VX/VY Flash PCM EEPROM Writing and Mapping

[VL400]

One of the current flashtool tasks has been to get EEPROM writing happening. So to start with I went hunting for routines in the factory code to do it and discovered mode 12 in the VX/VY PCMs. Its a limited EEPROM write mode and you must have already unlocked the PCM using mode 13. The limiting part is it restricts you to only being able to program a certain number of bytes at certain address'. Mode 12 has 9 sub functions that can write to different parts of the EEPROM. There are two tables, one that says for each sub function the address you can write from (0x9152) and the other how many bytes you can write (0x9164).

So after discovering the tables I set about trying to work out what each sub function of Mode 12 does. This is where I am at...

Mode 12 Func 1 - Change the seed/key (4 bytes from 0xE1C)
Mode 12 Func 2 - Control Byte Of Sorts? (1 byte from 0xE7F)
Mode 12 Func 3 - Change the VIN (17 bytes from 0xE20)
Mode 12 Func 4 - Not Used (0 bytes from 0xE31)
Mode 12 Func 5 - Not Used (0 bytes from 0xE31)
Mode 12 Func 6 - Not Used (0 bytes from 0xE31)
Mode 12 Func 7 - ? (10 bytes from 0xE31)
Mode 12 Func 8 - ? (4 bytes from 0xE3B)
Mode 12 Func 9 - ? (12 bytes from 0xE3F)

So part of this is also trying to map out whats in the EEPROM (See attached bin dump including EEPROM of my test bench PCM). The mapping that I have worked out so far of the EEPROM located at 0xE00 to 0xEFF is as follows...
E00 to E07 = Code Base (8Bytes)
E08 to E1B =Some sort of production date code??
E1C/E1D = Seed
E1E/E1F = Key
E20 to E30 = VIN (17Bytes)
E31 to E3A = TIS Key
E3B to E3E = Program Date of PCM
E3F to E4A = Vehicle Data (Engine Type, Trans Type)
E4B to E7E = Free
E7F = MEC
E80 to EBC = Diagnostic Fault Code Logging
EBD = Diagnostic Code Checksum
EBE to EC0 = BCM Security Bytes
EC1 to EC3 = ??
EC4 to EFF = Free



All of this does not really help the flashtool PCM reprogramming as i would like to rewrite the entire EEPROM so am part way through writing a routine to upload via mode 6. But thought it would still be worthwhile to try and map out the EEPROM. If anyone has any other info to share add it here

[yoda69]

VL400,
Excellent work.
Would any other dumps from EEPROM's help?

yoda69

[kojab]

EEPROM E0 - EE (17 bytes) is also printed on the white bar graph sticker on the A,B,C,D input sockets.

[Holden202T]

EEPROM E0 - EE (17 bytes) is also printed on the white bar graph sticker on the A,B,C,D input sockets.

do you mean the plugs on the pcm where the loom plugs into ?

[kojab]

Yes

[Doctor Bob]

email sent
i will try to get a log of a factory reflash.
they use a similar sequence to the LS1 as i understand, a bootloader routine needs to be put into it that carries out the erase & program.

[VL400]

Thanks rob, will check it out tomorrow.

[VL400]

The contents of my bench PCM's EEPROM is now this....

Code: Select all

00000000h: 31 37 32 38 44 54 43 46 32 31 30 33 30 35 39 FF ; 1728DTCF2103059ÿ
00000010h: F2 F2 F1 7E FF FF FF FF FF FF FF FF 76 FC 96 D7 ; òòñ~ÿÿÿÿÿÿÿÿvü–×
00000020h: 36 47 31 59 4B 38 32 41 32 33 4C 39 38 39 31 33 ; 6G1YK82A23L98913
00000030h: 30 FF FF FF FF FF FF FF FF FF FF 14 03 20 03 FF ; 0ÿÿÿÿÿÿÿÿÿÿ.. .ÿ
00000040h: FF 00 F8 3E DC 00 F8 3F B6 FF FF FF FF FF FF FF ; ÿ.ø>Ü.ø?¶ÿÿÿÿÿÿÿ
00000050h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000060h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00000070h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ.
00000080h: 15 99 03 FF 08 2E 2E 28 7E 01 78 00 0B B0 00 03 ; .™.ÿ...(~.x..°..
00000090h: 42 02 FF 7A 79 00 FF 7D 00 7D 00 05 BC 00 05 06 ; B.ÿzy.ÿ}.}..¼...
000000a0h: 01 FF 1F 3A 73 DC 06 00 50 00 17 B0 00 00 00 00 ; .ÿ.:sÜ..P..°....
000000b0h: 00 00 00 00 00 00 00 00 00 00 00 00 04 B6 1C D0 ; .............¶.Ð
000000c0h: 04 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF ; ....ÿÿÿÿÿÿÿÿÿÿÿÿ
000000d0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000000e0h: 48 45 4C 4C 4F 20 57 4F 52 4C 44 21 21 20 FF FF ; HELLO WORLD!! ÿÿ
000000f0h: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ; ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

[Doctor Bob]

lol thats funny
glad its coming together
did you get that email?

[VL400]

Sure did, thanks Doc