E67 e38 gm lan pid info

[04colyZQ8]

I’m well versed in vpw now but still learning gm lan.

I’m observing a tech 2 and what to see what pid changes for clutch depressed, but there are several ones under transmission.

Are they still called mode AE pid requests?

Any literature on these pids?

[Tazzi]

I’m well versed in vpw now but still learning gm lan.

I’m observing a tech 2 and what to see what pid changes for clutch depressed, but there are several ones under transmission.

Are they still called mode AE pid requests?

Any literature on these pids?

Live data is typically setup as DPIDs (Dynamic PIDs).

Basically theres some setup commands to tell the module which live data parameters to start broadcasting, and then the module will start spamming out the live data.

[gmtech825]

the DPID data the ecm broadcasts will be under the ID 0x5E8. the scan tool will request mode 0x2c to tell the ecm what pid to put in what buffer, and then I think mode 0xAA is the scan tool request to start the data broadcast. I can clarify more if it's needed. mode 0x22 is the request for the ecm to return the pid once, and the response ID will be 0x7E8

[04colyZQ8]

I’m well versed in vpw now but still learning gm lan.

I’m observing a tech 2 and what to see what pid changes for clutch depressed, but there are several ones under transmission.

Are they still called mode AE pid requests?


Thanks Tazzi I love your knowledge:)

Any literature on these pids?

Live data is typically setup as DPIDs (Dynamic PIDs).

Basically theres some setup commands to tell the module which live data parameters to start broadcasting, and then the module will start spamming out the live data.

[04colyZQ8]

the DPID data the ecm broadcasts will be under the ID 0x5E8. the scan tool will request mode 0x2c to tell the ecm what pid to put in what buffer, and then I think mode 0xAA is the scan tool request to start the data broadcast. I can clarify more if it's needed. mode 0x22 is the request for the ecm to return the pid once, and the response ID will be 0x7E8

Thanks! Yes please help some more!!

I see 5e8 21 pid1 pid2 pid3 pid4
5e8 22 pid5 pid6 pid7 pid8

But don’t user stand the reply with data load?

I’d expect to see something like
7e8 21 pid1 data load

But never see the requested pid on the responses.
I also see 30 00 00 between the pid requests

[Tazzi]

gmtech actually described it above pretty well for the ECUs actually!

It loads all the PIDs it wants into a DPID, and then sends off a AA to start spamming it out.

For reverse engineering, I actually use an OBDX Pro to simulate the 'ecu' responses to something like Tech2win, and then I change the live data values being spammed back to work out what each byte/bit corresponds to. Its a bit of a lengthy process, but, its the reverse engineering way.

[hjtrbo]

For reverse engineering, I actually use an OBDX Pro to simulate the 'ecu' responses to something like Tech2win, and then I change the live data values being spammed back to work out what each byte/bit corresponds to. Its a bit of a lengthy process, but, its the reverse engineering way.

Genius. Great idea.

[gmtech825]

2C FE XXXX Loads the FE DPID with the PID number xxxx
AA04FE tells the ecm to send DPID FE at a fast rate (04 is for fast rate)
ecu then starts sending 5E8 FE NN repeatedly Where NN is the pid data

you can pack multiple pids into a DPID by listing additional pids one after the after so 2C FE XXXX YYYY ZZZZ. 30 00 00 is just the flow control message from the ecu

Hope that helps!