pcmhacking.net

That is idle traffic from pcm.

Here is a eecv j-config for initial connection

unzip it in this folder
UNIVERSALPATCHER\Logger\J2534Profiles

When you get connected you can send some custom commands like test if pcm supports mode 2703

For example send
64 10 f1 27 03

I still haven`t found way to overcome that implied node ID filtering and monitor all messages with mdi. Must be some specific Ford shit type of encrypting monitoring. However simple elm is pretty enough with 11 byte message length.

I'll install it in a few minutes. I hate to take up Tazzi's thread but it might be useful to him in his OBDX development. He likes big long threads anyway

Is there anything else you would like me to try with the mdi when I get it all hooked back up? Should I log a read with stnterm for you to peruse? Your settings are a bit different than Tazzi's elm commands.

It only tagged a little 'till buffer was full, just like hyperterminal. PuTTY still wins

41 93 10 C6 CB
41 93 10 C6 CB
41 93 10 C6 CB
00 05 10 04 00 08 0B 61 00 31
64 10 F1 31 A0 00 D8 01 00 BC
C4 F1 10 7F 31 A0 00 D8 00 91
64 10 F1 27 01 48
C4 F1 10 67 01 0B 0C EA D5
64 10 F1 27 02 47 D1 74
C4 F1 10 67 02 34 A3
C4 10 F1 35 01 04 00 00 20 00 92
C4 F1 10 7F 35 01 04 00 00 0D
C4 F1 10 36 FF FA 27 FE FF FF 33
C4 F1 10 36 FF FF FF FF FF FF 7B
C4 F1 10 36 FF FF FF FF 60 20 E6
C4 F1 10 36 63 20 66 20 69 20 4A
C4 F1 10 36 6C 20 6F 20 72 20 B4
C4 F1 10 36 75 20 78 20 7D 20 9E
C4 F1 10 36 80 20 85 20 8A 20 8B
C4 F1 10 36 8F 20 94 20 99 20 96
C4 F1 10 36 9E 20 A3 20 A6 20 3D
C4 F1 10 36 A8 20 AD 20 B2 20 E4
C4 F1 10 36 B7 20 BC 20 C1 20 72
C4 F1 10 36 C6 20 CB 20 D0 20 AF
C4 F1 10 36 D5 20 DA 20 DF 20 6A
C4 F1 10 36 E1 20 E3 20 E5 20 3E
C4 F1 10 36 E7 20 EC 20 F1 20 46
C4 F1 10 36 F6 20 FB 20 00 21 76
C4 F1 10 36 E7 77 28 E7 79 28 82
C4 F1 10 36 E7 7C 28 E7 7F 28 FE
C4 F1 10 36 E7 82 28 E7 85 28 5B
C4 F1 10 36 E7 88 28 E7 8B 28 17
C4 F1 10 36 10 01 E7 17 78 E7 D3
C4 F1 10 36 B7 13 10 01 E7 0F 0D
C4 F1 10 36 78 10 01 E7 0A 78 CC
C4 F1 10 36 10 01 E7 05 78 10 E4
C4 F1 10 36 01 E7 00 78 10 01 6D
C4 F1 10 36 E7 FB 77 10 01 E7 47
C4 F1 10 36 F6 77 10 01 E7 F1 29
C4 F1 10 36 77 E7 FE 30 21 24 BC
C4 F1 10 36 10 01 E7 E7 77 10 D4
C4 F1 10 36 01 E7 E2 77 10 01 27
C4 F1 10 36 E7 DD 77 10 01 E7 E7
C4 F1 10 36 D8 77 10 01 E7 D3 3F
C4 F1 10 36 77 10 01 E7 CE 77 BC
C4 F1 10 36 10 01 E7 C9 77 10 ED
C4 F1 10 36 01 E7 C4 77 10 01 04
C4 F1 10 36 E7 BF 77 10 01 E7 6D
C4 F1 10 36 BA 77 10 01 E7 B5 11
C4 F1 10 36 77 21 CB 20 1F 20 9F
C4 F1 10 36 37 20 4F 10 01 E7 CB
C4 F1 10 36 A8 77 10 01 E7 A3 0A
C4 F1 10 36 77 10 01 E7 9E 77 E2
