E92 PCM Reverse Engineering

[Gatecrasher]

E92 is the other way. The flash kernel has a pointers in RAM to the flash erase and flash write branches. The bootloader jumps to those pointers when conditions are met for mode 36. But there doesn't seem to be any centralized way to call back from RAM into the bootloader for common things like CAN transactions. As usual, I wasn't thinking things all the way through.

[Tazzi]

One would assume the same ram address is being used in each operating system for the bootloader to use? Otherwise a different loader would be needed for each different OS.

[Gampy]

It would be nice if they made it that simple, I doubt it though.

-Enjoy

[turbo_v6]

So I’ve been diving into the FlexCAN module documentation and it’s been quite a lot.

It seems like there is a way to implement FIFO, but I’m not sure that’s necessary for what I’m doing right now.

I was able to transmit a message onto the bus using a function from the boot block. So really what I need to do is to duplicate what that function is doing into the kernel.

[antus]

Duplicate, or if you can identify the routine, and it can handle relocation, copy it to ram before any flash erase or write operations.

[turbo_v6]

After looking at it some more perhaps I've found a function that other kernels are calling, but it seems very specific and loaded with a lot of overhead.

I have looked at it before and thought it was interesting that it was at such an even address (0x9000), but didn't really think anything of it at the time. I could be wrong, but there is even a bunch of unused space before and after so that makes me thing it could be useful.

I still think it would be easier to write my own Rx/Tx functions, but it could be good info for others.

[In-Tech]

Hiya Everyone,
Everything you want to do is probably buried in the rom routines, and much faster than an external, nothing wrong with an external. Keep in mind it is possible to call a peripheral that can easily XOR with a simple byte value, or many things to confuse a disassembler if you cannot follow the code flow. That logic only takes a few tics from the code flow. I only mention this to help

[turbo_v6]

I believe I'm still dealing with issues from the Tactrix 2.0 device echoing Tx messages.

I just tried my VX Nano for the first time with CAN because it says it's capable, but I'm not able to log any of the chatter of the ECU like I can with the Tactrix.

I'd really hate to spend anymore money on yet another cable, but I'm not sure there is much support for developers using the Tactrix as the forum http://forums.openecu.org/ looks pretty much dead.

[turbo_v6]

Ok, might have been a user error on that last issue. Even though the echo messages are annoying that wasn't causing my issue. I had a mistake with the format of my UP script.

[kur4o]

bubba2533,

I can help you get rid of echoed messages but some debug log will be needed with gm mdi manager.
Typical install path of app
"Program Files\GM MDI Software\J2534 Configuration\J2534ConfigApp.exe"

With it we can see what exactly is assigned as flags to echoed messages and filter it on software level.