T43 Dissasembly

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
hjtrbo
Posts: 140
Joined: Tue Jul 06, 2021 6:57 pm
cars: VF2 R8 LSA
FG XR6T
HJ Ute w/RB25DET

Re: T43 Dissasembly

Post by hjtrbo »

Address workbook has been updated to v1 in the first post.
hjtrbo
Posts: 140
Joined: Tue Jul 06, 2021 6:57 pm
cars: VF2 R8 LSA
FG XR6T
HJ Ute w/RB25DET

Re: T43 Dissasembly

Post by hjtrbo »

Attached mode 6 OBD diag doc variant 7 for MYD 2014 Camaro / CTS-V (Same as VF HSV)
Attachments
14OBDG07 Transmission Diagnostics.pdf
(591.3 KiB) Downloaded 85 times
hjtrbo
Posts: 140
Joined: Tue Jul 06, 2021 6:57 pm
cars: VF2 R8 LSA
FG XR6T
HJ Ute w/RB25DET

Re: T43 Dissasembly

Post by hjtrbo »

Any help with checksum calcs would be appreciated.

I'm just concentrating on the trans segment for now. I've found a few functions that sent me down a rabbit hole, however I'm yet to work out how the checksum is verified which would then tell me how it is calculated.

Side note, if you set the first byte after the 2nd checksum location to 1 in the trans segment, checksum verification is disabled as reported by efilive.
gmtech825
Posts: 188
Joined: Fri Feb 24, 2017 11:27 am

Re: T43 Dissasembly

Post by gmtech825 »

universal patcher has the checksum calcs figured out for you already. see the t43 xml
hjtrbo
Posts: 140
Joined: Tue Jul 06, 2021 6:57 pm
cars: VF2 R8 LSA
FG XR6T
HJ Ute w/RB25DET

Re: T43 Dissasembly

Post by hjtrbo »

Thanks gm. This software continues to amaze me.

Image
hjtrbo
Posts: 140
Joined: Tue Jul 06, 2021 6:57 pm
cars: VF2 R8 LSA
FG XR6T
HJ Ute w/RB25DET

Re: T43 Dissasembly

Post by hjtrbo »

Fuck UPatcher is the shiz dizzle! :punk:

Trans segment range: 1C0000 - 1FCB57
CS1 offset = 0x0
CS2 offset = 0x1c
CS length = 2 bytes

With both CS set to 0x0: Segment is CRC16. Result is byte swapped and written to CS2. Then entire segment is word summed (incl. the newly calc'd CS2), 2's compliment and written to CS1.

My next move is to give back to the UP team and define what I have so far into an xdf => xml for this OS. About 90% of the HP def with every table needed to get a good tune up and running.
hjtrbo
Posts: 140
Joined: Tue Jul 06, 2021 6:57 pm
cars: VF2 R8 LSA
FG XR6T
HJ Ute w/RB25DET

Re: T43 Dissasembly

Post by hjtrbo »

xdf uploaded. Corresponding hpt tune attached which you can use to cross reference if needed.

Edit: 31/12/23 xdf updated to v1
Removed universal patcher xml, awaiting information on xdf import for row major and minor stride settings.

Edit: 03/01/24 xdf updated to v2
Added checksum dll
Image

Edit: 03/01/24
As per @antus, hold my beer

Edit: 03/01/24
Fixed up uuid. Please delete earlier copies of the xdf and dll :wall:
xdf is v3. dll is v0.1
Attachments
v3 xdf changelog.txt
(435 Bytes) Downloaded 55 times
T43 OS 24264923.xdf
(363.93 KiB) Downloaded 59 times
T43_Trans_Segment_Checksum.dll
(42 KiB) Downloaded 55 times
Stock_24264923.bin
(2 MiB) Downloaded 57 times
Stock_24264923.hpt
(1.34 MiB) Downloaded 58 times
Last edited by hjtrbo on Wed Jan 03, 2024 9:16 pm, edited 7 times in total.
User avatar
Tazzi
Posts: 3431
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: T43 Dissasembly

Post by Tazzi »

hjtrbo wrote: Thu Dec 28, 2023 12:05 pm Fuck UPatcher is the shiz dizzle! :punk:

Trans segment range: 1C0000 - 1FCB57
CS1 offset = 0x0
CS2 offset = 0x1c
CS length = 2 bytes

With both CS set to 0x0: Segment is CRC16. Result is byte swapped and written to CS2. Then entire segment is word summed (incl. the newly calc'd CS2), 2's compliment and written to CS1.

My next move is to give back to the UP team and define what I have so far into an xdf => xml for this OS. About 90% of the HP def with every table needed to get a good tune up and running.
Making some great progress!! Fucking awesome work! 8-)
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
hjtrbo
Posts: 140
Joined: Tue Jul 06, 2021 6:57 pm
cars: VF2 R8 LSA
FG XR6T
HJ Ute w/RB25DET

Re: T43 Dissasembly

Post by hjtrbo »

I built this handy little utility to help me. It speeds up analysis considerably. Pictures describe usage.
As is the case when one builds there own tools, the usual quirks and bugs apply. If anyone wants to improve on it, knock yourselves out. Send me back what you've done.

Parse data table out to array
HBDISiq.png
HBDISiq.png (67.65 KiB) Viewed 854 times
Convert hex array into a scaled table. 1D and 2D supported. Auto detect of table size by GM length bytes supported
mecsGM1.png
mecsGM1.png (130.9 KiB) Viewed 853 times
Parse out an assembly function to minimal text to simplify analysis
Zwl44sg.png
Attachments
T43 Ghidra Tools.zip
(244.08 KiB) Downloaded 76 times
hjtrbo
Posts: 140
Joined: Tue Jul 06, 2021 6:57 pm
cars: VF2 R8 LSA
FG XR6T
HJ Ute w/RB25DET

Re: T43 Dissasembly

Post by hjtrbo »

[youtube][/youtube]
Last edited by hjtrbo on Wed Jan 03, 2024 6:33 pm, edited 2 times in total.
Post Reply