PCM Hammer P05 support

[antus]

It looks like we have a winner!

SIM Base is FFFA00 like most the rest of the VPW PCMs, not FFFA30 like the P12, but other than that, it still did need a P12 style approach but for Intel chips.

[03:31:13:726] PCM Hammer (9/11/2025, 11:12 AM)
[03:31:13:728] Sunday, November 09 2025 @03:31:13:72
[03:31:13:730] Initializing J2534 Device
[03:31:13:811] Loaded DLL
[03:31:13:902] Connected to the device.
[03:31:13:906] Battery Voltage is: 13.634
[03:31:23:127] C:\Users\antus\Downloads\p05-antus_here_at_4000.bin
[03:31:23:142] Identifying 1024KiB file.
[03:31:23:153] File is P05 1024KiB.
[03:31:23:159] File operating system ID: 12584057
[03:31:23:163] File is P05 1024KiB.
[03:31:23:166] 1997 type P04, Param block not needed
[03:31:23:169] Start End Stored Needed Verdict Segment Name
[03:31:23:179] 00000 FFFFF F38BA9E3 F38BA9E3 Good Whole File
[03:31:23:184] Requesting operating system ID...
[03:31:23:210] File is P05 1024KiB.
[03:31:23:217] PCM and file match for hardware P05
[03:31:23:223] File is P05 1024KiB.
[03:31:23:231] PCM and file are both operating system 12584057
[03:31:23:305] Unlock OK.
[03:31:23:316] Attempting switch to VPW 4x
[03:31:23:342] Module 0x10 (engine controller) has agreed to enter high-speed mode.
[03:31:29:554] Upload permission granted.
[03:31:31:161] Kernel upload 100% complete.
[03:31:31:180] Kernel Version: 82400205
[03:31:31:185] Kernel uploaded to PCM successfully.
[03:31:31:207] File is P05 1024KiB.
[03:31:31:215] PCM and image file are both operating system 12584057
[03:31:31:236] Flash chip: Intel 28F800F3, Fast Boot Block (120ns) 1024KiB
[03:31:31:241] Calculating CRCs from file.
[03:31:31:252] Requesting CRCs from PCM.
[03:31:31:258] Range File CRC PCM CRC Verdict Purpose
[03:31:32:288] 0F0000-0FFFFF 4ACE2D32 4ACE2D32 Same General
[03:31:33:341] 0E0000-0EFFFF 651C38EC 651C38EC Same General
[03:31:34:384] 0D0000-0DFFFF A50F3C90 A50F3C90 Same General
[03:31:35:445] 0C0000-0CFFFF 60D2139A 60D2139A Same General
[03:31:36:476] 0B0000-0BFFFF A50F3C90 A50F3C90 Same General
[03:31:37:518] 0A0000-0AFFFF F485AD87 F485AD87 Same General
[03:31:38:552] 090000-09FFFF 598D42DE 598D42DE Same General
[03:31:39:613] 080000-08FFFF E4912470 E4912470 Same General
[03:31:40:657] 070000-07FFFF E13059B6 E13059B6 Same General
[03:31:41:700] 060000-06FFFF 1B490C3B 1B490C3B Same General
[03:31:42:757] 050000-05FFFF 19D974CD 19D974CD Same General
[03:31:43:817] 040000-04FFFF 77840800 77840800 Same General
[03:31:44:863] 030000-03FFFF 64B25BEB 64B25BEB Same General
[03:31:45:925] 020000-02FFFF E9346DDC E9346DDC Same General
[03:31:46:986] 010000-01FFFF F0035C16 F0035C16 Same General
[03:31:47:179] 00E000-00FFFF 85B5BB36 85B5BB36 Same General
[03:31:47:352] 00C000-00DFFF 85B5BB36 85B5BB36 Same General
[03:31:47:534] 00A000-00BFFF 85B5BB36 85B5BB36 Same General
[03:31:47:710] 008000-009FFF 85B5BB36 85B5BB36 Same General
[03:31:47:898] 006000-007FFF 671B90C1 671B90C1 Same General
[03:31:48:098] 004000-005FFF 818B057E 165D7E52 Different General
[03:31:48:290] 002000-003FFF 85B5BB36 85B5BB36 Same General
[03:31:48:469] 000000-001FFF FD5C1CE2 FD5C1CE2 Same General
[03:31:48:489] Processing range 004000-005FFF
[03:31:48:505] Erasing.
[03:31:48:867] Writing...
[03:31:57:269] Calculating CRCs from file.
[03:31:57:293] Requesting CRCs from PCM.
[03:31:57:308] Range File CRC PCM CRC Verdict Purpose
[03:31:58:349] 0F0000-0FFFFF 4ACE2D32 4ACE2D32 Same General
[03:31:59:416] 0E0000-0EFFFF 651C38EC 651C38EC Same General
[03:32:00:458] 0D0000-0DFFFF A50F3C90 A50F3C90 Same General
[03:32:01:507] 0C0000-0CFFFF 60D2139A 60D2139A Same General
[03:32:02:552] 0B0000-0BFFFF A50F3C90 A50F3C90 Same General
[03:32:03:622] 0A0000-0AFFFF F485AD87 F485AD87 Same General
[03:32:04:667] 090000-09FFFF 598D42DE 598D42DE Same General
[03:32:05:731] 080000-08FFFF E4912470 E4912470 Same General
[03:32:06:790] 070000-07FFFF E13059B6 E13059B6 Same General
[03:32:07:842] 060000-06FFFF 1B490C3B 1B490C3B Same General
[03:32:08:894] 050000-05FFFF 19D974CD 19D974CD Same General
[03:32:09:957] 040000-04FFFF 77840800 77840800 Same General
[03:32:11:022] 030000-03FFFF 64B25BEB 64B25BEB Same General
[03:32:12:086] 020000-02FFFF E9346DDC E9346DDC Same General
[03:32:13:137] 010000-01FFFF F0035C16 F0035C16 Same General
[03:32:13:340] 00E000-00FFFF 85B5BB36 85B5BB36 Same General
[03:32:13:548] 00C000-00DFFF 85B5BB36 85B5BB36 Same General
[03:32:13:757] 00A000-00BFFF 85B5BB36 85B5BB36 Same General
[03:32:13:943] 008000-009FFF 85B5BB36 85B5BB36 Same General
[03:32:14:120] 006000-007FFF 671B90C1 671B90C1 Same General
[03:32:14:324] 004000-005FFF 818B057E 818B057E Same General
[03:32:14:509] 002000-003FFF 85B5BB36 85B5BB36 Same General
[03:32:14:684] 000000-001FFF FD5C1CE2 FD5C1CE2 Same General
[03:32:14:705] All relevant ranges are identical.
[03:32:14:723] All write-request messages succeeded on the first try. You have an excellent connection to the PCM.
[03:32:14:741] Flash successful!
[03:32:14:807] Clearing trouble codes.
[03:32:15:887] Elapsed time 00:00:52.5779385

