P11 GM PCM

[DWS]

Thanks for the links, quick peek seems to be good info I need.

A template/jig would be nice, but I'm hitting a bunch of different PCM's lately. I just solder in a header to the ulink and plug it into whichever PCM i'm messing with.

I bought 5 PCM's from a member on here, just got them in this morning. I'm told I'm the first to crack into the P05's, it's basically a E40 hardware wise, right pins and it reads and writes using the E40 config.

I worked out the pin out for a couple P04's I got in the lot, so going to test and make sure I got things right. Clearly I'll have a lot of bin files to play with lol. Only have 1 car that runs any of these PCM's though, so the focus is more or less on the P11 until I can get another vehicle to toy with.

Now that I know what to look for and the basics on how to do this stuff, it seems pretty easy, hardest part is figuring out the CPU part number. I've just been lucky and have been having help with that process.

If/when I publish this info, I'll have to make a thread per PCM type and make an index or something. Forums are great but not real good for easy finding the data per pcm and such. It's way better than facebook though!

I also have a P01 which I'm sure is nothing new to discover there and another P11 I need to poke at and see if it has the watchdog enabled or not. The board name/letters matches the one I have w\o watchdog so I think that might be a pattern if it matches up.

I'm also building a database of PCMs based on serv + calibration/hw number and logging details like cpu, flash, fitment, iac driver (for p01/p59/p04), watchdog, etc. It might be easiest to publish the info to a fairly simple website and allow user submissions too.

I like the concept in that segment swap thread, I had the same basic idea. I figured a script to find all of the memory calls in the OS and try to somewhat automate the identification of the stored settings. Clearly I need to do it manually first and on more than one PCM to get a grasp of it. This adventure has been hitting like every skill I've built up, it's almost like I trained my whole life for this stuff with out even knowing it lol.

Either case, it's been really interesting to learn so far. Once I have more time to dedicate to breaking down the bin files, I'll have to see how far I can get. I read there's like 600+ settings that can be mapped (more or less based on os etc).

[Lunatic]

I'm not sure if this is of interest to anyone, but I've attached a .BIN file from one of these P11 ECU's. (2003 Cavalier, 5 speed, Ecotec 2.2 engine).
Immo/VATS is off and perhaps it could be of use to examine, reverse engineer, etc.
VIN-1G1JC52F537286653 (Seen on lines 402D-403D)
OS-12593523

[AngelMarc]

How did you manage to disassemble that?

[DWS]

It's a royal pain with the case glued together. Back then I had a cheap china desoldering gun and the big ground pins were a massive fight. I have a nice Hakko one now that would probably do a ton better. Even after desodlering, the glue is on the board a little holding it down to the case so fun working it out.

Being able to flash them over OBD2 is basically a must in the long term, not sure if there's been any progress on that though, I just helped with some of the hardware pinout research.

[antus]

From a quick disassembly it looks like watchdogs are at FFFA27 and 800806 and DLC is FF6000 (we ignore the high byte as its a 24 bit address bus internally and makes no difference if its FF or 00 or anything else). This lives in Common-Assembly.h in the kernel dir. There is a parameter block at 0x4000 but the seed / key looks a little different so would need to see an example of an unlock from another tool to see where it is exactly here and then determine which algorithm number through trial and error with the algos in PCM Hammer. From this it can also be determined what kernel load address to use and if the stack needs to be moved on kernel init to clear out some ram (Kernel.S). With this information that is enough to add P11 to the PCM Hammer Kernel (build.cmd) and app (PcmIinfo.cs) and see what happens. At least, if this is a VPW PCM in the first place. Being a different series of flash chip that may also need to be defined by ID in the FlashChip.cs file. Then on a lucky day it works first try, or on a regular day something unexpected happens or we get a crash and it's time to start experimenting. If it does work for read then the VPP enable and disable needs to be identified and lock/unlock updated (Kernel.S) as this seems to vary more than other parts of the process between VPW PCMs.

