Capturing Tech1 Commands VS V6

[vn5000]

Looks like someones having fun playing with there new toy .lol

[The1]

haha yeh, i flattened my battery playing for a few hours, got it on charge now.

[The1]

I have here a usb to serial adaptor, So im guessing i could try running the data pin from the serial pin to the srs serial pin and use hyper terminal to see what's going on?

[antus]

aldl is 8129 baud and i dont think hyperterm supports non standard speeds. maybe check continuity from the main aldl wire to the srs one to confirm if its isolated?

[The1]

multimeter doesn't detect continuity srs serial data pin is seperate from aldl data bus, also when piggybacked into the tech1 and pulling stuff from bcm, abs etc and laptop in srs data pin i see no data, so there defiantly separate circuits. My Gregories manual also show the srs data pin goes back to the sdm module

[VL400]

Am pretty sure EFIlive display's chatter that are non standard ALDL packets such as the heartbeat on later vehicles. Might be able to use that to see if there are any other items of interest on the bus?

[The1]

Hey yeh I'll give it a go, got full efilive v4.

Anyone know how to get security code for the all new key function in bcm menu, can do aditional key but not all new, have heard that holden gets it from tis2web with your vin, I'm guessing there has to be another way cause if a bcm gets swapped you can't get the vin, tried using security code from tech1 also tried all the numbers on the bcm itself

[Doctor Bob]

The BCM security PIN is calculated from the barcode on the BCM, im not sure of the algo used but if someone wants a crack at it PM me & ill send some barcodes & pin numbers to see if you can sort it out.

Rob

[brett_jjj]

I thought that all of the codes the tech 1 sends to the vehicles systems could be found somewhere in the tech 1 cartridge bin file.I have been trying to find someone who can disassemble and make sence of these bin files.I have also removed the eprom chip from inside the back of the tech 1 machine itself, and made a copy of it.I thought it might have some useful info on it as well.Maybe someone on here would know a bit about disassembling these files and would like to have a look at them or offer some insight on disassembling these bins.Im opening them with IDA pro disassembler and it says the code is 16 bit ,but the tech 1 processor is an 8 bit cpu.Ive looked at the board inside the tech 1, and cant find any info on google about any of the chips used on these boards,the numbers on them must be proprietary,otherwise something should show up on google when I search for them.I think the cartridge programs might be written in assembly language.I know a bit about assembly,but not enough to make proper sence out of it.I also bought a prototype tech 1 a while back from the US,and when its powered up it says "LILBUG MONITOR " on the screen.Its master and auxillary cartridge slots have been swapped over.It can still function as a normal tech 1,but has this other stuff added on.I looked through the bin file from the eporm chip out of this machine, and I get the impression that it might have been written to make the tech 1 either copy single cartridges over to a MSC (Mass Storage Cartridge) or to copy MSC's over to other MSC's.The bin file from the eprom chip in this machine is completely different to the "normal" tech1 bin file..Ive googled LILBUG MONITOR and cant find anything on there about it.The guy I bought it off didnt know anything either.Apparently he got it from a GM factory in the US.The cartridge that came with it says MSC, boot ,programming and power supply.The serial number for this cartridge says PILOT S/N 003 and its label is not a bodgey one.(eg:not homemade).The cartridge does nothing when inserted into a "normal" tech 1 either.This cartridge has an inbuilt chip that cant be removed,similar to the MSC cartridge setup,so I cant copy it over to my computer to open it up in a hex editor to check it out.If anyone is interested in any of this stuff, I can send you the bin files ,so you can check them out.When I open the LILBUG bin file it shows menus that display cartridge boot files,display memory addresses,offsets,it mentions learn dir,enable/disable update,memory examine/change,and heaps more.I think it would be very interesting to see exactly what it does ,so hopefully I can (or can find someone) to work out the cartridge bin files and to work out exactly what this LILBUG thing does.Hopefully it might help in finding the stuff you guys are wanting to know about the communications between the vehicle and the tech1.cheers.

[The1]

i get the same values logging in efilive as well. hmm where to next?