Software On ELM Street - OBD2 Software Development

Programs / Tools / Scripts
toddstan
Posts: 1
Joined: Thu Jun 12, 2014 4:03 am
cars: Ford super duty's

Re: ELM327 Software Development

Post by toddstan »

Any progress on this. Very interesting, just read all 37 pages.
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

toddstan wrote:Any progress on this. Very interesting, just read all 37 pages.
Yeah there is, actually got a fair bit more done on this a while ago. Managed to get a fully working autodetect feature running to check comport/baud of each port to find the elm, and an auto detect for the protocol.. although the elm can get this wrong weirdly enough? But have had to stop until my studies finish in 2 weeks. Ill be pumping out versions again once Im finished.

Ill hopefully pick up an ls1 pcm to tinker with and be able to check my progress and pid requests, and Iv got the tech2 setup as well to reverse engineering if theres anything that I missed so far.

For now, I will be focusing on getting VPW protocol all working and sorted first. Once Im happy with that, Ill be moving on to CAN (high/low) for VZ/VE commodores. :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

Attempting to source out a VT/VX/VY LS1 PCM and a VZ V6 PCM, VZ V8 PCM, VE V6 PCM, VE V8 PCM

Im not sure on the differences for VZ and VE pcms when in comes to V6/V8. Do they all run on CAN? Or is there a separate vpw for the V8's.. which I cant imagine otherwise VZ's would have ALDL,CAN and VPW... what a nightmare for developers..

Anyways, anyone with a spare one laying around/wrecking a car/have one by anychance, Im happy to pick it up for a reasonable price! Ebay @$250 is a little too high for each one!.
Im going to need these so I can efficiently test application while developing. Can also hook the pcm and tech2 up to together to get proper live recordings with the elm327.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Jayme
Posts: 2585
Joined: Sat Feb 28, 2009 10:59 pm
Location: North Coast, NSW

Re: ELM327 Software Development

Post by Jayme »

VZ v6 is CAN
VZ v8 can be either VPW or CAN depending if its 5.7(vpw) or 6.0L (can)

VE's are allllll CAN


so yep, VZ had all 3 protocols :P its either VPW/ALDL or CAN/ALDL.
so confuse matters further.... the alloytec pcm has got CAN and K-line. without the K-line hooked up hptuners wouldnt flash it :S

ive been trying to get my AVT cable to talk to my VZ v6 using can but can protocol is so much more confusing than vpw :comp: trying to make a CAN adx to go with my vpw adx.
VX L67 Getrag
Posts: 2971
Joined: Sun Aug 02, 2009 11:16 am
Location: Bayside, Melbourne, Victoria

Re: ELM327 Software Development

Post by VX L67 Getrag »

Jayme, seems there is too much for 1 person, is there anything I or Tazzi can help with trying to work out?

Tazzi has all the gear to log it, & I may have more gear but just not as good of a grasp on how to bring it all to fruition?
User avatar
Jayme
Posts: 2585
Joined: Sat Feb 28, 2009 10:59 pm
Location: North Coast, NSW

Re: ELM327 Software Development

Post by Jayme »

atm I just need to figure out how to get the AVT to listen to chatter and spew the can chatter out. reading the docs I figured out how to put it into can mode but it seems as though it is mandatory to turn on some sort of packet filter and I cant figure it out... havent got it to return anything yet.

maybe it might give me a hint to get a serial log of tunercat downloading a VE v8 bin thru CAN.....
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

Jayme wrote:atm I just need to figure out how to get the AVT to listen to chatter and spew the can chatter out. reading the docs I figured out how to put it into can mode but it seems as though it is mandatory to turn on some sort of packet filter and I cant figure it out... havent got it to return anything yet.

maybe it might give me a hint to get a serial log of tunercat downloading a VE v8 bin thru CAN.....
aaahhh 3 protocols in one car! what were they thinking!!!! haha

But yeah, happy to help where I can. After tinkering with CAN frames/protocol im becoming more familiar with it.
Your not be any chance talking about the CAN header mask and filter are you? Thats a bit messy since everything is read in 'bits' so some frames can come through and others not at all.

Obviously the AVT isnt the same as the ELM, but thought there would be a simple command like the elm, "Monitor All"
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3626
Joined: Thu May 17, 2012 10:53 am
cars: VE SS Ute
Location: WA

Re: ELM327 Software Development

Post by Tazzi »

So the PCM list to pick up:
- any old VE pcm will do
- VZ V6 and VZ V8 (CAN)
- LS1 PCM (VPW)
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
antus
Site Admin
Posts: 10016
Joined: Sat Feb 28, 2009 10:34 am
cars: TX Gemini 2L Twincam 8psi
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Subaru WRX 2007

Re: ELM327 Software Development

Post by antus »

Yeah. The vz v8 ls1vpw is the 1mbyte pcms which are the same but with double the flash mem. The vz ls1 have the electronic throttle.

