Reading eeprom from delco PCM, MC68336 based
Re: Reading eeprom from delco PCM, MC68336 based
Wouldn't it be better to use the BDM, now you've got that sorted?
Joe.
Joe.
-
- Posts: 43
- Joined: Fri Mar 20, 2015 4:34 am
- cars: saturn
Re: Reading eeprom from delco PCM, MC68336 based
So after a month of pool openings, tree removals, and engine swaps (other vehicle...)...I'm back trying to get this finished. I apologize for not following up sooner. I have attached the dump from the manual pcm...here's hoping that something intelligent can come of it.
- Attachments
-
- pcmmanual.bin
- (1 MiB) Downloaded 417 times
- antus
- Site Admin
- Posts: 8251
- Joined: Sat Feb 28, 2009 8:34 pm
- cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B - Contact:
Re: Reading eeprom from delco PCM, MC68336 based
That looks like a good read. Can you post up the other one your trying to merge it with?
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
-
- Posts: 43
- Joined: Fri Mar 20, 2015 4:34 am
- cars: saturn
Re: Reading eeprom from delco PCM, MC68336 based
It's a few posts back, but I have included it again. I did try to compare the two, and I noticed a few things:
-even though one is a manual, and one is an auto, the code size seems very similar...enough that I suspect the code to control all features exists in both versions, but there are flags enabled in the auto version to trigger running of the auto code
-the MFS blocks at 0x4000 & 0x6000 are formatted a little differently between the two, I don't think a direct swap would be sufficient between the two
-the versions of the code are different between the two, I think much more would be similar if I had the same version in both pcm's, but I don't unfortunately.
A few comments:
1) I would like to figure out a little more of this code using IDA. In what format are the reset and interrupt vectors? Are they jump instructions, or pure vectors?
2) When modifying the bin, how would I recalculate the checksum?
3) since the hardware seems to be similar, I'm going to try programming the auto bin into the manual and see if it works. This would confirm at least that the fuel continue password is stored in the eeprom, as I suspect (I can't see any programmable devices that would store it otherwise...it's more of a quick test that I can do...)
-even though one is a manual, and one is an auto, the code size seems very similar...enough that I suspect the code to control all features exists in both versions, but there are flags enabled in the auto version to trigger running of the auto code
-the MFS blocks at 0x4000 & 0x6000 are formatted a little differently between the two, I don't think a direct swap would be sufficient between the two
-the versions of the code are different between the two, I think much more would be similar if I had the same version in both pcm's, but I don't unfortunately.
A few comments:
1) I would like to figure out a little more of this code using IDA. In what format are the reset and interrupt vectors? Are they jump instructions, or pure vectors?
2) When modifying the bin, how would I recalculate the checksum?
3) since the hardware seems to be similar, I'm going to try programming the auto bin into the manual and see if it works. This would confirm at least that the fuel continue password is stored in the eeprom, as I suspect (I can't see any programmable devices that would store it otherwise...it's more of a quick test that I can do...)
- Attachments
-
- sl2_auto.bin
- (1 MiB) Downloaded 424 times
-
- Posts: 43
- Joined: Fri Mar 20, 2015 4:34 am
- cars: saturn
Re: Reading eeprom from delco PCM, MC68336 based
I made a bit of a mistake...I thought I had two good reads, the auto and the manual, so I programmed the manual with the auto build, and it didn't work...I had done two reads of the manual before programming it, and it turns out they are different, by quite a bit...
Now I am back to just having a working auto pcm..
Now I am back to just having a working auto pcm..
- antus
- Site Admin
- Posts: 8251
- Joined: Sat Feb 28, 2009 8:34 pm
- cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B - Contact:
Re: Reading eeprom from delco PCM, MC68336 based
crap. might need to read at a slower speed, if you can get another data source
a1) vectors are pure vectors. See the processor datasheet for more information. These are bottom fill layout.
a2) thats a good question. sum will probably be a plain sum (not crc), and 16 bit. The data will likely be the 2nd and 3rd bytes of the segment, or the last 2, or failing that really close to the start. Can figure it out with trial and error if you can correctly guess the size of the area. If a couple of educated guesses dont get you anywhere you can try and brute force it with a pc program that sums ranges with differing start and end addresses (but in the area you suspect) and then looks for the sum nearby. Once you find a match, can test another bin image and see if it lines up the same.
a3) doh! I had a bit of a compare of the bins you posted.. they looked close but a little odd. seems be some duplicated rows. From what you say, that now sounds like bad reads
a1) vectors are pure vectors. See the processor datasheet for more information. These are bottom fill layout.
a2) thats a good question. sum will probably be a plain sum (not crc), and 16 bit. The data will likely be the 2nd and 3rd bytes of the segment, or the last 2, or failing that really close to the start. Can figure it out with trial and error if you can correctly guess the size of the area. If a couple of educated guesses dont get you anywhere you can try and brute force it with a pc program that sums ranges with differing start and end addresses (but in the area you suspect) and then looks for the sum nearby. Once you find a match, can test another bin image and see if it lines up the same.
a3) doh! I had a bit of a compare of the bins you posted.. they looked close but a little odd. seems be some duplicated rows. From what you say, that now sounds like bad reads
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
-
- Posts: 43
- Joined: Fri Mar 20, 2015 4:34 am
- cars: saturn
Re: Reading eeprom from delco PCM, MC68336 based
The 2nd read I did looks much closer to the auto pcm...but I'm kind of frustrated tonight and I haven't looked that closely at it. The blocks at 0x4000 & 0x6000 format looks very similar.
- Attachments
-
- pcmmanual2.bin
- (1 MiB) Downloaded 378 times
-
- Posts: 43
- Joined: Fri Mar 20, 2015 4:34 am
- cars: saturn
Re: Reading eeprom from delco PCM, MC68336 based
I got a guy to send me the eeprom from another manual pcm. I put it in my pcm and confirmed that it works (starts the car and dies immediately because it hasn't got the right fuel continue password)
I then read 2x on my programmer and verified the results are identical. I have attached the file.
I then read 2x on my programmer and verified the results are identical. I have attached the file.
- Attachments
-
- verified_read_manual.bin
- (1 MiB) Downloaded 405 times
-
- Posts: 43
- Joined: Fri Mar 20, 2015 4:34 am
- cars: saturn
Re: Reading eeprom from delco PCM, MC68336 based
I also wrote the new manual code to another eeprom, and read verified it. I tried it in the pcm...identical behavior, so my burn was successful.
Ivan
Ivan
Re: Reading eeprom from delco PCM, MC68336 based
Sorry for late reply.
These Saturn PCMs were made by Motorola.
If you give me VIN #'s for your Auto and for a Manual, I can pull you files.
Pretty sure I have mapping & checksum info as well...
These Saturn PCMs were made by Motorola.
If you give me VIN #'s for your Auto and for a Manual, I can pull you files.
Pretty sure I have mapping & checksum info as well...