V6 ability for pcm hammer.

They go by many names, P01, P59, VPW, '0411 etc . Circa 1999 to 2006. All VPW OBD2 PCMs.
Posts: 181
Joined: Wed Dec 06, 2017 1:02 pm

V6 ability for pcm hammer.

Postby Vampyre » Mon Nov 25, 2019 12:06 pm

Going to keep This post updated with info so ppl dont have to search for it.


Kernel can be loaded at FF9090
Needs to be smaller than 4018byte

correct size kernel loads

Darkhorizon provided the keyalgo file
gampy found how to implement it

The Code for the P01,P59 is 40
The Code for the P04 is 14

Works like a champ.
key algo is up and running
-Enjoy[/quote]

watchdog info
move.b #$55,($FFFFFA27).w ; 'U'
move.b #$AA,($FFFFFA27).w
bclr #7,($FFFFC006).w
bset #7,($FFFFC006).w

DLC Register info
#define DLC_TRANSMIT_COMMAND (*(unsigned char *)0x00FFE800)
#define DLC_TRANSMIT_FIFO (*(unsigned char *)0x00FFE801)
#define DLC_STATUS (*(unsigned char *)0x00FFF800
#define DLC_RECEIVE_FIFO (*(unsigned char *)0x00FFF801)
Attachments
KeyAlgorithm.txt
(26.04 KiB) Downloaded 94 times
Last edited by Vampyre on Sun May 17, 2020 6:44 am, edited 5 times in total.

Posts: 181
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Mon Nov 25, 2019 12:07 pm

Since I have multiple seeds and corresponding keys plus all the dif algorithms saved is there a way to build a small program with all the algorithm data and just input seed to see which comes up with correct key.

Sorry if none of this makes since new to the world software side of things. Ive done just enough research so far to have a vague understanding of whats going on with pcm

Site Admin
User avatar
Posts: 6182
Joined: Sat Feb 28, 2009 8:34 pm

Re: V6 ability for pcm hammer.

Postby antus » Mon Nov 25, 2019 6:27 pm

Yep the algorithms are known, dont bother spending long on that. I can tell you which one if you post up a couple of samples. But you can hard code your key and see if you can get the read working, and contribute v6 support to the flash kernel if you can. In that case we can make it official with credit to you.
Have you read the FAQ? For lots of information and links to significant threads see here: viewtopic.php?f=7&t=1396

User avatar
Posts: 575
Joined: Sat Dec 15, 2018 7:38 am

Re: V6 ability for pcm hammer.

Postby Gampy » Mon Nov 25, 2019 9:51 pm

Where/how does one hardcode the algo/key?
I'm not angry, I'm a blatant, driven, passionate individual that is extremely intense!

Posts: 181
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Tue Nov 26, 2019 7:12 am

Antus im new to coding so have no idea how to do that part but I can post a few seed key combos to help out

Posts: 181
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Tue Nov 26, 2019 10:48 am

these are all from hw# 9357440 which is standard 99-05 v6 pcm

seed key
254a 8259
450a 8357
51ef abbe

I can get more if need I have friends that own a junkyard

Posts: 181
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Sat Nov 30, 2019 3:34 am

successfully wrote new vin to v6 pcm this morning

AVT filter configured
[11:19:34:674] TX: 6C 10 F0 3C 0A
[11:19:34:690] RX: 6C F0 10 7C 0A 00 BA 2D F7
[11:19:34:768] TX: 6C 10 F0 3C 01
[11:19:34:784] RX: 6C F0 10 7C 01 00 31 47 32 4E 56
[11:19:34:784] TX: 6C 10 F0 3C 02
[11:19:34:815] RX: 6C F0 10 7C 02 31 32 45 33 59 4D
[11:19:34:815] TX: 6C 10 F0 3C 03
[11:19:34:830] RX: 6C F0 10 7C 03 37 38 37 31 37 30
[11:19:37:048] Sending seed request.
[11:19:37:048] TX: 6C 10 F0 27 01
[11:19:37:064] RX: 6C F0 10 67 01 25 4A
[11:19:37:080] Parsing seed value.
[11:19:37:080] Sending unlock request (4A25, 8259)
[11:19:37:080] TX: 6C 10 F0 27 02 82 59
[11:19:37:111] RX: 6C F0 10 67 02 34
[11:19:37:173] Changing VIN to 1G2NV12E3YM787170
[11:19:37:173] Block 1
[11:19:37:189] TX: 6C 10 F0 3B 01 00 31 47 32 4E 56
[11:19:37:189] Successful write to block 1
[11:19:37:189] Block 2
[11:19:37:205] TX: 6C 10 F0 3B 02 31 32 45 33 59 4D
[11:19:37:205] Successful write to block 2
[11:19:37:205] Block 3
[11:19:37:220] TX: 6C 10 F0 3B 03 37 38 37 31 37 30
[11:19:37:220] Successful write to block 3
[11:19:37:220] VIN successfully updated to 1G2NV12E3YM787170

