E67/T42 Mapping and Modding

[Xnke]

Been working on extending the BinTool program to the E67 and T42 controllers. Mostly T42 work so far, the BinTool can do a full read, calibration-only write, and OS+Calibration write. It can not write the boot segment. Writing the boot segments (Segments S0-S3) brick the T42 every time so far. The E67 side can do a full read, but I have not started with a write yet. The E38 side can do a full read, but again, no write yet.

I don't have a *lot* of the E67 codebase for the Impala/Monte Carlo/G6 OS traced out yet-just a few table hacks that UP and Tableseek already seem to know. I am about 10% through the T42 transmission program for the 2006 GTO, and have enough data to be able to enable some truck OS features in the GTO OS, like shift table selection (up to three table sets, but still not sure how to enable set 3) and tap up/tap down shifting. Just because I know how to turn them on, doesn't mean it actually works, yet.

Right now, the big issue is figuring out the memory map and how the tables are built-so far it looks like the shift tables and line pressure tables are all built during runtime, they aren't actually stored as complete tables. For example, the 1-2 upshift table is a 5 row, 17 column table, but each row is stored as a 1x17 table and they're assembled somehow by the running program. It's weird to me, but maybe that's the way it's supposed to be.

Anyway, that weirdness is what has me chasing down the boot-init-run chain, using Ghidra and some help from Claude to learn what I'm doing. Claude is kinda crap at it now that OpenAI has nerfed it's abilities, so I'm having to get it to explain to me what I should be doing. Means I'm gonna make more mistakes but with confidence!

I will post my XDF files here once they actually have something more than the other XDFs I can find on the internet, and they load properly...I am still learning how to write them.

[Xnke]

Here's a list of the current T42 functions that I kinda know what they are doing:

