pcmhacking.net

Posted: **Sat Dec 10, 2022 4:17 pm**

That's interesting. I get perfect results even at different read sizes. I wonder what's different?
I'm using OBDx Pro VT can that play a difference?

Code: Select all

[10:13:08:189]  Loaded C:\Users\stamp\source\repos\PcmHacks\Apps\PcmHammer\bin\Debug\Kernel-P04-Test.bin
[10:13:08:196]  Sending upload request for kernel size 1034, loadaddress FF9076
[10:13:08:205]  XPro: 20 01 00 DE
[10:13:08:209]  TX: 6C 10 F0 34 00 04 0A FF 90 76
[10:13:08:216]  RX: 6C F0 10 74 00 44
[10:13:08:220]  Going to load a 1034 byte kernel to 0xFF9076
[10:13:08:224]  Sending end block payload with offset 0x0, start address 0xFF9076, length 0x40A.
[10:13:08:479]  XPro: 21 01 00 DD
[10:13:08:484]  TX: 6D 10 F0 36 80 04 0A FF 90 76 61 00 01 62 13 FC 00 03 00 FF E8 00 13 FC 00 00 00 FF E8 01 61 00 00 F6 61 00 01 4A 10 39 00 FF E8 00 02 00 00 E0 0C 00 00 E0 66 E8 10 39 00 FF E8 01 61 00 00 FA 61 00 03 0A 0C 39 00 20 00 FF 94 37 66 00 00 2A 20 7C 00 FF 94 44 20 39 00 FF 94 48 61 00 01 1A 13 FC 00 40 00 FF E8 00 13 FC 00 00 00 FF E8 01 61 00 00 C6 4E 70 60 FE 0C 39 00 35 00 FF 94 37 67 0E 0C 39 00 3D 00 FF 94 37 67 36 60 00 FF B2 42 80 80 39 00 FF 94 3B E1 88 80 39 00 FF 94 3C E1 88 80 39 00 FF 94 3D 20 40 42 80 80 39 00 FF 94 39 E1 88 80 39 00 FF 94 3A 61 00 01 98 60 00 FF 80 0C 39 00 00 00 FF 94 38 67 0E 0C 39 00 01 00 FF 94 38 67 18 60 00 FF 68 20 7C 00 FF 94 5A 20 39 00 FF 94 64 61 00 00 90 60 00 FF 54 76 01 61 00 00 DC 61 00 01 22 61 00 00 1C 23 C4 00 FF 94 52 20 7C 00 FF 94 4D 20 39 00 FF 94 56 61 00 00 68 60 00 FF 2C 13 FC 00 55 00 FF FA 27 13 FC 00 AA 00 FF FA 27 13 FC 00 50 00 FF C0 06 13 FC 00 A0 00 FF C0 06 4E 75 2A 3C 00 00 27 10 61 D6 61 00 00 2C 61 00 00 28 61 00 00 24 61 00 00 20 61 00 00 1C 61 00 00 18 61 00 00 14 61 00 00 10 61 00 00 0C 61 00 00 08 51 CD FF D4 4E 75 4E 71 4E 71 4E 71 4E 71 4E 75 55 40 61 9A 13 FC 00 14 00 FF E8 00 13 D8 00 FF E8 01 61 E2 51 C8 FF F6 13 FC 00 0C 00 FF E8 00 13 D8 00 FF E8 01 61 CE 13 FC 00 03 00 FF E8 00 13 FC 00 00 00 FF E8 01 61 00 FF 64 61 B8 10 39 00 FF E8 00 02 00 00 E0 0C 00 00 E0 66 EA 10 39 00 FF E8 01 4E 75 61 00 FF 46 33 FC 00 07 00 FF FA 48 33 FC 68 20 00 FF FA 4A 33 FC 00 07 00 FF FA 4C 0C 03 00 01 67 12 33 FC 10 60 00 FF FA 4E 02 79 FF FE FF FF E2 FA 60 10 33 FC 70 60 00 FF FA 4E 00 79 00 01 FF FF E2 FA 61 00 FF 24 4E 75 61 00 FE FC 33 FC 00 07 00 FF FA 4C 33 FC 68 20 00 FF FA 4A 33 FC 70 60 00 FF FA 4E 33 FC 90 90 00 00 00 00 28 39 00 00 00 00 33 FC FF FF 00 00 00 00 33 FC 10 60 00 FF FA 4E 4E 75 61 00 FE C0 22 08 13 C1 