Segment Name
[11:22:41:471] Checksum table is corrupt.
[11:22:41:487] This file is corrupt. It would render your PCM unusable.
Re: V6 ability for pcm hammer.
found out sub mode80 is a no go for P04 but did get it to attempt multi part upload. now to try and get it to stop the sub 80 and see if it loads
- Attachments
-
3818kernelsize2partuploadfailwithunknowsubfailcode.txt
- (87.77 KiB) Downloaded 153 times
Re: V6 ability for pcm hammer.
So gampy found some interesting code in P04 asking about intel or amd, Ive opened all my P04 and only found intel chips, but I will head to junk yard and pull apart a few 04-05s and see what they have, also I know the 4cyl pcms used P10 and another pcm but code interchanges between the 2 so that could be a cause also.
Re: V6 ability for pcm hammer.
It's official ... The P04 does in fact come with a AMD chip as well!
Lookey see what showed up on our porch a little bit ago ...
2005 Buick Century 4dr Sdn Custom 3.1L (LG8)
OsID: 12594316
SvN: 12583827
HW: 12582720
[Edit]
Pulled with PcmHammer:
The Unlock short pin,
A top view,
A bottom view,
Definitely a different layout, and as David pointed out no BDM header, but I'm sure he'll suss out the pinout.
MCU looks a bit different.
The DLC looks to be the same (If I'm looking at the right chip).
I did notice something else different between this unit and David's unit, his is missing a driver chip that would be the IAC driver on a P01/59.
This unit has a chip there ... though not visible in these images except for the used solder points on the bottom.
Why do some posted images get a Zoom magnifier others don't??
Lookey see what showed up on our porch a little bit ago ...
2005 Buick Century 4dr Sdn Custom 3.1L (LG8)
OsID: 12594316
SvN: 12583827
HW: 12582720
[Edit]
Pulled with PcmHammer:
The Unlock short pin,
A top view,
A bottom view,
- Code: Select all
// AM29F400BB
case 0x000122AB:
size = 512 * 1024;
description = "AMD AM29F400BB, 512kb";
memoryRanges = new MemoryRange[]
{
new MemoryRange(0x70000, 0x10000, BlockType.OperatingSystem), // 64kb main block
new MemoryRange(0x60000, 0x10000, BlockType.OperatingSystem), // 64kb main block
new MemoryRange(0x50000, 0x10000, BlockType.OperatingSystem), // 64kb main block
new MemoryRange(0x40000, 0x10000, BlockType.OperatingSystem), // 64kb main block
new MemoryRange(0x30000, 0x10000, BlockType.OperatingSystem), // 64kb main block
new MemoryRange(0x20000, 0x10000, BlockType.OperatingSystem), // 64kb main block
new MemoryRange(0x10000, 0x10000, BlockType.Calibration), // 64kb calibration block
new MemoryRange(0x08000, 0x08000, BlockType.Calibration), // 32kb calibration block
new MemoryRange(0x06000, 0x02000, BlockType.Parameter), // 8kb parameter block
new MemoryRange(0x04000, 0x02000, BlockType.Parameter), // 8kb parameter block
new MemoryRange(0x00000, 0x04000, BlockType.Boot), // 16kb boot block
};
break;
Definitely a different layout, and as David pointed out no BDM header, but I'm sure he'll suss out the pinout.
MCU looks a bit different.
The DLC looks to be the same (If I'm looking at the right chip).
I did notice something else different between this unit and David's unit, his is missing a driver chip that would be the IAC driver on a P01/59.
This unit has a chip there ... though not visible in these images except for the used solder points on the bottom.
Why do some posted images get a Zoom magnifier others don't??
Last edited by Gampy on Sun Nov 29, 2020 7:23 am, edited 3 times in total.
Windows 10 is like an off idle flat spot ... It stumbles when it's time to go!
Return to GM LS1 512Kbyte and 1Mbyte
Who is online
Users browsing this forum: No registered users and 2 guests