C4 F1 10 36 10 01 E7 99 77 10 95
C4 F1 10 36 01 E7 94 77 20 4E DC
C4 F1 10 36 F2 88 35 00 D7 06 38
C4 F1 10 36 BD FF 48 C0 35 48 79
C4 F1 10 36 A1 40 80 39 C3 D2 4A
C4 F1 10 36 74 22 A3 D2 76 22 91
C4 F1 10 36 F3 F0 F2 88 35 00 A0
C4 F1 10 36 D7 06 BD FF 48 C0 64
C4 F1 10 36 35 48 A1 40 80 39 D3
C4 F1 10 36 C3 D2 74 22 A3 D2 20
C4 F1 10 36 78 22 F3 F0 F2 88 8B
C4 F1 10 36 35 00 D7 06 BD FF 4D
C4 F1 10 36 48 C0 35 48 A1 40 65
C4 F1 10 36 80 39 C3 D2 74 22 39
C4 F1 10 36 A3 D2 7A 22 F3 F0 4E
C4 F1 10 36 F2 88 35 00 DF 12 DB
C4 F1 10 36 07 37 31 8B 05 71 CC
C4 F1 10 36 FE 8B 20 26 91 02 61
C4 F1 10 36 8B 91 01 8B 20 1E B4
C4 F1 10 36 C0 37 00 71 FE 8B 47
C4 F1 10 36 71 FD 8B 8B D2 74 D0
C4 F1 10 36 00 DF 08 91 02 8B 24
C4 F1 10 36 91 01 8B 20 07 C0 C7
C4 F1 10 36 35 22 A3 D2 70 22 32
C4 F1 10 36 3F 0A FD 11 1F 47 AB
C4 F1 10 36 CE 62 06 0E B1 9F 3D
C4 F1 10 36 0D F3 F1 37 60 0C 26
C4 F1 10 36 4B 01 32 17 8B 48 2C
C4 F1 10 36 C3 01 30 17 48 F0 D2
C4 F1 10 36 C3 01 28 17 8B B3 A8
C4 F1 10 36 D2 E2 4A 99 80 4A 0D
C4 F1 10 36 DF 06 15 4A C7 D2 71
C4 F1 10 36 E2 4A 91 08 8A C3 40
C4 F1 10 36 01 32 17 8B F0 09 8B
C4 F1 10 36 0F 00 09 03 00 3A 60
C4 F1 10 36 0A 06 F3 F1 F2 32 2E
C4 F1 10 36 0A F1 C9 24 2D A0 B6
C4 F1 10 36 0E 4A B0 60 61 B0 BA
C4 F1 10 36 0D 60 94 60 61 70 23
C4 F1 10 36 0C 61 A0 06 48 B0 2D
C4 F1 10 36 13 5C 48 4A 48 8F 97
C4 F1 10 36 48 8F 48 8B B8 00 AF
C4 F1 10 36 5C B3 F8 52 4A 99 56
C4 F1 10 36 02 4A D7 54 30 A9 9B
C4 F1 10 36 51 31 61 4E 31 60 C4
C4 F1 10 36 4B C3 01 1E 17 8B 0A
C4 F1 10 36 C7 EA F1 5C A0 8B 25
C4 F1 10 36 52 B0 5C 50 4F 01 3B
C4 F1 10 36 12 17 2D 4C 4F 01 F6
C4 F1 10 36 14 17 2D 48 11 4C 5A
C4 F1 10 36 11 48 67 01 2A 17 86
C4 F1 10 36 4E B7 01 2C 17 4C 01
C4 F1 10 36 67 01 2A 17 4A B7 19
C4 F1 10 36 01 2C 17 48 68 52 69
C4 F1 10 36 4A B8 50 48 3F 48 59
C4 F1 10 36 0F 68 4E 52 B8 4C 9B
C4 F1 10 36 50 3F 50 06 91 20 A5
C4 F1 10 36 A9 71 FD 61 30 61 B8
C4 F1 10 36 03 EF 85 0B 37 61 AC
C4 F1 10 36 02 2F 3A 36 61 48 50
C4 F1 10 36 B0 CD 48 9B F6 48 C4
C4 F1 10 36 00 D7 03 3E 60 03 CA
BUFFER FULL

kur4o
Error, Datalogger line 338: There is an error in XML document (2, 2).
Error, Datalogger line 338: There is an error in XML document (2, 2).
J2534 client initializing...
Initializing J2534 Device
J2534 client: Device initialization complete.
Battery Voltage is: 14.057
Device initialization complete.
J2534 client Message sent fail.
J2534 WriteMsgs error: ERR_INVALID_MSG ((02280006:00000000) Invalid message structure pointed to by pMsg)
J2534 client Message sent fail.
J2534 WriteMsgs error: ERR_INVALID_MSG ((02050003:00000000) Invalid message structure pointed to by pMsg)


