Reverse Engineering 12587603

[AngelMarc]

The source for Dzidav8/NSFW's work for the TBLU is here: viewtopic.php?p=104736#p104736
It seems its not working properly or completely even though it is working partially, so needs someone else to improve it and ideally get a patch in to ghidra. Perhaps it's because it's using a linked reference to a6 instead of a direct register. I don't know.

I'll agree with all that unless I find out otherwise.

[gmtech825]

Does anyone know the addresses where the shift adapt cell pressures are stored? I'd like an easy way to see if it is adding or removing pressure and by how much to get where it wants to be with less guess work. I wasn't able to tie it to a supported PID either. Maybe it's 0xffff8b96?

Do these PCM's even support mode $2d for logging memory addresses?

[NSFW]

They do support logging from memory. The Parameters.RAM.xml file has a few examples showing how to get the logger to use memory.

This branch has more examples than the one in the develop branch:

https://github.com/PcmHammer/PcmHammer/ ... rs.RAM.xml

[gmtech825]

They do support logging from memory. The Parameters.RAM.xml file has a few examples showing how to get the logger to use memory.

This branch has more examples than the one in the develop branch:

https://github.com/PcmHammer/PcmHammer/ ... rs.RAM.xml

Thanks, I see now how to set up the logger to read memory. I'll give it a try when I have more confidence the address I'm looking at is right. I think If i can trace the address by the reset TAP control functions I should be able to nail it down... But I'm having trouble finding that control function routine. I'm better with the can based ecms than I am with these.

actually PID 199B or 199C might be the current cell adapt pressure. And I may have found the jump to the $3b routine but it looks like it's pointing to ram

[gmtech825]

Found a way. For anyone else wondering the easy way to read them. Mode $3c , block number $41,42,43 will return the 17 1-2 cell values. $44,45,46 will return the 17 2-3 cell values.

[G-Body]

I`ve been looking for a way to monitor tow/haul aka performance mode status for a while now and I think I may have found an option. The reverse lockout pin 44 on C2 green connector is unused on automatic cars and seems like a good fit to be repurposed to control the indicator light. After digging through Ghidra it looks like when you are in performance shift mode DAT_ffffa3fe = 1 Oddly enough it looks like when DAT_ffffa3ce = 1 and you are below the reverse lockout speed the PCM will pull pin 44 down to ground. To me it looks like I could enable the reverse lockout, set the enable speed to 250, set the disable speed to 254 and then replace DAT_ffffa3ce with DAT_ffffa3fe at the 2 locations in the reverse lockout code routine and have an indicator light. I feel like I`m way over my head with this, but does anyone see a reason it would not work?

[NSFW]

That sounds reasonable to me. The only way to know for sure is to try.

If you use an LED for the indicator light, you'll want a resistor to limit the current flow.