Colorado / H3 BCM hacking

[04colyZQ8]

I think the rf chip might send the remote and tire pressure rf frequency signals by class 2? To the processor? I don’t see any can or lin, references. And didn’t see locking in mpADC

[Gatecrasher]

mibADC is the "multi buffered analog to digital converter". So basically anything that shows a 0-5 or 0-12 voltage in the Tech2 data display would be here. Stuff like battery voltage, light sensor voltage, wiper delay, dimmer, etc. I've got quite a few of those figured out. Go to the symbol tree window and search for 2116. That'll take you to the general area of the PIDs that hold those values.

I don't think the RF stuff uses class 2. It'd be needlessly complicated. It might be something like SPI. The BCM uses that for the EEPROM. Dunno if it's connected to the RF stuff or not. I haven't traced back any of that hardware. The FCC docs have some high level diagrams showing how the RF stuff works, but nothing about the protocol.

https://fcc.report/FCC-ID/L2C0022R

Go to the files for block diagram and description.

[04colyZQ8]

I see the key fob number of fobs, the learn new fob, and luck unlock pids in the tech 2.
How do I trace those back to the bcm? Do I need to sniff the vpw msgs being sent?
Not sure how to decide that, and trace within the bcm?

Is there an easier way to find tech 2, msg and pids? Maybe the pc ram while the program is running
Might show a few things?

Anyway I’d like to find the address of the eeprom to write to it, so I can dump registers to it. Or just write the eeprom from obd rather then a chip clip. I don’t see it’s address even though you mapped the tire Id codes, they are stored There along with the sdm and key fob data. Do you think the eeprom is never written two? And only changes are made to the copy in ram, then at key off the eeprom is hard wired to read the copy in ram, and dump it to the chip?

[04colyZQ8]

This https://fcc.report/FCC-ID/L2C0022R

Was quite interesting!! The line slicer seems like the last step from anolog to digital conversion?

What does a line slicer look like? If I can trace it to the pin on the processor, then maybe it will tell us what module it goes to?

[04colyZQ8]

This is a nicer graphical over view

https://www.ti.com/lit/ml/slad010/slad0 ... le.ca%252F

[04colyZQ8]

ok so all the mode 3B and 3C requests go to the ram, not the EEProm, so either the EEprom is the same as the ram, as far as read write, or it is definitely as I say, and the copy in ram is all that is worked with, and at key off it saves that portion to the EEProm.

for example, 3B / 3C request to read write tire sensor ID is at 0x8000171h, and open up the bin of the ram read I posted, and it is at address 171h .

found a loop in the bcm that starts at 0x800040h, and reads the vin located in the EEprom at 41h . that's neat!

[Gatecrasher]

EEPROM is copied into RAM and worked on there. At some point it gets copied back to EEPROM during a power down event. I haven't figured out where or under what circumstances that happens. So the RAM addresses from 0x80000000 to 0x80001B0 are just a live, working copy of what's stored on the EEPROM chip.

I made a pretty big discovery last night. Ghidra isn't correctly tracking the branches to and from ARM Thumb mode. That's part of why it's not disassembling all the code correctly. It doesn't answer all the questions, but it'll help a lot. I'm trying to go through and manually patch some of it up. I'll post another archive later this weekend.

[04colyZQ8]

EEPROM is copied into RAM and worked on there. At some point it gets copied back to EEPROM during a power down event. I haven't figured out where or under what circumstances that happens. So the RAM addresses from 0x80000000 to 0x80001B0 are just a live, working copy of what's stored on the EEPROM chip.

I made a pretty big discovery last night. Ghidra isn't correctly tracking the branches to and from ARM Thumb mode. That's part of why it's not disassembling all the code correctly. It doesn't answer all the questions, but it'll help a lot. I'm trying to go through and manually patch some of it up. I'll post another archive later this weekend.

Cool!! Yes that makes sense about the eeprom. I’m tempted to disable the checks I see for vin write, looks like it checks to locations for ignition counter? Because I’ve never been able to change the vin for some reason. Using 3b even after cycling the ignition switch.

[04colyZQ8]

Could this be of any use?
https://www.ti.com/tool/SPRC236#downloads

[04colyZQ8]

Or this?
https://www.ti.com/tool/SPNC010