P05 PCMs

[antus]

warning: we've just found that it is bricking when erasing the boot sector on AMD flash based P05s (most are intel). Do not attempt to swap the OS on an AMD P05 at this stage.

[antus]

Firstly, its bricking the boot sector on Intel as well. There is something not quite right in the hardware setup. And its brick risk to test every time. I think I have another brick, but want to re-check with fresh eyes before I call it. For some reason, with some kernel versions I was able to re-write the boot sector on the second try if I left the kernel running. That saved a few bricks, but eventually one variation sent the hardware nuts and CRC stopped working and started returning all sector CRCs are zero, thus thinks needs to re-write all. I pulled the power during the CRC operations and before it tried to erase/write, but.... its not looking good for that pcm. I think it was already in a bad way by that point.

Secondly, the recovery isn't working properly because the kernel loads the OSID straight of a value in the flash. But the P05c file variation has the OSID as an ascii string. So now the kernel needs to be able to tell the difference between the two file formats and apply an ascii conversion. As an excersize I tried to figure out the smallest ascii conversion that could be used. I think its this as 22 bytes. I'm just going to leave it here to remember it for when I look to implement this. Its 68020 code, it should work on the PCM but only if the BFEXTU instruction is available, if its not the it might need to be done another way and grow by 2 bytes. Will need to make sure its not clobbering registers that matter, and correctly identify if it should return a numeric OSID from one location or use this to pull the ASCII from another. I was able to work around this for P05c in my testing by hard coding the response in a dev version of PCMHammer, but it needs something like this so that it can get an accurate OSID from the PCM.

Might not need the RTS if it fits inline and doesn't break any other alignment. I think were pretty safe as its the early 1990s PCMs that are super picky about alignment and this code is only needed on 2006/2007+ bin/file formats in the PCMs. Thus other PCM Hammer kernels wont change.

uses A0, D0, D1 and D7.

Code: Select all

        LEA     $FFFF00,A0       ; 6 bytes ; ascii string address placeholder (not real world address)
        CLR.L   D0               ; 2 bytes ; init register
        MOVEQ   #7,D7            ; 2 bytes ; loop counter for 8 digits

loop:
        MULU.L  #10,D0           ; 4 bytes ; multiply existing result by 10
        BFEXTU  (A0)+{0:4},D1    ; 2 bytes ; extract low nibble of ASCII → digit
        ADD.L   D1,D0            ; 2 bytes ; sum up total
        DBF     D7,loop          ; 2 bytes ; loop for 8 characters
        RTS                      ; 2 bytes ; return

Or this is 26 bytes, doesn't need BFEXTU is more readable and adds use of D2. Less preferred due to byte size and extra register. But good to have options.

Code: Select all

        LEA     $FFFF00,A0     ; 6 bytes
        CLR.L   D0             ; 2
        MOVEQ   #10,D2         ; 2
        MOVEQ   #7,D7          ; 2

loop:
        MULU    D2,D0          ; 2
        MOVE.B  (A0)+,D1       ; 2
        SUB.B   #'0',D1        ; 4
        ADD.L   D1,D0          ; 2
        DBF     D7,loop        ; 2
        RTS                    ; 2

[antus]

Back working on the P05 and I noticed something interesting. On these E40 type PCMs (that is E40, P05, P12) the flash chips do not require 12v. This we knew. But I do have a new bench loom and it has insufficient power wiring that is dropping the voltage to 11.5v Traditionally we've always said 12.5 or above is required - and it is, for the chips that require 12v to program. But, even though I expected this P05 to fail I attempted to write a sector, expecting a fail, and it instead worked at 11.5v. This might apply to other newer PCMs that use newer chips as well.

