Re: PCM Hammer P12 development
Posted: Sat Mar 12, 2022 12:58 am
I guess I need to watch the matrix ...
Just know, there are FOUR movies in the series.Gampy wrote:I guess I need to watch the matrix ...
Mike
pcmhacking.net
Electronic Fuel Injection - Developement & Tuning
https://pcmhacking.net/forums/
PCM Hammer P12 development
Page 36 of 56
Re: PCM Hammer P12 development
Posted: Sat Mar 12, 2022 3:16 am
Mike
Re: PCM Hammer P12 development
Posted: Sat Mar 12, 2022 9:23 am
The first one is still the best. The 4th one is worth a watch. 2 & 3... a bit meh.
Re: PCM Hammer P12 development
Posted: Sat Mar 12, 2022 10:14 am
Gampy wrote:I guess I need to watch the matrix ...
And remember " There is no spoon "
Re: PCM Hammer P12 development
Posted: Sat Mar 12, 2022 10:49 am
"Do you want the red pill or the blue pill . . . . . ???"
Rick
Rick
Re: PCM Hammer P12 development
Posted: Sun Mar 13, 2022 7:06 am
Okay I think I have done a successful eavesdrop session between my Tech2 and the soft bricked P12 PCM in an attempt to reflash it and capture the conversation between the Tech2 and the P12. I received the same error from the Tech2 as it's been giving me all this time, however I took a pic of the Tech2 screen and also saved this log. I need you guys to see if the eavesdrop session was successful. If it was then we should be able to see what is causing the flash to fail, but more importantly the factory programming kernel and who knows what else. Give it a look over and let me know.
Re: PCM Hammer P12 development
Posted: Sun Mar 13, 2022 8:51 am
Shh, don't bother me ... I'm on the couch wrapped up in an electric blanket with my bucket of Haagen Dazs Walnuts & Maple watching a marathon of, Who's The Boss! 
In the mean time my family (and all are here except one daughter) keeps touching my forehead looking for fever ... My TV is not on the Western Channel.
In the mean time my family (and all are here except one daughter) keeps touching my forehead looking for fever ... My TV is not on the Western Channel.
Re: PCM Hammer P12 development
Posted: Mon Mar 14, 2022 12:55 am
This the actual write loop ??
How does one find where sub_FF213C is called from ...
Code: Select all
ROM:00FF213C sub_FF213C:
ROM:00FF213C
ROM:00FF213C arg_0 = 4
ROM:00FF213C arg_4 = 8
ROM:00FF213C arg_8 = $C
ROM:00FF213C
ROM:00FF213C move.l d7,-(sp)
ROM:00FF213E move.l d5,-(sp)
ROM:00FF2140 move.l 8+arg_0(sp),d1 ; byte count
ROM:00FF2144 move.l 8+arg_4(sp),d7 ; source
ROM:00FF2148 move.l 8+arg_8(sp),d5 ; target
ROM:00FF214C movea.l d7,a0 ; source address
ROM:00FF214E movea.l d5,a1 ; target address
ROM:00FF2150 moveq #0,d5
ROM:00FF2152 tst.l d1
ROM:00FF2154 beq.w loc_FF2220 ; Byte count = 0
ROM:00FF2158 move.l a5,-(sp)
ROM:00FF215A move.l d6,-(sp)
ROM:00FF215C
ROM:00FF215C loc_FF215C: ; CODE XREF: sub_FF213C+DCj ; Begin write loop
ROM:00FF215C move.w #$AAAA,($AAA).w ; Command Amd Unlock
ROM:00FF2162 move.w #$5555,($554).w ; Command Amd Unlock
ROM:00FF2168 move.w #$A0A0,($AAA).w ; Command Amd Program
ROM:00FF216E move.w (a0),(a1) ; Write source to target
ROM:00FF2170 move.w (a0),d5 ;
ROM:00FF2172