Watchdogs patterns:

Code: Select all

move.b  #$55,($FFFFFA27).w 
move.b  #$AA,($FFFFFA27).w
bset    #7,($FF800806).l
andi.b  #$5F,($FF800806).l 
rts

DLC Patterns:

Code: Select all

cmpi.w  #$6780,($FFFFF600).w
seq     ($FFFF9207).w
bne.s   loc_5A2
moveq   #$B,d3
lea     (unk_494).w,a2
lea     ($FFFFF608).w,a3
move.w  #$A,(a3)

loc_588:
move.w  (a2)+,($FFFFF60A).w
dbf     d3,loc_588
moveq   #$B,d3
move.w  #$10A,(a3)

loc_596:
move.w  (a2)+,($FFFFF60A).w
dbf     d3,loc_596
move.w  #$20A,(a3)

loc_5A2:
move.w  #$370,($FFFFF606).w
move.w  #$85,($FFFFF600).w
rts

After a bit more looking it seems the above matches the P10 and it also has the same SIM_BASE as P10, so treating it exactly like a P10 would be a good starting point.

[antus]

I found some time to move on to the P11 today, and after a bit of messing around, with load address FFC000, Algo 0x0D, 6D instead of 6C on the priority byte of the upload request, and skipped over the flash ID check as I have not started to investigate the flash chip support yet I was able to read a bin off the PCM. So that's a start.

[antus]

Made some headway on the flash chip functions, got it to ID which enabled the block checksums.

Code: Select all

[01:11:54:239]  PCM Hammer (6/04/2026, 1:11 AM)
[01:11:54:249]  Monday, April 06 2026 @01:11:54:24
[01:11:54:254]  Initializing J2534 Device
[01:11:54:277]  Loaded DLL
[01:11:55:453]  Connected to the device.
[01:11:55:470]  Battery Voltage is: 13.698
[01:11:55:479]  Thanks for using PCM Hammer.
[01:12:20:403]  Will save to S:\P11\test.bin
[01:12:21:321]  Using manually selected PCM type: P11
[01:12:21:432]  Unlock OK.
[01:12:21:449]  Attempting switch to VPW 4x
[01:12:21:471]  Module 0x10 (engine controller) has agreed to enter high-speed mode.
[01:12:27:670]  Upload permission granted.
[01:12:28:090]  Kernel upload 100% complete.
[01:12:31:227]  Kernel Version: 8240020B
[01:12:31:229]  Kernel uploaded to PCM successfully. Requesting data...
[01:12:31:248]  Flash chip: Intel 28F800F3, Fast Boot Block (120ns) 1024KiB
[01:16:17:838]  Read complete.
[01:16:17:842]  All read-request messages succeeded on the first try. You have an excellent connection to the PCM.
[01:16:17:845]  Starting verification...
[01:16:17:864]  Calculating CRCs from file.
[01:16:17:877]  Requesting CRCs from PCM.
[01:16:17:881]  	Range		File CRC		PCM CRC	Verdict	Purpose
[01:16:18:893]  0F0000-0FFFFF	A50F3C90	A50F3C90	Same	General
[01:16:19:922]  0E0000-0EFFFF	A50F3C90	A50F3C90	Same	General
[01:16:20:954]  0D0000-0DFFFF	A50F3C90	A50F3C90	Same	General
[01:16:21:983]  0C0000-0CFFFF	A50F3C90	A50F3C90	Same	General
[01:16:23:017]  0B0000-0BFFFF	A50F3C90	A50F3C90	Same	General
[01:16:24:047]  0A0000-0AFFFF	A50F3C90	A50F3C90	Same	General
[01:16:25:091]  090000-09FFFF	A50F3C90	A50F3C90	Same	General
[01:16:26:103]  080000-08FFFF	A50F3C90	A50F3C90	Same	General
[01:16:27:125]  070000-07FFFF	F21089FE	F21089FE	Same	General
[01:16:28:159]  060000-06FFFF	522B721F	522B721F	Same	General
[01:16:29:188]  050000-05FFFF	7E224A6D	7E224A6D	Same	General
[01:16:30:228]  040000-04FFFF	7F77F594	7F77F594	Same	General
[01:16:31:261]  030000-03FFFF	F1FE9148	F1FE9148	Same	General
[01:16:32:304]  020000-02FFFF	7BA96BDB	7BA96BDB	Same	General
[01:16:33:328]  010000-01FFFF	FAC97041	FAC97041	Same	General
[01:16:33:482]  00E000-00FFFF	CBE4ADFC	CBE4ADFC	Same	General
[01:16:33:651]  00C000-00DFFF	A0678A5D	A0678A5D	Same	General
[01:16:33:803]  00A000-00BFFF	7CB2564C	7CB2564C	Same	General
[01:16:33:955]  008000-009FFF	20D53EC1	20D53EC1	Same	General
[01:16:34:111]  006000-007FFF	85B5BB36	85B5BB36	Same	General
[01:16:34:289]  004000-005FFF	C44FA296	C44FA296	Same	General
[01:16:34:442]  002000-003FFF	DCB550E2	DCB550E2	Same	General
[01:16:34:597]  000000-001FFF	D55EBB97	D55EBB97	Same	General
[01:16:34:617]  The contents of the file match the contents of the PCM.
[01:16:34:646]  Clearing trouble codes.
[01:16:35:721]  Elapsed time 00:04:14.2865753
[01:16:35:744]  Saving contents to S:\P11\test.bin

