pcmhacking.net

julespatch wrote:Hey yes it definitely works! Just disconnect the key reader if your in the car!
You only need to write the eeprom, just 00 it out like above.

So to confirm you have it all working by just zeroing out the Eprom data in above locations?

hsv08 wrote:

julespatch wrote:Hey yes it definitely works! Just disconnect the key reader if your in the car!
You only need to write the eeprom, just 00 it out like above.

So to confirm you have it all working by just zeroing out the Eprom data in above locations?

Yep, confirmed

I also can confirm that it works, we have the ECU as a standalone now with no known issues (haven't hit the dyno yet)

The process was simple, BDM read EEPROM with KTAG, write Julespatch's IMMO off file from MHHauto, job done.

Having looked deep into this it appears that PCMflash can read the EEPROM via OBD, that will be the way I do this next time.

I found another thread relating to immo off on med9.6.1 and it looks like all they did was fill in the whole block with FF. I'm assuming you just have to disable some kind of jump?

Hiya,
Following along as best I can, in 8 bit land, it will just keep going forward until another instruction op code. In most code I follow, we will jump to the end of the end of a subset to keep the stack correct, "ret, rts or eret". Of course, in this instance it never gets "jumped" and doesn't affect the stack. Interesting, they use FF which is normally a 00 as well.

Are you thinking this is code? I think its parameter data, and one or more of those fields are the VATS flag. First person probably just cleared a chunk of it and hit the right flags with a sledge hammer, next person narrowed it down better, but maybe there is only 2 or 3 bits that need to be set or cleared. Strange that one person cleared the data, the other set the data. I have a feeling both are not right, and we know the clear one is verified.

antus wrote:Are you thinking this is code? I think its parameter data, and one or more of those fields are the VATS flag. First person probably just cleared a chunk of it and hit the right flags with a sledge hammer, next person narrowed it down better, but maybe there is only 2 or 3 bits that need to be set or cleared. Strange that one person cleared the data, the other set the data. I have a feeling both are not right, and we know the clear one is verified.

Agreed, it could simply be data and not code. Again, I am just trying to follow along. Parameter data still gets set upon boot and in my mind is something the ecm "decides"
Fix the boot and no parameter area will be affected. Just thoughts

I believe this data is in a small stand alone eeprom of to the side of the main flash and ram, its not a logical place for code, and is not written at boot. Yes there will have to be code somewhere else, but this is about setting the flags.

Interesting thoughts. I know nothing about the e77. The e38,e67,e78,e92 has its' "slave modules" and interestingly enough, this is where the permanent codes are stored that cause an instant failure at smog time here in Calif if not fixed

This is a Bosch platform, and even though it was used by GM, it is a completely different heritage to the delco/delphi pcms and a different way of doing things.