Code: Select all

[12:46:13:715]  PCM Hammer (3/01/2026, 12:35 AM)
[12:46:13:717]  Saturday, January 03 2026 @12:46:13:71
[12:46:13:719]  Initializing J2534 Device
[12:46:13:807]  Loaded DLL
[12:46:13:902]  Connected to the device.
[12:46:13:905]  Battery Voltage is: 11.581
[12:46:19:100]  Read canceled.
[12:46:34:674]  C:\Users\antus\Downloads\p05 osid 12619740 sn 12581501 ANTUS at 6000.bin
[12:46:34:689]  Identifying 1024KiB file.
[12:46:34:697]  File is P05 1024KiB.
[12:46:34:707]  File operating system ID: 12619740
[12:46:34:712]  File is P05 1024KiB.
[12:46:34:715]  P04/P05 1998+, checking for valid paramater block
[12:46:34:718]  Param block at 0x4000
[12:46:34:721]  	Start	End	Stored		Needed		Verdict	Segment Name
[12:46:34:733]  	00000	FFFFF	F5457336	F5457336	Good	Whole File
[12:46:34:738]  Requesting operating system ID...
[12:46:34:770]  File is P05 1024KiB.
[12:46:34:777]  PCM and file match hardware P05
[12:46:34:783]  File is P05 1024KiB.
[12:46:34:793]  PCM and file are both operating system 12619740
[12:46:34:863]  Unlock OK.
[12:46:34:880]  Attempting switch to VPW 4x
[12:46:34:901]  Module 0x10 (engine controller) has agreed to enter high-speed mode.
[12:46:41:110]  Upload permission granted.
[12:46:41:619]  Kernel upload 100% complete.
[12:46:41:630]  Kernel Version: 82400205
[12:46:41:635]  Kernel uploaded to PCM successfully.
[12:46:41:648]  File is P05 1024KiB.
[12:46:41:656]  PCM and image file are both operating system 12619740
[12:46:41:670]  Flash chip: Intel 28F800F3, Fast Boot Block (120ns) 1024KiB
[12:46:41:676]  Calculating CRCs from file.
[12:46:41:687]  Requesting CRCs from PCM.
[12:46:41:692]  	Range		File CRC		PCM CRC	Verdict	Purpose
[12:46:42:702]  0F0000-0FFFFF	113410DD	113410DD	Same	General
[12:46:43:719]  0E0000-0EFFFF	EFBD6F46	EFBD6F46	Same	General
[12:46:44:737]  0D0000-0DFFFF	A50F3C90	A50F3C90	Same	General
[12:46:45:762]  0C0000-0CFFFF	83289D99	83289D99	Same	General
[12:46:46:784]  0B0000-0BFFFF	A50F3C90	A50F3C90	Same	General
[12:46:47:820]  0A0000-0AFFFF	778045E7	778045E7	Same	General
[12:46:48:839]  090000-09FFFF	276713F6	276713F6	Same	General
[12:46:49:854]  080000-08FFFF	948266C3	948266C3	Same	General
[12:46:50:873]  070000-07FFFF	64AA8B6A	64AA8B6A	Same	General
[12:46:51:891]  060000-06FFFF	F453BA9D	F453BA9D	Same	General
[12:46:52:929]  050000-05FFFF	57C82AB5	57C82AB5	Same	General
[12:46:53:947]  040000-04FFFF	FB39EBB1	FB39EBB1	Same	General
[12:46:54:981]  030000-03FFFF	1A8222A9	1A8222A9	Same	General
[12:46:56:002]  020000-02FFFF	94E05435	94E05435	Same	General
[12:46:57:022]  010000-01FFFF	2FD83B07	2FD83B07	Same	General
[12:46:57:174]  00E000-00FFFF	85B5BB36	85B5BB36	Same	General
[12:46:57:329]  00C000-00DFFF	85B5BB36	85B5BB36	Same	General
[12:46:57:499]  00A000-00BFFF	85B5BB36	85B5BB36	Same	General
[12:46:57:656]  008000-009FFF	85B5BB36	85B5BB36	Same	General
[12:46:57:828]  006000-007FFF	4A532F4F	85B5BB36	Different	General
[12:46:57:982]  004000-005FFF	B51C4AF7	B51C4AF7	Same	General
[12:46:58:160]  002000-003FFF	85B5BB36	85B5BB36	Same	General
[12:46:58:314]  000000-001FFF	FD5C1CE2	FD5C1CE2	Same	General
[12:46:58:332]  Processing range 006000-007FFF
[12:46:58:350]  Erasing.
[12:46:58:767]  Writing...
[12:47:02:337]  Calculating CRCs from file.
[12:47:02:364]  Requesting CRCs from PCM.
[12:47:02:383]  	Range		File CRC		PCM CRC	Verdict	Purpose
[12:47:03:411]  0F0000-0FFFFF	113410DD	113410DD	Same	General
[12:47:04:437]  0E0000-0EFFFF	EFBD6F46	EFBD6F46	Same	General
[12:47:05:470]  0D0000-0DFFFF	A50F3C90	A50F3C90	Same	General
[12:47:06:507]  0C0000-0CFFFF	83289D99	83289D99	Same	General
[12:47:07:555]  0B0000-0BFFFF	A50F3C90	A50F3C90	Same	General
[12:47:08:601]  0A0000-0AFFFF	778045E7	778045E7	Same	General
[12:47:09:636]  090000-09FFFF	276713F6	276713F6	Same	General
[12:47:10:678]  080000-08FFFF	948266C3	948266C3	Same	General
[12:47:11:726]  070000-07FFFF	64AA8B6A	64AA8B6A	Same	General
[12:47:12:751]  060000-06FFFF	F453BA9D	F453BA9D	Same	General
[12:47:13:781]  050000-05FFFF	57C82AB5	57C82AB5	Same	General
[12:47:14:837]  040000-04FFFF	FB39EBB1	FB39EBB1	Same	General
[12:47:15:870]  030000-03FFFF	1A8222A9	1A8222A9	Same	General
[12:47:16:898]  020000-02FFFF	94E05435	94E05435	Same	General
[12:47:17:937]  010000-01FFFF	2FD83B07	2FD83B07	Same	General
[12:47:18:096]  00E000-00FFFF	85B5BB36	85B5BB36	Same	General
[12:47:18:257]  00C000-00DFFF	85B5BB36	85B5BB36	Same	General
[12:47:18:418]  00A000-00BFFF	85B5BB36	85B5BB36	Same	General
[12:47:18:593]  008000-009FFF	85B5BB36	85B5BB36	Same	General
[12:47:18:752]  006000-007FFF	4A532F4F	4A532F4F	Same	General
[12:47:18:912]  004000-005FFF	B51C4AF7	B51C4AF7	Same	General
[12:47:19:107]  002000-003FFF	85B5BB36	85B5BB36	Same	General
[12:47:19:282]  000000-001FFF	FD5C1CE2	FD5C1CE2	Same	General
[12:47:19:303]  All relevant ranges are identical.
[12:47:19:322]  All write-request messages succeeded on the first try. You have an excellent connection to the PCM.
[12:47:19:338]  Flash successful!
[12:47:19:402]  Clearing trouble codes.
[12:47:20:483]  Elapsed time 00:00:45.6153542