============================================================
T42 GTO known-function naming and plate-comment pass v1
Program: Pontiac 2006 GTO TCM 24236195 - Attempt2.bin
Entries in script: 135
============================================================
OK 0x0001AEF4 T42_ElapsedTimeOrMeasurementHelper
OK 0x0001B8C4 T42_NonnegativeTimeDeltaHelper
OK 0x0001B138 T42_PCS_2DInterpolationHelper
OK 0x0001BAC8 T42_PCS_FeedbackScaleHelper
OK 0x0001B934 T42_SaturatedSignedSubtract
OK 0x0001A814 T42_SaturatedAddHelper
OK 0x0001A588 T42_ElapsedTimeCountHelper
OK 0x0006FFB2 T42_ClassifyShiftOperatingState
OK 0x000740BE T42_EvaluateShiftOperatingState
MISSING FUNCTION 0x00071CE6 : T42_EvaluateCalibratedStateCondition
OK 0x0007266A T42_PackStateConditionGroup1A
OK 0x0007271A T42_PackStateConditionGroup1B
OK 0x000727A2 T42_PackStateConditionGroup2
OK 0x0007282A T42_ClearTransientWordArray
OK 0x00072896 T42_TestTransientWordArray
OK 0x0007330A T42_UpdateStateMaximumAccumulator
MISSING FUNCTION 0x00073416 : T42_SetTimedStateCondition_9F6C
OK 0x0007441A T42_PostClassStateEvaluation
MISSING FUNCTION 0x0007294E : T42_EvaluateGearIndexedStateCondition_9F70
MISSING FUNCTION 0x00072AF6 : T42_EvaluateModeThresholdPair_9F72
MISSING FUNCTION 0x00072BF6 : T42_EvaluateSensorHysteresis_9FA0
MISSING FUNCTION 0x00072CBA : T42_EvaluateTFTHysteresisByClass
MISSING FUNCTION 0x00072D56 : T42_EvaluateTimerStateCondition_9F86
MISSING FUNCTION 0x00072EE6 : T42_TimerStateConditionHelper
MISSING FUNCTION 0x00072F42 : T42_EvaluateGearModeClassCondition_9F88
MISSING FUNCTION 0x0007305A : T42_EvaluateThresholdCondition_9F8C
MISSING FUNCTION 0x00073102 : T42_EvaluateTFTGearStateCondition_9F8E
MISSING FUNCTION 0x0007316A : T42_WriteClassDependentStateFlags
MISSING FUNCTION 0x000731D2 : T42_EvaluateModeGatedMeasurement_9F96
MISSING FUNCTION 0x00073446 : T42_SetStateCondition_9F6E
MISSING FUNCTION 0x0007349E : T42_EvaluateModeTimedCondition_9F76
MISSING FUNCTION 0x000734FE : T42_EvaluateModeTimerThreshold_9F78
MISSING FUNCTION 0x00073552 : T42_EvaluateThresholdModeCondition_9F7A
MISSING FUNCTION 0x000735C2 : T42_EvaluateRelatedThresholdModeCondition_9F7C
MISSING FUNCTION 0x0007362A : T42_EvaluateGearIndexedCalibrationFlag_9F7E
MISSING FUNCTION 0x00073662 : T42_EvaluateTFTHysteresis_9F80
MISSING FUNCTION 0x0007369A : T42_EvaluateSensorHysteresis_9F84
MISSING FUNCTION 0x000736D2 : T42_EvaluateModeStateCondition_9F8A
MISSING FUNCTION 0x0007370A : T42_EvaluatePointerControlledCondition_9F90
MISSING FUNCTION 0x0007372E : T42_EvaluateSensorHysteresis_9F94
MISSING FUNCTION 0x00073776 : T42_EvaluateElapsedTimeCondition_9F98
MISSING FUNCTION 0x000737BE : T42_EvaluateThresholdCondition_9F9A
MISSING FUNCTION 0x000737D6 : T42_EvaluateThresholdCondition_9F9C
OK 0x00073B6E T42_WriteGroup2ThresholdCondition
MISSING FUNCTION 0x00073BF2 : T42_SelectGroup2ThresholdsByState
MISSING FUNCTION 0x00073D96 : T42_WriteIndexedGroup2Condition_9FB8
OK 0x00073E7E T42_WriteIndexedTimedCondition
MISSING FUNCTION 0x00073EFA : T42_EvaluateModeThresholdCondition_9FA8
MISSING FUNCTION 0x00073F36 : T42_EvaluateComplementaryThreshold_9FAA
MISSING FUNCTION 0x00073F72 : T42_EvaluateThresholdCondition_9FAC
MISSING FUNCTION 0x00073F92 : T42_EvaluateElapsedTimeCondition_9FB0
MISSING FUNCTION 0x00074026 : T42_EvaluateIndexedHysteresisCondition
MISSING FUNCTION 0x0007408E : T42_UpdateGroup2MeasurementFromHelper
OK 0x0007DDBE T42_InitializePCSMonitorState
OK 0x0007DE22 T42_RunPCSClosedLoopController
OK 0x0007DF16 T42_MonitorPCSOutputWindow
OK 0x0007E0FA T42_QualifyPCSOperatingWindow
OK 0x0007E17A T42_UpdatePCSMonitorStateMachine
OK 0x0007E2E6 T42_RunPCSCommandMonitor
OK 0x0007E37A T42_DerivePCSDriverEnableRequest
OK 0x0007E42A T42_LookupPCSCurrentCommandSchedule
OK 0x0007E4FA T42_SelectPCSCurrentTarget
OK 0x0007E64E T42_ResetPCSMonitorState
OK 0x0007E692 T42_RedispatchPCSOutputCommand
OK 0x0007F44A T42_GetScaledPCSFeedback
OK 0x0007F49A T42_ValidatePCSCurrentTarget
OK 0x0007F5F2 T42_UpdatePCSValidityPermission
OK 0x0007F61A T42_HandlePCSMonitorDiagnosticEvent
