PCM Hammer Release 010

[NSFW]

Code: Select all

05:06:33:489]  Kernel upload 100% complete.
[05:06:33:497]  TX: 6C 10 F0 3D 00
[05:06:33:579]  RX: 6D F0 10 76
[05:06:33:692]  TX: 6C 10 F0 3D 00
[05:06:34:330]  RX: 6C F0 10 60 CC 00 00 23

That last message is what the kernel sends after it gets a reboot request.

I'll put out a new release in the next day or two that should hopefully prevent that problem.

Thanks for helping to troubleshoot. It sounds like your BCM was sending the messages that trigger the reboot, but the kernel should be just ignoring those messages.

[jlvaldez]

Makes sense. There must be another module requesting the restart, I had the BCM fuses pulled and still was failing on reads.

Can you modify the kernel to provide a byte or something describing the source of the restart request? I don't have a VPW sniffer, but I don't see why you couldn't use the bus tool anyway to listen on the bus for the restart command.

I've got a P59 (Intel flash) in my truck and a P01 PCM in my Vette. I can test on them both

[NSFW]

Please give it a try with this kernel. It will only honor reboot requestst that come from the app.

Just copy the attached file over the top of the kernel.bin that came in with release 10.

If this fixes the problem I'll do another release with this change plus a configuration setting to disable 4x.

[jlvaldez]

Please give it a try with this kernel. It will only honor reboot requestst that come from the app.

Just copy the attached file over the top of the kernel.bin that came in with release 10.

If this fixes the problem I'll do another release with this change plus a configuration setting to disable 4x.

This kernel worked flawlessly for me. I did 2 reads on my silverado without pulling any fuses and it did 2 back to back flawless reads

Nothing interesting in the logs at all, but there is this new line that showed up

Code: Select all

[11:01:12:080]  PCM Hammer 010
[11:01:12:081]  Initializing J2534 Device
[11:01:12:082]  DLL already loaded, unloading before proceeding
[11:01:12:084]  DLL successfully unloaded
[11:01:12:086]  Loaded DLL
[11:01:12:207]  Connected to Scantool
[11:01:12:223]  Battery Voltage is: 11.884
[11:01:12:224]  Battery Voltage is: 11.884
[11:01:12:367]  Protocol Set
[11:01:12:383]  Filter Set
[11:01:21:443]  Will save to \\Mac\Home\Downloads\PcmHammer010\PcmHammer010\SilveradoTest2.bin
[11:01:23:973]  Querying operating system of current PCM.
[11:01:23:978]  TX: 6C 10 F0 3C 0A
[11:01:24:015]  RX: 6C F0 10 7C 0A 00 13 93 EA
[11:01:24:017]  OSID: 1283050
[11:01:24:019] [b][u] Suppressing VPW chatter.[/u][/b]
[11:01:24:021]  TX: 6C FE F0 28 00
[11:01:24:024]  Sending 'test device present' notification.
[11:01:24:029]  TX: 8C FE F0 3F
[11:01:24:032]  Sending seed request.
[11:01:24:034]  TX: 6C 10 F0 27 01
[11:01:24:079]  RX: 6C F0 10 68 00
[11:01:24:081]  Parsing seed value.
[11:01:24:083]  Unable to parse seed response. Attempt #1
[11:01:24:095]  RX: 6C F0 10 67 01 0C 17
[11:01:24:098]  Parsing seed value.
[11:01:24:100]  Sending unlock request (170C, 7C41)
[11:01:24:103]  TX: 6C 10 F0 27 02 7C 41
[11:01:24:143]  RX: 6C F0 10 67 02 34
[11:01:24:146]  Unlock succeeded.
[11:01:24:150]  Sending 'test device present' notification.
[11:01:24:153]  TX: 8C FE F0 3F
[11:01:24:157]  Attempting switch to VPW 4x
[11:01:24:161]  TX: 6C FE F0 A0
[11:01:24:191]  RX: 6C F0 10 E0 AA
[11:01:24:195]  Parsing 6C F0 10 E0 AA
[11:01:24:198]  Module 0x10 (engine controller) has agreed to enter high-speed mode.
[11:01:24:201]  Sending 'test device present' notification.
[11:01:24:204]  TX: 8C FE F0 3F
[11:01:26:210]  ReadMsgs OBDError: ERR_BUFFER_EMPTY
[11:01:26:214]  Sending 'test device present' notification.
[11:01:26:218]  TX: 8C FE F0 3F
[11:01:26:224]  TX: 6C FE F0 A1
[11:01:28:230]  ReadMsgs OBDError: ERR_BUFFER_EMPTY
[11:01:28:234]  J2534 setting VPW 4X
[11:01:28:362]  Sending 'test device present' notification.
[11:01:28:366]  TX: 8C FE F0 3F
[11:01:28:372]  Sending 'test device present' notification.
[11:01:28:376]  TX: 8C FE F0 3F
[11:01:28:384]  Loaded \\Mac\Home\Downloads\PcmHammer010\PcmHammer010\kernel.bin
[11:01:28:389]  Uploading kernel to PCM.
[11:01:28:394]  Sending upload request for kernel size 8212, loadaddress FF8000
[11:01:28:398]  TX: 6C 10 F0 34 00 10 00 FF 80 00
[11:01:28:426]  RX: 6C F0 10 74 00 44
[11:01:28:431]  Found response, Success
[11:01:28:435]  Going to load a 8212 byte kernel to 0xFF8000
[11:01:28:440]  Sending end block payload with offset 0x2000, start address 0xFFA000, length 0x14.
[11:01:28:444]  TX: 6D 10 F0 36 00 00 14 FF A0 00 20 3C 00 FF FA 4E 20 40 30 BC 10 60 42 00 4F EF 00 20 4E 75 08 75
[11:01:28:474]  RX: 6D F0 10 76 00 73
[11:01:28:478]  Found response, Success
[11:01:28:483]  Kernel upload 0% complete.

