E67 to T87/T87A TCM interface needed

[Tre-Cool]

I've got 8777 if you need it.

got that 1 from u already. I've got the main 8762,8772 ones now.

the place we got our last ones from no longer do a pdf download, but i got another site, which to be honest looks like it's just some1 charging for them but not an actual authorized place.

[hjtrbo]

Not ideal. Would you be able to shoot over the other 2? If you need a hand to spread the load $ for the other standards you need I'm happy to buy a couple.

[kur4o]

For anyone wondering how Cal data is defined per node, there is a table in OS that defines it, similar to DTC list logic.
second dword per node defines???length ??size and some other ??data.

Code: Select all

M:000755C8 TX_table_dword_755C8:.long 0xC9         # DATA XREF: TX1_main_sub_74334+104o
ROM:000755C8                                         # TX1_main_sub_74334+10Co ...
ROM:000755CC                 .long 0x7000100
ROM:000755D0                 .long 0xF1
ROM:000755D4                 .long 0x1000100
ROM:000755D8                 .long 0xF9
ROM:000755DC                 .long 0x8000100
ROM:000755E0                 .long 0x110
ROM:000755E4                 .long 0x8000100
ROM:000755E8                 .long 0x120
ROM:000755EC                 .long 0x8000100
ROM:000755F0                 .long 0x124
ROM:000755F4                 .long 0x5000100
ROM:000755F8                 .long 0x128
ROM:000755FC                 .long 0x3000100
ROM:00075600                 .long 0x131
ROM:00075604                 .long 0x8000100
ROM:00075608                 .long 0x140
ROM:0007560C                 .long 0x8000100
ROM:00075610                 .long 0x170
ROM:00075614                 .long 0x3000100
ROM:00075618                 .long 0x191
ROM:0007561C                 .long 0x8000100
ROM:00075620                 .long 0x1A1
ROM:00075624                 .long 0x3000100
ROM:00075628                 .long 0x1C1
ROM:0007562C                 .long 0x4000100
ROM:00075630                 .long 0x1C3
ROM:00075634                 .long 0x4000100
ROM:00075638                 .long 0x1E9
ROM:0007563C                 .long 0x8000100
ROM:00075640                 .long 0x1ED
ROM:00075644                 .long 0x8000100
ROM:00075648                 .long 0x1F1
ROM:0007564C                 .long 0x8000100
ROM:00075650                 .long 0x1F5
ROM:00075654                 .long 0x6000100
ROM:00075658                 .long 0x280
ROM:0007565C                 .long 0x8000100
ROM:00075660                 .long 0x285
ROM:00075664                 .long 0x1000100
ROM:00075668                 .long 0x289
ROM:0007566C                 .long 0x1000100
ROM:00075670                 .long 0x2C3
ROM:00075674                 .long 0x6000100
ROM:00075678                 .long 0x2C5
ROM:0007567C                 .long 0x6000100
ROM:00075680                 .long 0x2D1
ROM:00075684                 .long 0x5000100
ROM:00075688                 .long 0x2F0
ROM:0007568C                 .long 0x5000100
ROM:00075690                 .long 0x300
ROM:00075694                 .long 0x8000100
ROM:00075698                 .long 0x308
ROM:0007569C                 .long 0x8000100
ROM:000756A0                 .long 0x320
ROM:000756A4                 .long 0x8000100
ROM:000756A8                 .long 0x348
ROM:000756AC                 .long 0x7000100
ROM:000756B0                 .long 0x380
ROM:000756B4                 .long 0x8000100
ROM:000756B8                 .long 0x3C1
ROM:000756BC                 .long 0x8000100
ROM:000756C0                 .long 0x3D1
ROM:000756C4                 .long 0x8000100
ROM:000756C8                 .long 0x3E9
ROM:000756CC                 .long 0x8000100
ROM:000756D0                 .long 0x3F9
ROM:000756D4                 .long 0x8000100
ROM:000756D8                 .long 0x3FB
ROM:000756DC                 .long 0x2000100
ROM:000756E0                 .long 0x410
ROM:000756E4                 .long 0x8000100
ROM:000756E8                 .long 0x480
ROM:000756EC                 .long 0x8000100
ROM:000756F0                 .long 0x490
ROM:000756F4                 .long 0x8000100
ROM:000756F8                 .long 0x4C1
ROM:000756FC                 .long 0x5000100
ROM:00075700                 .long 0x4C9
ROM:00075704                 .long 0x4000100