OK 0x0007F686 T42_DispatchPCSOutputWrapper
OK 0x0007F99A T42_PeriodicPCSTask
OK 0x0007EA12 T42_UpdatePCSRelatedTimingLimit
OK 0x00016420 T42_AcquirePCSFeedbackADC
OK 0x000164C8 T42_InitializePCSDriverADC
OK 0x000162DC T42_DispatchPCSChannel2Command
OK 0x0001639C T42_UpdatePCSDriverState
OK 0x00016914 T42_InitializePCSDriverSubsystem
OK 0x00013CCC T42_WritePWMOutputChannel
MISSING FUNCTION 0x00013EAC : T42_AcquireTFTInputStage1
OK 0x00013F74 T42_AcquireTFTInputStage2
OK 0x0001403C T42_ProcessTFTInputForConversion
OK 0x0007B0CE T42_UpdateFilteredTFTState
OK 0x00056EF6 T42_TemperatureDependentInterpolation_A
OK 0x00063D02 T42_TemperatureDependentInterpolation_B
OK 0x00077D16 T42_ResolveStateToOutputCommand
OK 0x00071BDE T42_ApplyStateOutputSelection
OK 0x00077B26 T42_UpdateOutputStateFromSelection
OK 0x00077B92 T42_CommitOutputState
OK 0x000159B0 T42_WriteHardwareOutputRegister
PRESERVED EXISTING NAME 0x00018E58 : T42_TestRuntimeRAM (wanted T42_TestRAMPresenceAndReadback)
OK 0x00018E58 T42_TestRuntimeRAM
PRESERVED EXISTING NAME 0x00019D2C : T42_InitRuntimeMemoryAndRelocate (wanted T42_InitializeMemoryAndRelocateApplication)
OK 0x00019D2C T42_InitRuntimeMemoryAndRelocate
PRESERVED EXISTING NAME 0x00018D1C : T42_ProgramAddressWindowRegisters (wanted T42_ProgramHardwareAddressWindows)
OK 0x00018D1C T42_ProgramAddressWindowRegisters
PRESERVED EXISTING NAME 0x00018DC4 : T42_ApplyPendingMemoryMapping (wanted T42_SelectHardwareAddressWindowBase)
OK 0x00018DC4 T42_ApplyPendingMemoryMapping
OK 0x000012DC T42_InitializeMemoryController_A
OK 0x00000E68 T42_InitializeMemoryController_B
OK 0x000A086C T42_InitializeObjectControlBlock
OK 0x000A0CB4 T42_SetupObjectListService
OK 0x000A0E34 T42_UpdateObjectFromCallbackInput
OK 0x000A0E92 T42_ServiceObjectPointerList
OK 0x000A0F42 T42_ServiceObjectPointerListExtended
OK 0x000A1BA6 T42_RelocatedModuleManagerHelper
MISSING FUNCTION 0x000A1DCE : T42_SetManagerContextPointer
MISSING FUNCTION 0x000A1DDE : T42_GetManagerContextPointer
OK 0x000A1DE2 T42_MatchManagerEntries
OK 0x000A202A T42_SetObjectStateAndGlobal_AE22
OK 0x000A2042 T42_SetObjectStateAndGlobal_B67E
MISSING FUNCTION 0x000A2106 : T42_SetRelocatedStateByte_21EF40
MISSING FUNCTION 0x000A2112 : T42_GetRelocatedStateByte_21EF40
MISSING FUNCTION 0x000A211A : T42_SetRelocatedStateByte_21EF42
MISSING FUNCTION 0x000A2126 : T42_GetRelocatedStateByte_21EF42
MISSING FUNCTION 0x000A212E : T42_SetRelocatedStateByte_21EF43
MISSING FUNCTION 0x000A213A : T42_GetRelocatedStateByte_21EF43
MISSING FUNCTION 0x000A2142 : T42_ProcessRelocatedObjectEvent
MISSING FUNCTION 0x000A21AE : T42_CallRelocatedHelper_2199B8
MISSING FUNCTION 0x000A21C2 : T42_Add600ToRelocatedByteArgument
MISSING FUNCTION 0x000A21D2 : T42_SetRelocatedGlobal_21EF44
OK 0x000A230E T42_RelocatedModulePostStartupRoutine_A
OK 0x000A234A T42_RelocatedModulePostStartupRoutine_B
OK 0x000A2382 T42_RelocatedModulePostStartupRoutine_C
OK 0x000A239E T42_RelocatedModuleMainRoutine
OK 0x000A27EE T42_RelocatedModuleRoutine_A27EE
PRESERVED EXISTING NAME 0x000A294A : T42_ProcessRuntimeChannelRecord (wanted T42_RelocatedModuleRoutine_A294A)
OK 0x000A294A T42_ProcessRuntimeChannelRecord
OK 0x000A2B3E T42_RelocatedModuleRoutine_A2B3E
OK 0x000A2C9E T42_RelocatedModuleRoutine_A2C9E
OK 0x000A2E12 T42_RelocatedModuleRoutine_A2E12
OK 0x000A2E8E T42_RelocatedModuleRoutine_A2E8E
OK 0x000A3036 T42_RelocatedModuleAccessor_A3036
OK 0x000A3046 T42_RelocatedModuleAccessor_A3046
OK 0x000A30DE T42_RelocatedModuleRoutine_A30DE
OK 0x000A325E T42_RelocatedModuleRoutine_A325E
OK 0x000A334E T42_RelocatedModuleRoutine_A334E
OK 0x000A3902 T42_RelocatedModuleRoutine_A3902
OK 0x000A3A1A T42_RelocatedModuleRoutine_A3A1A
OK 0x000A3B16 T42_RelocatedModuleRoutine_A3B16
OK 0x000A3B9E T42_RelocatedModuleRoutine_A3B9E
OK 0x000A3CFA T42_RelocatedModuleRoutine_A3CFA
============================================================
SUMMARY
Renamed: 82
Missing function entries (not created): 48
Existing non-default names preserved: 5
Errors: 0
============================================================

