PCM Hammer P12 development

[Tazzi]

Happy to help rip apart the GM kernel if you have that logged

[Gampy]

It would definitely be nice to have one ...

[darkman5001]

Inside of a 2003 l6 4.2 pcm.

Uses 1mb chip but bin is 512kb, There is also some slave file $C000 size.
It looks like the second part of chip [upper 512kb bytes] are referenced in code, but can`t be read from memory. Maybe shared with other cpu or bankswitched somehow. The slave is also loaded somewhere. Starting at $10000 but again couldn`t figure yet where it is in memory layout.

A real dump of full chip will help alot how memory is organized.

SLave ram is at 80 00 00 address.

It can take multipart flash routines if they are between ffa000 and ffe000.
main cpu ID is 10
slave ID is 17
It also can take some slave flash routine that is loaded at ff8xxx and is max $600 bytes long. But seems unused with factory tools. Maybe some underground equipment ready.

Reading of 512kb bin part is easy. The main difference between ls1 reading is the COP, needs to keep slave quiet.
bset #7 at ff800806
bclr #7 at ff800806

You know that is a P10 board right? I am still trying to get this P12 PCM opened up and see what's inside. I did post alot of information on the P10 earlier.

[Gampy]

So, I fixed up a test, Darkman5001 ran it on a P12, the results ...

It's happily getting along,

[06:34:12:412] OSID: 12606400
[06:34:12:443] Ignoring chatter: 6C F0 10 68 00
[06:34:12:521] Unlock succeeded.

Until it's not,

[06:34:12:537] Sending upload request for kernel size 1190, loadaddress FFA000
[06:34:12:537] Requesting permission to upload kernel.
[06:34:12:537] TX: 6C 10 F0 34 00 04 A6 FF A0 00
[06:34:12:568] RX: 6C F0 10 7F 34 00 04 A6 FF A0 12
[06:34:12:568] Found response, Refused

A breakdown for those that don't know what all the bytes mean ...

Mode34RefusalBreakdown.png (5.33 KiB) Viewed 3061 times

At least that is what I think the last byte is on the RX, VPW Mode 34 error code ??
PLEASE correct me (and those next to come along) if I'm wrong.

Thought I would try losing the 'size' from the request and see what happens, thus making the request,

TX: 6C 10 F0 34 00 FF A0 00

Nothing to lose but time ...

Any other suggestions ??

[kur4o]

6C 10 F0 34

You need to send only this, after pcm is unlocked.

P12 have different memory layout. try loading at ffff2000

[Gampy]

edit: Ignore this quote, see the following two posts!

And, 34 80 on the last ??

I'll worry about the address after getting past the request ...

Duh!

[kur4o]

You send this to enable mode 36
6C 10 F0 34

the response will contain 44 if succesfull.

Than send mode 36 00 for upload only and 36 80 for upload and execute[last message]

[Gampy]

kur4o,

I humbly apologize, that was all my mistake ... I know the the steps, I guess I was having a brain fart!

[kur4o]

Wait to see the craploading flash routine assembler.

[Gampy]

Oh yea, Thank ya sir!
Busy ATM, I'll look later ... Thank you!