[MPC001]

Back working on the P05 and I noticed something interesting. On these E40 type PCMs (that is E40, P05, P12) the flash chips do not require 12v. This we knew. But I do have a new bench loom and it has insufficient power wiring that is dropping the voltage to 11.5v Traditionally we've always said 12.5 or above is required - and it is, for the chips that require 12v to program. But, even though I expected this P05 to fail I attempted to write a sector, expecting a fail, and it instead worked at 11.5v. This might apply to other newer PCMs that use newer chips as well.

FYI likewise always had success on the bench, CAN flashing E40, E38, E67, T42 with 11.4 - 11.7 volts as the 12v 1A power supply doesn't quite manage 12v even under 135mA of load. (Bit wimpy).

Even though no fails out of hundreds who knows how close to the edge this is. ECM system voltage doesn't error until 9V or 10V & likely they do NVM writes down to these voltages.

[antus]

For notes, I think this is the p05a p05b p05c thing.

P05a Service number ? VPW Only
p05b Service number 12591279, VPW + Can (AMD)
p05c Service number 12581501, 12600930, Can only, 2007

[Yt24824]

I have a stock 2007 Grand Prix L32 file that's currently in HPT format. I have the complete car if that helps in any way. I'm waiting on my OBDX to ship before I can pull it with PCMH or Universalpatcher. I'm still very green with all this, but I can send the HPT file to anyone who likes and pull it later with Universalpatcher. I also have access to a shopkey account to pull schematics, not sure how indepth it will go into ECM info though.

What type of CAN sniffer would I need to be helpful pulling data from it?

I really appreciate this forum. It has been fun reading and learning. Big thanks!

[antus]

Thanks! Univeral patcher guys are around, they can speak to mapping it. It probably would be worth reaching out to them so that they know people want it.
P05 I think is working as well as it is going to work, for the a and the b. Since I was last working on it i've learnt the boot sector is hardware write protected and you cant even erase it with BDM. Right now PCM Hammer (test versions) are bricking trying to work with the boot sector, so I need to add something to the app to block writes where the boot sector differs and re-validate the erase and write is working. There is no function that blocks boot sector write yet so that is a new piece of code, but not too difficult. Ping me if you dont see it materiealise in the next few weeks and I'll make sure I get it sorted. I think the same thing affects P12 so that would solve and boot sector problems there too. Might even get us to a point we can put out an official 2.0.