And both read attempts showed this output afterwards: remember this is with all modules connected, no fuses pulled.

Code: Select all

[10:59:55:153]  Processing message
[10:59:55:161]  0x0FF000	99%	00:00
[10:59:55:169]  Read complete.
[10:59:55:179]  All write-request messages succeeded on the first try. You have an excellent connection to the PCM.
[10:59:55:188]  We're not sure how much retrying is normal for a read operation on a 1024kb PCM.
[10:59:55:198]  Please help by sharing your results in the PCM Hammer thread at pcmhacking.net.
[10:59:55:211]  Starting verification...
[10:59:55:225]  Calculating CRCs from file...

Also decided to go do a read on my 01 Vette so I could get a binary of it. Everything worked here as well:
Some info for you.

Code: Select all

[11:09:07:819]  PCM Hammer 010
[11:09:07:826]  Loaded DLL
[11:09:07:946]  Connected to Scantool
[11:09:07:962]  Battery Voltage is: 11.858
[11:09:14:628]  VIN: 1G1YY12S315113275
[11:09:14:675]  OS ID: 12593358
[11:09:14:723]  Calibration ID: 12204931
[11:09:14:756]  Hardware ID: 9386530
[11:09:14:868]  Serial Number: 1EB02HWM0304
[11:09:14:901]  Broad Cast Code: DHYS
[11:09:14:948]  MEC: 0
[11:09:23:041]  Will save to \\Mac\Home\Downloads\PcmHammer010\PcmHammer010\Vette01.bin
[11:09:27:472]  Querying operating system of current PCM.
[11:09:27:540]  OSID: 12593358
[11:09:27:683]  Unlock succeeded.
[11:09:27:698]  Attempting switch to VPW 4x
[11:09:27:751]  Module 0x10 (engine controller) has agreed to enter high-speed mode.
[11:09:31:943]  Uploading kernel to PCM.

Code: Select all

[11:11:53:514]  Read complete.
[11:11:53:526]  All write-request messages succeeded on the first try. You have an excellent connection to the PCM.
[11:11:53:537]  We're not sure how much retrying is normal for a read operation on a 512kb PCM.
[11:11:53:548]  Please help by sharing your results in the PCM Hammer thread at pcmhacking.net.
[11:11:53:558]  Starting verification...

Great work! Will the new version allow for flashing I'd like to flash the OS on my truck (P59) so I can get my lean cruise + cruise control working. Lean cruise didn't do much for my vette (Has a 416 CI LS3 stroker, so getting more than 26 mpg highway is a pipe dream), so i'm not as concerned there.

