pcmhacking.net

your packet was
6C 10 F1 2C FE 4B 12 55 11 92 F3

so to understand this message we need to decode 4B = 01001011
so 01 is use PID
001 is start at byte 1
011 is get 3 bytes

then PID 1255 (unsure hwat this is)
then pid 1192 - Desired Idle Speed

so presumably one of those PID's is one byte long and the other is 2 bytes long. to speed htings up you cna load up 2x pids in one hit like this but i normally only load up one at a time for simplicitys sake.

Cheers! Thats saved a huge amount of time!
I guess the automatic approach wouldnt be bad. Set it up, then fire off a tester present message every 2ish seconds (is what the tech2 was doing).

Well all the above will be a huge help to reverse some of these other tech2 options, can now provide answer back to the tech's request to allow logging of the "turn off/ turn on" of the different function tests and controls.

On a random note. I think Iv figured out how to take snap shots using the computers webcam through an application, so I can set the computer on complete auto pilot with the fault code searching.
May be a few thousand photos. But least itl be easy to flick through.

Jayme wrote:your packet was
6C 10 F1 2C FE 4B 12 55 11 92 F3

so to understand this message we need to decode 4B = 01001011
so 01 is use PID
001 is start at byte 1
011 is get 3 bytes

then PID 1255 (unsure hwat this is)
then pid 1192 - Desired Idle Speed

so presumably one of those PID's is one byte long and the other is 2 bytes long. to speed htings up you cna load up 2x pids in one hit like this but i normally only load up one at a time for simplicitys sake.

Ah alright.. Ill take note of the options available next time. And one by one add messages back to work out what each one is. Was about 30 or so I think.
think Im gonna have to make an excel sheet to make breaking the bytes to bits easier.

http://www.fastfieros.com/tech/vpw_comm ... otocol.htm
there is a pretty decent list of PID's here.... the info one that page is pretty much where I started out when figuring out the vpw protocol.

Jayme wrote:http://www.fastfieros.com/tech/vpw_comm ... otocol.htm
there is a pretty decent list of PID's here.... the info one that page is pretty much where I started out when figuring out the vpw protocol.

Thats where Iv been looking at too. Brilliant stuff there.

So after putting through a fair amount of DTC's. Look like the commodores only have the standard GM fault codes. These fault codes can be easily looked up online. Havent found one that isnt already found for GM. Will see if I cant do this loop anyway, since the tech2 does give "slightly" different explanations of the faults.

Cool, Iv started the implementation of the dynamic request. May add an option to do single requests or continuous read
Some of this stuff from the tech2 is getting fairly quick, I think the elm is keeping up. Otherwise I may need to run 2, even 3 elms at once to fluently send back info from the "fake pcm".

Ill capture those initially dynamic frame requests the tech2 sent, and break those down 1 by 1.. should help out with understanding whats going on with more examples. Really should implement some structures and enums to manage this data/coding better. Can simply define each PID and output a result for it. Same with the faults, need to store those buggers somewhere.

*Edit
This is what is sent when clicking on "display data" and then "Engine data", theres also the option for fuel trim data. And the options available are:

So we have the standard "return to normal mode" request from the Tech2 (6C 10 F1 20 64)

Next, its requesting mode 22.. which is... "Mode $22 - Request Diagnostic Data by PID".
So Id assume that would be the "DTC Status" option.

Starting from the top of the Dynamic requests..6C 10 F1 2C FE 4B 12 55 11 92 F3
2C - Is the mode.
FE - Table that the PIDs are being loaded into. Up to 8 can be configured
4B - 01001011, therefore: 01 is use PID, 001 is start at byte 1, 011 is get 3 bytes
1255 - PID 1255 Request..(unknown so far)
1192 - PID 1192, Desired Idle Speed.. One before might engine speed RPM?
F3 - Checksum
So this means, one parameter will have 1 byte, and the other will have 2. Id assume it would be the first parameter will have 2 and last will have 1.