[antus]

I got my bdm going again today and recovered successfully my p05 and p12b. added a function to pcm hammer to reject operations that require boot sector changes for those 2 pcms and the tests are passing. If anyone wants to try it you can get the latest test version here: https://github.com/PcmHammer/PcmHammer/ ... 3996922260

It might be time to setup a P11, get that in and tested, and with some additional third party testing we might be closing in on an official v2 release.

These BDM frames, I would recommend. They don't make it easy but they do make it easier than direct soldering.

[antus]

P05c is reading and writing on the CAN bus on the bench. I expect it will be in the next PCM Hammer update, along side E38 in the not too distant future!
This PCM was not nice to work with. I think (but am not sure) it's a first for any reflash tool out side of OEM to get this one working.

[10:18:15.208] Unlock succeeded.
[10:18:15.304] Loaded Kernel-P05c-write.bin (5585 bytes)
[10:18:15.304] Kernel MD5=BB3BB412C6570FBDDB7FF11508011ED6
[10:18:15.456] Requesting programming mode (0xA5/01).
[10:18:18.273] Kernel upload 36% complete.
[10:18:18.915] Kernel upload 73% complete.
[10:18:19.402] Kernel upload 99% complete.
[10:18:19.461] Kernel upload 100% complete.
[10:18:19.461] Kernel uploaded to PCM successfully.
[10:18:19.836] Kernel version: 2026-06-25 00:47:24
[10:18:19.933] Flash chip: AMD AM29BL802C, 1024KiB
[10:18:19.938] Calculating CRCs from file.
[10:18:19.938] Requesting CRCs from PCM.
[10:18:19.938] Range File CRC PCM CRC Verdict Purpose
[10:18:22.428] 0C0000-0FFFFF 73B4CAC4 73B4CAC4 Same General
[10:18:24.919] 080000-0BFFFF BA5DE1EB BA5DE1EB Same General
[10:18:26.206] 060000-07FFFF 1FFCAD00 1FFCAD00 Same General
[10:18:27.491] 040000-05FFFF 3B57F82C 3B57F82C Same General
[10:18:28.766] 020000-03FFFF 1076D06E 1076D06E Same General
[10:18:29.747] 008000-01FFFF 88EAB0F3 90C932CA Different General
[10:18:29.892] 006000-007FFF 85D3A32C 85D3A32C Same General
[10:18:30.027] 004000-005FFF 85B5BB36 85B5BB36 Same General
[10:18:30.242] 000000-003FFF BFFCDA1E BFFCDA1E Same General
[10:18:30.242] Processing range 008000-01FFFF
[10:18:30.244] Erasing.
[10:18:33.707] Writing...
[10:19:13.787] Calculating CRCs from file.
[10:19:13.787] Requesting CRCs from PCM.
[10:19:13.787] Range File CRC PCM CRC Verdict Purpose
[10:19:16.280] 0C0000-0FFFFF 73B4CAC4 73B4CAC4 Same General
[10:19:18.782] 080000-0BFFFF BA5DE1EB BA5DE1EB Same General
[10:19:20.071] 060000-07FFFF 1FFCAD00 1FFCAD00 Same General
[10:19:21.347] 040000-05FFFF 3B57F82C 3B57F82C Same General
[10:19:22.625] 020000-03FFFF 1076D06E 1076D06E Same General
[10:19:23.610] 008000-01FFFF 88EAB0F3 88EAB0F3 Same General
[10:19:23.764] 006000-007FFF 85D3A32C 85D3A32C Same General
[10:19:23.916] 004000-005FFF 85B5BB36 85B5BB36 Same General
[10:19:24.136] 000000-003FFF BFFCDA1E BFFCDA1E Same General
[10:19:24.136] All relevant ranges are identical.
[10:19:24.137] All write-request messages succeeded on the first try. You have an excellent connection to the PCM.
[10:19:24.137] Flash successful!
[10:19:24.139] Returning to normal mode.
[10:19:25.703] Clearing trouble codes.
[10:19:26.356] Elapsed time 00:01:11.1476468

[MPC001]

Cool