[Xnke]

The "MISSING FUNCTION" warnings are code locations that I know the function is there, but Ghidra has not identified it automatically. Thus, chasing down the boot sequence and memory map, Ghidra does not know (And hell, I don't know) how to handle all the addresses that are completely outside the 1024kb ROM space.

[fl0wl0w]

The "MISSING FUNCTION" warnings are code locations that I know the function is there, but Ghidra has not identified it automatically. Thus, chasing down the boot sequence and memory map, Ghidra does not know (And hell, I don't know) how to handle all the addresses that are completely outside the 1024kb ROM space.

Grab the reference manual for the mcu if it is available. They are available for E38s MPC561/MPC563. The E67 probably uses the same thing or something similar. T42 uses some raw silicon inside on a very integrated board, but it is basically some off the shelf MCU, can't remember what tho. The reference manual will have all of the addresses and what they go to. could be RAM or peripherals. I just handed it to codex and it went off and setup the memory in ghidra and then labeled every function that messes with peripheral addresses.

[Xnke]

It is a Motorola M68332 or M68336 CPU, but I can't determine exactly which one yet. Almost 100% positive it's an M68332 CPU32 unit. I was gonna rip the case off one of my bricked ones, but I can use them as cores at the local pull-a-part and it cuts the replacement cost down to 5$, so I haven't done that yet. They won't take an opened up one, thought.

By Missing, i mean I located this function by hand and decoded it, but Ghidra has an issue with the CPU32 instruction set for 4E 71 NOP and it will often stop decoding when it hits a 4E 71 NOP or 4E 75 RTS instruction, and just kinda gives up and moves on. If I go in and hand-decompile, it will find the instructions, usually. It's just complaining that I'm defining a function manually via a script, so more of a script issue than an actual missing function.

[fl0wl0w]

The older Motorola based PCMs had special instructions for table lookups. I bet the T42 uses that instruction too. I recall there being a patch for ghidra to add those instructions. Have you done that yet?

[Xnke]

I have not-I will look into that today!

[Xnke]

So, apparently "Performance Shift" is a mode that needs to be enabled, but once enabled it is handled automatically by some form of motion sensing? I am not entirely sure what's going on with that.

However, it appears that Tow/Haul mode can have up to four map schedules. In theory, it's possible to build a CAN widget with four buttons for normal, sport, tow/haul, and snow modes, or whatever else.

This is all in the GTO OS, so none of it is enabled in the stock calibration. I guess once I have the transmission simulator going I can emulate a CAN datastream and the transmission hardware signals and test it out.

[Rapidfire]

Im following with great interest,

[Xnke]

Turns out, Yes, the GTO has the required logic programmed in for the Tow/Haul mode and can handle at least two alternate maps with different bits toggled in the CAN message 0x1F1. I think I have a good idea of how to enable the behavior, as the message is received as a valid message even if it isn't enabled. I am working on a good way to bench test the shift pattern changing without having to hook it up to a running system.