[antus]

"[03:31:23:166] 1997 type P04, Param block not needed" is wrong will need to look in to that, and I also MD5 summed the previous kernels and P10 changed for some reason while trying to extend the kernel for P05 and it should not have, so will need to sus that out to make sure there is not a regression.

I know P12 isnt working properly with asm kernel so it could that it's sim base is FFFA00 after all and not FFFA30 and that could be its problem since it looks very similar to what was happening here. So if I have a living 1M P12 on the bench (not sure i do) i'll move back to it next. Until then 1M P12 is working with the C kernel anyway.

[antus]

P10 change was not a problem. I noticed while I was working that the version set for a P10 was $10 (16) not $0A (10) and fixed that while I was working. So no functional change that matters.
basic checks looks like sim_base is FFFA30 for P12, still confirming that.
updated some readmes and spelling.
"1997 type P04, Param block not needed" is actually ok. I put fake data in 0x4000 which does overlap a paramater block, and the real block is at 0x6000 and so both sectors non-blank is the signature chip for a 1997 file which has code through both regions. So I probably should have tested in another sector, but the app is working properly. I think that means P05 might be good to go. Will give it another day to see if there is anything else that needs to be done then push the code up to github.

[antus]

I think its good. Just did an OS change, most sectors re-written, 100% successful. Last steps now I want to update the docs to call it more clearly P05b and make it clear that CAN bus only P05s are not supported then I'll put the code up for review and after anyone who wants to has had a chance to review get it in to pcmhammer.

