PCM Hammer P12 development

[Gampy]

I have repeatedly and it has been ignored ...

No challenges that I know of.

[NSFW]

Is FFA000 - FFE000 the usable RAM range for both P10 and P12?

[kur4o]

Is FFA000 - FFE000 the usable RAM range for both P10 and P12?

p10 only

p12 usable ram is ffff0000-ffff7fff

[antus]

Ive implemented RAMSize but linked to the above comment, as I dont have hardware to test if we can upload to the entire range on P10. Im also pretty sure since P12 doesnt have the execute bit uploading to FF2000 is magic for the code to be executed but I have not verified this. So ive provided what we need but it can be revisited in the future if the kernel keeps growing for some reason. https://github.com/LegacyNsfw/PcmHacks/ ... 3514ca2dcd

[antus]

We now have P10 Checksum and file signature validation working.

And also protection against cross flashing in a file with good structure and signature, in to a PCM that cant run it.

P12 structure looks more like an E38 so that will be more work to bring the P12 code up to the same level. But I have an E38 sum tool viewtopic.php?f=26&t=3833 so might be able to reuse some of the code after some more P12 analysis.

[Gampy]

Hmm ...

Interesting.png (39.4 KiB) Viewed 2442 times

Yup, short by a comment commit.

RepoLevel.png (8.72 KiB) Viewed 2442 times

[antus]

Checksums now appear to be working for P12. I'll send a test build to those in this thread who have a P12, but I think we might have it!