[antus]

I think its good. Only done one flash and outta time but file ID seems good, checksums good, erase and write good on this sector. I reckon there is a high chance they all work. But I've gone ahead and added a new write dialog when I probably shouldnt not have started adding new features, so after testing I either need to tidy that up, or remove it and get P11 in just the base app first and then look at the read/write dialog.

[10:21:01:845] PCM Hammer (6/04/2026, 10:20 AM)
[10:21:01:860] Monday, April 06 2026 @10:21:01:85
[10:21:01:866] Initializing J2534 Device
[10:21:01:886] Loaded DLL
[10:21:03:049] Connected to the device.
[10:21:03:065] Battery Voltage is: 13.725
[10:21:03:101] Thanks for using PCM Hammer.
[10:21:16:097] S:\P11\antus p11 modified param block.bin
[10:21:16:121] Identifying 1024KiB file.
[10:21:16:127] File type forced to P11 (manual selection).
[10:21:16:138] File operating system ID: 12218878
[10:21:16:141] Start End Stored Needed Verdict Segment Name
[10:21:16:148] 00000 7FFFB 8A37 8A37 Good Whole File
[10:21:16:155] Using manually selected PCM type: P11
[10:21:16:504] Unlock OK.
[10:21:16:520] Attempting switch to VPW 4x
[10:21:16:543] Module 0x10 (engine controller) has agreed to enter high-speed mode.
[10:21:22:773] Upload permission granted.
[10:21:23:199] Kernel upload 100% complete.
[10:21:26:339] Kernel Version: 8240020B
[10:21:26:350] Kernel uploaded to PCM successfully.
[10:21:26:380] PCM and image file are both operating system 12218878
[10:21:26:396] Flash chip: Intel 28F800F3, Fast Boot Block (120ns) 1024KiB
[10:21:26:404] Calculating CRCs from file.
[10:21:26:415] Requesting CRCs from PCM.
[10:21:26:420] Range File CRC PCM CRC Verdict Purpose
[10:21:26:425] 0F0000-0FFFFF not needed not needed n/a OperatingSystem
[10:21:26:431] 0E0000-0EFFFF not needed not needed n/a OperatingSystem
[10:21:26:437] 0D0000-0DFFFF not needed not needed n/a OperatingSystem
[10:21:26:445] 0C0000-0CFFFF not needed not needed n/a OperatingSystem
[10:21:26:452] 0B0000-0BFFFF not needed not needed n/a OperatingSystem
[10:21:26:460] 0A0000-0AFFFF not needed not needed n/a OperatingSystem
[10:21:26:468] 090000-09FFFF not needed not needed n/a OperatingSystem
[10:21:26:477] 080000-08FFFF not needed not needed n/a OperatingSystem
[10:21:26:487] 070000-07FFFF not needed not needed n/a OperatingSystem
[10:21:26:498] 060000-06FFFF not needed not needed n/a OperatingSystem
[10:21:26:509] 050000-05FFFF not needed not needed n/a OperatingSystem
[10:21:26:521] 040000-04FFFF not needed not needed n/a OperatingSystem
[10:21:26:533] 030000-03FFFF not needed not needed n/a OperatingSystem
[10:21:26:546] 020000-02FFFF not needed not needed n/a OperatingSystem
