2004 Chevrolet Cavalier 2.2L ECM (P11)

[Gampy]

Does anyone know what ECM family is used in a 2004 Chevrolet Cavalier 2.2L ... Is it an E38 ??

Looking it up online gives part/service numbers, not family name.

Thanks

[Chuff]

Hey Gampy,

I wondered the same thing 18 months ago as a mentioned in this post I made early last year: viewtopic.php?f=42&t=6208&p=92299&hilit=chuff#p92299

This is the information that caught my attention in the link I provided in the above mentioned post.

PCM_4CYL.png

I'm not sure if that helps you in any way but it is at the least a possible lead.

I'm beginning the process of retrofitting an '808 ECU running VL400's OSE 12P onto my Ford Escort and would love it if a LS variant PCM was available as an option. If the GM PCMs could be opened up to retrofitting the way the '808 12P combination is for so many other engines then I believe it would be a popular & powerful option for many modders.

Chuff

[antus]

I downloaded a stock 2004 tune from the hp tuners repo and that app says its a P11.

Internet sluthing shows pictures which look like an E38 case from the outside, and perhaps it is the same family, but I'd guess the hardware would be cut down internally being only a 4 banger to keep costs down.

[Gampy]

Welp, whatever it is I'll have it in my hands soon ... The car is now ours, couldn't pass up the deal!

US$150 for a running driving state inspected car, it's going to need tires, brakes and brake lines soon.

My kid is going to use it as an AtoB car until destruction derby time, save wear and tear on his truck ... If it doesn't get resold for profit.

Thanks

[antus]

I just starting to look at P11 for PCM Hammer, and hit this thread in google. Have a service number 12210553, DPSJ CHEVY CAVALIER 2.2L. This is the file above as a bin.

[antus]

I took a quick look at the bin today, putting some notes here for future reference. I think I've found COP, DLC, and hardware registers for flash programming. Looks very similar P05/P12 style, looking more on more common for this PCMs of these years in this style case.
Updating the files type ID and checksum code will probably be harder that updating the kernel with these values for this platform.

For anyone learning, the two moves copying $55 and then $AA to an address in code really early in the operating system is easily identifiable by eye to locate the COP registers. The SIM_BASE is also easy to spot from the start of a long list of move commands that move static values in to registers slightly above the first one. The DLC is spotable as the boot sector needs to be able to send and receive recovery prompts from really early code as it needs to be able to do that if only the first 2kb of data is on the flash. Nearly this entire generation have had the DLC Registers at the same address so they're easily spotable especially when we can see bytes going in to a function that look like a typical VPW packet, eg 6C or 6A, then 10, and so on. Not shown here but that did point straight to this function I've labeled as DLC_TRANSMIT. Finally I did a search through the whole bin for 50 50 and when I saw 50 50, two other bytes the 40 40 and not far after FF FF I knew that was the magic numbers for the intel flash code so I was able to disassemble from 2 bytes before the 5050 knowing how big the opcodes would have been, then that disassembled most of the flash function, then I went back earlier until I saw bytes 4E 75 4E 71. These often go together, they assemble to RTS NOP which is the end of the previous function and some padding. So I could start disassembling there to reveal the whole flash function. Then we know we are looking for a couple of writes to bits or values within about 200 bytes from SIM_BASE and so its possible to identify code that setups the registers for erase and write, and resets them a the other end of the function. This is the dangerous part to get right in the flash kernel, as its possible to make some strange and potentially destructive things happens if its partly but not completely right, but testing that will be a later task.

Code: Select all

				 ; P05, P12 Style COP
loc_3C84E:                       
move.b  #$55,($FFFFFA55).w ; '; COP1=FFFA55 
move.b  #$AA,($FFFFFA55).w
move.w  d0,-(sp)
bchg    #7,($FFFFFA21).w      ; COP2=FFFA21
move.w  ($FFFFF762).w,d0
addi.w  #5,d0


loc_650:                         ; SIM_BASE=FFFFA00  (standard recognisable address, near the start of the initial PC function)
move.w  d0,($FFFFFA00).w
move.w  #$A828,($FFFFFA08).w
move.w  #$E322,($FFFFFA7E).w
move.l  #$FFFF8000,($FFFFF6C4).w
move.w  #$4800,($FFFFF6C0).w
move.w  #$841F,($FFFFFA1E).w
move.w  #0,($FFFFFA18).w
move.w  #$FFFF,($FFFFFA1C).w
move.w  #$C1F,($FFFFFA26).w
move.w  #0,($FFFFFA20).w
move.w  #$FFFF,($FFFFFA24).w
move.w  #$113C,($FFFFFA50).w
move.w  #$D842,($FFFFFA52).w
move.w  #$6B6C,($FFFFFA58).w
move.b  ($FFFFFA0B).w,d0
bsr.s   sub_6EC
bsr.w   sub_450
moveq   #$FFFFFFFF,d3
moveq   #3,d4