Next Frame: 6C 10 F1 2C FE 62 00 05 11 6F AB
2C - Is the mode.
FE - DPID that the PIDs are being loaded into.
62 - 01100010, therefore: 01 is use PID, 100 is start at byte 4, 010 is get 2 bytes
0005 - PID0005 Engine coolant Temp (Deg)
116F - PID116F Start Up Engine Coolant Temp (Deg)

Next: 6C 10 F1 2C FE 71 00 0F FF FF A6
2C - Is the mode.
FE - DPID that the PIDs are being loaded into.
71 - 01110001, therefore: 01 is use PID, 110 is start at byte 6, 001 is get 1 byte
000F - PID000F Intake Air Temp (Deg)
FFFF - Padding


6C 10 F1 2C FD 4B 00 0B 00 10 AE
2C - Is the mode.
FD - DPID that the PIDs are being loaded into. (New DPID Used here)
4B - 01001011, therefore: 01 is use PID, 001 is start at byte 1, 011 is get 3 bytes
000B - PID000B Manifold Absolute Pressure (kPa) (Just Convert to Volts as well?)
0010 - PID0010 Mass Air Flow

6C 10 F1 2C FD 63 12 50 19 70 D4
FD - DPID that the PIDs are being loaded into.
63 - 01100011, therefore: 01 is use PID, 100 is start at byte 4, 011 is get 3 bytes
1250 - Not sure.. MAF Frequency Hz?
1970- TCC PWM Duty Cycle (According to fastfieros)

6C 10 F1 2C FC 4A 11 9D 00 11 FA
FC - DPID that the PIDs are being loaded into.
4A - 01001010, therefore: 01 is use PID, 001 is start at byte 1, 010 is get 2 bytes
119D - Barometric Pressure kPa
0011- Throttle Position %

6C 10 F1 2C FC 5A 11 43 00 0E D3
FC - DPID that the PIDs are being loaded into.
5A - 01011010, therefore: 01 is use PID, 011 is start at byte 3, 010 is get 2 bytes
1143 - Throttle Position Sensor
000E - Spark Advance CA

6C 10 F1 2C FC 6A 11 70 11 08 EE
FC - DPID that the PIDs are being loaded into.
6A - 01101010, therefore: 01 is use PID, 101 is start at byte 5, 010 is get 2 bytes
1170 - Controlled Canister Purge Solenoid (From Fastfiero).. Is this Purge PWM %?
1108 - Unknown... Fuel System status??

6C 10 F1 2C FB 4C 12 5A 12 5B 29
FB - DPID that the PIDs are being loaded into.
4C - 01001100, therefore: 01 is use PID, 001 is start at byte 1, 100 is get 4 bytes
125A - Injector Pulse Bank 1 ms
125B - Injector Pulse Bank 2 ms

6C 10 F1 2C FB 6A 11 A6 11 06 3A
FB - DPID that the PIDs are being loaded into.
6A - 01101010, therefore: 01 is use PID, 101 is start at byte 5, 010 is get 2 bytes
11A6- Knock Retard CA
1106 - Unknown

6C 10 F1 2C FA 4C 13 2C 11 72 19
FA - DPID that the PIDs are being loaded into.
4C - 01001100, therefore: 01 is use PID, 001 is start at byte 1, 100 is get 4 bytes
132C- Unknown
1172 - Idle Air Control STEPS

6C 10 F1 2C FA 6A 16 17 FF FF DC
FA - DPID that the PIDs are being loaded into.
6A - 01101010, therefore: 01 is use PID, 101 is start at byte 5, 010 is get 2 bytes
1617 - Unknown
FFFF - Padding

6C 10 F1 2C F9 4A 11 44 11 12 5D
F9 - DPID that the PIDs are being loaded into.
4A - 01001010, therefore: 01 is use PID, 001 is start at byte 1, 010 is get 2 bytes
1144 - A/C Pressure kPa
1112 - Unknown

