AI and RE

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
User avatar
antus
Site Admin
Posts: 10076
Joined: Sat Feb 28, 2009 10:34 am
cars: TX Gemini 2L Twincam 8psi
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Subaru WRX 2007

Re: AI and RE

Post by antus »

I've done a bit of searching, I cant find any evidence of any car with a second VPW data bus to the cluster. Going back to basics - can you find any wiring diagram that shows this wiring with a second VPW data bus in the physical world?
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Ralmo94
Posts: 25
Joined: Thu Mar 12, 2026 10:00 pm
cars: 1995 towncar
1994 k1500
1998 k2500 7.4
2002 Tahoe 5.3
2004 Silverado 1500
2008 F250 5.4

Re: AI and RE

Post by Ralmo94 »

I had before... but good point let me check again! Will Up date with what find, Hopefully proof.
OEM boxes. Open questions. Closed source.
The engine knows what it wants. The ECU knows what it got. :hmm:
If the bootloader can read it, so can we. :gear:
The silicon doesn't lie — it's just not telling the whole story. :silent:
User avatar
Ralmo94
Posts: 25
Joined: Thu Mar 12, 2026 10:00 pm
cars: 1995 towncar
1994 k1500
1998 k2500 7.4
2002 Tahoe 5.3
2004 Silverado 1500
2008 F250 5.4

Re: AI and RE

Post by Ralmo94 »

2002 4.8 Vin V Engine Performance Circuits W Case Grounded HO2S Sensors.pdf

This is from a factory service manual of a 2002 Silverado
Image

Notice pins 14 and 15. Both Class2 data. However, I think I need to correct my assumptions that it only went to the cluster, as this clearly shows otherwise.

Lines up with this too showing class2 on both
viewtopic.php?p=81690#p81690

This is the best evidence I can find without cracking the case open. I am not against that, but I have nowhere to work on it right now and it would take a while before I could mess with it.

Also found this, https://www.customecm.com/tune-file-rep ... VFS9IWx1kP. The author of the site says that most people use pin 58, but he's found that you can use pin 59 for a bench harness. -- note I found these results on my own without ai help.
You do not have the required permissions to view the files attached to this post.
OEM boxes. Open questions. Closed source.
The engine knows what it wants. The ECU knows what it got. :hmm:
If the bootloader can read it, so can we. :gear:
The silicon doesn't lie — it's just not telling the whole story. :silent:
kur4o
Posts: 1154
Joined: Sun Apr 10, 2016 11:20 am

Re: AI and RE

Post by kur4o »

There is 2 physical pins for VPW but they are tied internally in the pcm board, so output is single. ALDL is used on p01 to talk to early ALDL modules, on P59 ALDL is repurposed for TAC. Need to check it again.
User avatar
antus
Site Admin
Posts: 10076
Joined: Sat Feb 28, 2009 10:34 am
cars: TX Gemini 2L Twincam 8psi
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Subaru WRX 2007

Re: AI and RE

Post by antus »

Good to know. That was going to be my next test - check if the two pins were connected before commenting further.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
8SecSleeper
Posts: 27
Joined: Sun Mar 12, 2017 5:57 am

Re: AI and RE

Post by 8SecSleeper »

Ralmo94 wrote: Tue Jun 23, 2026 3:28 am
8SecSleeper wrote: Tue Jun 23, 2026 2:59 am
Ralmo94 wrote: Tue Jun 23, 2026 1:43 am

