VX/VY Flash PCM EEPROM Writing and Mapping
- VL400
- Posts: 4991
- Joined: Sun Mar 01, 2009 2:54 pm
- cars: VL Calais and Toyota Landcruiser. Plus some toys :)
- Location: Perth, WA
- Contact:
VX/VY Flash PCM EEPROM Writing and Mapping
One of the current flashtool tasks has been to get EEPROM writing happening. So to start with I went hunting for routines in the factory code to do it and discovered mode 12 in the VX/VY PCMs. Its a limited EEPROM write mode and you must have already unlocked the PCM using mode 13. The limiting part is it restricts you to only being able to program a certain number of bytes at certain address'. Mode 12 has 9 sub functions that can write to different parts of the EEPROM. There are two tables, one that says for each sub function the address you can write from (0x9152) and the other how many bytes you can write (0x9164).
So after discovering the tables I set about trying to work out what each sub function of Mode 12 does. This is where I am at...
Mode 12 Func 1 - Change the seed/key (4 bytes from 0xE1C)
Mode 12 Func 2 - Control Byte Of Sorts? (1 byte from 0xE7F)
Mode 12 Func 3 - Change the VIN (17 bytes from 0xE20)
Mode 12 Func 4 - Not Used (0 bytes from 0xE31)
Mode 12 Func 5 - Not Used (0 bytes from 0xE31)
Mode 12 Func 6 - Not Used (0 bytes from 0xE31)
Mode 12 Func 7 - ? (10 bytes from 0xE31)
Mode 12 Func 8 - ? (4 bytes from 0xE3B)
Mode 12 Func 9 - ? (12 bytes from 0xE3F)
So part of this is also trying to map out whats in the EEPROM (See attached bin dump including EEPROM of my test bench PCM). The mapping that I have worked out so far of the EEPROM located at 0xE00 to 0xEFF is as follows...
E00 to E07 = Code Base (8Bytes)
E08 to E1B =Some sort of production date code??
E1C/E1D = Seed
E1E/E1F = Key
E20 to E30 = VIN (17Bytes)
E31 to E3A = TIS Key
E3B to E3E = Program Date of PCM
E3F to E4A = Vehicle Data (Engine Type, Trans Type)
E4B to E7E = Free
E7F = MEC
E80 to EBC = Diagnostic Fault Code Logging
EBD = Diagnostic Code Checksum
EBE to EC0 = BCM Security Bytes
EC1 to EC3 = ??
EC4 to EFF = Free
All of this does not really help the flashtool PCM reprogramming as i would like to rewrite the entire EEPROM so am part way through writing a routine to upload via mode 6. But thought it would still be worthwhile to try and map out the EEPROM. If anyone has any other info to share add it here
So after discovering the tables I set about trying to work out what each sub function of Mode 12 does. This is where I am at...
Mode 12 Func 1 - Change the seed/key (4 bytes from 0xE1C)
Mode 12 Func 2 - Control Byte Of Sorts? (1 byte from 0xE7F)
Mode 12 Func 3 - Change the VIN (17 bytes from 0xE20)
Mode 12 Func 4 - Not Used (0 bytes from 0xE31)
Mode 12 Func 5 - Not Used (0 bytes from 0xE31)
Mode 12 Func 6 - Not Used (0 bytes from 0xE31)
Mode 12 Func 7 - ? (10 bytes from 0xE31)
Mode 12 Func 8 - ? (4 bytes from 0xE3B)
Mode 12 Func 9 - ? (12 bytes from 0xE3F)
So part of this is also trying to map out whats in the EEPROM (See attached bin dump including EEPROM of my test bench PCM). The mapping that I have worked out so far of the EEPROM located at 0xE00 to 0xEFF is as follows...
E00 to E07 = Code Base (8Bytes)
E08 to E1B =Some sort of production date code??
E1C/E1D = Seed
E1E/E1F = Key
E20 to E30 = VIN (17Bytes)
E31 to E3A = TIS Key
E3B to E3E = Program Date of PCM
E3F to E4A = Vehicle Data (Engine Type, Trans Type)
E4B to E7E = Free
E7F = MEC
E80 to EBC = Diagnostic Fault Code Logging
EBD = Diagnostic Code Checksum
EBE to EC0 = BCM Security Bytes
EC1 to EC3 = ??
EC4 to EFF = Free
All of this does not really help the flashtool PCM reprogramming as i would like to rewrite the entire EEPROM so am part way through writing a routine to upload via mode 6. But thought it would still be worthwhile to try and map out the EEPROM. If anyone has any other info to share add it here
- Attachments
-
- VY_PCM_BIN.zip
- (56.87 KiB) Downloaded 603 times
-
- Posts: 1215
- Joined: Sun Mar 15, 2009 10:20 am
- cars: 2004 VYII Acclaim Wagon V6 Auto LPG/Petrol
2004 VYII Berlina sedan V6 Auto
2005 VZ Monaro CV8 manual - Location: Geelong, VIC
Re: VX/VY Flash PCM EEPROM Writing and Mapping
VL400,
Excellent work.