00 FF 94 79 E0 89 13 C1 00 FF 94 78 E0 89 13 C1 00 FF 94 77 22 00 13 C1 00 FF 94 76 E0 89 13 C1 00 FF 94 75 72 09 22 7C 00 FF 94 70 13 FC 00 14 00 FF E8 00 13 D9 00 FF E8 01 61 00 FE 7E 51 C9 FF F4 61 00 FE 76 53 80 42 81 42 82 14 39 00 FF 94 74 D2 82 14 39 00 FF 94 75 D2 82 14 39 00 FF 94 76 D2 82 14 39 00 FF 94 77 D2 82 14 39 00 FF 94 78 D2 82 14 39 00 FF 94 79 D2 82 61 00 FE 3C 14 39 00 FF E8 00 02 02 00 03 0C 02 00 03 67 EC 13 FC 00 04 00 FF E8 00 13 D0 00 FF E8 01 14 18 D2 82 51 C8 FF D8 20 01 E0 88 61 00 FE 0E 14 39 00 FF E8 00 02 02 00 03 0C 02 00 03 67 EC 13 FC 00 04 00 FF E8 00 13 C0 00 FF E8 01 61 00 FD EC 14 39 00 FF E8 00 02 02 00 03 0C 02 00 03 67 EC 13 FC 00 0C 00 FF E8 00 13 C1 00 FF E8 01 4E 75 42 86 61 00 FD C6 10 39 00 FF E8 00 02 00 00 E0 0C 00 00 40 67 00 00 10 52 86 0C 86 00 26 25 A0 67 00 FC F2 60 DC 20 7C 00 FF 94 34 10 F9 00 FF E8 01 61 00 FD 96 10 39 00 FF E8 00 02 00 00 E0 0C 00 00 40 66 00 00 10 52 86 0C 86 00 26 25 A0 67 00 FC C2 60 D6 10 F9 00 FF E8 01 20 7C 00 FF 94 34 0C 10 00 6C 66 9A 0C 28 00 10 00 01 67 00 00 0A 0C 28 00 FE 00 01 66 88 4E 75 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6C F0 10 60 00 00 00 04 00 6C F0 10 7D 01 00 00 00 00 00 00 00 09 6C F0 10 7D 00 01 03 05 04 00 00 00 00 09 00 00 00 00 00 00 00 00 6D F0 10 36 01 00 00 00 00 00 00 00 00 00 00 0A 6E 84
[10:13:08:496]  RX: 6D F0 10 76 00 78
[10:13:08:501]  Found response, Success
[10:13:08:507]  Kernel upload 100% complete.
[10:13:08:515]  XPro: 20 01 00 DE
[10:13:08:519]  TX: 6C 10 F0 3D 00
[10:13:08:674]  RX: 6C F0 10 7D 00 01 03 05 04
[10:13:08:679]  Kernel Version: 01030504
[10:13:08:684]  kernel uploaded to PCM succesfully. Requesting data...
[10:13:08:694]  Sending 'test device present' notification.
[10:13:08:701]  XPro: 20 01 00 DE
[10:13:08:706]  TX: 8C FE F0 3F
[10:13:08:713]  Reading from 0 / 0x0, length 1024 / 0x400
[10:13:08:722]  XPro: 20 01 00 DE
[10:13:08:727]  TX: 6C 10 F0 35 01 04 00 00 00 00
[10:13:08:916]  RX: 6D F0 10 36 01 04 00 00 00 00 00 FF B8 00 00 00 04 40 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 EC 00 00 00 00 00 00 00 00 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 28 00 00 0C 76 00 01 77 6C 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 D4 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 54 00 00 05 0E 00 00 05 76 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 01 C2 9A 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 07 2E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 00 00 05 0E 19 CC
[10:13:08:928]  Processing message