6C 10 F1 2C F9 5A 19 9A 11 5C 2B
F9 - DPID that the PIDs are being loaded into.
5A - 01011010, therefore: 01 is use PID, 011 is start at byte 3, 010 is get 2 bytes
199A - Unknown
115C - Unknown

6C 10 F1 2C F9 6A 00 0D 11 41 3E
F9 - DPID that the PIDs are being loaded into.
6A - 01101010, therefore: 01 is use PID, 101 is start at byte 5, 010 is get 2 bytes
000D - Vehicle Speed km/h
1141 - Battery Voltage V

6C 10 F1 2C F8 53 11 18 11 A1 D1
F8 - DPID that the PIDs are being loaded into.
53 - 01 010 011, therefore: 01 is use PID, 010 is start at byte 2 (wheres byte 1?), 011 is get 3 bytes
1118 - Unknown
11A1 - Engine Run Time

6C 10 F1 2C F8 6A FC 12 FF FF 89
F8 - DPID that the PIDs are being loaded into.
6A - 01101010, therefore: 01 is use PID, 101 is start at byte 5, 010 is get 2 bytes
FC12 - Unknown
FFFF - Padding

6C 10 F1 2C F7 4A 11 05 11 00 C6
F7 - DPID that the PIDs are being loaded into.
4A - 01001010, therefore: 01 is use PID, 001 is start at byte 1, 010 is get 2 bytes
1105 - Unknown
1100 - Unknown


6C 10 F1 2C F7 5A 11 02 11 04 D6
F7 - DPID that the PIDs are being loaded into.
5A - 01011010, therefore: 01 is use PID, 011 is start at byte 3, 010 is get 2 bytes
1102 - Unknown
1104 - Unknown

6C 10 F1 2C F7 6A 11 03 11 14 BB
F7 - DPID that the PIDs are being loaded into.
6A - 01101010, therefore: 01 is use PID, 101 is start at byte 5, 010 is get 2 bytes
1103 - Unknown
1114 - Unknown

So theres a fair few unknowns in there. Will search the net to see if any match up which what we have.

The final two frames sent are:
[09:06:21:386] Received: 6C 10 F1 2A 14 FE FD FC FB 35
[09:06:21:399] Received: 6C 10 F1 2A 24 FA F9 F8 F7 E3

So sending: 6C 10 F1 2A 14 FE 00 00 00
Will make DPID FE continuously send.

Therefore sending: 6C 10 F1 2A 14 FE FD FC FB 35
Will make DPID's FE,D,FC,FB be sent continuously

And then sending: 6C 10 F1 2A 24 FA F9 F8 F7 E3
Makes DPID's FA,F9,F8,F7 send continuously.

Interesting to see that the second message uses "24" instead of "14". Could indicate to the pcm, perform first command, then perform second.
I imagine replacing the 24 with 14 will make only the second frames DPID's be sent continuously.

Also to note, a successfully loading into a DPID is corresponded by: 6C F1 10 6C FE 4A
6C = Mode response = 2C + 40 = 6C
FE = DPID
4A = Configuration Byte

And the way to send back the tables: 6C F0 10 6A FE 00 00 01 00 0A 01
6A = mode response
FE = DPID Table
Then rest is the PID's that have been loaded up

Oh and almost forgot about the last two frames:
[09:16:05:301] Received: 6C 10 F1 3F 12
[09:16:05:359] Received: 6C 10 F1 2A 00 19
First is a Tester present message
And second is... Cancel request??

All in all, Should be able to just spam back one table at a time, to verify each table, and also determine the unknowns.

Will work on that this arvo.

But can someone try sending: 6C 10 F1 22 11 72 01 B9
So header set to 6C 10 F1 (standard header)
And fire off: 22 11 72 01
As I have no clue on how to respond back to that one!

my adx sends... 0x6C 0x10 0xF1 0x22 0x11 0x72 0x01
and receives 0x6C 0xF1 0x10 0x62 0x11 0x72 XX XX

XX XX = 2 byte IAC steps