Page 1 of 6
'99 Saturn Dissassembly
Posted: Thu Jan 14, 2010 3:35 pm
by sabercatpuck
This is the bin files for the '99 Saturn DOHC Auto box I am working on. By the way do not try flashing these directly to the eeprom and then put them in cause they wont work as they are in these files. The Saturn engineers did something clever and swapped 4 pairs of address lines so that when you unsolder the flash and put it in the eeprom burner to read it it comes out garbage, but the system doesn't care so long as the lines are correct. These were done after making a modified carrier to unscramble the lines before the willem programmer.
Re: GNU assembler for HC11
Posted: Thu Jan 14, 2010 3:43 pm
by sabercatpuck
This is the dissasembly for the flash (quadrents 1+2), note still very raw so no comments and I still need to figure out what is happening in the ram for good annotations (waiting on cables for the logic analyzer). Again the code in the area of $5666 is where the page switching is happening.
Re: GNU assembler for HC11
Posted: Thu Jan 14, 2010 3:45 pm
by sabercatpuck
And finally the tranny side of the ECM. It only uses the lower 64k so no page swapping needed.
Re: '99 Saturn Dissassembly
Posted: Thu Jan 14, 2010 4:01 pm
by antus
Interesting stuff to read. It sounds like the bank switching mechanism works the same as the holden ecus here. Interesting that they swap the address pins. Ive not heard of that before on GM based vehicles, only the software seed/key challenges on some of the later ecus. Welcome to the forums, its always good to have more reverse engineers around
PS I split your topic in to a thread of its own to keep the 99 saturn info findable.
Re: '99 Saturn Dissassembly
Posted: Thu Jan 14, 2010 4:26 pm
by sabercatpuck
In my opinion there is nothing more fun han reverse engineering something. You get to play detective, psycologist, and technician all at once. Gotta do something productive with that BSEET degree
I am just waiting for a couple cables to get in for a couple of logicwave logic analyzers that I picked up off ebay and then I can start going to town with these things (well after I finish finishing the basement, wife project must come first
i have mentioned the project to a few people and they think I am a nut, I figure I am just re-aquainting myself with my inner engineer. One other project I had recently was designing a method of getting the seed key pair out, very simple program for a really simple lock. All seemed to be going well on EFI live, forum mods egging me on etc, untill they started getting calls and all the sudden the whole thread was gone. Ohh well, luckily there were a few that directed me this way.
Re: '99 Saturn Dissassembly
Posted: Thu Jan 14, 2010 4:29 pm
by sabercatpuck
by the way specifically it was the A1-A13, A2-A12, A3-A11, and A10-A14 pairs that were swapped
Re: '99 Saturn Dissassembly
Posted: Thu Jan 14, 2010 4:35 pm
by sabercatpuck
ohh one more post script before I head to bed, I also snagged the SDM(airbag), ABS and RKE modules from the same junk yard car and eventually plan to get to them too. SDM might be a bit easier just because I know what processor it has, I have not been able to cross the one in the abs yet, but agin that is what the logic analyzer is for
Re: '99 Saturn Dissassembly
Posted: Thu Jan 14, 2010 4:37 pm
by VL400
Welcome aboard, some great info you have posted so far. The seed/key stuff is just what I am looking at now actually
Re: '99 Saturn Dissassembly
Posted: Fri Jan 15, 2010 9:39 am
by sabercatpuck
The really funny thing is that I don't have much of a clue about this stuff yet. I am only an OK mechanic, and have little to no experience knowing what a spark table looks like compared to a MAF table (or if they are even the same), I am sure I will pick that up as I go allong. What I am though is a real good electronics guy. I can mentally take something appart in my head and figure out what it is doing or why it isn't working (I think I irritate allot of the other ET's at work because of it though).
Oh well, my logic analyzer cables arrived today so hopefully I will be able to add some stuff to my knowledge base soon (64 channels of data and 4 clocks between the two of them, ohh yeah
)
Re: '99 Saturn Dissassembly
Posted: Fri Jan 15, 2010 2:58 pm
by sabercatpuck
there is a 40 pin headder on the boards. Edited in pins 7 and 11 as going to the flash pins A15 and A16. A15 on pin 27 still goes directly to the A15 on the HC11. It goes as follows
Code: Select all
A4 1 2
A3 3 4 Ground
A2 5 6
Flash A15 7 8 A1
9 10 A0
Flash A16 11 12 A5
A6 13 14 A8
A7 15 16 A9
A10 17 18 D7
A11 19 20 D6
A12 21 22 D5
A13 23 24 D4
A14 24 25 D0
A15 27 28 D1
R/W 29 30 D2
Reset 31 32 D3
Moda/LIR 33 34 PD1/TXTD
PD1/RXD 35 36 E
ModB/Vstby 37 38 ground
XIRQ 39 40