ABS Hacking

They go by many names, P01, P59, VPW, '0411 etc . Circa 1999 to 2006. All VPW OBD2 PCMs.
Site Admin
User avatar
Posts: 6182
Joined: Sat Feb 28, 2009 8:34 pm

Re: ABS Hacking

Postby antus » Tue Feb 04, 2020 6:42 pm

@nsfw try changing the priority. It might need to be 6D or something else.
@jlvaldez im pretty sure j2534 could just read and log for data if something with the time wanted to make and test something.
Im not sure that its ROM, but from what posted ROM was mentioned, so im taking that on face value. We also dont know for sure its even code in ROM. Something like an ABS/EBCM might be better made in an FPGA/ASIC for the amount of parallel processing its doing from 4 wheel sensors and multiple brake actuators. It could be that and just hold some flash and a basic MCU to handle configuration and comms. Just thoughts. If anyone does know, jump in!

Edit: Just googling for brake +asic I found this document. Its the loosest connection you could possibly get but it does have multiple references to delphi and other OEMs and does mention various sensor modules built around an ASIC. So I think shows that an ASIC in these small modules is reasonably likely.

https://archive.org/stream/AdvancedMicr ... f_djvu.txt
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

User avatar
Posts: 402
Joined: Fri Feb 02, 2018 3:13 pm

Re: ABS Hacking

Postby NSFW » Wed Feb 05, 2020 5:54 am

The shim DLL thing might be the easiest way to capture messages, if it comes with an app to record data.

I don't know much about J2534 but I suspect that a J2453 device could be put into a monitoring mode, which could be used with a Y-adapter. However we'd need an app to put it into monitoring mode and actually log the data to a file (and again I'm only assuming that such a mode exists).

It might be easier to use Pete & Tazzi's ObdXPro device for monitoring once it becomes available.

In the source code for PCM Hammer there's also an app named "PCM Explorer" that I made for quick-and-hacky things like this, and I've been wanting to give it a Record button to investigate the messages that are on the bus while driving. I might be able to write code for that today but I don't think I'll be able to test it.
Please don't PM me with questions about tuning or flashing - start a thread instead. Thanks!

Site Admin
User avatar
Posts: 6182
Joined: Sat Feb 28, 2009 8:34 pm

Re: ABS Hacking

Postby antus » Wed Feb 05, 2020 8:48 am

j2534 is on par with AVT, its just the crappy elm protocol that wont let you do this. You'd just keep calling ReceiveMessage() in the open j2534 driver and output the data as text. It doesnt need a specific monitoring mode. Thats why the streaming devices as I call them (avt, j2534, X-pro) are better than elm type (elm, scantool, obdlink) when your trying to do more than just read pids.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

User avatar
Posts: 2180
Joined: Thu May 17, 2012 8:53 pm
Location: WA

Re: ABS Hacking

Postby Tazzi » Wed Feb 05, 2020 12:58 pm

Some J2534 devices allow monitoring, where others do not (Its a tool firmware thing).

So you should be able to set the filter to something like 6C10F0 but then the mask to 000000 which means any frame will pass through. Some J devices do not like the mask being 00's and either do not accept the command or stop communicating all together.
I think the MDI freaks out for all 00's, but the VX nano will allow it?
Image

User avatar
Posts: 2180
Joined: Thu May 17, 2012 8:53 pm
Location: WA

Re: ABS Hacking

Postby Tazzi » Wed Feb 05, 2020 1:03 pm

As for logging the tech2, this actually doesnt use J2534, it uses its cousin DPU ISO 22900.

Iv been working on trying to get the tech2 to communicate with the OBDX by making a super basic implementation. Its similar to J protocol, just different commands, structures and return values.
Image

Posts: 66
Joined: Mon Feb 11, 2019 12:48 pm

Re: ABS Hacking

Postby jlvaldez » Wed Mar 11, 2020 7:19 am

So I was at a track here in the DFW area this last weekend and was able to active ice mode consistently once I figured out what it was. Supposedly one of the guys here has been trying to get a calibration from a friend at GM that changes these thresholds...

Site Admin
User avatar
Posts: 6182
Joined: Sat Feb 28, 2009 8:34 pm

Re: ABS Hacking

Postby antus » Wed Mar 11, 2020 8:39 am

That would be ideal, heres hopeing it surfaces.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

User avatar
Posts: 402
Joined: Fri Feb 02, 2018 3:13 pm

Re: ABS Hacking

Postby NSFW » Thu Mar 12, 2020 3:44 pm

A calibration that works with their Tech 2 programming stuff would simplify things a lot!

But if that's not possible then just ask for the source code and some reflash documentation and we'll take it from there. :)
Please don't PM me with questions about tuning or flashing - start a thread instead. Thanks!

User avatar
Posts: 402
Joined: Fri Feb 02, 2018 3:13 pm

Re: ABS Hacking

Postby NSFW » Sun Jun 21, 2020 5:59 am

jlvaldez wrote:I have TIS200 on my computer and a tech 2. Also have a J2534. I can pull the cal ID from my EBCM no issues. Not sure where it would live on my machine though, if it's already in TIS2000.

Upon some googling, I realize you apparently can't use a J2534 device to sniff the bus. However, I can use a "shim DLL" to intercept the J2534 calls from TIS2000 to my J2534 tool and dump that to a file for analysis... I'll play with this tonight and see if I can get anywhere.

I have the 2001+ module semi disassembled. Looks like I'll need to desoldee the two boards and then remove the epoxy to get anywhere, though.


How did you get yours apart?

I tried to get at the circuit build on my spare EBCM today and it still won't come apart. I attacked that MFer with a knife, a couple of screwdrivers, and even a blowtorch (just on one corner, to see if it would loosen the adhesive) all with no results.

I have the electronic half separated from the pump/valve half, I just can't get to the circuit board.
Please don't PM me with questions about tuning or flashing - start a thread instead. Thanks!

Posts: 66
Joined: Mon Feb 11, 2019 12:48 pm

Re: ABS Hacking

Postby jlvaldez » Sun Jun 28, 2020 5:39 pm

I haven't made it beyond pulling it out of the housing yet, either. Looks like it "just" needs to be desoldered. I had some stuff happen as all this covid crap happened that required my effort elsewhere. So I had to shelf it. I'm trying frantically to get back on track now.

However, I was at a track here, talking to a guy that knows a few people in GM. I told him about how we're unable to get at the OS and need someone to reach out to. He is actually very interested in being able to remove or defeat ice mode. Turns out that he has 2 contacts he knows at GM. One was involved with the C4 electronics and knows all the people that worked on the C5 stuff.

So I had him reach out and start that dialog. I'll follow up with him soon, but want some confirmation. We need the OS binary. I'm surprised they're separate but that's the missing piece.

I was also told he may be able to get his hands on a C5R unit that could be given. However, I don't know if that would help, since I don't know if the C5R ABS unit is the same. If it truly just is a calibration tweak, then why can't we pull the calibration for a C5R and upload it to C5 (of course the means to upload is not yet determined).

I haven't forgotten, it's just been crazy the last few months but things are mostly back to normal.

PreviousNext

Return to GM LS1 512Kbyte and 1Mbyte

Who is online

Users browsing this forum: No registered users and 4 guests