V6 ability for pcm hammer.

They go by many names, P01, P59, VPW, '0411 etc . Circa 1999 to 2006. All VPW OBD2 PCMs.
Posts: 151
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Wed Jan 15, 2020 1:52 pm

yeah over my head

Posts: 151
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Wed Jan 15, 2020 1:59 pm

160plus, I would appreciate any info you can give us any pcm. I deal with alot of v6 swaps and tuning so wouldnt mind doing some testing.

Posts: 391
Joined: Sat Dec 15, 2018 7:38 am

Re: V6 ability for pcm hammer.

Postby Gampy » Wed Jan 15, 2020 2:49 pm

160plus wrote:@Gampy

I don't get on these forums much so emailing me would be the best way to contact me if your interested.
@160plus,

If you're talking source, I'm always all in for an education ...

I do this in Spirit of Community, and I do have commercial desires, they are to take every penny I can out of HP Tuners pocket!

Posts: 151
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Wed Jan 15, 2020 3:17 pm

If you're talking source, I'm always all in for an education ...

I do this in Spirit of Community, and I do have commercial desires, they are to take every penny I can out of HP Tuners pocket![/quote]


Im with gampy on that

Posts: 391
Joined: Sat Dec 15, 2018 7:38 am

Re: V6 ability for pcm hammer.

Postby Gampy » Wed Jan 15, 2020 3:17 pm

Vampyre,

If you want to do some heavy reading, grab this Datasheet Intel 28f400b3 posted by Antus.
I recommend starting at chapter 3.0 (pg14), the real meat starts at 3.2.

Posts: 77
Joined: Thu Sep 21, 2017 3:00 pm

Re: V6 ability for pcm hammer.

Postby 160plus » Wed Jan 15, 2020 5:29 pm

I got your email Gampy.

Since multiple people are asking the same question here, the "source" is nothing like the C kernel that NSFW wrote for PCM Hammer. Unless you can read Motorola machine language there isn't any type of conventional source for the kernels and there is no easy way to modify how they work at this point. There has been so much done in these that the loops are full. Comparing this to the source code for Antus LS1 Flash Tool read kernel isn't even a good comparison, these were made with a much more primitive method.

Without seeing it I would not have a clue as to what I'd do with it

Depending on what tools you have to work with I can offer AVT scripts for use with the AVT terminal app. I can also offer complete read/write logs in txt format including that show the proper use and structure for sending large messages with the OBDLink tools, using an Allpro would just need basic Elm headers set but I probably have some old logs from one of those when I was working with a Blue Tooth Allpro as well.

Code: Select all
TX: STPX H:6D10F0, R:1, L:2057
TX: 36000800FFA00000FFCE00000004400000055C00.........000FC04CDFCEF1
RX: 6CF010760078
RX: 6CFE103F
RX: 6CF010760078
TX: 6C10F03F80
RX: 6CF0103F00
RX: 6CF010760078
RX: 6CF010760078
RX: 6CFE103F
RX: 6CF010760073
RX: 6CFE103F
TX: 6C10F03F80
RX: 6CF0103F01
TX: STPX H:6D10F0, R:1, L:2057
TX: 36000800FFA000000346DF4E750C14E........C4200DC6600C1DA
RX: 6CF010760073
RX: 6CFE103f
TX: STPX H:6D10F0, R:1, L:2057
TX: 36000800FFA00007D107D307D407D507.....etc


I have a large list of all error codes the kernel supports and how to deal with each type of error when writing as well as what the most likely cause of the error was from.

I also have a full list of the correct reply message from the PCM when loading kernels, running flash chip ID etc that let you know what the expected response for any given message should be.

All the kernels are capable of reading, so after you write a block you can go back and read it out to make sure you wrote what you intended to.

