PCM Hammer Release 012

[antus]

P01 and P59 are related computers which talk the VPW OBD2 protocol. There is no CAN code in Pcmhammer, even if you have an interface that suppots it. Maybe there will be one day, but not yet. CAN will need a lot of new code.

[In-Tech]

I suppose you are still wanting feedback. I just took a tuner locked 2004 P59 and grounded the pin and wrote a completely different OS from a 2006. Then had to ground the pin again to do a parameters write(clone). I used a obdlink cable and all went perfect. It can now read and write without grounding the pin. I did a compare in hex workshop of the read after cloning the parameters and there is an area that didn't match. So I rewrote the parameters(clone) again and it said it didn't match so it rewrote again. Did a read again and another compare and there is an area that isn't getting written although it appears it shouldn't matter.

Original file

Code: Select all

00004390 850C 850C 0000 0000 0A18 FFFF FFFF FFFF ................
000043A0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
000043B0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
000043C0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
000043D0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
000043E0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
000043F0 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................

After clone

Code: Select all

00004390 850C 850C 0000 0000 0A18 FFFF FFFF FFFF ................
000043A0 A5A0 1F8B 8770 4D4E 162B 6F1B 0000 0000 .....pMN.+o.....
000043B0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000043C0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000043D0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000043E0 0000 0000 0000 0040 850C 850C 0000 0000 .......@........
000043F0 0A18 FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................

I see the "end of file 0A18".

Not complaining in the least, just giving feedback.
-Carl

[In-Tech]

False alarm, once again I didn't notice the notes at end of file. Sorry about that. This time I tried my AVT on the 1x setting, worked perfect.
[03:05:50:324] Note that mismatched Parameter blocks are to be expected.
[03:05:50:356] Parameter data can change every time the PCM is used.

Code: Select all

[03:04:13:963]  PCM Hammer 012
[03:04:14:525]  AVT 852 Reset OK
[03:04:14:540]  AVT Firmware 1.1
[03:04:15:055]  Thanks for using PCM Hammer.
[03:05:05:037]  C:\Users\Carl_Dell_D630_Win7\Desktop\Unknown.bin
[03:05:09:359]  Validating 1024k file.
[03:05:09:359]  	Start	End	Stored	Needed	Verdict	Segment Name
[03:05:09:405]  	00000	FFFFD	2626	2626	Good	Operating system
[03:05:09:421]  	08002	1613F	EE54	EE54	Good	Engine calibration
[03:05:09:421]  	16142	1949F	ADBA	ADBA	Good	Engine diagnostics.
[03:05:09:437]  	194A2	1D70F	8AC4	8AC4	Good	Transmission calibration
[03:05:09:452]  	1D712	1E00F	E30A	E30A	Good	Transmission diagnostics
[03:05:09:468]  	1E012	1FA8F	6ADA	6ADA	Good	Fuel system
[03:05:09:483]  	1FA92	1FF9F	EAD5	EAD5	Good	System
[03:05:09:499]  	1FFA2	1FFEF	3A00	3A00	Good	Speedometer
[03:05:09:515]  Requesting operating system ID...
[03:05:09:639]  PCM and file are both operating system 12587811
[03:05:09:780]  Unlock succeeded.
[03:05:09:873]  4X communications disabled by configuration.
[03:05:09:905]  Uploading kernel to PCM.
[03:05:13:212]  Kernel upload 49% complete.
[03:05:16:504]  Kernel upload 100% complete.
[03:05:16:847]  Kernel Version: 010301BB
[03:05:16:862]  Kernel uploaded to PCM succesfully.
[03:05:16:972]  PCM and image file are both operating system 12587811
[03:05:17:081]  Flash chip: AMD AM29F800BB, 1mb
[03:05:17:112]  Calculating CRCs from file...
[03:05:17:143]  Requesting CRCs from PCM...
[03:05:17:284]  	Range		File CRC		PCM CRC	Verdict	Purpose
[03:05:19:015]  0F0000-0FFFFF	8D0F8F91	8D0F8F91	Same	OperatingSystem
[03:05:20:747]  0E0000-0EFFFF	A50F3C90	A50F3C90	Same	OperatingSystem
[03:05:22:478]  0D0000-0DFFFF	A50F3C90	A50F3C90	Same	OperatingSystem
[03:05:24:210]  0C0000-0CFFFF	A50F3C90	A50F3C90	Same	OperatingSystem
[03:05:25:942]  0B0000-0BFFFF	A50F3C90	A50F3C90	Same	OperatingSystem
[03:05:27:673]  0A0000-0AFFFF	A50F3C90	A50F3C90	Same	OperatingSystem
[03:05:29:405]  090000-09FFFF	E5BAAE49	E5BAAE49	Same	OperatingSystem
[03:05:31:136]  080000-08FFFF	74E52F61	74E52F61	Same	OperatingSystem
[03:05:32:868]  070000-07FFFF	0D5A658C	0D5A658C	Same	OperatingSystem
[03:05:34:600]  060000-06FFFF	047C7846	047C7846	Same	OperatingSystem
[03:05:36:331]  050000-05FFFF	771331E8	771331E8	Same	OperatingSystem
[03:05:38:063]  040000-04FFFF	0CD256BB	0CD256BB	Same	OperatingSystem
[03:05:39:810]  030000-03FFFF	7F78050F	7F78050F	Same	OperatingSystem
[03:05:41:557]  020000-02FFFF	5A0E380C	5A0E380C	Same	OperatingSystem
[03:05:43:304]  010000-01FFFF	33644623	33644623	Same	Calibration
[03:05:45:052]  008000-00FFFF	D013EC0D	D013EC0D	Same	Calibration
[03:05:46:799]  006000-007FFF	85B5BB36	85B5BB36	Same	Parameter
[03:05:48:546]  004000-005FFF	76969862	73163328	Different	Parameter
[03:05:50:293]  000000-003FFF	B5DA9728	B5DA9728	Same	Boot
[03:05:50:324]  Note that mismatched Parameter blocks are to be expected.
[03:05:50:356]  Parameter data can change every time the PCM is used.
[03:05:50:449]  Clearing trouble codes.
[03:05:51:058]  Elapsed time 00:00:41.2620725