Would any other dumps from EEPROM's help?
yoda69
Excellent work.
Would any other dumps from EEPROM's help?
yoda69
-
- Posts: 440
- Joined: Sun Mar 22, 2009 11:52 am
- cars: VT V6 supercharged in a corolla
- Location: Sydney
- Contact:
Re: VX/VY Flash PCM EEPROM Writing and Mapping
EEPROM E0 - EE (17 bytes) is also printed on the white bar graph sticker on the A,B,C,D input sockets.
- Holden202T
- Posts: 10311
- Joined: Sat Feb 28, 2009 9:05 pm
- Location: Tenambit, NSW
- Contact:
Re: VX/VY Flash PCM EEPROM Writing and Mapping
do you mean the plugs on the pcm where the loom plugs into ?kojab wrote:EEPROM E0 - EE (17 bytes) is also printed on the white bar graph sticker on the A,B,C,D input sockets.
No matter what the question is, the answer is always more horsepower!
Just starting out? Have a read of the getting started guide
Basic tuning of a delco ECM with $12P thread
Advanced tuning of a delco ECM with $12P thread
Just starting out? Have a read of the getting started guide
Basic tuning of a delco ECM with $12P thread
Advanced tuning of a delco ECM with $12P thread
- Doctor Bob
- Posts: 195
- Joined: Mon Mar 02, 2009 10:58 pm
- cars: VN, VT
- Location: Melbourne Vic.
- Contact:
Re: VX/VY Flash PCM EEPROM Writing and Mapping
email sent
i will try to get a log of a factory reflash.
they use a similar sequence to the LS1 as i understand, a bootloader routine needs to be put into it that carries out the erase & program.
i will try to get a log of a factory reflash.
they use a similar sequence to the LS1 as i understand, a bootloader routine needs to be put into it that carries out the erase & program.
- VL400
- Posts: 4991
- Joined: Sun Mar 01, 2009 2:54 pm
- cars: VL Calais and Toyota Landcruiser. Plus some toys :)
- Location: Perth, WA
- Contact:
Re: VX/VY Flash PCM EEPROM Writing and Mapping
Thanks rob, will check it out tomorrow.
- VL400
- Posts: 4991
- Joined: Sun Mar 01, 2009 2:54 pm
- cars: VL Calais and Toyota Landcruiser. Plus some toys :)
- Location: Perth, WA
- Contact:
Re: VX/VY Flash PCM EEPROM Writing and Mapping
The contents of my bench PCM's EEPROM is now this....
Code: Select all
00000000h: 31 37 32 38 44 54 43 46 32 31 30 33 30 35 39 FF ; 1728DTCF2103059ÿ
00000010h: F2 F2 F1 7E FF FF FF FF FF FF FF FF 76 FC 96 D7 ; òòñ~ÿÿÿÿÿÿÿÿvü–×
00000020h: 36 47 31 59 4B 38 32 41 32 33 4C 39 38 39 31 33 ; 6G1YK82A23L98913
00000030h: 30 FF FF FF FF FF FF FF FF FF FF 14 03 20 03 FF ; 0ÿÿÿÿÿÿÿÿÿÿ.. .ÿ
00000040h: FF 00 F8 3E DC 00 F8 3F B6 FF FF FF FF FF FF FF ; ÿ.ø>Ü.ø?¶ÿÿÿÿÿÿÿ
00000050h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ.
00000080h: 15 99 03 FF 08 2E 2E 28 7E 01 78 00 0B B0 00 03 ; .™.ÿ...(~.x..°..
00000090h: 42 02 FF 7A 79 00 FF 7D 00 7D 00 05 BC 00 05 06 ; B.ÿzy.ÿ}.}..¼...
000000a0h: 01 FF 1F 3A 73 DC 06 00 50 00 17 B0 00 00 00 00 ; .ÿ.:sÜ..P..°....
000000b0h: 00 00 00 00 00 00 00 00 00 00 00 00 04 B6 1C D0 ; .............¶.Ð
000000c0h: 04 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF ; ....ÿÿÿÿÿÿÿÿÿÿÿÿ
000000d0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000e0h: 48 45 4C 4C 4F 20 57 4F 52 4C 44 21 21 20 FF FF ; HELLO WORLD!! ÿÿ
000000f0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
- Doctor Bob
- Posts: 195
- Joined: Mon Mar 02, 2009 10:58 pm
- cars: VN, VT
- Location: Melbourne Vic.
- Contact:
Re: VX/VY Flash PCM EEPROM Writing and Mapping
lol thats funny
glad its coming together
did you get that email?
glad its coming together
did you get that email?
- VL400
- Posts: 4991
- Joined: Sun Mar 01, 2009 2:54 pm
- cars: VL Calais and Toyota Landcruiser. Plus some toys :)
- Location: Perth, WA
- Contact:
Re: VX/VY Flash PCM EEPROM Writing and Mapping
Sure did, thanks Doc