2004 to 2012 Colorado and 2006 -10 h3 cluster programming

[kur4o]

[11:05:47.908] 8C 60 F0 23 [00 00 00] 01
vs
--> 0A 00 6C 60 F1 23 [00 00 00 00] 01

You are using 4 bytes addressing, try 3 byte addressing.

You can also test different addresses in the whole 3 byte range, It is unknown the offset cpu uses.

Mode 35 pw takes max 16 bytes long messages

Here is some example with mode35 and a bcm
[12:25:37.274] 6C 40 F0 35 [00 10] [00 00 00] 0010=size 000000=address

[12:25:37.156] 6C FE F1 28 00
[12:25:37.171] 6C F1 A6 68 00
[12:25:37.176] 6C F1 10 68 00
[12:25:37.182] 6C F1 29 68 00
[12:25:37.187] 6C F1 40 68 00
[12:25:37.192] 6C F1 58 68 00
[12:25:37.197] 6C F1 60 68 00
[12:25:37.202] 6C F1 98 68 00
[12:25:37.208] 6C F1 A0 68 00
[12:25:37.213] 6C F1 A1 68 00
[12:25:37.219] 6C F1 A2 68 00
[12:25:37.224] 6C F1 A7 68 00
[12:25:37.227] 6C 40 F0 27 01
[12:25:37.230] 6C F1 1A 68 00
[12:25:37.242] 6C F1 AA 68 00
[12:25:37.248] 6C F0 40 67 01 69 B1
[12:25:37.252] 6C 40 F0 27 02 47 A6
[12:25:37.253] 6C F1 C0 68 00
[12:25:37.270] 6C F0 40 67 02 34
[12:25:37.274] 6C 40 F0 35 00 10 00 00 00
[12:25:37.300] 6C F0 40 75 54
[12:25:37.326] 6D F0 40 36 01 00 10 00 00 00 FB 00 FB 00 FB 00 FB 00 FB 00 FB 00 FB 00 FB 00 07 E9
[12:25:37.345] 6C 40 F0 76 01 54
[12:25:37.364] 8C FE F0 3F
[12:25:37.382] 6C 40 F0 3F
[12:25:37.400] 6C 40 F0 35 00 10 00 00 10
[12:25:37.416] 6C F0 40 75 54
[12:25:37.443] 6D F0 40 36 01 00 10 00 00 10 FB 00 FB 00 FB 00 FB 00 40 20 00 00 22 82 EC 60 06 5D
[12:25:37.461] 6C 40 F0 76 01 54
[12:25:37.479] 8C FE F0 3F
[12:25:37.496] 6C 40 F0 3F
[12:25:37.513] 6C 40 F0 35 00 10 00 00 20

You need to test every possible combination and if still not working, the ipc might not support these modes.
Sometimes if you request specific address the cpu can crash.

I noticed at your log that the ipc resets couple of times.

Do you have a pcm out of these for testing. It is VPW only and if similar to p12, read/write can be added.

[Gatecrasher]

I've got an old Colorado IPC circuit board I was about to throw away. Let me know if it can be used for destructive testing or something.

[04colyZQ8]

Ok thanks hang on to the cluster for now!

It’s only vpw I have a few stripped down to the board!

No matter what a try I get negative response 11.

It’s got to be dumped over uart.

Wonder if I can put a Trojan in the mileage chip! I can write to that chip. Typically the eeprom is at the first part of ram, I might be able to over write the reset vector to jump to that location.

[kur4o]

You can change strategy.

First dump all 3c data that is stored in ipc with this script, if there is some submode used for mileage I can give you some hints how to test changing it.

[04colyZQ8]

What software do I use to run that script? What’s it supposed to do? Isn’t 3c for segment numbers etc? Doesn’t dps essentially do this check on modules? Not much comes up with dps for the cluster

[kur4o]

It will read all submodes of 2a mode out of module. There is much more than segment numbers.

[04colyZQ8]

Ok great will give this a try soon! Is that program universal patcher master?

[kur4o]

Ok great will give this a try soon! Is that program universal patcher master?

It is the logger section of universal patcher available in basic and advanced mode.

tuner->utilities->logger

[04colyZQ8]

I can never get Universal patcher to work, most confusing thing ever... lol
I do not know were to load the script? Nothing seems to happen

[04colyZQ8]

Ok I uploaded the script in vpw console seems to be working but I don't see any response from the cluster.. were is that stored?