[10:21:26:558] 010000-01FFFF not needed not needed n/a Calibration
[10:21:26:572] 00E000-00FFFF not needed not needed n/a Calibration
[10:21:26:586] 00C000-00DFFF not needed not needed n/a Calibration
[10:21:26:600] 00A000-00BFFF not needed not needed n/a Calibration
[10:21:26:615] 008000-009FFF not needed not needed n/a Calibration
[10:21:26:767] 006000-007FFF 7E1B9FA9 85B5BB36 Different Parameter
[10:21:26:924] 004000-005FFF C44FA296 C44FA296 Same Parameter
[10:21:26:950] 002000-003FFF not needed not needed n/a OperatingSystem
[10:21:26:968] 000000-001FFF not needed not needed n/a Boot
[10:21:26:985] Processing range 006000-007FFF
[10:21:27:003] Erasing.
[10:21:27:377] Writing...
[10:21:30:829] Calculating CRCs from file.
[10:21:30:860] Requesting CRCs from PCM.
[10:21:30:875] Range File CRC PCM CRC Verdict Purpose
[10:21:30:891] 0F0000-0FFFFF not needed not needed n/a OperatingSystem
[10:21:30:908] 0E0000-0EFFFF not needed not needed n/a OperatingSystem
[10:21:30:926] 0D0000-0DFFFF not needed not needed n/a OperatingSystem
[10:21:30:944] 0C0000-0CFFFF not needed not needed n/a OperatingSystem
[10:21:30:962] 0B0000-0BFFFF not needed not needed n/a OperatingSystem
[10:21:30:982] 0A0000-0AFFFF not needed not needed n/a OperatingSystem
[10:21:31:002] 090000-09FFFF not needed not needed n/a OperatingSystem
[10:21:31:020] 080000-08FFFF not needed not needed n/a OperatingSystem
[10:21:31:040] 070000-07FFFF not needed not needed n/a OperatingSystem
[10:21:31:058] 060000-06FFFF not needed not needed n/a OperatingSystem
[10:21:31:077] 050000-05FFFF not needed not needed n/a OperatingSystem
[10:21:31:095] 040000-04FFFF not needed not needed n/a OperatingSystem
[10:21:31:114] 030000-03FFFF not needed not needed n/a OperatingSystem
[10:21:31:133] 020000-02FFFF not needed not needed n/a OperatingSystem
[10:21:31:152] 010000-01FFFF not needed not needed n/a Calibration
[10:21:31:171] 00E000-00FFFF not needed not needed n/a Calibration
[10:21:31:191] 00C000-00DFFF not needed not needed n/a Calibration
[10:21:31:210] 00A000-00BFFF not needed not needed n/a Calibration
[10:21:31:228] 008000-009FFF not needed not needed n/a Calibration
[10:21:31:385] 006000-007FFF 7E1B9FA9 7E1B9FA9 Same Parameter
[10:21:31:578] 004000-005FFF C44FA296 C44FA296 Same Parameter
[10:21:31:605] 002000-003FFF not needed not needed n/a OperatingSystem
[10:21:31:624] 000000-001FFF not needed not needed n/a Boot
[10:21:31:642] All relevant ranges are identical.
[10:21:31:662] All write-request messages succeeded on the first try. You have an excellent connection to the PCM.
[10:21:31:678] Flash successful!
[10:21:31:709] Clearing trouble codes.
[10:21:32:791] Elapsed time 00:00:16.2823897

[DWS]

@antus congrats on the progress, sounding promising so far =).