LZ4/LX9 Canyon Swap Prep

[Xnke]

Actually the V6 coil pack drive scheme uses the QSPI system to drive an external driver chip. The TPU channel spark outputs are not used to actually output coil signals.

I agree, the code is 99% the same, but it's not all arranged the same way or in the same order. Especially as you get away from the V8 OS, some weirdness has cropped up even between different OSID numbers in the V6 OS. 4676 and 6475 are basically the same though.

[Xnke]

Working on the T42 TCM swap some today while I supervise OSHA-10 training courses. Have been working on my BinTool program, with the intention of having it able to work with .PHZ files if they ever come about. Have to get with the PCMHammer crew before I can really do much with it...good thing they're easy to find!

Tonight I have to do some halloween costume sewing, but I am fairly sure I will have BIN read access with an OBDXPro VX working on the T42 by sometime tomorrow. The plan is to get a bench harness going with E38/E67/T42 controller connectors all on CANBUS and get a canbus sniffer on there to start flashing in various years/models of OS that I *THINK* should be compatible. At least they're all talking the same PPEI revision, so it should be possible to get them all chatting nicely.

Once the bench harness is going, I have an ECU/TCU stim board that I'm waiting on PCBs for that will put appropriate signals onto the bench harness to simulate engine and transmission functions, and has enough I/O signals and LEDs that I hopefully can exercise all the I/O enough to get good data for RE work. Two signals that I am not going to try and generate are the pedal and throttle body. I will have to figure out a pedal/throttle connector setup to swap in pedal/throttle pairs and test against different PCM's, but that will be dependent on the slave OS, which I can't really control and don't really know how to identify yet.

[Xnke]

Read access achieved. Took a minute to figure out the algorithm, I kept seeing references to Algo 73 but then I had to figure out what that was-found it. Now I can connect, unlock, and piss it off, so next step is to learn to connect, unlock, and get data.

I assume I'll need some kind of kernel to dump the flash, however the age of AI tools is drawing to a close. Now, Claude Code can't do this kind of disassembly work, it gets flagged as cybersecurity violations and refuses. Forces us back to an older model, for now-until those models get retired. Then this window will close.

[antus]

I think powerpcm flasher does both with the same kernel, so it might just work with the e38 kernel. If the kernel uploads and does not respond at read then its heavier. If the kernel loads and responds then read will probably work, and its reasonably write will as well. It's a non-zero brick risk, do a calibration write only first and work your way up. Boot sector is the most likely sector to fail if you try to change OS and they have different boot sectors. If you can confirm one way or the other on that we can set the configuration for E67 appropriately. I also don't know if the slave write will work as that uses the OEM method, not the pcm hammer native method. At a minimum the slave bins wont be in the archive and you cant read them yourself.

[Xnke]

I'm working on the T42 transmission controller first, not the E67 PCM, for now. I figured I'd start with the cheap module to break, and I need to get a compatible T42 bin onto the controllers I have-I have a 4L80e Escalade controller, and I have a Malibu controller. I need a 2006 specific year 4L60E controller binary, and then I need to make it happy to work with the modified LZ9 OS.

Current path is get T42 flashing going, so I can change BIN. Then, add some more ports onto the flash tool so I can plug in multiple devices onto a single canbus, just like in the vehicle, and log the can messages while they fight it out. Correct it so that the ECM/TCM aren't fighting over anything, then add in the engine simulator and transmission simulator, and start stress testing that combo. THEN it's time to add in the BCM (which we don't know how to flash, don't know how to read, and don't generally know shit about) and the instrument cluster, which are both on Class 2 serial and are probably going to be the biggest headache to deal with.

I know that an E40+T42 from a 2006 trailblazer will get along and play nice with the BCM/IPC, and a E67+T42 from a 2008 trailblazer really does not get along with the 2005 BCM well. I suspect it's due to the PPEI2 vs PPEI3 mismatch.

The kernel for the T42 (that currently does not work) is for the M68k target. Right now, if the kernel gets loaded into RAM successfully, it will close the ISO15765 CAN channel, set up the TouCAN peripheral with a raw CANBUS channel, and listens for an A2 ping, then A3 01 and it should reply back KERNEL IS ALIVE, and do nothing else. Currently the kernel is 75 instructions.

[antus]

Nice, both the TCM and ECM have BDM as well as a backup if you brick and have a USB JTAG NT. Though you do need to break the seal to get in to them to access them.

[Xnke]

Right now, everything is pointing to the E38 flash kernel being fine to use on the E67, only the seed/key algorithm changes. (And we know what it is).

That, however, is no guarantee that an OS write is going to work, and further the correct Ecu with the correct slave OS is still a hard prerequesite.

That's what the BinTool is going to be for-you'll have the right OS and right Slave OS, but the OS can be patched to add in features you might need/want from another binary. Similar to Universal Patcher, I guess, but more focused on getting a single matching set of ECM/TCM/Slave OS systems to all play nice.