Code: Select all

[10:22:48:554]  PCM Hammer (11/04/2022, 10:22 PM)
[10:22:48:677]  AVT 852 Reset OK
[10:22:48:704]  AVT Firmware 1.5
[10:22:48:875]  Thanks for using PCM Hammer.
[10:23:00:390]  You have made a wise choice. Try a full read first.
[10:23:09:629]  Will save to C:\Users\a\Downloads\test.bin
[10:23:10:955]  Querying operating system of current PCM.
[10:23:11:083]  OSID: 12606400
[10:23:11:278]  Unlock succeeded.
[10:23:11:365]  Attempting switch to VPW 4x
[10:23:11:402]  Module 0x10 (engine controller) has agreed to enter high-speed mode.
[10:23:15:467]  Kernel upload 49% complete.
[10:23:16:368]  Kernel upload 100% complete.
[10:23:17:491]  Kernel Version: 0103040C
[10:23:17:493]  kernel uploaded to PCM succesfully. Requesting data...
[10:23:17:566]  Flash chip: AMD AM29BL802C, 1mb
[10:27:14:400]  Read complete.
[10:27:14:403]  All read-request messages succeeded on the first try. You have an excellent connection to the PCM.
[10:27:14:405]  We're not sure how much retrying is normal for a read operation on a 1024kb PCM.
[10:27:14:407]  Please help by sharing your results in the PCM Hammer thread at pcmhacking.net.
[10:27:14:410]  Starting verification...
[10:27:14:421]  Calculating CRCs from file.
[10:27:14:430]  Initializing CRC algorithm on PCM, this will take a minute...
[10:27:14:522]  Requesting CRCs from PCM.
[10:27:14:528]  	Range		File CRC		PCM CRC	Verdict	Purpose
[10:27:18:530]  0C0000-0FFFFF	8539A189	8539A189	Same	OperatingSystem
[10:27:22:508]  080000-0BFFFF	825B437C	825B437C	Same	OperatingSystem
[10:27:24:589]  060000-07FFFF	15D1575A	15D1575A	Same	OperatingSystem
[10:27:26:621]  040000-05FFFF	A2DFACB0	A2DFACB0	Same	OperatingSystem
[10:27:28:743]  020000-03FFFF	C80F2468	C80F2468	Same	Calibration
[10:27:30:361]  008000-01FFFF	BD4C3D8E	BD4C3D8E	Same	Calibration
[10:27:30:650]  006000-007FFF	C08B1F1F	C08B1F1F	Same	Parameter
[10:27:30:930]  004000-005FFF	85B5BB36	85B5BB36	Same	Parameter
[10:27:31:344]  000000-003FFF	7EBCD52C	7EBCD52C	Same	Boot
[10:27:31:422]  The contents of the file match the contents of the PCM.
[10:27:31:513]  Clearing trouble codes.
[10:27:32:713]  Clearing trouble codes.
[10:27:33:839]  Elapsed time 00:04:22.5573735
[10:27:33:859]  Saving contents to C:\Users\a\Downloads\test.bin
[10:30:58:654]  C:\Users\a\Downloads\2006_Colorado_3.5L(I5)L52_Os12606375.bin
[10:30:58:675]  Validating 1024k file.
[10:30:58:686]  	Start	End	Stored	Needed	Verdict	Segment Name
[10:30:58:698]  	00000	03FFF	15DD	15DD	Good	Boot Block
[10:30:58:710]  	08002	FFFFF	B295	B295	Good	OS
[10:30:58:721]  	20532	3245F	8829	8829	Good	Engine Calibration
[10:30:58:733]  	32462	3748F	990E	990E	Good	Engine Diagnostics
[10:30:58:747]  	37492	3F4BF	20EE	20EE	Good	Transmission Calibration
[10:30:58:761]  	3F4C2	3FFFB	5649	5649	Good	Transmission Diagnostics
[10:30:58:775]  	20002	200FF	5DD2	5DD2	Good	Speedometer
[10:30:58:788]  	20102	2052F	13F5	13F5	Good	System
[10:30:58:803]  Requesting operating system ID...
[10:30:58:921]  PCM and file are both for the same Hardware P12
[10:30:58:934]  Operating system IDs do not match.
[10:30:58:947]  PCM operating system ID: 12606400
[10:30:58:962]  File operating system ID: 12606375
[10:30:58:975]  Changing PCM to operating system 12606375
[10:30:59:166]  Unlock succeeded.
[10:30:59:244]  Attempting switch to VPW 4x
[10:30:59:301]  Module 0x10 (engine controller) has agreed to enter high-speed mode.
[10:31:03:370]  Kernel upload 49% complete.
[10:31:04:282]  Kernel upload 100% complete.
[10:31:05:416]  Kernel Version: 0103040C
[10:31:05:428]  Kernel uploaded to PCM succesfully.
[10:31:05:508]  Changing PCM to operating system 12606375
[10:31:05:582]  Flash chip: AMD AM29BL802C, 1mb
[10:31:05:593]  Calculating CRCs from file.
[10:31:05:609]  Initializing CRC algorithm on PCM, this will take a minute...
[10:31:05:714]  Requesting CRCs from PCM.
[10:31:05:723]  	Range		File CRC		PCM CRC	Verdict	Purpose
[10:31:09:638]  0C0000-0FFFFF	9E9AA4FE	8539A189	Different	OperatingSystem
[10:31:13:590]  080000-0BFFFF	DC4C00BC	825B437C	Different	OperatingSystem
[10:31:15:661]  060000-07FFFF	75F3CEFF	15D1575A	Different	OperatingSystem
[10:31:17:811]  040000-05FFFF	E0E2649D	A2DFACB0	Different	OperatingSystem
[10:31:19:901]  020000-03FFFF	1D5E36DC	C80F2468	Different	Calibration
[10:31:21:516]  008000-01FFFF	9F5568C7	BD4C3D8E	Different	Calibration
[10:31:21:827]  006000-007FFF	192F3CB1	C08B1F1F	Different	Parameter
[10:31:22:133]  004000-005FFF	85B5BB36	85B5BB36	Same	Parameter
[10:31:22:538]  000000-003FFF	7EBCD52C	7EBCD52C	Same	Boot
[10:31:22:568]  Processing range 0C0000-0FFFFF
[10:31:22:584]  Erasing.
[10:31:26:910]  Writing...
[10:32:48:413]  Retry count for this block: 2
[10:32:48:423]  Processing range 080000-0BFFFF
[10:32:48:433]  Erasing.
[10:32:52:684]  Writing...
[10:34:14:373]  Retry count for this block: 2
[10:34:14:381]  Processing range 060000-07FFFF
[10:34:14:390]  Erasing.
[10:34:17:766]  Writing...
[10:34:59:704]  Retry count for this block: 1
[10:34:59:712]  Processing range 040000-05FFFF
[10:34:59:722]  Erasing.
[10:35:03:015]  Writing...
[10:35:44:786]  Retry count for this block: 1
[10:35:44:794]  Processing range 020000-03FFFF
[10:35:44:803]  Erasing.
[10:35:47:822]  Writing...
[10:36:26:314]  Processing range 008000-01FFFF
[10:36:26:322]  Erasing.
[10:36:29:442]  Writing...
[10:37:01:627]  Retry count for this block: 1
[10:37:01:656]  Processing range 006000-007FFF
[10:37:01:670]  Erasing.
[10:37:02:179]  Writing...
[10:37:04:561]  Calculating CRCs from file.
[10:37:04:575]  Initializing CRC algorithm on PCM, this will take a minute...
[10:37:04:669]  Requesting CRCs from PCM.
[10:37:04:675]  	Range		File CRC		PCM CRC	Verdict	Purpose
[10:37:08:620]  0C0000-0FFFFF	9E9AA4FE	9E9AA4FE	Same	OperatingSystem
[10:37:12:652]  080000-0BFFFF	DC4C00BC	DC4C00BC	Same	OperatingSystem
[10:37:14:685]  060000-07FFFF	75F3CEFF	75F3CEFF	Same	OperatingSystem
[10:37:16:726]  040000-05FFFF	E0E2649D	E0E2649D	Same	OperatingSystem
[10:37:18:811]  020000-03FFFF	1D5E36DC	1D5E36DC	Same	Calibration
[10:37:20:451]  008000-01FFFF	9F5568C7	9F5568C7	Same	Calibration
[10:37:20:735]  006000-007FFF	192F3CB1	192F3CB1	Same	Parameter
[10:37:21:036]  004000-005FFF	85B5BB36	85B5BB36	Same	Parameter
[10:37:21:425]  000000-003FFF	7EBCD52C	7EBCD52C	Same	Boot
[10:37:21:504]  All relevant ranges are identical.
[10:37:21:512]  Write-request messages had to be re-sent 7 times.
[10:37:21:519]  We're not sure how much retrying is normal for a write operation on a 1024kb PCM.
[10:37:21:534]  Please help by sharing your results in the PCM Hammer thread at pcmhacking.net.
[10:37:21:553]  Flash successful!
[10:37:21:639]  Clearing trouble codes.
[10:37:22:753]  Elapsed time 00:06:23.5741899