Posted: **Tue Dec 13, 2022 6:06 am**

Hi all;

Can anyone tell me what the difference is between the P04 (FWD V6) PCM and the P08 (FWD I4)?

I have a 3400 V6 in my van and a 2.4l I4 in my car.

Thanks

Mike

Posted: **Tue Dec 13, 2022 11:16 am**

the short version is the software on them is not compatible because of minor differences the hardware, but I dont know more than that.

Posted: **Tue Dec 13, 2022 11:48 am**

So couple things here to note:

1) P04s have VERY flakey J1850-VPW timing. This means that the timing can sometimes be far out enough that the responses from the P04 are rejected from the OBDX VT, we found that adding a 4.7k+ ohm resistor from the VPW pin to ground actually helped the stability of the P04 signal as it allowed it to clean up its 'low' pulses. Its not recommended to permanently leave a resistor like that connected in car or bench since it results in applying more load to the bus then is required. At 1x speeds, the P04 is able to maintain a stable timing as there is alot more room for error.

2) The P04's can be a bit temperamental, some seem to require the watch dog to be patted more frequent then others. I believe this comes down to internal interrupts firing which could be operating system dependent.

Both of the above can result in random drop out when reading or writing, hence its almost better to run at 1x VPW, and part the watchdog more often for stability.

Posted: **Thu Dec 15, 2022 7:59 am**

The Watchdog patting in my read kernel is heavily based on WinFlash which worked for Antus.

Any ideas how I can tell what the issue can be? To bad not many people are interested in the P04 PCM, more data would be nice.

Posted: **Thu Dec 15, 2022 8:28 am**

Trial and error is the only practical way I am aware of. You can get it to spit out a particular VPW message at particular places in the code and monitor the vpw bus and use that to try and see where it gets up to. Thats good for a repeatable crash but less useful for instability. Or you can investigate the 'breadcrumbs' feature in the pcmhammer mainsteam kernel as thats designed to drop bytes into a small buffer then send the buffer so you have some kind of visibility as to whats going on in the pcm. That wont fit in a p04 kernel upload though, so you'd need to finish adding the step of having a loader uploaded first (similar to above in this thread? viewtopic.php?f=4&t=8008#p118589 ) and add some implementation to pcmhammer, then use that to upload a larger pcmhammer kernel (which is a step we'll likely need on the way to full flash anyway). There is some possability of using BDM to debug on the PCM. From what I've seen you need to get the BDM to set some registers to turn off the watchdog first, then you should be able to break and trace with the right hardware and software. I dont know what hardware this would be, and Ive seen flashing over BDM but never debugging. Its work considering IF you have done firmware before and have/understand pro level BDM tooling similar to whats being done here viewtopic.php?f=26&t=8037

Posted: **Thu Dec 15, 2022 10:34 am**

Jakefunny wrote:The Watchdog patting in my read kernel is heavily based on WinFlash which worked for Antus.

Any ideas how I can tell what the issue can be? To bad not many people are interested in the P04 PCM, more data would be nice.

When I was creating one, I basically ensure where ever there was a for/while loop, the watchdog would be patted. Along with ensuring it was done at the start and end of every single jump (function) inside the kernel.

One issue to help track down if it is tool or kernel related is use 1x mode, and see if it drops out still. If you can reliably do 1x (Which technically is slower in the routines where it writes to the VPW line in the kernel) multiple times in a row, then the issue would be more likely related to noisy VPW signal produced by the P04 at 4x.

Posted: **Thu Dec 15, 2022 10:46 am**

I dont think its a watchdog issue here though, because the experimental kernel in pcmhammer can transmit 2k blocks fine until about the 80% mark, then at one particular place with certain data it crashes, with any packet size over 8 bytes. So, its somehow data related. So, based on what you said about this DLC being a bit unstable or sensitive to timings, I reckon there is a state returned from the DLC about some kind of transmit error that we never hit on the P01/P59/P10/P12 and we need to figure out what it is, where it is, and how to handle it properly on this generation of hardware. Hard to know what it is though, when we crash blindly straight away. Older motorola vpw DLC docs would be useful if anyone has been able to find them. They should have example logic to transmit a packet, and I reckon it'll be slightly different to the docs we used for P01 which did us well for all the other models so far.

Posted: **Thu Dec 15, 2022 11:59 am**

I guess its time for me to go and source different versions of the P04, since I can't replicate the data drop and the crashing of the kernel that Antus got.

I'm still working on the loader kernel when I have time, but I worry it will work for me but not others.

Posted: **Thu Dec 15, 2022 12:39 pm**

Ill post a copy of the bin that my pcm cant transmit with the experimental pcmhammer kernel later, and if you can load that on with another tool it'd be interesting to see if you can recreate the problem. I remember there is a long run of $55s which are 0101 0101 over and over when it crashes. And VPW does long/short pulses high to low or low to high depending on 1/0 so it might create a long run of all long or all short pulses (I havnt calculated this or looked with the scope to verify) but especially if its all long something might happen that the code cant handle. The DLC can do it and my pcm/hardware is not faulty - other tools can read and write this PCM with this data.

pcmhacking.net

PCMHammer P04

Re: PCMHammer P04

Re: PCMHammer P04

Re: PCMHammer P04

Re: PCMHammer P04

Re: PCMHammer P04

Re: PCMHammer P04

Re: PCMHammer P04

Re: PCMHammer P04

Re: PCMHammer P04

Re: PCMHammer P04