V6 ability for pcm hammer.

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
Post Reply
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

V6 ability for pcm hammer.

Post by Vampyre »

Going to keep This post updated with info so ppl dont have to search for it.


Kernel can be loaded at FF9090
Needs to be smaller than 4018byte

correct size kernel loads

Darkhorizon provided the keyalgo file
gampy found how to implement it

The Code for the P01,P59 is 40
The Code for the P04 is 14

Works like a champ.
key algo is up and running
-Enjoy[/quote]

watchdog info
move.b #$55,($FFFFFA27).w ; 'U'
move.b #$AA,($FFFFFA27).w
bclr #7,($FFFFC006).w
bset #7,($FFFFC006).w

DLC Register info
#define DLC_TRANSMIT_COMMAND (*(unsigned char *)0x00FFE800)
#define DLC_TRANSMIT_FIFO (*(unsigned char *)0x00FFE801)
#define DLC_STATUS (*(unsigned char *)0x00FFF800
#define DLC_RECEIVE_FIFO (*(unsigned char *)0x00FFF801)
Attachments
KeyAlgorithm.txt
(26.04 KiB) Downloaded 392 times
Last edited by Vampyre on Sun May 17, 2020 6:44 am, edited 5 times in total.
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: V6 ability for pcm hammer.

Post by Vampyre »

Since I have multiple seeds and corresponding keys plus all the dif algorithms saved is there a way to build a small program with all the algorithm data and just input seed to see which comes up with correct key.

Sorry if none of this makes since new to the world software side of things. Ive done just enough research so far to have a vague understanding of whats going on with pcm
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: V6 ability for pcm hammer.

Post by antus »

Yep the algorithms are known, dont bother spending long on that. I can tell you which one if you post up a couple of samples. But you can hard code your key and see if you can get the read working, and contribute v6 support to the flash kernel if you can. In that case we can make it official with credit to you.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Gampy
Posts: 2330
Joined: Sat Dec 15, 2018 7:38 am

Re: V6 ability for pcm hammer.

Post by Gampy »

Where/how does one hardcode the algo/key?
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: V6 ability for pcm hammer.

Post by Vampyre »

Antus im new to coding so have no idea how to do that part but I can post a few seed key combos to help out
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: V6 ability for pcm hammer.

Post by Vampyre »

these are all from hw# 9357440 which is standard 99-05 v6 pcm

seed key
254a 8259
450a 8357
51ef abbe

I can get more if need I have friends that own a junkyard
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: V6 ability for pcm hammer.

Post by Vampyre »

successfully wrote new vin to v6 pcm this morning

AVT filter configured
[11:19:34:674] TX: 6C 10 F0 3C 0A
[11:19:34:690] RX: 6C F0 10 7C 0A 00 BA 2D F7
[11:19:34:768] TX: 6C 10 F0 3C 01
[11:19:34:784] RX: 6C F0 10 7C 01 00 31 47 32 4E 56
[11:19:34:784] TX: 6C 10 F0 3C 02
[11:19:34:815] RX: 6C F0 10 7C 02 31 32 45 33 59 4D
[11:19:34:815] TX: 6C 10 F0 3C 03
[11:19:34:830] RX: 6C F0 10 7C 03 37 38 37 31 37 30
[11:19:37:048] Sending seed request.
[11:19:37:048] TX: 6C 10 F0 27 01
[11:19:37:064] RX: 6C F0 10 67 01 25 4A
[11:19:37:080] Parsing seed value.
[11:19:37:080] Sending unlock request (4A25, 8259)
[11:19:37:080] TX: 6C 10 F0 27 02 82 59
[11:19:37:111] RX: 6C F0 10 67 02 34
[11:19:37:173] Changing VIN to 1G2NV12E3YM787170
[11:19:37:173] Block 1
[11:19:37:189] TX: 6C 10 F0 3B 01 00 31 47 32 4E 56
[11:19:37:189] Successful write to block 1
[11:19:37:189] Block 2
[11:19:37:205] TX: 6C 10 F0 3B 02 31 32 45 33 59 4D
[11:19:37:205] Successful write to block 2
[11:19:37:205] Block 3
[11:19:37:220] TX: 6C 10 F0 3B 03 37 38 37 31 37 30
[11:19:37:220] Successful write to block 3
[11:19:37:220] VIN successfully updated to 1G2NV12E3YM787170

now issue is program is trying to validate file, but since its got different check sums comes back as invalid file so cant write or clone.

