VX/VY Flash PCM EEPROM Writing and Mapping

Holden/Delco Tuning. ALDL, OBD 1.5. Circa 1989 to 2004.
User avatar
Posts: 4988
Joined: Sun Mar 01, 2009 2:54 pm
Location: Perth, WA

VX/VY Flash PCM EEPROM Writing and Mapping

Postby VL400 » Fri May 07, 2010 8:09 pm

One of the current flashtool tasks has been to get EEPROM writing happening. So to start with I went hunting for routines in the factory code to do it and discovered mode 12 in the VX/VY PCMs. Its a limited EEPROM write mode and you must have already unlocked the PCM using mode 13. The limiting part is it restricts you to only being able to program a certain number of bytes at certain address'. Mode 12 has 9 sub functions that can write to different parts of the EEPROM. There are two tables, one that says for each sub function the address you can write from (0x9152) and the other how many bytes you can write (0x9164).

So after discovering the tables I set about trying to work out what each sub function of Mode 12 does. This is where I am at...

Mode 12 Func 1 - Change the seed/key (4 bytes from 0xE1C)
Mode 12 Func 2 - Control Byte Of Sorts? (1 byte from 0xE7F)
Mode 12 Func 3 - Change the VIN (17 bytes from 0xE20)
Mode 12 Func 4 - Not Used (0 bytes from 0xE31)
Mode 12 Func 5 - Not Used (0 bytes from 0xE31)
Mode 12 Func 6 - Not Used (0 bytes from 0xE31)
Mode 12 Func 7 - ? (10 bytes from 0xE31)
Mode 12 Func 8 - ? (4 bytes from 0xE3B)
Mode 12 Func 9 - ? (12 bytes from 0xE3F)

So part of this is also trying to map out whats in the EEPROM (See attached bin dump including EEPROM of my test bench PCM). The mapping that I have worked out so far of the EEPROM located at 0xE00 to 0xEFF is as follows...
E00 to E07 = Code Base (8Bytes)
E08 to E1B =Some sort of production date code??
E1C/E1D = Seed
E1E/E1F = Key
E20 to E30 = VIN (17Bytes)
E31 to E3A = TIS Key
E3B to E3E = Program Date of PCM
E3F to E4A = Vehicle Data (Engine Type, Trans Type)
E4B to E7E = Free
E7F = MEC
E80 to EBC = Diagnostic Fault Code Logging
EBD = Diagnostic Code Checksum
EBE to EC0 = BCM Security Bytes
EC1 to EC3 = ??
EC4 to EFF = Free



All of this does not really help the flashtool PCM reprogramming as i would like to rewrite the entire EEPROM so am part way through writing a routine to upload via mode 6. But thought it would still be worthwhile to try and map out the EEPROM. If anyone has any other info to share add it here :thumbup:
Attachments
VY_PCM_BIN.zip
(56.87 KiB) Downloaded 257 times

Posts: 1103
Joined: Sun Mar 15, 2009 10:20 am
Location: Geelong, VIC

Re: VX/VY Flash PCM EEPROM Writing and Mapping

Postby yoda69 » Fri May 07, 2010 8:59 pm

VL400,
Excellent work.
Would any other dumps from EEPROM's help?

yoda69

Posts: 318
Joined: Sun Mar 22, 2009 11:52 am
Location: Sydney

Re: VX/VY Flash PCM EEPROM Writing and Mapping

Postby kojab » Fri May 07, 2010 10:17 pm

EEPROM E0 - EE (17 bytes) is also printed on the white bar graph sticker on the A,B,C,D input sockets.

User avatar
Posts: 9702
Joined: Sat Feb 28, 2009 9:05 pm
Location: Tenambit, NSW

Re: VX/VY Flash PCM EEPROM Writing and Mapping

Postby Holden202T » Fri May 07, 2010 10:21 pm

kojab wrote:EEPROM E0 - EE (17 bytes) is also printed on the white bar graph sticker on the A,B,C,D input sockets.


do you mean the plugs on the pcm where the loom plugs into ?

