V6 ability for pcm hammer.

[Vampyre]

Going to keep This post updated with info so ppl dont have to search for it.


Kernel can be loaded at FF9090
Needs to be smaller than 4018byte

correct size kernel loads

Darkhorizon provided the keyalgo file
gampy found how to implement it

The Code for the P01,P59 is 40
The Code for the P04 is 14

Works like a champ.
key algo is up and running
-Enjoy[/quote]

watchdog info
move.b #$55,($FFFFFA27).w ; 'U'
move.b #$AA,($FFFFFA27).w
bclr #7,($FFFFC006).w
bset #7,($FFFFC006).w

DLC Register info
#define DLC_TRANSMIT_COMMAND (*(unsigned char *)0x00FFE800)
#define DLC_TRANSMIT_FIFO (*(unsigned char *)0x00FFE801)
#define DLC_STATUS (*(unsigned char *)0x00FFF800
#define DLC_RECEIVE_FIFO (*(unsigned char *)0x00FFF801)

[Vampyre]

Since I have multiple seeds and corresponding keys plus all the dif algorithms saved is there a way to build a small program with all the algorithm data and just input seed to see which comes up with correct key.

Sorry if none of this makes since new to the world software side of things. Ive done just enough research so far to have a vague understanding of whats going on with pcm

[antus]

Yep the algorithms are known, dont bother spending long on that. I can tell you which one if you post up a couple of samples. But you can hard code your key and see if you can get the read working, and contribute v6 support to the flash kernel if you can. In that case we can make it official with credit to you.

[Gampy]

Where/how does one hardcode the algo/key?

[Vampyre]

Antus im new to coding so have no idea how to do that part but I can post a few seed key combos to help out

[Vampyre]

these are all from hw# 9357440 which is standard 99-05 v6 pcm

seed key
254a 8259
450a 8357
51ef abbe

I can get more if need I have friends that own a junkyard

[Vampyre]

successfully wrote new vin to v6 pcm this morning

AVT filter configured
[11:19:34:674] TX: 6C 10 F0 3C 0A
[11:19:34:690] RX: 6C F0 10 7C 0A 00 BA 2D F7
[11:19:34:768] TX: 6C 10 F0 3C 01
[11:19:34:784] RX: 6C F0 10 7C 01 00 31 47 32 4E 56
[11:19:34:784] TX: 6C 10 F0 3C 02
[11:19:34:815] RX: 6C F0 10 7C 02 31 32 45 33 59 4D
[11:19:34:815] TX: 6C 10 F0 3C 03
[11:19:34:830] RX: 6C F0 10 7C 03 37 38 37 31 37 30
[11:19:37:048] Sending seed request.
[11:19:37:048] TX: 6C 10 F0 27 01
[11:19:37:064] RX: 6C F0 10 67 01 25 4A
[11:19:37:080] Parsing seed value.
[11:19:37:080] Sending unlock request (4A25, 8259)
[11:19:37:080] TX: 6C 10 F0 27 02 82 59
[11:19:37:111] RX: 6C F0 10 67 02 34
[11:19:37:173] Changing VIN to 1G2NV12E3YM787170
[11:19:37:173] Block 1
[11:19:37:189] TX: 6C 10 F0 3B 01 00 31 47 32 4E 56
[11:19:37:189] Successful write to block 1
[11:19:37:189] Block 2
[11:19:37:205] TX: 6C 10 F0 3B 02 31 32 45 33 59 4D
[11:19:37:205] Successful write to block 2
[11:19:37:205] Block 3
[11:19:37:220] TX: 6C 10 F0 3B 03 37 38 37 31 37 30
[11:19:37:220] Successful write to block 3
[11:19:37:220] VIN successfully updated to 1G2NV12E3YM787170

now issue is program is trying to validate file, but since its got different check sums comes back as invalid file so cant write or clone.

[11:22:41:268] E:\cals\v6\2000gagt1factoryourvinserial.bin
[11:22:41:393] Validating 512k file.
[11:22:41:393] This file does not contain the expected signature at 0x1FFFE.
[11:22:41:408] Start End Stored Needed Verdict Segment Name
[11:22:41:471] Checksum table is corrupt.
[11:22:41:487] This file is corrupt. It would render your PCM unusable.

[Vampyre]

found out sub mode80 is a no go for P04 but did get it to attempt multi part upload. now to try and get it to stop the sub 80 and see if it loads

[Vampyre]

So gampy found some interesting code in P04 asking about intel or amd, Ive opened all my P04 and only found intel chips, but I will head to junk yard and pull apart a few 04-05s and see what they have, also I know the 4cyl pcms used P10 and another pcm but code interchanges between the 2 so that could be a cause also.

[Gampy]

It's official ... The P04 does in fact come with a AMD chip as well!

Lookey see what showed up on our porch a little bit ago ...
2005 Buick Century 4dr Sdn Custom 3.1L (LG8)
OsID: 12594316
SvN: 12583827
HW: 12582720

[Edit]
Pulled with PcmHammer:

2005 Buick Century 4dr Sdn Custom 3.1L (LG8) SvN12583827 OsID12594316.bin

(512 KiB) Downloaded 350 times

2005-Buick-P04-FlashChip.jpg (127.54 KiB) Viewed 11611 times

The Unlock short pin,

A top view,

A bottom view,

Code: Select all

                // AM29F400BB   
                case 0x000122AB:
                    size = 512 * 1024;
                    description = "AMD AM29F400BB, 512kb";
                    memoryRanges = new MemoryRange[]
                    {
                        new MemoryRange(0x70000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x60000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x50000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x40000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x30000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x20000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x10000, 0x10000, BlockType.Calibration), //  64kb calibration block
                        new MemoryRange(0x08000, 0x08000, BlockType.Calibration), //  32kb calibration block
                        new MemoryRange(0x06000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x04000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x00000, 0x04000, BlockType.Boot), //  16kb boot block
                    };
                    break;

AM29F400B.pdf

(580.77 KiB) Downloaded 587 times

Definitely a different layout, and as David pointed out no BDM header, but I'm sure he'll suss out the pinout.
MCU looks a bit different.
The DLC looks to be the same (If I'm looking at the right chip).

I did notice something else different between this unit and David's unit, his is missing a driver chip that would be the IAC driver on a P01/59.
This unit has a chip there ... though not visible in these images except for the used solder points on the bottom.

Why do some posted images get a Zoom magnifier others don't??