PCMHammer P04

[Gampy]

These

[07:52:24:619] Timeout.. no data present A

Are strictly on the OBDX VCI's, no other VCI's have this issue.

-Enjoy

[In-Tech]

Most excellent. I had a feeling it was seed + key 0000. There must be some code in the factory OS that implements FFFF = 0000. Maybe they know FFFF is a blank prom but wanted 0000 to signal unlocked because the suits in the office were confused by FFFF.... And that code does it to both seed and key. I can't see any other reason we'd get this seed and key, but its proven.

Hiya, I think it is a simple XOR to check if output register "matches".

[antus]

Thing is 0000 does not match FFFF, but somehow seed and key both become 0000 when they have FFFF on the flash. Special case. It doesn't matter, its just an observation.

[kur4o]

When pcm is unlocked it sends 0000 for seed. Maybe if it is FFFF it is also unlocked since it can`t be FFFF by gm specs so it also sends 0000 for seed. Some test can be done to omit unlocking, to confirm the theory.

[antus]

In this case we know flash has FFFF for seed and key (as the whole segment is erased). We know it is locked, and we receive 0000 for seed. We must send 0000 for key before we can upload. There is not really a question here, it is fact. When seed and key are FFFF in flash, they become 0000 and 0000 somehow and still requires unlock. It doesn't matter how, I was just commenting there must be code that does it in these PCMs.

[zack4200]

Gampy, the version you PM'd me worked perfectly. got the original file back on the PCM

[zack4200]

Saw this in the log from Zack's P04 read.
[07:52:21:263] Read-request messages had to be re-sent 4 times.

Is this a bench setup? If it is, I'd bet that read could fail in car like mine does.

yeah it is on the bench, I sometimes get the message that messages had to be re-sent and sometimes it doesn't have to retry any ¯\_(ツ)_/¯

[kur4o]

In this case we know flash has FFFF for seed and key (as the whole segment is erased). We know it is locked, and we receive 0000 for seed. We must send 0000 for key before we can upload. There is not really a question here, it is fact. When seed and key are FFFF in flash, they become 0000 and 0000 somehow and still requires unlock. It doesn't matter how, I was just commenting there must be code that does it in these PCMs.

I will need to look that in disassembly to uncover the mystery.

[zack4200]

Yea, I recognize this file, it is blank from 4000 to 8000 ... No parameter segments.

Bad file ...

-Enjoy

I meant to ask, how would one go about checking if a bin has this issue?

[Gampy]

Hex editor and visually inspecting the range from 4000 to 8000.

4000 to 5FFF is parameter segment 1
6000 to 7FFF is parameter segment 2

-Enjoy