[11:22:41:268] E:\cals\v6\2000gagt1factoryourvinserial.bin
[11:22:41:393] Validating 512k file.
[11:22:41:393] This file does not contain the expected signature at 0x1FFFE.
[11:22:41:408] Start End Stored Needed Verdict Segment Name
[11:22:41:471] Checksum table is corrupt.
[11:22:41:487] This file is corrupt. It would render your PCM unusable.
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: V6 ability for pcm hammer.

Post by Vampyre »

found out sub mode80 is a no go for P04 but did get it to attempt multi part upload. now to try and get it to stop the sub 80 and see if it loads
Attachments
3818kernelsize2partuploadfailwithunknowsubfailcode.txt
(87.77 KiB) Downloaded 339 times
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: V6 ability for pcm hammer.

Post by Vampyre »

So gampy found some interesting code in P04 asking about intel or amd, Ive opened all my P04 and only found intel chips, but I will head to junk yard and pull apart a few 04-05s and see what they have, also I know the 4cyl pcms used P10 and another pcm but code interchanges between the 2 so that could be a cause also.
User avatar
Gampy
Posts: 2330
Joined: Sat Dec 15, 2018 7:38 am

Re: V6 ability for pcm hammer.

Post by Gampy »

It's official ... The P04 does in fact come with a AMD chip as well!

Lookey see what showed up on our porch a little bit ago ...
2005 Buick Century 4dr Sdn Custom 3.1L (LG8)
OsID: 12594316
SvN: 12583827
HW: 12582720

[Edit]
Pulled with PcmHammer:
2005-Buick-P04-FlashChip.jpg
2005-Buick-P04-FlashChip.jpg (127.54 KiB) Viewed 7940 times
The Unlock short pin,
2005-Buick-P04-Unlock-Pin.jpg
A top view,
2005-Buick-P04-Board-Top.jpg
A bottom view,
2005-Buick-P04-Board-Bottom.jpg

Code: Select all

                // AM29F400BB   
                case 0x000122AB:
                    size = 512 * 1024;
                    description = "AMD AM29F400BB, 512kb";
                    memoryRanges = new MemoryRange[]
                    {
                        new MemoryRange(0x70000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x60000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x50000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x40000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x30000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x20000, 0x10000, BlockType.OperatingSystem), //  64kb main block
                        new MemoryRange(0x10000, 0x10000, BlockType.Calibration), //  64kb calibration block
                        new MemoryRange(0x08000, 0x08000, BlockType.Calibration), //  32kb calibration block
                        new MemoryRange(0x06000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x04000, 0x02000, BlockType.Parameter), //  8kb parameter block
                        new MemoryRange(0x00000, 0x04000, BlockType.Boot), //  16kb boot block
                    };
                    break;
AM29F400B.pdf
(580.77 KiB) Downloaded 360 times
Definitely a different layout, and as David pointed out no BDM header, but I'm sure he'll suss out the pinout.
MCU looks a bit different.
The DLC looks to be the same (If I'm looking at the right chip).

I did notice something else different between this unit and David's unit, his is missing a driver chip that would be the IAC driver on a P01/59.
This unit has a chip there ... though not visible in these images except for the used solder points on the bottom.

Why do some posted images get a Zoom magnifier others don't??
Last edited by Gampy on Sun Nov 29, 2020 7:23 am, edited 3 times in total.
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
Post Reply