Reading eeprom from delco PCM, MC68336 based

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
User avatar
j_ds_au
Posts: 384
Joined: Sun Jan 25, 2015 4:21 pm
Location: Sydney

Re: Reading eeprom from delco PCM, MC68336 based

Post by j_ds_au »

Wouldn't it be better to use the BDM, now you've got that sorted?

Joe.
iblackford
Posts: 43
Joined: Fri Mar 20, 2015 4:34 am
cars: saturn

Re: Reading eeprom from delco PCM, MC68336 based

Post by iblackford »

So after a month of pool openings, tree removals, and engine swaps (other vehicle...)...I'm back trying to get this finished. I apologize for not following up sooner. I have attached the dump from the manual pcm...here's hoping that something intelligent can come of it. :)
Attachments
pcmmanual.bin
(1 MiB) Downloaded 416 times
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: Reading eeprom from delco PCM, MC68336 based

Post by antus »

That looks like a good read. Can you post up the other one your trying to merge it with?
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
iblackford
Posts: 43
Joined: Fri Mar 20, 2015 4:34 am
cars: saturn

Re: Reading eeprom from delco PCM, MC68336 based

Post by iblackford »

It's a few posts back, but I have included it again. I did try to compare the two, and I noticed a few things:

-even though one is a manual, and one is an auto, the code size seems very similar...enough that I suspect the code to control all features exists in both versions, but there are flags enabled in the auto version to trigger running of the auto code
-the MFS blocks at 0x4000 & 0x6000 are formatted a little differently between the two, I don't think a direct swap would be sufficient between the two
-the versions of the code are different between the two, I think much more would be similar if I had the same version in both pcm's, but I don't unfortunately.

A few comments:
1) I would like to figure out a little more of this code using IDA. In what format are the reset and interrupt vectors? Are they jump instructions, or pure vectors?
2) When modifying the bin, how would I recalculate the checksum?
3) since the hardware seems to be similar, I'm going to try programming the auto bin into the manual and see if it works. This would confirm at least that the fuel continue password is stored in the eeprom, as I suspect (I can't see any programmable devices that would store it otherwise...it's more of a quick test that I can do...)
Attachments
sl2_auto.bin
(1 MiB) Downloaded 422 times
iblackford
Posts: 43
Joined: Fri Mar 20, 2015 4:34 am
cars: saturn

Re: Reading eeprom from delco PCM, MC68336 based

Post by iblackford »

I made a bit of a mistake...I thought I had two good reads, the auto and the manual, so I programmed the manual with the auto build, and it didn't work...I had done two reads of the manual before programming it, and it turns out they are different, by quite a bit...:(

Now I am back to just having a working auto pcm..:(
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: Reading eeprom from delco PCM, MC68336 based

Post by antus »

crap. might need to read at a slower speed, if you can get another data source :(

a1) vectors are pure vectors. See the processor datasheet for more information. These are bottom fill layout.
a2) thats a good question. sum will probably be a plain sum (not crc), and 16 bit. The data will likely be the 2nd and 3rd bytes of the segment, or the last 2, or failing that really close to the start. Can figure it out with trial and error if you can correctly guess the size of the area. If a couple of educated guesses dont get you anywhere you can try and brute force it with a pc program that sums ranges with differing start and end addresses (but in the area you suspect) and then looks for the sum nearby. Once you find a match, can test another bin image and see if it lines up the same.
a3) doh! :( I had a bit of a compare of the bins you posted.. they looked close but a little odd. seems be some duplicated rows. From what you say, that now sounds like bad reads :(
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
iblackford
Posts: 43
Joined: Fri Mar 20, 2015 4:34 am
cars: saturn

Re: Reading eeprom from delco PCM, MC68336 based

Post by iblackford »

The 2nd read I did looks much closer to the auto pcm...but I'm kind of frustrated tonight and I haven't looked that closely at it. The blocks at 0x4000 & 0x6000 format looks very similar.
Attachments
pcmmanual2.bin
(1 MiB) Downloaded 376 times
iblackford
Posts: 43
Joined: Fri Mar 20, 2015 4:34 am
cars: saturn

Re: Reading eeprom from delco PCM, MC68336 based

Post by iblackford »

I got a guy to send me the eeprom from another manual pcm. I put it in my pcm and confirmed that it works (starts the car and dies immediately because it hasn't got the right fuel continue password)

I then read 2x on my programmer and verified the results are identical. I have attached the file.
Attachments
verified_read_manual.bin
(1 MiB) Downloaded 404 times
iblackford
Posts: 43
Joined: Fri Mar 20, 2015 4:34 am
cars: saturn

Re: Reading eeprom from delco PCM, MC68336 based

Post by iblackford »

I also wrote the new manual code to another eeprom, and read verified it. I tried it in the pcm...identical behavior, so my burn was successful.

Ivan
beyerch
Posts: 26
Joined: Sat May 22, 2010 8:36 am
cars: all kinds

Re: Reading eeprom from delco PCM, MC68336 based

Post by beyerch »

Sorry for late reply.

These Saturn PCMs were made by Motorola.

If you give me VIN #'s for your Auto and for a Manual, I can pull you files.

Pretty sure I have mapping & checksum info as well...
Post Reply