ROM:00075708                 .long 0x4D1
ROM:0007570C                 .long 0x8000100
ROM:00075710                 .long 0x4E1
ROM:00075714                 .long 0x8000100
ROM:00075718                 .long 0x4E9
ROM:0007571C                 .long 0x2000100
ROM:00075720                 .long 0x4F1
ROM:00075724                 .long 0x6000100
ROM:00075728                 .long 0x510
ROM:0007572C                 .long 0x8000100
ROM:00075730                 .long 0x520
ROM:00075734                 .long 0x6000100
ROM:00075738                 .long 0x772
ROM:0007573C                 .long 0x7000100
ROM:00075740 RX_table_dword_75740:.long 0xC1         # DATA XREF: RX1_main_sub_7357C+78o
ROM:00075740                                         # RX1_main_sub_7357C+7Co ...
ROM:00075744                 .long 0x8000000
ROM:00075748                 .long 0xC5
ROM:0007574C                 .long 0x8000000
ROM:00075750                 .long 0xF1
ROM:00075754                 .long 0x1000000
ROM:00075758                 .long 0xF9
ROM:0007575C                 .long 0x8000000
ROM:00075760                 .long 0x128
ROM:00075764                 .long 0x3000000
ROM:00075768                 .long 0x130
ROM:0007576C                 .long 0x6000000
ROM:00075770                 .long 0x131
ROM:00075774                 .long 0x8000000
ROM:00075778                 .long 0x140
ROM:0007577C                 .long 0x8000000
ROM:00075780                 .long 0x144
ROM:00075784                 .long 0x1000000
ROM:00075788                 .long 0x150
ROM:0007578C                 .long 0x8000000
ROM:00075790                 .long 0x151
ROM:00075794                 .long 0x8000000
ROM:00075798                 .long 0x199
ROM:0007579C                 .long 0x8000000
ROM:000757A0                 .long 0x19D
ROM:000757A4                 .long 0x8000000
ROM:000757A8                 .long 0x1C7
ROM:000757AC                 .long 0x7000000
ROM:000757B0                 .long 0x1C9
ROM:000757B4                 .long 0x7000000
ROM:000757B8                 .long 0x1CB
ROM:000757BC                 .long 0x3000000
ROM:000757C0                 .long 0x1E1
ROM:000757C4                 .long 0x3000000
ROM:000757C8                 .long 0x1E9
ROM:000757CC                 .long 0x8000000
ROM:000757D0                 .long 0x1EB
ROM:000757D4                 .long 0x2000000
ROM:000757D8                 .long 0x1F1
ROM:000757DC                 .long 0x8000000
ROM:000757E0                 .long 0x1F5
ROM:000757E4                 .long 0x6000000
ROM:000757E8                 .long 0x1F9
ROM:000757EC                 .long 0x6000000
ROM:000757F0                 .long 0x280
ROM:000757F4                 .long 0x8000000
ROM:000757F8                 .long 0x299
ROM:000757FC                 .long 0x2000000
ROM:00075800                 .long 0x2C9
ROM:00075804                 .long 0x5000000
ROM:00075808                 .long 0x2D1
ROM:0007580C                 .long 0x5000000
ROM:00075810                 .long 0x2E0
ROM:00075814                 .long 0x6000000
ROM:00075818                 .long 0x2F0
ROM:0007581C                 .long 0x5000000
ROM:00075820                 .long 0x2F9
ROM:00075824                 .long 0x5000000
ROM:00075828                 .long 0x320
ROM:0007582C                 .long 0x8000000
ROM:00075830                 .long 0x380
ROM:00075834                 .long 0x8000000
ROM:00075838                 .long 0x3C9
ROM:0007583C                 .long 0x8000000
ROM:00075840                 .long 0x3F1
ROM:00075844                 .long 0x4000000
ROM:00075848                 .long 0x3FD
ROM:0007584C                 .long 0x3000000
ROM:00075850                 .long 0x420
ROM:00075854                 .long 0x1000000
ROM:00075858                 .long 0x488
ROM:0007585C                 .long 0x8000000
ROM:00075860                 .long 0x4C9
ROM:00075864                 .long 0x4000000
ROM:00075868                 .long 0x4D9
ROM:0007586C                 .long 0x3000000
ROM:00075870                 .long 0x4E1
ROM:00075874                 .long 0x8000000
ROM:00075878                 .long 0x4E9
ROM:0007587C                 .long 0x2000000
ROM:00075880                 .long 0x520
ROM:00075884                 .long 0x6000000