Posts: 318
Joined: Sun Mar 22, 2009 11:52 am
Location: Sydney

Re: VX/VY Flash PCM EEPROM Writing and Mapping

Postby kojab » Fri May 07, 2010 10:23 pm

Yes

User avatar
Posts: 195
Joined: Mon Mar 02, 2009 10:58 pm
Location: Melbourne Vic.

Re: VX/VY Flash PCM EEPROM Writing and Mapping

Postby Doctor Bob » Sat May 08, 2010 10:23 pm

email sent
i will try to get a log of a factory reflash.
they use a similar sequence to the LS1 as i understand, a bootloader routine needs to be put into it that carries out the erase & program.

User avatar
Posts: 4988
Joined: Sun Mar 01, 2009 2:54 pm
Location: Perth, WA

Re: VX/VY Flash PCM EEPROM Writing and Mapping

Postby VL400 » Sat May 08, 2010 11:42 pm

Thanks rob, will check it out tomorrow.

User avatar
Posts: 4988
Joined: Sun Mar 01, 2009 2:54 pm
Location: Perth, WA

Re: VX/VY Flash PCM EEPROM Writing and Mapping

Postby VL400 » Mon May 10, 2010 11:55 pm

The contents of my bench PCM's EEPROM is now this....

Code: Select all
00000000h: 31 37 32 38 44 54 43 46 32 31 30 33 30 35 39 FF ; 1728DTCF2103059ÿ
00000010h: F2 F2 F1 7E FF FF FF FF FF FF FF FF 76 FC 96 D7 ; òòñ~ÿÿÿÿÿÿÿÿvü–×
00000020h: 36 47 31 59 4B 38 32 41 32 33 4C 39 38 39 31 33 ; 6G1YK82A23L98913
00000030h: 30 FF FF FF FF FF FF FF FF FF FF 14 03 20 03 FF ; 0ÿÿÿÿÿÿÿÿÿÿ.. .ÿ
00000040h: FF 00 F8 3E DC 00 F8 3F B6 FF FF FF FF FF FF FF ; ÿ.ø>Ü.ø?¶ÿÿÿÿÿÿÿ
00000050h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ.
00000080h: 15 99 03 FF 08 2E 2E 28 7E 01 78 00 0B B0 00 03 ; .™.ÿ...(~.x..°..
00000090h: 42 02 FF 7A 79 00 FF 7D 00 7D 00 05 BC 00 05 06 ; B.ÿzy.ÿ}.}..¼...
000000a0h: 01 FF 1F 3A 73 DC 06 00 50 00 17 B0 00 00 00 00 ; .ÿ.:sÜ..P..°....
000000b0h: 00 00 00 00 00 00 00 00 00 00 00 00 04 B6 1C D0 ; .............¶.Ð
000000c0h: 04 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF ; ....ÿÿÿÿÿÿÿÿÿÿÿÿ
000000d0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000e0h: 48 45 4C 4C 4F 20 57 4F 52 4C 44 21 21 20 FF FF ; HELLO WORLD!! ÿÿ
000000f0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

User avatar
Posts: 195
Joined: Mon Mar 02, 2009 10:58 pm
Location: Melbourne Vic.

Re: VX/VY Flash PCM EEPROM Writing and Mapping

Postby Doctor Bob » Tue May 11, 2010 6:29 am

lol thats funny
glad its coming together
did you get that email?

User avatar
Posts: 4988
Joined: Sun Mar 01, 2009 2:54 pm
Location: Perth, WA

Re: VX/VY Flash PCM EEPROM Writing and Mapping

Postby VL400 » Tue May 11, 2010 9:11 am

Sure did, thanks Doc :thumbup:

Return to Holden ALDL ECUs

Who is online

Users browsing this forum: Google [Bot] and 5 guests