DLC Registers=from FFF600    ; standard DLC

DLC_TRANSMIT:                           ; CODE XREF: initial_pc_entry+350↑p
ROM:00000C3C                                         ; initial_pc_entry+47C↑p ...
ROM:00000C3C                 movem.w d2-d3,-(sp)
ROM:00000C40
ROM:00000C40 loc_C40:                                ; CODE XREF: DLC_TRANSMIT+1A↓j
ROM:00000C40                 bsr.w   sub_5DE
ROM:00000C44                 move.b  ($FFFFF60E).w,d2
ROM:00000C48                 andi.b  #8,d2
ROM:00000C4C                 bne.s   loc_C94
ROM:00000C4E                 move.b  ($FFFFF60E).w,d2
ROM:00000C52                 andi.b  #$10,d2
ROM:00000C56                 beq.s   loc_C40
ROM:00000C58                 move.b  #$14,($FFFFF60C).w
ROM:00000C5E                 subq.b  #1,d4
ROM:00000C60
ROM:00000C60 loc_C60:                                ; CODE XREF: DLC_TRANSMIT+2C↓j
ROM:00000C60                 move.b  (a3)+,($FFFFF60D).w
ROM:00000C64                 mulu.w  d3,d3
ROM:00000C66                 subq.b  #1,d4
ROM:00000C68                 bne.s   loc_C60
ROM:00000C6A                 move.b  #$C,($FFFFF60C).w
ROM:00000C70                 move.b  (a3),($FFFFF60D).w
ROM:00000C74
ROM:00000C74 loc_C74:                                ; CODE XREF: DLC_TRANSMIT+3C↓j
ROM:00000C74                 bsr.w   sub_B50
ROM:00000C78                 bcc.s   loc_C74
ROM:00000C7A                 moveq   #$40,d2 ; '@'
ROM:00000C7C                 and.b   d3,d2
ROM:00000C7E                 bne.s   loc_C94
ROM:00000C80                 moveq   #$30,d2 ; '0'
ROM:00000C82                 and.b   d3,d2
ROM:00000C84                 cmpi.b  #$30,d3 ; '0'
ROM:00000C88                 bne.s   loc_C94
ROM:00000C8A                 movem.w (sp)+,d2-d3
ROM:00000C8E                 andi    #$1E,ccr
ROM:00000C92                 bra.s   locret_C9C
ROM:00000C94 ; ---------------------------------------------------------------------------
ROM:00000C94
ROM:00000C94 loc_C94:                                ; CODE XREF: DLC_TRANSMIT+10↑j
ROM:00000C94                                         ; DLC_TRANSMIT+42↑j ...
ROM:00000C94                 movem.w (sp)+,d2-d3
ROM:00000C98                 ori     #1,ccr
ROM:00000C9C
ROM:00000C9C locret_C9C:                             ; CODE XREF: DLC_TRANSMIT+56↑j
ROM:00000C9C                 rts
ROM:00000C9C 





