PCMTec Development Blog

[luke111]

the HP tuner i had took around 2 mins 20sec to flash.
best price i can find for a new open port 2.0 on ebay usa is about $370 to my door.
the hp tuner is around $700.

any luck getting it to work with vc diag? they are a lot cheaper.
I will order an open port if you think it will work the best for me.
Im keen to test on my spare ecu. I dont care if I brick it, only cost $50 from local wreckers & he's got plenty more.
I also thought about upgrading the BF ecu so I can have the dual vct.

Here's a pic of the BA PCM; A3AC 3R23-12A650-AAC ABU-242

[rolls]

Where did you get that price from? Someone is ripping them off but the sounds of it.

Should only be $180 usd if you buy it direct. Not only is open port cheaper it seems to work better than other devices. It also has a proprietary iso15675 sniffing mode built in which is super useful for sniffing flash routines.

They also do 4 day delivery to Australia which is great.

[luke111]

so i ordered the open port 2.0 direct from tactrix.
$250AUD delivered

[rolls]

Almost finished my auto detection code. Have implemented only BA/BF/FG but if someone can run my Sniffer on green/silver I should be able to quickly implement those as well. Will send something out to you guys that are testing the app out in a few days.

If anyone is wondering how I did it I got a massive PHF dump from IDS, parsed the PHF files and built a table of all strategies and their ECU type. All of this info will be available in an XML format in the final program so you can easily add more.

I've spent a lot of time on my CAN bus sniffer so it filters and logs all comms with human readable text, makes implementing the flash routines super easy as I decode all the packets. Here is an example of the detail the sniffer will give you, should work on completely different vehicles as well.

Next step is to write something to sniff and decode DMRs then I'll get back to working on my main GUI.

4:12:55 PM
Length: 0x8 Data: 0x00 00 07 E0 B1 00 B2 AA
ProtocolID: ISO15765
UDS command DIAGNOSTIC_COMMAND
Diagnostic Command: ERASE_FLASH

4:12:55 PM
Length: 0x7 Data: 0x00 00 07 E8 7F B1 78
ProtocolID: ISO15765
NEGATIVE_RESPONSE to command DIAGNOSTIC_COMMAND
NEGATIVE_RESPONSE code RESPONSE_PENDING

4:13:03 PM
Length: 0x7 Data: 0x00 00 07 E8 F1 00 B2
ProtocolID: ISO15765
SUCCESSFUL_RESPONSE to UDS command DIAGNOSTIC_COMMAND

4:13:03 PM
Length: 0xD Data: 0x00 00 07 E0 34 00 01 00 00 00 0F 00 00
ProtocolID: ISO15765
UDS command REQUEST_DOWNLOAD
Write Address: 0x00010000
Data Size: 0x000F0000

4:13:03 PM
Length: 0x7 Data: 0x00 00 07 E8 7F 34 78
ProtocolID: ISO15765
NEGATIVE_RESPONSE to command REQUEST_DOWNLOAD
NEGATIVE_RESPONSE code RESPONSE_PENDING

4:13:03 PM
Length: 0x7 Data: 0x00 00 07 E8 74 04 01
ProtocolID: ISO15765
SUCCESSFUL_RESPONSE to UDS command REQUEST_DOWNLOAD

4:13:03 PM
Length: 0x405 Data: 0x00 00 07 E0 36 3C 60 00 01 60 63 8E 50 7C 69 03 A6 4E 80 04 20 A7 95 9E BB FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 48 41 43 43 4B 47 41 2E 48 45 58 2A FF 05 35 52 32 39 41 47 46 2A FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 43 6F 70 79 72 69 67 68 74 20 46 6F 72 64 20 4D 6F 74 6F 72 20 43 6F 2E 20 32 30 30 37 36 46 50 41 41 41 4A 47 53 57 36 41 34 38 36 32 39 FF FF FF FF 2A FF FF FF E6 03 39 0E E8 FF 00 FF 41 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF B0 AE FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 48 41 43 43 4B 08 08 08 09 08 08 08 08 08 08 08 11 90 94 55 D0 51 4D 08 08 00 00 00 00 00 00 00 D0 91 16 08 08 08 08 08 08 08 08 08 08 ....
ProtocolID: ISO15765
UDS command TRANSFER_DATA
Block Number: 0x1
Bytes Transfered: 0x400

4:01:16 PM
Length: 0xC Data: 0x00 00 07 E8 25 E0 00 40 3B FF B8 14
ProtocolID: CAN
UDS command STOP_REPEATED_DATA_TRANSMISSION

4:01:16 PM
Length: 0x805 Data: 0x00 00 07 E8 63 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ....
SUCCESSFUL_RESPONSE to UDS command READ_MEMORY_BY_ADDRESS
Block Number: 0x200
Bytes Read: 0x100000

[roughneck427]

Awesome work!!

[Tazzi]

Woohoo! Nice!

[galapogos01]

Amazing progress you're making here rolls.

[Tazzi]

Here's a pic of the BA PCM; A3AC 3R23-12A650-AAC ABU-242

How did you go about getting the back plate off? Its well and truly stuck down.

[luke111]

Here's a pic of the BA PCM; A3AC 3R23-12A650-AAC ABU-242

How did you go about getting the back plate off? Its well and truly stuck down.

I think I used a small screwdriver to pry it off. I butchered it though. It will never go back on again

I was going to try and connect with BDM to it. I found some stuff in the UK where guys have done it with ford fiesta mpc555 ecu's.
I just never got around to figuring out the pins on the board.

[Tazzi]

Here's a pic of the BA PCM; A3AC 3R23-12A650-AAC ABU-242

How did you go about getting the back plate off? Its well and truly stuck down.

I think I used a small screwdriver to pry it off. I butchered it though. It will never go back on again

I was going to try and connect with BDM to it. I found some stuff in the UK where guys have done it with ford fiesta mpc555 ecu's.
I just never got around to figuring out the pins on the board.

Anychance you could do some closer pics of the board? Might help identify chips and things to possibly attack.

At minimum.. at least will be able to pinpoint the required pins for the MCU, and can back trace from their with a probe or direct connect from the chip.