[05:04:30:496] PCM Hammer (9/11/2025, 5:04 PM)
[05:04:30:509] Sunday, November 09 2025 @05:04:30:50
[05:04:30:515] Initializing J2534 Device
[05:04:30:547] Loaded DLL
[05:04:30:661] Connected to the device.
[05:04:30:670] Battery Voltage is: 13.634
[05:04:30:791] Thanks for using PCM Hammer.
[05:04:35:319] VIN: 2G2WR524741198653
[05:04:35:361] OSID: 12584057
[05:04:35:375] Description: P05 Service No 12584054
[05:04:35:396] Calibration ID: 12584054
[05:04:35:474] Serial Number: 1324M0QRU
[05:04:35:496] Broad Cast Code: YDXH
[05:04:35:518] MEC: 0
[05:04:35:544] Voltage: 13.3
[05:04:42:697] S:\backedup\ecu\P05\p05b.bin
[05:04:42:723] Identifying 1024KiB file.
[05:04:42:731] File is P05 1024KiB.
[05:04:42:740] File operating system ID: 12588933
[05:04:42:744] File is P05 1024KiB.
[05:04:42:748] P04/P05 1998+, checking for valid paramater block
[05:04:42:752] Param block at 0x4000
[05:04:42:757] Start End Stored Needed Verdict Segment Name
[05:04:42:768] 00000 FFFFF F576C57A F576C57A Good Whole File
[05:04:42:773] Requesting operating system ID...
[05:04:42:799] File is P05 1024KiB.
[05:04:42:806] PCM and file match for hardware P05
[05:04:42:812] File is P05 1024KiB.
[05:04:42:819] Operating system IDs do not match.
[05:04:42:824] PCM operating system ID: 12584057
[05:04:42:829] File operating system ID: 12588933
[05:04:42:835] File is P05 1024KiB.
[05:04:42:843] Changing PCM to operating system 12588933
[05:04:42:919] Unlock OK.
[05:04:42:938] Attempting switch to VPW 4x
[05:04:42:969] Module 0x10 (engine controller) has agreed to enter high-speed mode.
[05:04:49:241] Upload permission granted.
[05:04:49:737] Kernel upload 100% complete.
[05:04:49:763] Kernel Version: 82400205
[05:04:49:771] Kernel uploaded to PCM successfully.
[05:04:49:785] File is P05 1024KiB.
[05:04:49:793] Changing PCM to operating system 12588933
[05:04:49:813] Flash chip: Intel 28F800F3, Fast Boot Block (120ns) 1024KiB
[05:04:49:822] Calculating CRCs from file.
[05:04:49:834] Requesting CRCs from PCM.
[05:04:49:839] Range File CRC PCM CRC Verdict Purpose
[05:04:50:853] 0F0000-0FFFFF 8BB6267D 4ACE2D32 Different General
[05:04:51:879] 0E0000-0EFFFF FD2DE95B 651C38EC Different General
[05:04:52:894] 0D0000-0DFFFF A50F3C90 A50F3C90 Same General
[05:04:53:908] 0C0000-0CFFFF 849489DB 60D2139A Different General
[05:04:54:943] 0B0000-0BFFFF A50F3C90 A50F3C90 Same General
[05:04:55:957] 0A0000-0AFFFF 712899DD F485AD87 Different General
[05:04:56:976] 090000-09FFFF F0CCC60F 598D42DE Different General
[05:04:57:994] 080000-08FFFF 1574ED13 E4912470 Different General
[05:04:59:027] 070000-07FFFF 358BBADC E13059B6 Different General
[05:05:00:047] 060000-06FFFF 4393B023 1B490C3B Different General
[05:05:01:069] 050000-05FFFF D1E67EAB 19D974CD Different General
[05:05:02:090] 040000-04FFFF D3547AEF 77840800 Different General
[05:05:03:131] 030000-03FFFF 33ECF381 64B25BEB Different General
[05:05:04:147] 020000-02FFFF 78D35551 E9346DDC Different General
[05:05:05:171] 010000-01FFFF F2069842 F0035C16 Different General
[05:05:05:325] 00E000-00FFFF 85B5BB36 85B5BB36 Same General
[05:05:05:500] 00C000-00DFFF 85B5BB36 85B5BB36 Same General
[05:05:05:652] 00A000-00BFFF 85B5BB36 85B5BB36 Same General
[05:05:05:802] 008000-009FFF 85B5BB36 85B5BB36 Same General
[05:05:05:954] 006000-007FFF 85B5BB36 671B90C1 Different General
[05:05:06:108] 004000-005FFF C121BB28 818B057E Different General
