Software On ELM Street - OBD2 Software Development
-
toddstan
- Posts: 1
- Joined: Thu Jun 12, 2014 4:03 am
- cars: Ford super duty's
Re: ELM327 Software Development
Any progress on this. Very interesting, just read all 37 pages.
-
Tazzi
- Posts: 3626
- Joined: Thu May 17, 2012 10:53 am
- cars: VE SS Ute
- Location: WA
Re: ELM327 Software Development
Yeah there is, actually got a fair bit more done on this a while ago. Managed to get a fully working autodetect feature running to check comport/baud of each port to find the elm, and an auto detect for the protocol.. although the elm can get this wrong weirdly enough? But have had to stop until my studies finish in 2 weeks. Ill be pumping out versions again once Im finished.toddstan wrote:Any progress on this. Very interesting, just read all 37 pages.
Ill hopefully pick up an ls1 pcm to tinker with and be able to check my progress and pid requests, and Iv got the tech2 setup as well to reverse engineering if theres anything that I missed so far.
For now, I will be focusing on getting VPW protocol all working and sorted first. Once Im happy with that, Ill be moving on to CAN (high/low) for VZ/VE commodores.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

-
Tazzi
- Posts: 3626
- Joined: Thu May 17, 2012 10:53 am
- cars: VE SS Ute
- Location: WA
Re: ELM327 Software Development
Attempting to source out a VT/VX/VY LS1 PCM and a VZ V6 PCM, VZ V8 PCM, VE V6 PCM, VE V8 PCM
Im not sure on the differences for VZ and VE pcms when in comes to V6/V8. Do they all run on CAN? Or is there a separate vpw for the V8's.. which I cant imagine otherwise VZ's would have ALDL,CAN and VPW... what a nightmare for developers..
Anyways, anyone with a spare one laying around/wrecking a car/have one by anychance, Im happy to pick it up for a reasonable price! Ebay @$250 is a little too high for each one!.
Im going to need these so I can efficiently test application while developing. Can also hook the pcm and tech2 up to together to get proper live recordings with the elm327.
Im not sure on the differences for VZ and VE pcms when in comes to V6/V8. Do they all run on CAN? Or is there a separate vpw for the V8's.. which I cant imagine otherwise VZ's would have ALDL,CAN and VPW... what a nightmare for developers..
Anyways, anyone with a spare one laying around/wrecking a car/have one by anychance, Im happy to pick it up for a reasonable price! Ebay @$250 is a little too high for each one!.
Im going to need these so I can efficiently test application while developing. Can also hook the pcm and tech2 up to together to get proper live recordings with the elm327.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

-
Jayme
- Posts: 2585
- Joined: Sat Feb 28, 2009 10:59 pm
- Location: North Coast, NSW
Re: ELM327 Software Development
VZ v6 is CAN
VZ v8 can be either VPW or CAN depending if its 5.7(vpw) or 6.0L (can)
VE's are allllll CAN
so yep, VZ had all 3 protocols
its either VPW/ALDL or CAN/ALDL.
so confuse matters further.... the alloytec pcm has got CAN and K-line. without the K-line hooked up hptuners wouldnt flash it :S
ive been trying to get my AVT cable to talk to my VZ v6 using can but can protocol is so much more confusing than vpw
trying to make a CAN adx to go with my vpw adx.
VZ v8 can be either VPW or CAN depending if its 5.7(vpw) or 6.0L (can)
VE's are allllll CAN
so yep, VZ had all 3 protocols
so confuse matters further.... the alloytec pcm has got CAN and K-line. without the K-line hooked up hptuners wouldnt flash it :S
ive been trying to get my AVT cable to talk to my VZ v6 using can but can protocol is so much more confusing than vpw
-
VX L67 Getrag
- Posts: 2971
- Joined: Sun Aug 02, 2009 11:16 am
- Location: Bayside, Melbourne, Victoria
Re: ELM327 Software Development
Jayme, seems there is too much for 1 person, is there anything I or Tazzi can help with trying to work out?
Tazzi has all the gear to log it, & I may have more gear but just not as good of a grasp on how to bring it all to fruition?
Tazzi has all the gear to log it, & I may have more gear but just not as good of a grasp on how to bring it all to fruition?
-
Jayme
- Posts: 2585
- Joined: Sat Feb 28, 2009 10:59 pm
- Location: North Coast, NSW
Re: ELM327 Software Development
atm I just need to figure out how to get the AVT to listen to chatter and spew the can chatter out. reading the docs I figured out how to put it into can mode but it seems as though it is mandatory to turn on some sort of packet filter and I cant figure it out... havent got it to return anything yet.
maybe it might give me a hint to get a serial log of tunercat downloading a VE v8 bin thru CAN.....
maybe it might give me a hint to get a serial log of tunercat downloading a VE v8 bin thru CAN.....