There are also 4 tables 2 for TX and 2 for RX that defines subroutine addresses for execution per node. It reads or saves data before send/receive.

If a good detailed a2l is present, each node can be traced per byte/bit meaning.

[kidturbo]

Nice find on that "easy viewing" CAN msg table.. Checked some notes, and believe you are also correct on that second dword data. First byte looks to match common message lengths, and the "1" signifies it's a TX message maybe?

I've yet trace any ID's or messages bytes data down to bit level for any ECM/TCM files yet. But if you think ya have that part mapped, I have the ID's, positions, and scaling to compare from the CANbus side.

Here is a CAN capture from a common E38 msg to see if any of these fields trace back in your bins.

ID: 0x4D1 Std Bus: 1 Len: 8
Data Bytes: 0x00 0x00 0x00 0x82 0x12 0x8B 0x00 0x7D
EngShtdwnAct: false
EngShtdwnPndgIO: false
FuelFltChgNwIO: false
PTExPrtclFltrWrn2IO: false
PTHiElecLdReqd: false
PTExPrtclFltrWrnIO: false
AirCndOffIO: false
DslGlwPlgIO: false
StgDisIO: false
RdcdPwrIO: true
FuelTotCap: 66.25liters
FlLvlPctV: Valid
FlLvlPct: 54.5098%
EngWtrInFlIO: false
EngOilTmpV: Valid
EngOilTmp: -40deg C
EngOilPrsV: Valid
EngOilPrsLwIO: false
EngOilPrs: 0kPa
EngOilLvlLwIO: false
EngOilChngIO: false
EngHt_StpEngIO: false
EngHotFuelEnrchmntIO: false
CkFlFilrCapIO: false

[Tre-Cool]

For anyone wondering how Cal data is defined per node, there is a table in OS that defines it, similar to DTC list logic.
second dword per node defines???length ??size and some other ??data.


There are also 4 tables 2 for TX and 2 for RX that defines subroutine addresses for execution per node. It reads or saves data before send/receive.

If a good detailed a2l is present, each node can be traced per byte/bit meaning.

Hey Kurbo, you able to further explain on where to find that in Ghidra for a retard like me. lol

There is definetly a different amount of tx/rx between the oses im currently working on. 12639270 specfically.

ignore this request, found it.

Champion

[kidturbo]

Bump these off that list.

0x0F9 Trans_General_Status_1
0x199 Trans_Torque_Request_HS
0x1F5 Trans_General_Status_2
0x4C9 Trans_General_Status_3

Have any good CANbus captures off a Holden car?

no can captures directly, obv i have tons of efilive logging.

I do have a can capture device i can use that i put onto my hub dyno as the can interface, i used that to capture comms to decipher the haltec wideband protocol.