Also, just for my curiosity, where does the kernel live when you upload it to the PCM? Is it just loaded into RAM?

[jlvaldez]

Also making a new reply because this question is kinda out of left field: have you thought about supporting other modules in the car?

For example, I would LOVE to be able to decompile the OS in my Vette's cluster. Reason: It has the ability to show my transmission temperature, but ONLY when it thinks it's over heated. Then you can see the temperature until a power cycle and it's gone again. I know it's something as stupid as a flag that is cleared by default, preventing you from seeing it in the gauge menu. For whatever reason, automatic C5s have this ability all the time, Manual C5s (or maybe it's just Z06s, i'm not sure), can not see the temperature.

Would be amazing because I use my vette for track duty and would like to keep an eye on my trans temp. Right now I have a hack, where I have a button inside the cab i can press that shorts the sensor out, making the cluster think it's over heated, then I release and i can see the regular temperature. But it's a hack.

[Gampy]

Also, just for my curiosity, where does the kernel live when you upload it to the PCM? Is it just loaded into RAM?

Yes.

[NSFW]

Thanks for confirming the fix!

I have a Corvette track car myself (2002 Z06), it's what got me started on this whole project. I might steal your transmission temperature hack.

I would love to support other modules, but there's a lot of foundational work that I'm not sure I can do on my own, so I can't promise anything.

I will probably at least try to get it working with the EBCM, and then try to tune out the "ice mode" ABS problem. I was given a 1997 EBCM unit to dissect, and the electronics seem to be encased in epoxy so I'm stuck there. But maybe the ones used in later years will be easier, I haven't looked at one yet.

I'd also like to be able to tune the TAC module, because I have a Nick Williams 102mm throttle body that my tuner wasn't able to get working. I suspect that the TAC module just needs to be tuned for its TPS sensor, but that's just a guess. I've been looking into adding a TAC module, APP sensor, and throttle body to the wiring harness on my desk to investigate that.

[jlvaldez]

Thanks for confirming the fix!

I have a Corvette track car myself (2002 Z06), it's what got me started on this whole project. I might steal your transmission temperature hack.

I would love to support other modules, but there's a lot of foundational work that I'm not sure I can do on my own, so I can't promise anything.

I will probably at least try to get it working with the EBCM, and then try to tune out the "ice mode" ABS problem. I was given a 1997 EBCM unit to dissect, and the electronics seem to be encased in epoxy so I'm stuck there. But maybe the ones used in later years will be easier, I haven't looked at one yet.

I'd also like to be able to tune the TAC module, because I have a Nick Williams 102mm throttle body that my tuner wasn't able to get working. I suspect that the TAC module just needs to be tuned for its TPS sensor, but that's just a guess. I've been looking into adding a TAC module, APP sensor, and throttle body to the wiring harness on my desk to investigate that.

Awesome. I was going to mention tuning out Ice Mode It frustrates me on track. I do have an EBCM from a later model C5 that I bought to rebuild and keep as a spare for when mine fails.

I had a NW102 and ultimately nothing I did ever got it to work perfectly. It kept causing REP on track, which is unnerving at 110 mph entering a corner. I ended up selling it and getting a ported LS2 throttle body (92 mm i think is the size). No issues ever since. I know that the code that kept getting thrown was a throttle correlation code, I suspect because the bigger TB is slower to turn than normal. With the slower movement of the blade, it would violate whatever the maximum % difference between actual and commanded and cause a correlation code. Perhaps it was a miscalibrated TPS sensor, but slower throttle transitions would keep it from activating. Would love if there was a fix for this. I'd like the 102 back.

I'm not familiar with the APP sensor, what's what?

[NSFW]

APP sensor = Accelerator Pedal Position sensor, it's just the part of the pedal assembly that the TAC connects to.

I'm running an LS2 throttle body as well. I'm hoping that the problem with the NW 102 might just be in the calibration of the throttle blade position sensors, so there might be some hope of "tuning" around it with a resistor or two, so I want to look at that first. But I doubt it's that simple. The tuner I worked with thinks that the TAC module can't supply enough current, and using a weaker return spring might help, so that's another thing to look into.

I haven't encountered ice mode yet, but I've read enough about it to want to fix it anyway.

[Vampyre]

hey NSFW can you post your tune so I can look it over, I might be able to help.

and this is why cable drive is better than wire drive