I looked at your scripts, looked like they are hard coded for an exact OS with absolute addresses in the gm ppc. Interesting to look at, but all of my personal focus is on other boxes currently
You were looking at the rename template that ai is told to create and run to end the prompt from extract5.py
So what do you really have, a pipeline that places the llm as the reverse engineer, or a deterministic python script? Anything that lets an llm walk an entire bin is beyond my current hardware and cloud usage. All the AI tools I use are on Free plans, and the largest local model I have hardware for is like a 3B. I work in construction so I don't have the advantage of an expensive hardware stack for work.
I use the $5 a month of the zen go plan. You get $30 usage of deepseek flash, mimo v2.5. I do not use frontier models as they are not needed. I use my own harness which is very strict with tool calls, how many tokens it's used, my method make it's the top priority to save money, doing it the way I mention is very cheap in reality. But if you pair it up with a bad harness that will try reading entire source code to try to find basic context, then you will have problems.
User avatar
Ralmo94
Posts: 25
Joined: Thu Mar 12, 2026 10:00 pm
cars: 1995 towncar
1994 k1500
1998 k2500 7.4
2002 Tahoe 5.3
2004 Silverado 1500
2008 F250 5.4

Re: AI and RE

Post by Ralmo94 »

kur4o wrote: Tue Jun 23, 2026 8:09 am There is 2 physical pins for VPW but they are tied internally in the pcm board, so output is single.
I was beginning to wonder if they were tied together, the fact that you can use either for flashing makes that seem reasonable
ALDL is used on p01 to talk to early ALDL modules, on P59 ALDL is repurposed for TAC. Need to check it again.
That was my next assumption, two communication chips but only one vpw. Is there a stock os that actually speaks aldl, did gm ever actually use that in a production pcm, of so what is the application?
OEM boxes. Open questions. Closed source.
The engine knows what it wants. The ECU knows what it got. :hmm:
If the bootloader can read it, so can we. :gear:
The silicon doesn't lie — it's just not telling the whole story. :silent:
User avatar
Ralmo94
Posts: 25
Joined: Thu Mar 12, 2026 10:00 pm
cars: 1995 towncar
1994 k1500
1998 k2500 7.4
2002 Tahoe 5.3
2004 Silverado 1500
2008 F250 5.4

Re: AI and RE

Post by Ralmo94 »

8SecSleeper wrote: Tue Jun 23, 2026 12:56 pm
Ralmo94 wrote: Tue Jun 23, 2026 3:28 am
8SecSleeper wrote: Tue Jun 23, 2026 2:59 am


I use the $5 a month of the zen go plan. You get $30 usage of deepseek flash, mimo v2.5. I do not use frontier models as they are not needed. I use my own harness which is very strict with tool calls, how many tokens it's used, my method make it's the top priority to save money, doing it the way I mention is very cheap in reality. But if you pair it up with a bad harness that will try reading entire source code to try to find basic context, then you will have problems.
So you have a targeted pipeline that uses a remote api, and is strict about what the llm can do and only lets it do a certain search, and auto prompts it for the next step?

$5 a month isn't bad at all
OEM boxes. Open questions. Closed source.
The engine knows what it wants. The ECU knows what it got. :hmm:
If the bootloader can read it, so can we. :gear:
The silicon doesn't lie — it's just not telling the whole story. :silent:
User avatar
antus
Site Admin
Posts: 10076
Joined: Sat Feb 28, 2009 10:34 am
cars: TX Gemini 2L Twincam 8psi
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Subaru WRX 2007

Re: AI and RE

Post by antus »

Try looking back at earlier generations to see about ALDL. Maybe start looking at ~1996 PCMs with the 68k core and VPW (eg P04 256k and Blackbox), then move forward to the earliest of the P01 type.
Australian commodore V8s had P01 (1999) and P59 (2005) and do run an ALDL bus, but they had a PIM which was a module that bridged the two buses and translated/forwarded some data between VPW and ALDL, rather than direct connection from PCM to ALDL.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
kur4o
Posts: 1154
Joined: Sun Apr 10, 2016 11:20 am

Re: AI and RE

Post by kur4o »

1998-2002 f-bodies have aldl talking to ABS, there is some code in PCM, but very limited modes are supported for direct communication. 96-97 Lt1 also have VPW + ALDL if you want to reverse that too.