-
Tazzi
- Posts: 3626
- Joined: Thu May 17, 2012 10:53 am
- cars: VE SS Ute
- Location: WA
Re: ELM327 Software Development
aaahhh 3 protocols in one car! what were they thinking!!!! hahaJayme wrote:atm I just need to figure out how to get the AVT to listen to chatter and spew the can chatter out. reading the docs I figured out how to put it into can mode but it seems as though it is mandatory to turn on some sort of packet filter and I cant figure it out... havent got it to return anything yet.
maybe it might give me a hint to get a serial log of tunercat downloading a VE v8 bin thru CAN.....
But yeah, happy to help where I can. After tinkering with CAN frames/protocol im becoming more familiar with it.
Your not be any chance talking about the CAN header mask and filter are you? Thats a bit messy since everything is read in 'bits' so some frames can come through and others not at all.
Obviously the AVT isnt the same as the ELM, but thought there would be a simple command like the elm, "Monitor All"
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

-
Tazzi
- Posts: 3626
- Joined: Thu May 17, 2012 10:53 am
- cars: VE SS Ute
- Location: WA
Re: ELM327 Software Development
So the PCM list to pick up:
- any old VE pcm will do
- VZ V6 and VZ V8 (CAN)
- LS1 PCM (VPW)
- any old VE pcm will do
- VZ V6 and VZ V8 (CAN)
- LS1 PCM (VPW)
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

-
antus
- Site Admin
- Posts: 10016
- Joined: Sat Feb 28, 2009 10:34 am
- cars: TX Gemini 2L Twincam 8psi
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Subaru WRX 2007
Re: ELM327 Software Development
Yeah. The vz v8 ls1vpw is the 1mbyte pcms which are the same but with double the flash mem. The vz ls1 have the electronic throttle.
What were they thinking? Diversity? Lets put a bosch/euro pcm in there this time..... and why bother paying to move the flash code to can.
Ill be at my mates place who has an 07 6.0 crewman today. Ill take my gear and see if I can get some can logs.
What were they thinking? Diversity? Lets put a bosch/euro pcm in there this time..... and why bother paying to move the flash code to can.
Ill be at my mates place who has an 07 6.0 crewman today. Ill take my gear and see if I can get some can logs.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
-
vn5000
- Posts: 551
- Joined: Fri Jul 17, 2009 4:11 am
- cars: vn v8 commodore
- Location: GOLD COAST QLD
Re: ELM327 Software Development
AVT set up to write bin ve v8
25 [00000035] IOCTL_SERIAL_SET_LINE_CONTROL StopBits: 1, Parity: No, DataBits: 8
26 [00000036] IRP_MJ_WRITE Length: 0002, Data: E1 99
27 [00000036] IRP_MJ_READ Length: 0010, Data: 91 10 83 11 00 00 83 11 04 00
28 [00000037] IRP_MJ_WRITE Length: 0004, Data: 73 0A 00 02
29 [00000037] IRP_MJ_READ Length: 0006, Data: 91 19 83 0A 00 02
30 [00000037] IRP_MJ_WRITE Length: 0004, Data: 73 2B 00 04
31 [00000037] IRP_MJ_READ Length: 0004, Data: 83 2B 00 04
32 [00000037] IRP_MJ_WRITE Length: 0006, Data: 75 2A 00 00 07 E0
33 [00000037] IRP_MJ_READ Length: 0006, Data: 85 2A 00 00 07 E0
34 [00000038] IRP_MJ_WRITE Length: 0006, Data: 75 2C 00 00 00 0F
35 [00000038] IRP_MJ_READ Length: 0006, Data: 85 2C 00 00 00 0F
36 [00000038] IRP_MJ_WRITE Length: 0004, Data: 73 27 00 00
37 [00000038] IRP_MJ_READ Length: 0004, Data: 83 27 00 00
38 [00000038] IRP_MJ_WRITE Length: 0004, Data: 73 30 00 00
39 [00000039] IRP_MJ_READ Length: 0004, Data: 83 30 00 00
40 [00000039] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E0
41 [00000039] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E0
42 [00000039] IRP_MJ_WRITE Length: 0004, Data: 73 0E 00 02
43 [00000039] IRP_MJ_READ Length: 0004, Data: 83 0E 00 02
44 [00000039] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
45 [00000039] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
46 [00000040] IRP_MJ_WRITE Length: 0004, Data: 73 11 00 01
47 [00000040] IRP_MJ_READ Length: 0004, Data: 83 11 00 01
48 [00000040] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 00
49 [00000040] IRP_MJ_READ Length: 0004, Data: 83 26 00 00
50 [00000041] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E0
51 [00000041] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E0
52 [00000041] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
53 [00000041] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
54 [00000041] IRP_MJ_WRITE Length: 0008, Data: 12 00 05 00 07 E0 1A C1
