PCM Hammer P12 development

[Cincinnatus]

Are the bins the same? Impressive work you two!

[Gampy]

Between the lifted chip version and the PCM Hammer version ??

If that's the thought that would be a good one, unfortunately the one pulled from the lifted chip was in a bad way, recoverable, but bad way, it had been damaged by a Tech2 flash attempt.
However for someone like me that wants to know the difference in the mode it was in .. Hell ya, Thank ya, that's gonna get done, what I'll learn who knows, something I'm sure, even if it's nothing!

[antus]

the pcm hammer read is definatly good, checksums are fine. comparing the two I can see two erased patches in the lifted chip read that were not re-written.

20000-40000
e8000-ffff0

they're all FF, no data when there should be data. the rest is ok.

[Gampy]

Holy flipping sticks ...

[07:08:17:411] Found response, Success
[07:08:17:411] Kernel upload 100% complete.
[07:08:17:413] Kernel uploaded to PCM succesfully...
[07:08:17:416] Sending 'test device present' notification.
[07:08:17:416] TX: 8C FE F0 3F
[07:08:42:321] TX: 6C 10 F0 3D 00
[07:08:42:321] RX: 6C F0 10 7D 00 82 40 AA BB
[07:08:42:322] Kernel Version: 8240AABB
[07:08:45:086] TX: 6C 10 F0 3D 01
[07:08:45:087] RX: 6C F0 10 7D 01 00 01 22 81
[07:08:45:087] ChipID: 00012281

One last hurdle before trying to write ... That damn sector layout map!

[kur4o]

From gm flash routine
1mb chip

Code: Select all

00 00 00 00
00 00 40 00 
00 00 60 00 
00 00 80 00 
00 02 00 00 
00 04 00 00 
00 06 00 00 
00 08 00 00 
00 0C 00 00

2mb chip

Code: Select all

RAM:FFFF2318                 dc.l 0                                              
RAM:FFFF231C                 dc.l $4000
RAM:FFFF2320                 dc.l $6000
RAM:FFFF2324                 dc.l $8000
RAM:FFFF2328                 dc.l $40000
RAM:FFFF232C                 dc.l $80000
RAM:FFFF2330                 dc.l $C0000
RAM:FFFF2334                 dc.l $100000
RAM:FFFF2338                 dc.l $140000
RAM:FFFF233C                 dc.l $180000
RAM:FFFF2340                 dc.l $1C0000

I would check chip manual too, to make sure.

[kur4o]

I found another gm flash routine that uses 2281 chipid, and the given segments in the previous post matched exactly. Takes this as a confirmation for 1mb segments.

[Gampy]

Welp, it's taken all night (it's 07:56), 4 edits, 3 deleted posts (7 versions) later, but I think I finally have the Sector Layout.
Sure be nice if someone at least called me a <bleeping> idiot if it's wrong!
I don't want to create a paper weight out of a volunteers PCM ... I don't have the hardware to test on.

PLEASE protect the volunteer!

Code: Select all

                // AM29BL802C
                case 0x00012281:
                    size = 1024 * 1024;
                    description = "AMD AM29BL802C, 1mb";
                    memoryRanges = new MemoryRange[]
                    {          // Start Address, Size, Type
                        new MemoryRange(0xC0000, 0x40000, BlockType.OperatingSystem), // 256kb main block        (128 * 1024 = 131072 * 2 = 262144 (0x40000)) (128Kwords)
                        new MemoryRange(0x80000, 0x40000, BlockType.OperatingSystem), // 256kb main block        (128 * 1024 = 131072 * 2 = 262144 (0x40000)) (128Kwords)
                        new MemoryRange(0x60000, 0x20000, BlockType.OperatingSystem), // 128kb main block         (64 * 1024 =  65536 * 2 = 131072 (0x20000)) (64Kwords)
                        new MemoryRange(0x40000, 0x20000, BlockType.OperatingSystem), // 128kb main block         (64 * 1024 =  65536 * 2 = 131072 (0x20000)) (64Kwords)
                        new MemoryRange(0x20000, 0x20000, BlockType.Calibration),     // 128kb calibration block  (64 * 1024 =  65536 * 2 = 131072 (0x20000)) (64Kwords)
                        new MemoryRange(0x08000, 0x18000, BlockType.Calibration),     //  96kb calibration block  (48 * 1024 =  49152 * 2 =  98304 (0x18000)) (48Kwords)
                        new MemoryRange(0x06000, 0x02000, BlockType.Parameter),       //  8kb parameter block      (4 * 1024 =   4096 * 2 =   8192 (0x02000)) (4Kwords)
                        new MemoryRange(0x04000, 0x02000, BlockType.Parameter),       //  8kb parameter block      (4 * 1024 =   4096 * 2 =   8192 (0x02000)) (4Kwords)
                        new MemoryRange(0x00000, 0x04000, BlockType.Boot),            //  16kb boot block          (8 * 1024 =   8192 * 2 =  16384 (0x04000)) (8Kwords)
                    };
                    break;

Next step is test write!

We do need a checksum valid Calibration change bin to test write with ... Any volunteers to create such a piece ??

[kur4o]

Extract to xml folder and you can fix it yourself. Make sure you have the latest autodetect.xml too

[Gampy]

That's a double good ... Thank ya sir!

[turbo_v6]

Guys, as you remember from earlier in the thread, I was able to get the flash chip out of the original and pull the data from it. I am not sure how much of it is good, as I was attempting to program it with a Tech2 and listen in and log using my J2534 and a logger and for some reason the flash failed. However I was able to find a bin file from a 2006 Trailblazer which is literally the same truck, different sub-brand as the flash that failed from a 2006 Envoy. I am going to upload it, and as far as I can tell it is a good read using some other professional tuner. I am sure if there is anything wrong with it you will probably be able to tell. However if good, which it should be, you should be able to figure out anything needed using it.

Opening this file in a commercial program shows that the OS and Engine Calibration Checksums are incorrect.

I've started disassembling this file, but it's very different from my experience with P01/P59 code. I'll start a thread about the disassembly to see what we can discover.