Downside to me using a simple 1 line to show all the parameters, I can't add text to each field to further explain what's on the broadcast address, which from looking at the gm doc's they can have multiple things.

gm8782.PNG

before i purchase a bunch of other pdf's does anyone have a copy of the GMW8763-8781 doc's?

Your CAN tool should probably work fine with HS GMLAN. Just set the bus speed to 500K and jack into CAN HI/LO pins at the DLC. I'd just like to see an ID list from some Holden hardware for comparison.

As for those GM files, I don't believe I have that one. Found a bunch of other useful stuff on Scribed when I was looking for schematic of the Bosch FICM the early Duramax uses. And have that huge dump of totally unsearchable Bosch ECM schematics, but not even that had anything on the GM EDU module details.

But for the CANbus msg details, that one I have ya covered..

[kur4o]

If I counted correctly this is where bytes are stored from that message,
r31 is the offset they get stored in numerical order.

Now tracing down to individual bits will take some time, due to ppc crap code.

Here is how bits are copied for first byte , r4 is the bit position, some bits might get inversed

Code: Select all

M:000A5808 sub_A5808:                              # CODE XREF: sub_A5930+18p
ROM:000A5808                 lis       r11, VeEODI_b_EngOilSensedVld@h
ROM:000A580C                 lbz       r11, VeEODI_b_EngOilSensedVld@l(r11)
ROM:000A5810                 li        r4, 0
ROM:000A5814                 cmpwi     r11, 0
ROM:000A5818                 bne       loc_A5820
ROM:000A581C                 li        r4, 0x80 # 'Ç'
ROM:000A5820
ROM:000A5820 loc_A5820:                              # CODE XREF: sub_A5808+10j
ROM:000A5820                 lis       r12, VeEOPI_b_ValidEngOil@h
ROM:000A5824                 lbz       r12, VeEOPI_b_ValidEngOil@l(r12)
ROM:000A5828                 cmpwi     r12, 0
ROM:000A582C                 bne       loc_A5834
ROM:000A5830                 ori       r4, r4, 0x40
ROM:000A5834
ROM:000A5834 loc_A5834:                              # CODE XREF: sub_A5808+24j
ROM:000A5834                 lis       r12, VeEOPC_b_EngOilPresLoWarnLmp@h
ROM:000A5838                 lbz       r12, VeEOPC_b_EngOilPresLoWarnLmp@l(r12)
ROM:000A583C                 cmpwi     r12, 0
ROM:000A5840                 beq       loc_A5848
ROM:000A5844                 ori       r4, r4, 0x20
ROM:000A5848
ROM:000A5848 loc_A5848:                              # CODE XREF: sub_A5808+38j
ROM:000A5848                 lis       r12, VeEODC_b_EngOilLvlLoLmp@h
ROM:000A584C                 lbz       r12, VeEODC_b_EngOilLvlLoLmp@l(r12)
ROM:000A5850                 cmpwi     r12, 0
ROM:000A5854                 beq       loc_A585C
ROM:000A5858                 ori       r4, r4, 0x10
ROM:000A585C
ROM:000A585C loc_A585C:                              # CODE XREF: sub_A5808+4Cj
ROM:000A585C                 lis       r12, VeEODC_b_OilChangeIndOn@h
ROM:000A5860                 lbz       r12, VeEODC_b_OilChangeIndOn@l(r12)
ROM:000A5864                 cmpwi     r12, 0
ROM:000A5868                 beq       loc_A5870
ROM:000A586C                 ori       r4, r4, 8
ROM:000A5870
ROM:000A5870 loc_A5870:                              # CODE XREF: sub_A5808+60j
ROM:000A5870                 lis       r12, VeFEQR_HotCoolantMode@h
ROM:000A5874                 lbz       r12, VeFEQR_HotCoolantMode@l(r12)
ROM:000A5878                 cmpwi     r12, 0
ROM:000A587C                 beq       loc_A5884
ROM:000A5880                 ori       r4, r4, 4
ROM:000A5884
ROM:000A5884 loc_A5884:                              # CODE XREF: sub_A5808+74j
ROM:000A5884                 lis       r12, ((VeECTI_b_EngHotStopEng+0x10000)@h)
ROM:000A5888                 lbz       r12, VeECTI_b_EngHotStopEng@l(r12)
ROM:000A588C                 cmpwi     r12, 0
ROM:000A5890                 beq       loc_A5898
ROM:000A5894                 ori       r4, r4, 2
ROM:000A5898
ROM:000A5898 loc_A5898:                              # CODE XREF: sub_A5808+88j
ROM:000A5898                 lis       r12, VeFANC_b_AC_OffRequest@h
ROM:000A589C                 lbz       r12, VeFANC_b_AC_OffRequest@l(r12)
ROM:000A58A0                 cmpwi     r12, 0
ROM:000A58A4                 beq       loc_A58AC
ROM:000A58A8                 ori       r4, r4, 1
ROM:000A58AC
ROM:000A58AC loc_A58AC:                              # CODE XREF: sub_A5808+9Cj
ROM:000A58AC                 clrlwi    r3, r4, 24
ROM:000A58B0                 blr
ROM:000A58B0 # End of function sub_A5808

