kur4o wrote:How tac and pcm communicate. Do they use aldl protocol. If you can log communication between TAC and PCM, there might be much more left there. Even a possibility to dump rom. Just a wild speculation.
its GM 8192.
I would be super excited if you could dump over this bus....but I'm not even sure how to really communicate on it or ask it for a dump? lol I have along ways to go. I just wanted to take a look at the bin first and see if I could map a few things and get some excitement going.
maybe this could be promising? either way, a j-link may be easier to dump it. I just need the datasheet to map the JTAG pins.
Mode 2 is used to dump 60 bytes of memory from the ECU to the ALDL data line starting with a user or device defined address. This is used mainly for debugging purposes and has little or no use for the average mechanic or technician. The most significant byte (MSB) of the desired memory start address and least significant byte (LSB) is transmitted after the mode 2 byte to tell the ECU which address to start the memory dump at. The ECU will then reply with the mode 2 command set and the desired 60 bytes of data.
RADustin wrote:one thing I need to figure out is what wire to try and program over. It appears the two wire serial coms are just two redundant rx/tx lines.
Yeah, I noticed the same thing when connecting my bench DBW setup.
Is there anyway to se if there are factory GM updates for the firmware? Then you could monitor an update over those lines to see how it’s done.
I don’t believe there are any other communication channels that are connected to the vehicle so if there is a way to update them then those wires would be the way.
LS1 Boost OS V3 Here. For feature suggestions post in here Development Thread. Support future development ->Patreon.
RADustin wrote:one thing I need to figure out is what wire to try and program over. It appears the two wire serial coms are just two redundant rx/tx lines.
Yeah, I noticed the same thing when connecting my bench DBW setup.
Is there anyway to se if there are factory GM updates for the firmware? Then you could monitor an update over those lines to see how it’s done.
I don’t believe there are any other communication channels that are connected to the vehicle so if there is a way to update them then those wires would be the way.
I'm not aware of a reflash for the TAC modules. It would be pretty sweet though, especially through the main J1850 coms. EDIT- confirmed on tis2web that the TAC is not a selectable reprogrammable module. I think if this method will have any luck it'll be using the 8192 line(s) directly.
I'm wondering if winflash will work on the 8192 lines. I probably need to make a custom definitions for it so it knows how to dump it, but it already does ALDL/8192 reads and writes. and for hardware maybe just a simple diode and a FTDI chip will work? Just have to pick one of the two lines and see if they communicate.
a datasheet or more info on this chip would be great...but I can't find anything.
With ftdi cable using this program will be able to dump bin in mode2. If tac support it.
We need to have a log of pcm-tac communication, Can you wire the modules and intercept the wire that goes to pcm.
With mdi and universal patcher you can monitor aldl in j-console.
You need to set protocol to gm_uart_ps baud=8192 and for pins use 00000900. The aldl is at pin9 on obd2 connector.
exactly what I need to know. Thanks! I'll be working on this over the next few days.
I've logged this bus before many years ago. I used my rigol oscope which has a bus analyzer mode. I also made a man-in_the-middle device in a poor attempt to copy the signal to multiple tac modules. I never could get the timing right though and it would just error out.