ROM:00051E06                               flash_51E06:
ROM:00051E06
ROM:00051E06                               var_8           = -8
ROM:00051E06                               var_3           = -3
ROM:00051E06
ROM:00051E06 4E56 FFF8                                     link    a6,#-8
ROM:00051E0A 48E7 1908                                     movem.l d3-d4/d7/a4,-(sp)
ROM:00051E0E 08B8 0003 FA31                                bclr    #3,($FFFFFA31).w
ROM:00051E14 1838 B800                                     move.b  ($FFFFB800).w,d4
ROM:00051E18 49EE FFFD                                     lea     var_3(a6),a4
ROM:00051E1C 207C FFFF B801                                movea.l #$FFFFB801,a0
ROM:00051E22 224C                                          movea.l a4,a1
ROM:00051E24 303C 0003                                     move.w  #3,d0
ROM:00051E28 6002                                          bra.s   loc_51E2C
ROM:00051E2A                               ; ---------------------------------------------------------------------------
ROM:00051E2A
ROM:00051E2A                               loc_51E2A:                              ; CODE XREF: flash_51E06:loc_51E2C↓j
ROM:00051E2A 12D8                                          move.b  (a0)+,(a1)+
ROM:00051E2C
ROM:00051E2C                               loc_51E2C:                              ; CODE XREF: flash_51E06+22↑j
ROM:00051E2C 51C8 FFFC                                     dbf     d0,loc_51E2A
ROM:00051E30 026E 000F FFFC                                andi.w  #$F,-4(a6)
ROM:00051E36 08F8 0004 FA7E                                bset    #4,($FFFFFA7E).w ; set up hardware for write
ROM:00051E3C 08F8 0006 FA18                                bset    #6,($FFFFFA18).w ; set up hardware for write
ROM:00051E42 4278 F762                                     clr.w   ($FFFFF762).w
ROM:00051E46 08B8 0007 FA21                                bclr    #7,($FFFFFA21).w ; set up hardware for write
ROM:00051E4C 7600                                          moveq   #0,d3
ROM:00051E4E 4A04                                          tst.b   d4
ROM:00051E50 6700 00D0                                     beq.w   loc_51F22
ROM:00051E54 48E7 2604                                     movem.l d2/d5-d6/a5,-(sp)
ROM:00051E58 327C F762                                     movea.w #$F762,a1
ROM:00051E5C 343C FFFF                                     move.w  #$FFFF,d2
ROM:00051E60
ROM:00051E60                               loc_51E60:                              ; CODE XREF: flash_51E06+110↓j
ROM:00051E60 307C B804                                     movea.w #$B804,a0
ROM:00051E64 3C30 3A00                                     move.w  (a0,d3.l*2),d6
ROM:00051E68 206E FFFC                                     movea.l -4(a6),a0
ROM:00051E6C 49F0 3A00                                     lea     (a0,d3.l*2),a4
ROM:00051E70 3882                                          move.w  d2,(a4)
ROM:00051E72 3882                                          move.w  d2,(a4)
ROM:00051E74 3214                                          move.w  (a4),d1
ROM:00051E76 4641                                          not.w   d1
ROM:00051E78 8C41                                          or.w    d1,d6
ROM:00051E7A 38BC 5050                                     move.w  #$5050,(a4)     ; intel flash stuff
ROM:00051E7E 38BC 4040                                     move.w  #$4040,(a4)
ROM:00051E82 38C6                                          move.w  d6,(a4)+
ROM:00051E84 38BC 7070                                     move.w  #$7070,(a4)
ROM:00051E88 7218                                          moveq   #$18,d1
ROM:00051E8A 2049                                          movea.l a1,a0
ROM:00051E8C 7AAA                                          moveq   #$FFFFFFAA,d5
ROM:00051E8E 7C55                                          moveq   #$55,d6 ; 'U'
ROM:00051E90 3A7C FA55                                     movea.w #$FA55,a5
ROM:00051E94
ROM:00051E94                               loc_51E94:                              ; CODE XREF: flash_51E06+CE↓j
ROM:00051E94 DE7C FFFF                                     add.w   #$FFFF,d7
ROM:00051E98 3014                                          move.w  (a4),d0
ROM:00051E9A 1D40 FFF8                                     move.b  d0,var_8(a6)
ROM:00051E9E 1A86                                          move.b  d6,(a5)
ROM:00051EA0 1A85                                          move.b  d5,(a5)
ROM:00051EA2 B250                                          cmp.w   (a0),d1
ROM:00051EA4 6424                                          bcc.s   loc_51ECA
ROM:00051EA6 1A86                                          move.b  d6,(a5)
ROM:00051EA8 1A85                                          move.b  d5,(a5)
ROM:00051EAA 0838 0007 FA21                                btst    #7,($FFFFFA21).w
ROM:00051EB0 57C0                                          seq     d0
ROM:00051EB2 C0BC 0000 0001                                and.l   #1,d0
ROM:00051EB8 EF88                                          lsl.l   #7,d0
ROM:00051EBA C03C 0080                                     and.b   #$80,d0
ROM:00051EBE 0238 007F FA21                                andi.b  #$7F,($FFFFFA21).w
ROM:00051EC4 8138 FA21                                     or.b    d0,($FFFFFA21).w
ROM:00051EC8 4250                                          clr.w   (a0)
ROM:00051ECA
ROM:00051ECA                               loc_51ECA:                              ; CODE XREF: flash_51E06+9E↑j
ROM:00051ECA 082E 0007 FFF8                                btst    #7,var_8(a6)
ROM:00051ED0 6604                                          bne.s   loc_51ED6
ROM:00051ED2 4A47                                          tst.w   d7
ROM:00051ED4 66BE                                          bne.s   loc_51E94
ROM:00051ED6
ROM:00051ED6                               loc_51ED6:                              ; CODE XREF: flash_51E06+CA↑j
ROM:00051ED6 3882                                          move.w  d2,(a4)
ROM:00051ED8 3882                                          move.w  d2,(a4)
ROM:00051EDA 0C51 0018                                     cmpi.w  #$18,(a1)
ROM:00051EDE 632C                                          bls.s   loc_51F0C
ROM:00051EE0 11FC 0055 FA55                                move.b  #$55,($FFFFFA55).w ; 'U' ; watchdog
ROM:00051EE6 11FC 00AA FA55                                move.b  #$AA,($FFFFFA55).w   ; watchdog
ROM:00051EEC 0838 0007 FA21                                btst    #7,($FFFFFA21).w   ; watchdog
ROM:00051EF2 57C0                                          seq     d0
ROM:00051EF4 C0BC 0000 0001                                and.l   #1,d0
ROM:00051EFA EF88                                          lsl.l   #7,d0
ROM:00051EFC C03C 0080                                     and.b   #$80,d0
ROM:00051F00 0238 007F FA21                                andi.b  #$7F,($FFFFFA21).w
ROM:00051F06 8138 FA21                                     or.b    d0,($FFFFFA21).w
ROM:00051F0A 4251                                          clr.w   (a1)
ROM:00051F0C
ROM:00051F0C                               loc_51F0C:                              ; CODE XREF: flash_51E06+D8↑j
ROM:00051F0C 2003                                          move.l  d3,d0
ROM:00051F0E 5200                                          addq.b  #1,d0
ROM:00051F10 7600                                          moveq   #0,d3
ROM:00051F12 1600                                          move.b  d0,d3
ROM:00051F14 B604                                          cmp.b   d4,d3
ROM:00051F16 6500 FF48                                     bcs.w   loc_51E60
ROM:00051F1A 241F                                          move.l  (sp)+,d2
ROM:00051F1C 2A1F                                          move.l  (sp)+,d5
ROM:00051F1E 2C1F                                          move.l  (sp)+,d6
ROM:00051F20 2A5F                                          movea.l (sp)+,a5
ROM:00051F22
ROM:00051F22                               loc_51F22:                              ; CODE XREF: flash_51E06+4A↑j
ROM:00051F22 11FC 0055 B900                                move.b  #$55,($FFFFB900).w ; 'U'
ROM:00051F28 08B8 0004 FA7E                                bclr    #4,($FFFFFA7E).w  ; revert flash hardware registers
ROM:00051F2E 08B8 0006 FA18                                bclr    #6,($FFFFFA18).w  ; revert flash hardware registers
ROM:00051F34 08F8 0003 FA31                                bset    #3,($FFFFFA31).w  ; revert flash hardware registers
ROM:00051F3A 261F                                          move.l  (sp)+,d3
ROM:00051F3C 281F                                          move.l  (sp)+,d4
ROM:00051F3E 2E1F                                          move.l  (sp)+,d7
ROM:00051F40 285F                                          movea.l (sp)+,a4
ROM:00051F42 4E5E                                          unlk    a6
ROM:00051F44 4E75                                          rts
ROM:00051F44                               ; End of function flash_51E06

