E92 PCM Reverse Engineering

[In-Tech]

My nomenclature may be incorrect since I have been out of the loop so long. Basically power to the "chip"

[antus]

Yeah VPP means Voltage Programming Power. For Intel you can see 12v on VPP on the flash chip with a multimeter, AMD doesn't do this as it has an internal voltage generator that can create the power from the lower system voltage the chip is running at. When you are writing you can usually see 100-250ma more current on a lab bench supply with current meter. When developing the flash kernels on the earlier PCMs I could see at a glance to the current draw on the supply if it was really programming or not.

[bubba2533]

Well I just discovered Mode 9 via SAE J1979 which seems to be a very good resource.

Hopefully I can learn some more from that.

Edit: Looks like Mode 9 took me to the function that computes the CVN's.

This is the first time I've seen CVN's (since I'm more used to P01/P59) and it seems like they are related to checksums, but they are calculated real time and not stored in ROM of the ECU.

[In-Tech]

Just fyi, the cvn's are stored in flash, they are related to the checksums and I don't understand all of it. Sometimes I have to use 2 different "scratchpads" to do the correction per module. If not done correctly, the GM kernel/bootloader will discard the attempt to write. In the beginning of working on this, I had to bdm the write. Now after satisfying, I can write through the obd2 port.
Good work bubba, I enjoy following along. I wish I could dive deep

[gmtech825]

are you trying to find the cvn/checksum address ranges and algo? that's all known for the e92

[bubba2533]

are you trying to find the cvn/checksum address ranges and algo? that's all known for the e92

Yes! I wasn't aware that was already known.

[bubba2533]

In the beginning of working on this, I had to bdm the write.

What BDM did you use? And do you have a pinout for the connections?

are you trying to find the cvn/checksum address ranges and algo? that's all known for the e92

Is there someplace this is documented?

[In-Tech]

I apologize if I have mislead you. I have not BDM'd an e92. If anyone else has and have a schematic to share, I would love to hear.

Curious on the next question though. I thought I was alone

[antus]

I dont know what else is being referred to, but Joukoy and Kar4o look to have it covered with universal patcher, see them in the xml config in here: https://github.com/joukoy/UniversalPatc ... master/XML

[gmtech825]

I dont know what else is being referred to, but Joukoy and Kar4o look to have it covered with universal patcher, see them in the xml config in here: https://github.com/joukoy/UniversalPatc ... master/XML

yes, see this. the eng op section is different then the other segments. the extra checksums for the eng op segment seem to only be used on the e92 and not the e92a from what I've seen.