ROM:00FF2172 loc_FF2172: ; CODE XREF: sub_FF213C+B8j ; Inner read / verify write loop
ROM:00FF2172 move.b #$55,(byte_FFFFFA55).w ; COPA
ROM:00FF2178 move.b #$AA,(byte_FFFFFA55).w ; COPA
ROM:00FF217E bset #7,(byte_FFFFFA21).w ; COPB
ROM:00FF2184 move.w (word_FFFFF762).w,d6
ROM:00FF2188 moveq #$21,d7
ROM:00FF218A add.w d6,d7
ROM:00FF218C cmp.w d6,d7
ROM:00FF218E bls.s loc_FF219A
ROM:00FF2190 movea.w #$F762,a5
ROM:00FF2194
ROM:00FF2194 loc_FF2194: ; CODE XREF: sub_FF213C+5Cj
ROM:00FF2194 cmp.w (a5),d7
ROM:00FF2196 bls.s loc_FF21AA
ROM:00FF2198 bra.s loc_FF2194
ROM:00FF219A ; ---------------------------------------------------------------------------
ROM:00FF219A
ROM:00FF219A loc_FF219A: ; CODE XREF: sub_FF213C+52j
ROM:00FF219A movea.w #$F762,a5
ROM:00FF219E
ROM:00FF219E loc_FF219E: ; CODE XREF: sub_FF213C+64j
ROM:00FF219E cmp.w (a5),d7
ROM:00FF21A0 bcs.s loc_FF219E
ROM:00FF21A2 movea.w #$F762,a5
ROM:00FF21A6
ROM:00FF21A6 loc_FF21A6: ; CODE XREF: sub_FF213C+6Cj
ROM:00FF21A6 cmp.w (a5),d7
ROM:00FF21A8 bhi.s loc_FF21A6
ROM:00FF21AA
ROM:00FF21AA loc_FF21AA: ; CODE XREF: sub_FF213C+5Aj
ROM:00FF21AA bclr #7,(byte_FFFFFA21).w ; COPB
ROM:00FF21B0 move.w (word_FFFFF762).w,d6
ROM:00FF21B4 moveq #$21,d7
ROM:00FF21B6 add.w d6,d7
ROM:00FF21B8 cmp.w d6,d7
ROM:00FF21BA bls.s loc_FF21C6
ROM:00FF21BC movea.w #$F762,a5
ROM:00FF21C0
ROM:00FF21C0 loc_FF21C0: ; CODE XREF: sub_FF213C+88j
ROM:00FF21C0 cmp.w (a5),d7
ROM:00FF21C2 bls.s loc_FF21D6
ROM:00FF21C4 bra.s loc_FF21C0
ROM:00FF21C6 ; ---------------------------------------------------------------------------
ROM:00FF21C6
ROM:00FF21C6 loc_FF21C6: ; CODE XREF: sub_FF213C+7Ej
ROM:00FF21C6 movea.w #$F762,a5
ROM:00FF21CA
ROM:00FF21CA loc_FF21CA: ; CODE XREF: sub_FF213C+90j
ROM:00FF21CA cmp.w (a5),d7
ROM:00FF21CC bcs.s loc_FF21CA
ROM:00FF21CE movea.w #$F762,a5
ROM:00FF21D2
ROM:00FF21D2 loc_FF21D2: ; CODE XREF: sub_FF213C+98j
ROM:00FF21D2 cmp.w (a5),d7
ROM:00FF21D4 bhi.s loc_FF21D2
ROM:00FF21D6
ROM:00FF21D6 loc_FF21D6: ; CODE XREF: sub_FF213C+86j
ROM:00FF21D6 move.w (a1),d6
ROM:00FF21D8 moveq #word_FFFFFF80,d7
ROM:00FF21DA and.b d5,d7
ROM:00FF21DC moveq #word_FFFFFF80,d0
ROM:00FF21DE and.b d6,d0
ROM:00FF21E0 eor.b d7,d0
ROM:00FF21E2 bne.s loc_FF21F0
ROM:00FF21E4 moveq #1,d5
ROM:00FF21E6 move.w (a0),d0
ROM:00FF21E8 cmp.w (a1),d0
ROM:00FF21EA beq.s loc_FF2212 ; Success
ROM:00FF21EC moveq #0,d5
ROM:00FF21EE bra.s loc_FF221C ; Failure
ROM:00FF21F0 ; ---------------------------------------------------------------------------
ROM:00FF21F0
ROM:00FF21F0 loc_FF21F0: ; CODE XREF: sub_FF213C+A6j
ROM:00FF21F0 btst #5,d6
ROM:00FF21F4 beq.w loc_FF2172 ; Read does not match Write, try again
ROM:00FF21F8 move.w (a1),d5
ROM:00FF21FA moveq #word_FFFFFF80,d0
ROM:00FF21FC and.b d5,d0
ROM:00FF21FE eor.b d7,d0
ROM:00FF2200 bne.s loc_FF220E
ROM:00FF2202 moveq #1,d5
ROM:00FF2204 move.w (a0),d0
ROM:00FF2206 cmp.w (a1),d0
ROM:00FF2208 beq.s loc_FF2212 ; Success
ROM:00FF220A moveq #0,d5
ROM:00FF220C bra.s loc_FF221C ; Failure
ROM:00FF220E ; ---------------------------------------------------------------------------
ROM:00FF220E
ROM:00FF220E loc_FF220E: ; CODE XREF: sub_FF213C+C4j
ROM:00FF220E moveq #0,d5