[kur4o]

Tre-Cool, once I map some of the code and see what is needed, I can add some tableseek logic to find it on any e38 bins.

Currently you need to trace it in ghidra from start of calibration offset for CAN RX/TX settings.

[Tre-Cool]

Kur4bo, i used the address u posted to look at the 9099 os, used that as a bases to find it in the newer one.

Interestlying i found that there is a double up in the ecu code!

"Normal RX MSG" "0C1,0C5,0F1,0F9,128,130,131,140,199,19D,1C7,1C8,1C9,1CB,1E1,1E9,1EB,1F1,1F5,1F9,280,299,2C9,2D1,2E0,2F0,2F9,380,3C9,3C9,3ED,3F1,3FD,420,488,4C9,4D9,4E1,4E9"

12639249-rx.PNG (13.78 KiB) Viewed 217 times

TX - "0C9,0F1,0F9,110,120,170,191,1A1,1C1,1C3,1E9,1ED,1EF,1F1,1F5,280,285,289,2C3,2C5,2D1,2D3,300,308,320,348,3C1,3D1,3E9,3F9,3FB,410,480,490,4C1,4C9,4D1,4E1,4E9,4F1,510,520,772"

[Tre-Cool]

Bump these off that list.

0x0F9 Trans_General_Status_1
0x199 Trans_Torque_Request_HS
0x1F5 Trans_General_Status_2
0x4C9 Trans_General_Status_3

Have any good CANbus captures off a Holden car?

no can captures directly, obv i have tons of efilive logging.

I do have a can capture device i can use that i put onto my hub dyno as the can interface, i used that to capture comms to decipher the haltec wideband protocol.

Downside to me using a simple 1 line to show all the parameters, I can't add text to each field to further explain what's on the broadcast address, which from looking at the gm doc's they can have multiple things.

gm8782.PNG

before i purchase a bunch of other pdf's does anyone have a copy of the GMW8763-8781 doc's?

Your CAN tool should probably work fine with HS GMLAN. Just set the bus speed to 500K and jack into CAN HI/LO pins at the DLC. I'd just like to see an ID list from some Holden hardware for comparison.

As for those GM files, I don't believe I have that one. Found a bunch of other useful stuff on Scribed when I was looking for schematic of the Bosch FICM the early Duramax uses. And have that huge dump of totally unsearchable Bosch ECM schematics, but not even that had anything on the GM EDU module details.

But for the CANbus msg details, that one I have ya covered..

I'll have a play tomorrow. I have a couple of cars i can test in. 1 is a conversion with just e38/t43 & a pim module, others are factory 2011 model cars with all the factory modules.