There are no erase commands, no dealing with applying specific logic to unprotect the flash chip or anything like that. The kernel takes care of all that for you. It uses a modified header(18 bytes rather then 12), the additional header bytes are used to store information about the flash chip size/type, PCM type(P01,P59 etc) and the current OS on the PCM and also tell the kernel what type of flash your doing. At any point you can send a special request message to a specific ram address and the kernel will give you the information that was stored in the additional header bytes. This is very important on the V6 computers when resuming a failed flash since the OS number is stored at the end of the flash chip, once you erase the segment with calibration data you also loose the OS number....well a conventional kernel would loose the OS number :)

And....all of the kernels created for Ls Droid have an idle mode. Meaning if you don't send a message with in X amount of time the kernel goes into idle mode and takes control of the data bus for you until you send another message. The kernels will idle for as long as you like, I have tested the P01 kernel up to a week in idle mode and was able to pick up the flash like nothing ever happened. The write kernels are also unaffected by the switched 12V ING power. Once the kernel is loaded you can turn the key off and it has no impact :shock:

Posts: 151
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Wed Jan 15, 2020 5:42 pm

i emailed you also, i noticed other v6 flash tools added some headerbytes in the kernels also.

do you have a lsdroid emulaor for pc that i could test out lsdroid on v6s or should i just get the bluetooth moule

Posts: 77
Joined: Thu Sep 21, 2017 3:00 pm

Re: V6 ability for pcm hammer.

Postby 160plus » Wed Jan 15, 2020 6:30 pm

If you have an AVT you can load this script into the HEX terminal app. All you need to do is change the key below the line marked ENTER YOUR KEY HERE then load the script into the terminal and off you go reading......
Ls_Droid_read_V6_kernel_Script.rar
(1.28 KiB) Downloaded 7 times


Here is a log of what the above script will produce as logged from the AVT HEX terminal.
V6 Script Example Read.log
(42.3 KiB) Downloaded 6 times


If you don't have an AVT.. just look at the log file and see what it's loading, what message it gets back and then go from there. This kernel is extremely basic and very simple to use....it's also very small.

Once the kernel is loaded, if you do not send a message with in about 3 seconds after the PCM sends a response the kernel will go into idle mode for around 2 1/2 minutes. If no message has been sent during that time the kernel will self exit.

After every block request the PCM will send the 3F message to keep the bus quite. It will be sent as 6D FE 10 3F. When the kernel goes into idle mode the message will change to 8C FE 10 3F and the message will be sent around every 2.5-3 seconds regardless if you've sent a message on the bus or not. After you send your next message the kernel will exit idle mode and resume normal operation until the bus goes quite again.

At no point do you ever need to send a 3F message with this kernel to maintain bus control.... even in a vehicle.

You can exit the kernel at any time by sending 6C 10 F0 20, the PCM will respond 6C F0 10 60 and the pcm will reboot.

This kernel will also work in 1x or 4x mode depending on the tool your using. The AVT script switches to 4x mode, if you want to stay in 1x just leave out the 6C Fe F0 A0 and 6C Fe F0 A1 message.

Block request sizes need to be even values and in common sizes. 0x100,0x200,0x400,0x800 or 0x1000. Very small or odd request sizes may crash the kernel. I don't recall if this version can read into the RAM region... so if you try to read a block from ram and the kernel doesn't support it, probably just exit the kernel for attempting to read out of bounds. The same goes if you try to read past the end of the flash chip, the kernel will flag you out of bounds and just exit.

There is ZERO write code in this kernel and it is perfectly safe to "play with" if you will.

If anyone's worried about the legality of the kernel... feel free to look at it in ASCII, it's original.

Posts: 151
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Wed Jan 15, 2020 6:38 pm

could i still do vin change or serial change with this kernel, any ideas on fixing bricked P04

User avatar
Posts: 323
Joined: Fri Feb 02, 2018 3:13 pm

Re: V6 ability for pcm hammer.

Postby NSFW » Wed Jan 15, 2020 8:33 pm

Congratulations on getting the kernel talking on the V6 PCM!

If you haven't already, I think it probably makes sense to rename CKernelReader to V8KernelReader and create a new V6KernelReader for this (and likewise for the Writer classes, maybe Verifier too). Then we can figure out a way to get the app to choose between the V8 and V6 classes, or maybe just have the user pick one in the UI.

I'm totally fine with getting the app to use the LS Droid kernels too, in fact that's part of the reason the code in the reader/writer/verifier classes was moved into those classes in the first place. I even worked on getting the ap to work with the LS Droid P01 kernel a little bit, quite a while ago. There's probably still an old branch, but it's so old I doubt it's useful now (lots has changed since then).
Please don't PM me with questions about tuning or flashing - start a thread instead. Thanks!

PreviousNext

Return to GM LS1 512Kbyte and 1Mbyte

Who is online

Users browsing this forum: No registered users and 3 guests