ROM:00FF2210 bra.s loc_FF221C ; Failure
ROM:00FF2212 ; ---------------------------------------------------------------------------
ROM:00FF2212
ROM:00FF2212 loc_FF2212: ; CODE XREF: sub_FF213C+AEj ; Success
ROM:00FF2212 ; sub_FF213C+CCj
ROM:00FF2212 addq.l #2,a1 ; next word target
ROM:00FF2214 addq.l #2,a0 ; next word source
ROM:00FF2216 subq.l #1,d1 ; decrease bytes left count
ROM:00FF2218 bne.w loc_FF215C ; If not last byte do it again
Re: PCM Hammer P12 development
Posted: Mon Mar 14, 2022 2:01 am
Code from pcm is used to upload block message. Based on some conditions, the pointers at ffff2000 are called when blcok is uploaded successfully, 3rd pointer is for the write loop. write loop is part of another subroutine so it is not called directly.
upload->call 3rd pointer->call program loop.
darkman5001,
you are trying to flash pcm with corrupted file. Last part of bin is FFs while there is some data in non corrupted file. The tech2 exits when Os is done, but checks that is good are not passed and it fails when you start caldata write.
It is either corrupted file are loaded to tech2 or the tech2 bugs out for some reason.
You can try using tech2 as passthrough and flash from tis2000 utility, or try reuploading flash files to tech2.
upload->call 3rd pointer->call program loop.
darkman5001,
you are trying to flash pcm with corrupted file. Last part of bin is FFs while there is some data in non corrupted file. The tech2 exits when Os is done, but checks that is good are not passed and it fails when you start caldata write.
It is either corrupted file are loaded to tech2 or the tech2 bugs out for some reason.
You can try using tech2 as passthrough and flash from tis2000 utility, or try reuploading flash files to tech2.
Re: PCM Hammer P12 development
Posted: Mon Mar 14, 2022 6:11 am
I consider it rather strange that the Tech2 fails to write and neither can we ... We can get the chipid, erase a specified sector, we just cannot write.
They both leave the sector in the same condition, erased.
IMO, Something is odd.
I have done a little annotating as to how I interpret the above disassembly ... I haven't figure out all the timer stuff, not really a big deal, however I can see why it's done, there are several possible endless loops
There are multiple tests performed, I have not figured them all out yet, I know one is read and compare, I suspect there is a checksum, I'm sure I could figure out more if I spent more time with it.
kur4o,
I don't follow, we have control of the PCM (of 1 of the 2 MCU's), we are the program loop.
They both leave the sector in the same condition, erased.
IMO, Something is odd.
I have done a little annotating as to how I interpret the above disassembly ... I haven't figure out all the timer stuff, not really a big deal, however I can see why it's done, there are several possible endless loops
There are multiple tests performed, I have not figured them all out yet, I know one is read and compare, I suspect there is a checksum, I'm sure I could figure out more if I spent more time with it.
kur4o,
I don't follow, we have control of the PCM (of 1 of the 2 MCU's), we are the program loop.