PCM Hammer - new ls1 flash tool

They go by many names, P01, P59, VPW, '0411 etc . Circa 1999 to 2006. All VPW OBD2 PCMs.
Posts: 12
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Postby gmtech825 » Tue May 12, 2020 11:18 pm

Thanks to everyone who has worked on this. I've been trying to learn even a slight amount of this stuff and it isn't easy. I was able to successfully read my 2005 p59 OS 12606961 with both MDI and MDI 2. I have a couple files, one with it programmed as a Holden and one as GMT800(using HP). I've been using ghidra to try and decipher and find how It enables lean cruise but I think the lack of cpu32 support is holding me back. I found where the platform type is stored and multiple references pointing to it but I'm not confident enough to make the changes.

Anyways, If I'm able to make the changes is it safe to write to the p59? I see it says full write isn't supported but does that include any OS changes. Any advice on verifying the Checksum afterwards would be a real help also.

Thanks everyone!

Site Admin
User avatar
Posts: 6186
Joined: Sat Feb 28, 2009 8:34 pm

Re: PCM Hammer - new ls1 flash tool

Postby antus » Wed May 13, 2020 9:16 am

The latest version can write P59 OS. You will need a way to update the OS checksum before you flash if you have patched the OS. Its also worth familiarising yourself with which pin to ground on the main pcb to force recovery mode incase your mods crash the OS and you get a boot loop.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

Posts: 12
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Postby gmtech825 » Thu May 14, 2020 12:50 am

antus wrote:The latest version can write P59 OS. You will need a way to update the OS checksum before you flash if you have patched the OS. Its also worth familiarising yourself with which pin to ground on the main pcb to force recovery mode incase your mods crash the OS and you get a boot loop.


Thanks, If I ever get this figured out I'll try it. If tunerpro shows the checksum numbers haven't changed after editing the .bin am I good to go?? I figured it out on a different OS just fine, but this OS seems to have a completely different strategy...Unless I'm missing it somewhere.
In case anyone's interested in what I'm looking at (DAT_0001f76d is where the platform is stored):

switchD_00033f6c::caseD_c XREF[2]: 00033f6c (j) , 000913a2 (*)
0008628e 42 38 a0 d8 clr.b (DAT_ffffa0d8 ).w
00086292 0c 39 00 cmpi.b #0x2 ,(DAT_0001f76d ).l = 07h
.............. 02 00 01
.............. f7 6d
0008629a 66 06 bne.b LAB_000862a2
0008629c 36 3c 14 00 move.w #0x1400 ,D3w
000862a0 60 04 bra.b LAB_000862a6

Posts: 181
Joined: Wed Dec 06, 2017 1:02 pm

Re: PCM Hammer - new ls1 flash tool

Postby Vampyre » Thu May 14, 2020 1:45 pm

how do i change the crc checks? i see they check differently for p01 and p59, so can i just add a new case for p04?

AVT: no message waiting.
[10:36:48:538] TX: 6C 10 F0 3D 02 00 40 00 00 00 00
[10:36:49:545] Waited 2seconds.. no data present
[10:36:49:548] AVT: no message waiting.
[10:36:49:673] Unable to get CRC for memory range 00000000 / 00004000
[10:36:49:676] Sending 'test device present' notification.
[10:36:49:682] TX: 8C FE F0 3F
[10:36:49:694] ##############################################################################
[10:36:49:698] There are errors in the data that was read from the PCM. Do not use this file.
[10:36:49:702] ##############################################################################
[10:36:49:707] Halting the kernel.
[10:36:49:762] TX: 6C 10 F0 20
[10:36:49:765] AVT setting VPW 1X
[10:36:49:769] TX: 6C 10 F0 20
[10:36:49:774] Clearing trouble codes.
[10:36:50:077] TX: 68 6A F0 04
[10:36:50:347] TX: 68 6A F0 04
[10:36:50:612] TX: 8C FE F0 14
[10:36:50:869] TX: 8C FE F0 14
[10:36:50:877] Halting the kernel.
[10:36:50:936] AVT setting VPW 4X
[10:36:50:945] TX: 6C 10 F0 20
[10:36:50:952] AVT setting VPW 1X
[10:36:50:959] TX: 6C 10 F0 20
[10:36:50:965] Clearing trouble codes.
[10:36:51:283] TX: 68 6A F0 04
[10:36:51:548] TX: 68 6A F0 04
[10:36:51:807] TX: 8C FE F0 14
[10:36:52:063] TX: 8C FE F0 14
[10:36:52:070] Elapsed time 00:05:16.0060745
[10:36:52:075] Saving contents to C:\Users\jay\Documents\calsand bins\p04test.bin

User avatar
Posts: 180
Joined: Tue Dec 17, 2019 3:27 am

Re: PCM Hammer - new ls1 flash tool

Postby joukoy » Thu May 14, 2020 2:43 pm

gmtech825 wrote:
antus wrote:The latest version can write P59 OS. You will need a way to update the OS checksum before you flash if you have patched the OS. Its also worth familiarising yourself with which pin to ground on the main pcb to force recovery mode incase your mods crash the OS and you get a boot loop.