55 [00000041] IRP_MJ_READ Length: 0013, Data: 02 00 01 09 00 07 E8 5A C1 00 C0 A2 12
56 [00000042] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 00
57 [00000042] IRP_MJ_READ Length: 0004, Data: 83 26 00 00
58 [00000042] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E2
59 [00000042] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E2
60 [00000042] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
61 [00000042] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
62 [00000043] IRP_MJ_WRITE Length: 0008, Data: 12 00 05 00 07 E2 1A C1
63 [00000043] IRP_MJ_READ Length: 0003, Data: 02 00 01
64 [00000050] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 00
65 [00000050] IRP_MJ_READ Length: 0004, Data: 83 26 00 00
66 [00000050] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E0
67 [00000050] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E0
68 [00000050] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
69 [00000051] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
70 [00000051] IRP_MJ_WRITE Length: 0008, Data: 12 00 05 00 07 E0 1A 90
71 [00000051] IRP_MJ_READ Length: 0003, Data: 02 00 01
72 [00000052] IRP_MJ_READ Length: 0024, Data: 11 16 00 07 E8 5A 90 36 47 31 45 4B 34 32 48 32 39 4C 31 36 35 35 38 32
25 [00000035] IOCTL_SERIAL_SET_LINE_CONTROL StopBits: 1, Parity: No, DataBits: 8
26 [00000036] IRP_MJ_WRITE Length: 0002, Data: E1 99
27 [00000036] IRP_MJ_READ Length: 0010, Data: 91 10 83 11 00 00 83 11 04 00
28 [00000037] IRP_MJ_WRITE Length: 0004, Data: 73 0A 00 02
29 [00000037] IRP_MJ_READ Length: 0006, Data: 91 19 83 0A 00 02
30 [00000037] IRP_MJ_WRITE Length: 0004, Data: 73 2B 00 04
31 [00000037] IRP_MJ_READ Length: 0004, Data: 83 2B 00 04
32 [00000037] IRP_MJ_WRITE Length: 0006, Data: 75 2A 00 00 07 E0
33 [00000037] IRP_MJ_READ Length: 0006, Data: 85 2A 00 00 07 E0
34 [00000038] IRP_MJ_WRITE Length: 0006, Data: 75 2C 00 00 00 0F
35 [00000038] IRP_MJ_READ Length: 0006, Data: 85 2C 00 00 00 0F
36 [00000038] IRP_MJ_WRITE Length: 0004, Data: 73 27 00 00
37 [00000038] IRP_MJ_READ Length: 0004, Data: 83 27 00 00
38 [00000038] IRP_MJ_WRITE Length: 0004, Data: 73 30 00 00
39 [00000039] IRP_MJ_READ Length: 0004, Data: 83 30 00 00
40 [00000039] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E0
41 [00000039] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E0
42 [00000039] IRP_MJ_WRITE Length: 0004, Data: 73 0E 00 02
43 [00000039] IRP_MJ_READ Length: 0004, Data: 83 0E 00 02
44 [00000039] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
45 [00000039] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
46 [00000040] IRP_MJ_WRITE Length: 0004, Data: 73 11 00 01
47 [00000040] IRP_MJ_READ Length: 0004, Data: 83 11 00 01
48 [00000040] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 00
49 [00000040] IRP_MJ_READ Length: 0004, Data: 83 26 00 00
50 [00000041] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E0
51 [00000041] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E0
52 [00000041] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
53 [00000041] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
54 [00000041] IRP_MJ_WRITE Length: 0008, Data: 12 00 05 00 07 E0 1A C1
55 [00000041] IRP_MJ_READ Length: 0013, Data: 02 00 01 09 00 07 E8 5A C1 00 C0 A2 12
56 [00000042] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 00
57 [00000042] IRP_MJ_READ Length: 0004, Data: 83 26 00 00
58 [00000042] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E2
59 [00000042] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E2
60 [00000042] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
61 [00000042] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
62 [00000043] IRP_MJ_WRITE Length: 0008, Data: 12 00 05 00 07 E2 1A C1
63 [00000043] IRP_MJ_READ Length: 0003, Data: 02 00 01
64 [00000050] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 00
65 [00000050] IRP_MJ_READ Length: 0004, Data: 83 26 00 00
66 [00000050] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E0
67 [00000050] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E0
68 [00000050] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
69 [00000051] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
70 [00000051] IRP_MJ_WRITE Length: 0008, Data: 12 00 05 00 07 E0 1A 90
71 [00000051] IRP_MJ_READ Length: 0003, Data: 02 00 01
72 [00000052] IRP_MJ_READ Length: 0024, Data: 11 16 00 07 E8 5A 90 36 47 31 45 4B 34 32 48 32 39 4C 31 36 35 35 38 32