[antus]

Yep I think thats a log of the write process the os writes after boot. We never quite got to the bottom of it, and didnt really even try since it doesnt matter. It was first noticed by dimented 24x7 when he wrote his tool. Each time you go through the write process some kind of record is added to the end of the data in the param block. It could be to do with the sram at ff8000 mismatching, or the unlock or somehow the write. The relevant data for the os is at the start of the block.

[In-Tech]

Thanks for the feedback. I suppose it was worth mentioning in this thread in case others use a different software to do the compare like I did. Then I noticed the verify and tried it and the answer was right there. Doh! lol

Now to try an unbrick a p59 I have here. I can replace the flash chip but now with this great software I am getting lazy.

[In-Tech]

Looking for any suggestion to try before I pull the flash off of the board. I've tried grounding pin on key up, and many variations of time after key up. Read, write, read properties, etc etc. As far as I can tell, it's dead. Just for kicks I tried with the AVT too. Do you guys have anything else I should try?

Code: Select all

[04:23:42:050]  PCM Hammer 012
[04:23:44:031]  Thanks for using PCM Hammer.
[04:23:45:123]  Voltage: 13.4V
[04:23:45:139]  Elm ID: ELM327 v1.3a
[04:23:45:170]  ScanTool device ID: STN1130 v4.5.1
[04:23:52:143]  VIN query failed: Timeout
[04:24:12:345]  VIN query failed: Timeout
[04:24:51:819]  C:\Users\Carl_Dell_D630_Win7\Desktop\Unknown.bin
[04:24:55:033]  Validating 1024k file.
[04:24:55:033]  	Start	End	Stored	Needed	Verdict	Segment Name
[04:24:55:064]  	00000	FFFFD	2626	2626	Good	Operating system
[04:24:55:080]  	08002	1613F	EE54	EE54	Good	Engine calibration
[04:24:55:080]  	16142	1949F	ADBA	ADBA	Good	Engine diagnostics.
[04:24:55:095]  	194A2	1D70F	8AC4	8AC4	Good	Transmission calibration
[04:24:55:111]  	1D712	1E00F	E30A	E30A	Good	Transmission diagnostics
[04:24:55:111]  	1E012	1FA8F	6ADA	6ADA	Good	Fuel system
[04:24:55:127]  	1FA92	1FF9F	EAD5	EAD5	Good	System
[04:24:55:142]  	1FFA2	1FFEF	3A00	3A00	Good	Speedometer
[04:24:55:158]  Requesting operating system ID...
[04:24:58:496]  Operating system request failed, checking for a live kernel...
[04:25:00:899]  Checking for recovery mode...
[04:25:04:596]  PCM is not responding to OSID, kernel version, or recovery mode checks.
[04:25:04:611]  Unlock may not work, but we'll try...
[04:25:05:079]  Unlock was not successful.
[04:25:37:262]  Will save to C:\Users\Carl_Dell_D630_Win7\Desktop\Test\testb.bin
[04:25:40:039]  Querying operating system of current PCM.
[04:25:43:362]  Operating system query failed, will retry: Error
[04:25:46:778]  Operating system query failed: Error
[04:25:46:794]  Unable to get operating system ID. Will assume this can be unlocked with the default seed/key algorithm.
[04:25:47:262]  Unlock was not successful.
[04:26:18:665]  Will save to C:\Users\Carl_Dell_D630_Win7\Desktop\Test\testc.bin
[04:26:21:161]  Querying operating system of current PCM.
[04:26:24:499]  Operating system query failed, will retry: Error
[04:26:27:884]  Operating system query failed: Error
[04:26:27:900]  Unable to get operating system ID. Will assume this can be unlocked with the default seed/key algorithm.
[04:26:28:383]  Unlock was not successful.
[04:27:15:741]  C:\Users\Carl_Dell_D630_Win7\Desktop\Unknown.bin
[04:27:18:393]  Validating 1024k file.
[04:27:18:409]  	Start	End	Stored	Needed	Verdict	Segment Name
[04:27:18:440]  	00000	FFFFD	2626	2626	Good	Operating system
[04:27:18:471]  	08002	1613F	EE54	EE54	Good	Engine calibration