What were they thinking? Diversity? Lets put a bosch/euro pcm in there this time..... and why bother paying to move the flash code to can.

Ill be at my mates place who has an 07 6.0 crewman today. Ill take my gear and see if I can get some can logs.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
vn5000
Posts: 551
Joined: Fri Jul 17, 2009 4:11 am
cars: vn v8 commodore
Location: GOLD COAST QLD

Re: ELM327 Software Development

Post by vn5000 »

AVT set up to write bin ve v8


25 [00000035] IOCTL_SERIAL_SET_LINE_CONTROL StopBits: 1, Parity: No, DataBits: 8
26 [00000036] IRP_MJ_WRITE Length: 0002, Data: E1 99
27 [00000036] IRP_MJ_READ Length: 0010, Data: 91 10 83 11 00 00 83 11 04 00
28 [00000037] IRP_MJ_WRITE Length: 0004, Data: 73 0A 00 02
29 [00000037] IRP_MJ_READ Length: 0006, Data: 91 19 83 0A 00 02
30 [00000037] IRP_MJ_WRITE Length: 0004, Data: 73 2B 00 04
31 [00000037] IRP_MJ_READ Length: 0004, Data: 83 2B 00 04
32 [00000037] IRP_MJ_WRITE Length: 0006, Data: 75 2A 00 00 07 E0
33 [00000037] IRP_MJ_READ Length: 0006, Data: 85 2A 00 00 07 E0
34 [00000038] IRP_MJ_WRITE Length: 0006, Data: 75 2C 00 00 00 0F
35 [00000038] IRP_MJ_READ Length: 0006, Data: 85 2C 00 00 00 0F
36 [00000038] IRP_MJ_WRITE Length: 0004, Data: 73 27 00 00
37 [00000038] IRP_MJ_READ Length: 0004, Data: 83 27 00 00
38 [00000038] IRP_MJ_WRITE Length: 0004, Data: 73 30 00 00
39 [00000039] IRP_MJ_READ Length: 0004, Data: 83 30 00 00
40 [00000039] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E0
41 [00000039] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E0
42 [00000039] IRP_MJ_WRITE Length: 0004, Data: 73 0E 00 02
43 [00000039] IRP_MJ_READ Length: 0004, Data: 83 0E 00 02
44 [00000039] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
45 [00000039] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
46 [00000040] IRP_MJ_WRITE Length: 0004, Data: 73 11 00 01
47 [00000040] IRP_MJ_READ Length: 0004, Data: 83 11 00 01
48 [00000040] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 00
49 [00000040] IRP_MJ_READ Length: 0004, Data: 83 26 00 00
50 [00000041] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E0
51 [00000041] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E0
52 [00000041] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
53 [00000041] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
54 [00000041] IRP_MJ_WRITE Length: 0008, Data: 12 00 05 00 07 E0 1A C1
55 [00000041] IRP_MJ_READ Length: 0013, Data: 02 00 01 09 00 07 E8 5A C1 00 C0 A2 12
56 [00000042] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 00
57 [00000042] IRP_MJ_READ Length: 0004, Data: 83 26 00 00
58 [00000042] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E2
59 [00000042] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E2
60 [00000042] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
61 [00000042] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
62 [00000043] IRP_MJ_WRITE Length: 0008, Data: 12 00 05 00 07 E2 1A C1
63 [00000043] IRP_MJ_READ Length: 0003, Data: 02 00 01
64 [00000050] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 00
65 [00000050] IRP_MJ_READ Length: 0004, Data: 83 26 00 00
66 [00000050] IRP_MJ_WRITE Length: 0005, Data: 74 0F 00 07 E0
67 [00000050] IRP_MJ_READ Length: 0005, Data: 84 0F 00 07 E0
68 [00000050] IRP_MJ_WRITE Length: 0004, Data: 73 26 00 01
69 [00000051] IRP_MJ_READ Length: 0004, Data: 83 26 00 01
70 [00000051] IRP_MJ_WRITE Length: 0008, Data: 12 00 05 00 07 E0 1A 90
71 [00000051] IRP_MJ_READ Length: 0003, Data: 02 00 01
72 [00000052] IRP_MJ_READ Length: 0024, Data: 11 16 00 07 E8 5A 90 36 47 31 45 4B 34 32 48 32 39 4C 31 36 35 35 38 32