2 Messages I sent:
Window
[11:05:48.404] [00638134383484041085] 64 10 F1 27 03
[11:06:32.465] [00638134383924655342] 64 10 F1 27 01 48

To load the config xml use the load button above connect/disconnect button.

Progress,
I used the file/open, my mistake, thanks for the tip.

At the top of the log you can see where I manually typed in some commands, the returns were not correct. A little bug in there. It did fail twice during read. I am hard booting everything now. The ecm quit talking

Here is the log, I changed it from rtf to .txt and is much easier to follow. p.s. Hard reboot of the ecm and all is back.

rtf have the benefit of color encoding send/recieve data, so you don`t need to guess.

I think you made major discovery why tazzi test pcm always send 2 byte seed starting with zero.

Pcm needs to see mode 31 A0 requested before seed request.

Since we got it working now I made little test script, to confirm some stuff.

The goal is to make pcm enter high speed so tazzi can test the harware. If we can`t make pcm goes to high speed, we can use mdi set it to high speed and made a loop to send some data each 0.5 seconds. So some scope can be hooked and testing can be done.

To use the script

COnnect with mdi, click "upload script" button and select the script text file that is attached.

I noticed that you add the crc byte when you send messages, taken from the elm log. There is no need and it may bog the message.

So you just send only

64 10 F1 31 A0 00 D8 01 00
or
64 10 F1 27 01

kur4o wrote:rtf have the benefit of color encoding send/recieve data, so you don`t need to guess.Thank you, understand and will correct my font size to correspond

I think you made major discovery why tazzi test pcm always send 2 byte seed starting with zero.Thank You, I agree. I love testing with you guys

Pcm needs to see mode 31 A0 requested before seed request. YES

Since we got it working now I made little test script, to confirm some stuff.

The goal is to make pcm enter high speed so tazzi can test the harware. If we can`t make pcm goes to high speed, we can use mdi set it to high speed and made a loop to send some data each 0.5 seconds. So some scope can be hooked and testing can be done.

To use the script

COnnect with mdi, click "upload script" button and select the script text file that is attached.

I noticed that you add the crc byte when you send messages, taken from the elm log. There is no need and it may bog the message.

So you just send only

64 10 F1 31 A0 00 D8 01 00
or
64 10 F1 27 01

OK, will test stuff, probably not till tomorrow

See replies in red

HI - WOW ! Talk about finding a needle in a haystack.

I signed up in 2019 knowing nothing about PCMs , protocols used , etc. ( Haven't been on site since then and even forgot about this site. ) Slowly have learned a little but still far from knowing a lot. I'm retired and older so this has been a slow project.

All this time I have been exploring Chrysler PCM's. Specifically SBEC3 and NGC . Yes - not much info online. Goal was to be able to read and write Eeprom data and Flash file. SCI bus. Along the way I learned about Seed / key commands. So lately been looking at seed/key for the NGC controller. I learned it is 27 01 . Wait a minute - I saw that in your Ford logs !! and then also saw your comments about FCA similarity. Yes a needle in a haystack. I went back to a NGC4 - CAN "PCM dumps" I sniffed in 2019. Sure enough 27 01 seed request / key result messages were at the start of the dump.

So - I am here to help in any way I can and hope you will be kind enough to answer / guide me with some answers to my questions.

You mention level 1 and level 5 access. Can you clarify what each is used for ?
Can you share the algorithm to generate keys from the seeds received? FCA appears to be 2 byte. It might work on the FCA

Thank You !!

PS - Not sure if this works on Ford, B5 07 00 switched baud to 62500 ( from 7812 ) for NGC . That is about all I know about it !!

Hiya,
Welcome to the site.
I don't have any Chrysler stuff logged. It's neat you were able to look at some of these generic commands and make some sense of it. Anything OBD2 in America has to follow certain rules. I'm not sure how it is handled around the world