[04:27:18:487]  	16142	1949F	ADBA	ADBA	Good	Engine diagnostics.
[04:27:18:518]  	194A2	1D70F	8AC4	8AC4	Good	Transmission calibration
[04:27:18:534]  	1D712	1E00F	E30A	E30A	Good	Transmission diagnostics
[04:27:18:565]  	1E012	1FA8F	6ADA	6ADA	Good	Fuel system
[04:27:18:596]  	1FA92	1FF9F	EAD5	EAD5	Good	System
[04:27:18:612]  	1FFA2	1FFEF	3A00	3A00	Good	Speedometer
[04:27:18:643]  Requesting operating system ID...
[04:27:22:012]  Operating system request failed, checking for a live kernel...
[04:27:24:430]  Checking for recovery mode...
[04:27:28:159]  PCM is not responding to OSID, kernel version, or recovery mode checks.
[04:27:28:174]  Unlock may not work, but we'll try...
[04:27:28:658]  Unlock was not successful.
[04:28:26:585]  C:\Users\Carl_Dell_D630_Win7\Desktop\Unknown.bin
[04:28:29:720]  Validating 1024k file.
[04:28:29:751]  	Start	End	Stored	Needed	Verdict	Segment Name
[04:28:29:783]  	00000	FFFFD	2626	2626	Good	Operating system
[04:28:29:798]  	08002	1613F	EE54	EE54	Good	Engine calibration
[04:28:29:829]  	16142	1949F	ADBA	ADBA	Good	Engine diagnostics.
[04:28:29:845]  	194A2	1D70F	8AC4	8AC4	Good	Transmission calibration
[04:28:29:876]  	1D712	1E00F	E30A	E30A	Good	Transmission diagnostics
[04:28:29:892]  	1E012	1FA8F	6ADA	6ADA	Good	Fuel system
[04:28:29:923]  	1FA92	1FF9F	EAD5	EAD5	Good	System
[04:28:29:954]  	1FFA2	1FFEF	3A00	3A00	Good	Speedometer
[04:28:29:985]  Requesting operating system ID...
[04:28:33:355]  Operating system request failed, checking for a live kernel...
[04:28:35:773]  Checking for recovery mode...
[04:28:39:486]  PCM is not responding to OSID, kernel version, or recovery mode checks.
[04:28:39:501]  Unlock may not work, but we'll try...
[04:28:39:985]  Unlock was not successful.

[Gampy]

[edit]
When flashing,
Every time the Ignition is switched off, the Os writes parameters to the Parameter sector. Thus the parameter sector mismatch.

After doing any successful PcmHammer "Write ...", you can pull the battery before switching ignition off and it will prevent the Os from writing parameters, thus the next time the Pcm is powered up it will still compare the same.
Once PcmHammer's Kernel writes, it's written.

However if you are VIN changing via the "Change VIN" form, you must Ignition off before pulling the battery or the VIN change will not be saved.
The VIN change is done through the Os, not PcmHammer's Kernel.

That last Pcm looks like it's in need of a BDM ...

[In-Tech]

Thanks for the reply. I bought a bdm100 a few months ago and have never tried it so I guess now is a good time to learn how to use it. I assume it is similar to jtag that I used to do yearsssss ago. This thing came with no paperwork or instructions(china I think). If anyone knows of any handy destructions here or elsewhere I would sure appreciate a link.
I'll try to take a pic of what I have later today.

Good news is, last night, I was able to recover/reprogram 4 out of the 5 "bricks" I had laying around.

[DavidBraley]

Just did a full read using PCM Hammer 012 of a 12586243 1 meg P59 using my shiny new Xpro VT USB device (USB only, no Bluetooth). Took only 4 minutes and 28 seconds. This thing is smoking fast! I'll play more with it tomorrow and report back...

[antus]

The param block is only written if there are any changes in sram. Typically its not written during regular use and key on/key off. It is checked if a write is needed every key off but usually it isnt. This is older flash memory, it cant be written as many times as modern flash before it dies, but its easily capable of use as designed including reflashing many times by tuners.