pcmhacking.net

i see you wrote that software youreself if my bad web translation from russian was right nice work.have downloaded and run the software would be nice to be able to see all the outputs without the ecu needing to be connected .but ive seen the screenshots on the webpage looks good.

L2-Max wrote:I read M68HC11RM document from frescale. I found Boot loader listing. There is a comment:
* THIS BOOTSTRAP PROGRAM ALLOWS THE USER TO
* DOWNLOAD A PROGRAM OF EXACTLY 256 BYTES.
* THE PROGRAM MUST START AT $0000.
* EACH BYTE OF THE PROGRAM IS RECEIVED BY THE
* SCI, STARTING WITH THE $0000 BYTE AND WORKING
* UP TO THE $00FF BYTE.

reading listing I see set BAUD tu 8192 and wait for FF byte to start download ...

Why boot loader sets stack to 0x0FF if memory up to 0x400?

Does somebody use that loader to download user program into RAM (I mean - does realy work?)?.

Delco/Delphi/GM ECUs run entirely custom code, so its unlikely that the boot loader you found is used. The HC11 processors have been around for a while and may variants exist eg our '808 ecu has 0xFF bytes of ram but the 16231448 ecu has 0x3FF. Delco licensed the HC11 processor, but invented chips with custom hardware and there is no reference to what delco chip matches what freescale chip and some of them might have no 100% identical official part. But they can be figured out by studying the disassemblys.

Do you have a high res photo of the pcb in your ECU?

I tried to read the thread over at lanos .com.ua (babelfish translation). Did someone say that this ecu does work with efi-live v4? and it is KWP2000 protocol? It looks like $07 program, but since its a 2007 model I wonder if that refers to the year 2007?

delcowizzid wrote:i see you wrote that software youreself if my bad web translation from russian was right nice work.have downloaded and run the software would be nice to be able to see all the outputs without the ecu needing to be connected .but ive seen the screenshots on the webpage looks good.

Offcource, I foresee it. The program has ability to read datastream from file and don't need connection with ecu. Just open preferences and go to session->read from file (directory named as datastreams in root program directory) that s all.

Delco/Delphi/GM ECUs run entirely custom code, so its unlikely that the boot loader you found is used. The HC11 processors have been around for a while and may variants exist eg our '808 ecu has 0xFF bytes of ram but the 16231448 ecu has 0x3FF. Delco licensed the HC11 processor, but invented chips with custom hardware and there is no reference to what delco chip matches what freescale chip and some of them might have no 100% identical official part. But they can be figured out by studying the disassemblys.

Do you have a high res photo of the pcb in your ECU?

I tried to read the thread over at lanos .com.ua (babelfish translation). Did someone say that this ecu does work with efi-live v4? and it is KWP2000 protocol? It looks like $07 program, but since its a 2007 model I wonder if that refers to the year 2007?

I got that. HC11 is architech but it has modifications like F1, A8 and so on ... Looks like F1 with 4Kb RAM match to mu ECU. Sorry, my car currently in garage so I will lokk at ECU tomorow.

Next your questions. Yes, I will try my ECU with EFY. It is work in diagnostic and management modes(other I didnt test). But, as you know It need to be adjusted to datastream. For example, our ECUs has 4 malf bytes for mode 1 but yours 6...


No, the ECU has no kwp support.


Could you answer waht you means when says $07 program, thats ID of user program or some one else ?


I have carefuly read ref manual for HC11 and big amount of things clear(I familary with x86 processors. Reamode, protected ... peripheria ..... but has no deal with MCU).

Next question. How flash connected to MCU(as I read from RM MCU has few ROM)? There should be external controller and how it is addressed. Obwiously for x86 there is I/O port through user can communicate with device. How it built in MCU ?

Have you seen these schematics? They might be a starting point for understanding typical hardware layout. The ram and (if present) eeprom is built in to the processor, but the rom/flash is external.

http://www.cruzers.com/~ludis/schematics.html

The program id $07 is due to a standard header on GM binaries. There is a large cross reference of ecus, rom type and size, and rom mapping here:

http://www.cruzers.com/~ludis/idxref.html

The bins map from 0xFFFF down, and for a 32k bin like yours that means it'll map between 0x8000 -> 0xFFFF. For most binaries the ID byte is the 8th byte from the start of the bin. In your case, being a 2007 car and having $07 in this location makes me wonder if GM are doing things a little different now. It would be interesting to see if a 2005 model has $05 in that location?

I couldnt attach file up to 16Mb. Will try by photo

We dont have a huge amount of disk space, but i've increased the max attachment size for a trial so you should be able to upload now.

I have been having a look at the problem you have had L2-Max. I am not a programmer and its been a steep learning curve to get this far with the program! I am not sure how to adjust these settings, as far as i can tell they are not all directly adjustable from .NET?? I did find an issue with how i was setting RC and WC so have fixed that now.

Attached is a log from what I get when testing directly to the ECM. It shows how the frame is Rx'd, I read the device ID and then the number of bytes. Then set the ReceivedBytesThreshold to wait for that many bytes + 1 (so I get the checksum too).

What tuning tools are you using for making changes to the ECM?? Is there a disassembly of the ECM code?? This would help in understanding what the hardware is like.

http://depositfiles.com/files/2ji3h5ap3

The archive with few pics of my ECU