[antus]

pictures

[antus]

PCM Hammer latest can now identify the P11 file type and checksum it correctly.

Code: Select all

[10:51:13:083]  PCM Hammer (16/11/2025, 10:51 AM)
[10:51:13:111]  Sunday, November 16 2025 @10:51:13:11
[10:51:13:124]  Initializing J2534 Device
[10:51:13:160]  Loaded DLL
[10:51:13:294]  Connected to the device.
[10:51:13:301]  Battery Voltage is: 13.514
[10:51:13:396]  Thanks for using PCM Hammer.
[10:51:21:360]  Examining S:\backedup\ecu\P11\2004 Chevrolet Cavalier 2.2 L4 Manual.bin
[10:51:21:395]  Identifying 512KiB file.
[10:51:21:453]  File is P11 512KiB.
[10:51:21:474]  File operating system ID: 12586586
[10:51:21:524]  File is P11 512KiB.
[10:51:21:549]  	Start	End	Stored	Needed	Verdict	Segment Name
[10:51:21:578]  	00000	7FFFB	09FD	09FD	Good	Operating System
[10:51:21:601]  All checksums are valid.

Also triggered some crashes by having an exclusive file lock on the bin from another app while I was working on this, so I did a crash course on exception handling and made pcmhammer handle that nicely for file validation and write instead of putting a stack trace on the screen like it has up until now. That's just a nice to have for every file type when it cant open the file because of some permission thing.