Thanks, If I ever get this figured out I'll try it. If tunerpro shows the checksum numbers haven't changed after editing the .bin am I good to go?? I figured it out on a different OS just fine, but this OS seems to have a completely different strategy...Unless I'm missing it somewhere.
In case anyone's interested in what I'm looking at (DAT_0001f76d is where the platform is stored):

switchD_00033f6c::caseD_c XREF[2]: 00033f6c (j) , 000913a2 (*)
0008628e 42 38 a0 d8 clr.b (DAT_ffffa0d8 ).w
00086292 0c 39 00 cmpi.b #0x2 ,(DAT_0001f76d ).l = 07h
.............. 02 00 01
.............. f7 6d
0008629a 66 06 bne.b LAB_000862a2
0008629c 36 3c 14 00 move.w #0x1400 ,D3w
000862a0 60 04 bra.b LAB_000862a6


You can fix checksums with:
- PCMBinBuilder
- UniversalPatcher
- Tunerpro plugin
https://github.com/joukoy/

Posts: 12
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Postby gmtech825 » Thu May 14, 2020 11:40 pm

joukoy wrote:
gmtech825 wrote:
antus wrote:SNIP


You can fix checksums with:
- PCMBinBuilder
- UniversalPatcher
- Tunerpro plugin
https://github.com/joukoy/


hey that bin builder tool is really handy. Thanks :thumbup:

Posts: 12
Joined: Fri Feb 24, 2017 11:27 am

Re: PCM Hammer - new ls1 flash tool

Postby gmtech825 » Thu May 21, 2020 10:59 pm

Just wanted to give an update, I did the OS write after editing the bin OS successfully on the p59 using a Bosch MDI. Thank you guys. I'm willing to help out with any time consuming grunt work needed on this project if there is any. My abilities are limited obviously, but let me know. I also work for a GM dealer and have access to Tis if that helps in any way.

Posts: 3
Joined: Fri May 22, 2020 3:33 am

Re: PCM Hammer - new ls1 flash tool

Postby renat » Fri May 22, 2020 3:38 am

Hey everyone, just found the PCM Hammer soft on github today, I've ordered VXDIAG VCX straight away to check the soft out. I've got two LS cars and I'm a C# developer, hopefully I can be pretty useful here.

User avatar
Posts: 405
Joined: Fri Feb 02, 2018 3:13 pm

Re: PCM Hammer - new ls1 flash tool

Postby NSFW » Fri May 22, 2020 4:42 pm

renat wrote:Hey everyone, just found the PCM Hammer soft on github today, I've ordered VXDIAG VCX straight away to check the soft out. I've got two LS cars and I'm a C# developer, hopefully I can be pretty useful here.


Cool! The logger needs a ton of work, how much time do you have? :)

Here comes a brain-dump that I've been meaning to put into writing for a while...

Right now you have to edit XML files by hand to tell the logger which parameters to use, and that's not user-friendly at all. To fix that, I'd like to reduce the log profile files to just a list of parameter IDs and units, like:

<profile>
<parameter id="VehicleSpeed" units="mph" />
<parameter id="EngineSpeed" units="RPM" />
</profile>

Then we'd have separate XML files to keep track of how the parameters are really defined.
There would be one to describe the standard PIDs that every PCM supports:

<parameters>
<parameter id="VehicleSpeed" name="Vehicle Speed" pid="0xD" length="1">
<conversion units="mph" expression="x*0.61" />
<conversion units="kph" expression="x" />
</parameter>
</parameters>

And there would be one XML file per operating system, containing the "extended" parameters whose addresses need to be reverse-engineered for each operating system:

<parameters OS="12593358">
<parameter id="ThrottleFollowerAir" name="Throttle Follower Airflow" address="0xFF980A" length="2">
<conversion units="g/s" expression="x/1024" />
<conversion units="lb/min" expression="x/24" />
</parameter>
<parameter id="ThrottleCrackerAir" name="Throttle Cracker Airflow" address="0xFF97F0" length="2">
<conversion units="g/s" expression="x/1024" />
<conversion units="lb/min" expression="x/24" />
</parameter>
</parameters>

(Half of the numbers in the XML examples are totally made up.)

With these XML files to describe what parameters exist, the logger UI could give users a list of parameters to choose from. So users could click an "edit profile" button which would open a dialog box with a DataGridView table that has a column of checkboxes to add/remove parameters, and a column of parameter names, and a column of drop-lists to pick the preferred units.
Please don't PM me with questions about tuning or flashing - start a thread instead. Thanks!

User avatar
Posts: 405
Joined: Fri Feb 02, 2018 3:13 pm

Re: PCM Hammer - new ls1 flash tool

Postby NSFW » Fri May 22, 2020 4:51 pm

Also, the way the logger actually pulls data from the PCM is probably not optimal. Right now it sends one request for every row of data. At one point I had it sending a single request with parameter that told the PCM to send data continuously, but that didn't work very reliably. I still think it's probably the right approach to use (sending fewer requests = receiving more responses per second), but it's going to take some experimenting to get it working reliably.

And it might end up being necessary to use the current approach with ELM devices and a continuous-streaming approach with better devices (all of the non-ELM stuff).
Please don't PM me with questions about tuning or flashing - start a thread instead. Thanks!

PreviousNext

Return to GM LS1 512Kbyte and 1Mbyte

Who is online

Users browsing this forum: No registered users and 3 guests