now issue is program is trying to validate file, but since its got different check sums comes back as invalid file so cant write or clone.

[11:22:41:268] E:\cals\v6\2000gagt1factoryourvinserial.bin
[11:22:41:393] Validating 512k file.
[11:22:41:393] This file does not contain the expected signature at 0x1FFFE.
[11:22:41:408] Start End Stored Needed Verdict Segment Name
[11:22:41:471] Checksum table is corrupt.
[11:22:41:487] This file is corrupt. It would render your PCM unusable.

Posts: 181
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Fri Jan 10, 2020 3:35 am

found out sub mode80 is a no go for P04 but did get it to attempt multi part upload. now to try and get it to stop the sub 80 and see if it loads
Attachments
3818kernelsize2partuploadfailwithunknowsubfailcode.txt
(87.77 KiB) Downloaded 99 times

Posts: 181
Joined: Wed Dec 06, 2017 1:02 pm

Re: V6 ability for pcm hammer.

Postby Vampyre » Fri Jan 10, 2020 3:47 am

So gampy found some interesting code in P04 asking about intel or amd, Ive opened all my P04 and only found intel chips, but I will head to junk yard and pull apart a few 04-05s and see what they have, also I know the 4cyl pcms used P10 and another pcm but code interchanges between the 2 so that could be a cause also.

User avatar
Posts: 575
Joined: Sat Dec 15, 2018 7:38 am

Re: V6 ability for pcm hammer.

Postby Gampy » Fri Jan 10, 2020 4:35 am

It's official ... The P04 does in fact come with a AMD chip as well!

Lookey see what showed up on our porch a little bit ago ...
2005 Buick Century 4dr Sdn Custom 3.1L (LG8)
OsID: 12594316
SvN: 12583827
HW: 12582720

2005-Buick-P04-FlashChip.jpg
2005-Buick-P04-FlashChip.jpg (127.54 KiB) Viewed 2648 times

The Unlock short pin,
2005-Buick-P04-Unlock-Pin.jpg

A top view,
2005-Buick-P04-Board-Top.jpg

A bottom view,
2005-Buick-P04-Board-Bottom.jpg


Code: Select all
                // AM29F400BB   
                case 0x000122AB:
                    size = 512 * 1024;
                    description = "AMD AM29F400BB, 512kb";
                    memoryRanges = new MemoryRange[]
                    {
                        new MemoryRange(0x70000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x60000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x50000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x40000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x30000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x20000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x10000, 0x10000, BlockType.Calibration), //  64kb calibration block
                        new MemoryRange(0x08000, 0x08000, BlockType.Calibration), //  32kb calibration block
                        new MemoryRange(0x06000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x04000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x00000, 0x04000, BlockType.Boot), //  16kb boot block
                    };
                    break;

AM29F400B.pdf
(580.77 KiB) Downloaded 84 times

Definitely a different layout, and as David pointed out no BDM header, but I'm sure he'll suss out the pinout.
MCU looks a bit different.
The DLC looks to be the same (If I'm looking at the right chip).

I did notice something else different between this unit and David's unit, his is missing a driver chip that would be the IAC driver on a P01/59.
This unit has a chip there ... though not visible in these images except for the used solder points on the bottom.

Why do some posted images get a Zoom magnifier others don't??
Last edited by Gampy on Fri Jan 10, 2020 8:07 am, edited 1 time in total.
I'm not angry, I'm a blatant, driven, passionate individual that is extremely intense!

Next

Return to GM LS1 512Kbyte and 1Mbyte

Who is online

Users browsing this forum: jlvaldez and 3 guests