[05:05:06:263] 002000-003FFF 85B5BB36 85B5BB36 Same General
[05:05:06:429] 000000-001FFF FD5C1CE2 FD5C1CE2 Same General
[05:05:06:455] Processing range 0F0000-0FFFFF
[05:05:06:471] Erasing.
[05:05:07:529] Writing...
[05:05:36:286] Processing range 0E0000-0EFFFF
[05:05:36:301] Erasing.
[05:05:37:331] Writing...
[05:06:06:114] Processing range 0C0000-0CFFFF
[05:06:06:129] Erasing.
[05:06:07:171] Writing...
[05:06:35:730] Processing range 0A0000-0AFFFF
[05:06:35:745] Erasing.
[05:06:36:785] Writing...
[05:07:05:242] Processing range 090000-09FFFF
[05:07:05:277] Erasing.
[05:07:06:320] Writing...
[05:07:35:358] Processing range 080000-08FFFF
[05:07:35:373] Erasing.
[05:07:36:410] Writing...
[05:08:05:647] Processing range 070000-07FFFF
[05:08:05:673] Erasing.
[05:08:06:714] Writing...
[05:08:35:608] Processing range 060000-06FFFF
[05:08:35:619] Erasing.
[05:08:36:653] Writing...
[05:09:05:775] Processing range 050000-05FFFF
[05:09:05:790] Erasing.
[05:09:06:831] Writing...
[05:09:35:915] Processing range 040000-04FFFF
[05:09:35:932] Erasing.
[05:09:36:961] Writing...
[05:10:05:996] Processing range 030000-03FFFF
[05:10:06:011] Erasing.
[05:10:07:048] Writing...
[05:10:35:987] Processing range 020000-02FFFF
[05:10:35:996] Erasing.
[05:10:37:018] Writing...
[05:11:06:087] Processing range 010000-01FFFF
[05:11:06:091] Erasing.
[05:11:07:134] Writing...
[05:11:36:202] Processing range 006000-007FFF
[05:11:36:211] Erasing.
[05:11:36:574] Writing...
[05:11:40:154] Processing range 004000-005FFF
[05:11:40:158] Erasing.
[05:11:40:497] Writing...
[05:11:44:116] Calculating CRCs from file.
[05:11:44:126] Requesting CRCs from PCM.
[05:11:44:132] Range File CRC PCM CRC Verdict Purpose
[05:11:45:141] 0F0000-0FFFFF 8BB6267D 8BB6267D Same General
[05:11:46:154] 0E0000-0EFFFF FD2DE95B FD2DE95B Same General
[05:11:47:170] 0D0000-0DFFFF A50F3C90 A50F3C90 Same General
[05:11:48:188] 0C0000-0CFFFF 849489DB 849489DB Same General
[05:11:49:226] 0B0000-0BFFFF A50F3C90 A50F3C90 Same General
[05:11:50:261] 0A0000-0AFFFF 712899DD 712899DD Same General
[05:11:51:285] 090000-09FFFF F0CCC60F F0CCC60F Same General
[05:11:52:323] 080000-08FFFF 1574ED13 1574ED13 Same General
[05:11:53:347] 070000-07FFFF 358BBADC 358BBADC Same General
[05:11:54:377] 060000-06FFFF 4393B023 4393B023 Same General
[05:11:55:423] 050000-05FFFF D1E67EAB D1E67EAB Same General
[05:11:56:466] 040000-04FFFF D3547AEF D3547AEF Same General
[05:11:57:488] 030000-03FFFF 33ECF381 33ECF381 Same General
[05:11:58:520] 020000-02FFFF 78D35551 78D35551 Same General
[05:11:59:566] 010000-01FFFF F2069842 F2069842 Same General
[05:11:59:726] 00E000-00FFFF 85B5BB36 85B5BB36 Same General
[05:11:59:878] 00C000-00DFFF 85B5BB36 85B5BB36 Same General
[05:12:00:029] 00A000-00BFFF 85B5BB36 85B5BB36 Same General
[05:12:00:181] 008000-009FFF 85B5BB36 85B5BB36 Same General
[05:12:00:337] 006000-007FFF 85B5BB36 85B5BB36 Same General
[05:12:00:505] 004000-005FFF C121BB28 C121BB28 Same General
[05:12:00:677] 002000-003FFF 85B5BB36 85B5BB36 Same General
[05:12:00:836] 000000-001FFF FD5C1CE2 FD5C1CE2 Same General
[05:12:00:853] All relevant ranges are identical.
[05:12:00:869] All write-request messages succeeded on the first try. You have an excellent connection to the PCM.
[05:12:00:885] Flash successful!
[05:12:00:947] Clearing trouble codes.
[05:12:02:027] Elapsed time 00:07:19.1032237