[Gampy]

PcmHammer_P12_userLog_20220411@120712.txt

(9.03 KiB) Downloaded 136 times

PcmHammer_P12_debugLog_20220411@120723.txt

(6.45 MiB) Downloaded 132 times

Edit;
BTW, I also pulled the battery (not ignition) after the completion of an OS change, took a nap, woke up, did a Verify entire PCM, it was perfect, did a Read entire PCM, it was a perfect match to the written bin.

[kur4o]

It has been known there is 2mb version of p12, but nobody seen it so far.

Here it is.

Unsupported flash chip ID 00012203

I hope adding support will be not that hard.

[Gampy]

Code: Select all

                // AM29BL162C
                case 0x00012203:
                    size = 2048 * 1024;
                    description = "AMD AM29BL162CB, 2mb";
                    memoryRanges = new MemoryRange[]
                    {           // Start address, Size in Bytes
                        new MemoryRange(0x1C0000, 0x40000, BlockType.OperatingSystem), // 256kb main block        (128Kwords) (128 * 1024 = 131072 * 2 = 262144 (0x40000))
                        new MemoryRange(0x180000, 0x40000, BlockType.OperatingSystem), // 256kb main block        (128Kwords) (128 * 1024 = 131072 * 2 = 262144 (0x40000))
                        new MemoryRange(0x140000, 0x40000, BlockType.OperatingSystem), // 256kb main block        (128Kwords) (128 * 1024 = 131072 * 2 = 262144 (0x40000))
                        new MemoryRange(0x100000, 0x40000, BlockType.OperatingSystem), // 256kb main block        (128Kwords) (128 * 1024 = 131072 * 2 = 262144 (0x40000))
                        new MemoryRange( 0xC0000, 0x40000, BlockType.OperatingSystem), // 256kb main block        (128Kwords) (128 * 1024 = 131072 * 2 = 262144 (0x40000))
                        new MemoryRange( 0x80000, 0x40000, BlockType.OperatingSystem), // 256kb main block        (128Kwords) (128 * 1024 = 131072 * 2 = 262144 (0x40000))
                        new MemoryRange( 0x40000, 0x40000, BlockType.OperatingSystem), // 256kb main block        (128Kwords) (128 * 1024 = 131072 * 2 = 262144 (0x40000))
                        new MemoryRange( 0x08000, 0x38000, BlockType.Calibration),     // 229kb Calibration block (112Kwords) (112 * 1024 = 114688 * 2 = 229376 (0x38000))
                        new MemoryRange( 0x06000, 0x02000, BlockType.Parameter),       //   8kb parameter block     (4Kwords)   (4 * 1024 =   4096 * 2 =   8192 (0x02000))
                        new MemoryRange( 0x04000, 0x02000, BlockType.Parameter),       //   8kb parameter block     (4Kwords)   (4 * 1024 =   4096 * 2 =   8192 (0x02000))
                        new MemoryRange( 0x00000, 0x04000, BlockType.Boot),            //  16kb boot block          (8Kwords)   (8 * 1024 =   8192 * 2 =  16384 (0x04000)) 
                    };
                    break;

In operation it appears to be the same as the 1m ID:00012281, also needs to be added to the P12 kernel.