[antus]

Is anyone familiar with the differences between the a, b, c variations of P05s? Which ones have VPW and what version I am testing on? I have some labeled a and some labeled b on my bench but I dont know where those codes came from. It'd be good to get this clear before I put any descriptions it in PCM Hammer.

What I have found so far is:
Service number, application, protocol (if known)
12581501, 2004 Grand Prix, VPW, Intel 28F800F3
12581598, 2005 Chevrolet Equinox 6 Cyl 3.4L, ?
12591279, 2005 Chevrolet Equinox 6 Cyl 3.4L Chevrolet Malibu 6 Cyl 3.5L Pontiac G6 6 Cyl 3.5L, VPW
12600930, 2008 Grand Prix, CAN only
12604962, 2006-2009 Grand Prix, ?
12604963,, VPW, AMD AM29BL802C

Can anyone confirm particularly if they have and can verify if any of these service numbers support VPW, CAN, or Both? Doing a get properties with any version of PCM hammer will be enough to confirm if they are talking VPW. If they do not respond with pcmhammer then CAN can be assumed. Both is a bit harder and may need a tool that can read VIN with only CAN or VPW physically connected to prove it is talking both. Or, it could be cooked up universal patcher selecting only one protocol or the other.

I would guess, but need to confirm, the 2005 service numbers would support VPW, and all VPW capable PCMs support CAN.
I have confirmed 12581501 supports at least VPW and 12600930 supports CAN only.

Any other P05 service numbers?

[antus]

I think its done. The test version if anyone wants to try it is available from: https://github.com/PcmHammer/PcmHammer/ ... 9206410209 you must have a github account and be logged in to github download. It is working perfectly for my P05b PCM (service no 12581501) for read and clone write.

I have taken the line that 2004/2005 is P05b and is VPW. 2006-2009 is P05c and is CAN (not supported). It is a bit of a guess. More information welcome.

I've currently only got a very small number (6) OSIDs across 2 service numbers. If anyone has any more, please supply them and I will add.

Code: Select all

                case 12584057:
                case 12588933:
                    PCMInfo(PcmType.P05b);
                    this.Description = "2004 P05b (VPW) Service No 12581501";
                    this.ServiceNumber = 12584054;
                    break;

/*                case xxxxx:
                    PCMInfo(PcmType.P05b);
                    this.Description = "2005 P05b (VPW) Service No 12581598";
                    this.ServiceNumber = 12584054;
                    break;
*/
                case 12608100:
                case 12612950:
                case 12619714:
                case 12619715:
                    PCMInfo(PcmType.P05b);
                    this.Description = "2005 P05b (VPW) Service No 12591279";
                    this.ServiceNumber = 12584054;
                    break;

                // 2008 P05c service number 12600930 is CAN only
                // 2006-2009 P05c service number 12604962 is CAN only

[antus]

Thanks rjdrew1986 for the report that service number 12604963 OSID 12603217 is talking VPW. I've added it to the tool. Service number is only one different from 12604962 so it's likely that one will talk VPW as well. It looks like this one might be a P05c, but i've tagged it as P05b internally in pcmhammer (still P05c in the description) just so it works for now but if it turns out P05c variants do talk VPW + CAN than i might need to name the kernel differently to keep it all correct as we can.

a, b and c maybe refer to vpw, can, both, (or something else) but I don't know how we'll confirm this and which is which.

[zack4200]

service number 12591279 OSID 12608119 talks VPW also. Came from an 05 Malibu Maxx

[antus]

Can you confirm if it has CAN as well by setting the protocol directly in a logging tool?

[darkman5001]

I think all of the P05s speak VPW, however on certain cars that uses them the car speaks in CAN so I think the VPW pins are not used in some cases. So flashing a CAN wired car with PCM Hammer wouldn't work because there is no VPW wire run from PCM to OBD2 connector. Now does the OS dictate whether VPW pins are enabled, or are they always enabled? I don't know the answer to that. I just know that they all have the VPW pins on the PCM connector. Would be nice to bench test with a P05 out of a CAN only car and see if it will talk on those VPW pins as is.