Tinkering with GMT800 IPC and flag bits

[dubcrazy8392]

I spent some time messing with the 2003 cluster that i swapped into my 2000 silverado. mind you my truck is also running a P59 thats converted to DBC to match the 2000 truck as well. anyhow i deleted the ABS off of my truck because its a PITA. started out with the ABS light on my dash because the ABS ECU is no longer there obviously. thats very annoying to me so i went on a mission to see if i could find a flag bit or bits that tells the cluster to ignore looking for the ABS ECU on the class 2 data network.

to start im using 15104999 cluster firmware for a 2003 cluster that comes with IPChammer 016.9. i was comparing various BIN files in fairdell HEXcmp and realized that between 0x440 and 0x749 looked like a big bank of flag bits. as a test on a spare cluster i made that whole area 0x00, corrected the checksum and flashed it. that most definitely made the cluster quit talking to damn near everything on the class 2 data network so i was in the neighborhood of where i wanted to be. so than i took another file, started at 0x440 and started changing very bit pair that was not already 0x00 to 0x00 than flashing it to the cluster. when i changed 0x458 which was 0x01 and i flipped it to 0x00 the ABS light on my dash quit coming on so im going to say its safe to say that this is the bit that shuts off the class 2 communication to the ABS ECU.

to correct the checksum on a cluster file you can use IPC hammer. just do a checksum test on your modified file with IPChammer, it will tell you what the actual checksum is on the BIN and what is needed to be correct. the very first 2 bit pairs in the BIN are the checksum (0x0 & 0x1). when you see it it will make sense. once the checksum is correct IPChammer will successfully flash the BIN file to the cluster.

i really want to figure out what most if not all of the flag bits do but that is extremely time consuming to do this bit pair by bit pair than see the end result for every single thing you turn on or off. one thing i do want to figure out is ever since i flashed this firmware to my cluster the 4WD indicator no longer works on my dash when 4WD is engaged. im confident the IPC is getting the indication from the ECU that the 4WD is engaged because the ECU does recognize it and broadcast it over class 2. i wish there was a way to read the IPC over OBD because the light used to work prior to changing the IPC firmware. could have compared the original firmware from the cluster to the 15104999 firmware i flashed to see if i could take a random stab at locating the flag bit for the 4WD indicator.

[Gatecrasher]

Probably going to need to disassemble the code to get the level of detail you're looking for. What kind of CPU is inside that cluster?

[bbmike]

They 2003-04 use a Infineon c161 and the 2005-07 use a Infineon xc161.

[Gatecrasher]

How similar is that to C166? Looks like there's a Ghidra module for C166, but I'm not seeing anything for C161.

[bbmike]

It’s the same family. The c166 should work for it.

[dubcrazy8392]

i setup a bench rig today using a P59 ECU and a cluster from a 2003 GMC sierra 2500HD factory NV4500 5 speed truck. i flashed the original BIN 12593058 from the 2003 sierra to the P59, grounded/powered green connector pins 19 & 16. i was monitoring this with tech2win as well in the ECU. when i gave 19 12V the ECU acknowledged 4WD high was engaged. when i grounded pin 16 it also confirmed that 4WD low was engaged. also when i gave 19 12V the 4WD indicator on the IPC came on and stayed on when i engaged 4WD low. so i guess that confirms that this is not in the IPC, weather the 4WD indicator works is determined by the ECU itself and its OS. why i say the OS is because i flashed several different 12587603 as that the OSID im using in my truck currently and i get no 4WD indicator though when monitoring the ECU with tech2win it does indicate over class 2 that the 4WD is engaged but for some odd reason the IPC does not see this in the class 2 data so no 4WD light. would really like to get this working because i forgot i put my truck in 4WD once already and than forgot it was in 4WD and drove like 4-5 miles like that on dry pavement before i realized it was engaged. thats no good for the drivetrain. anyhow thats what i have figured out so far but i cant explain way the IPC gets the signal over class 2 from OS 12593058 but it doesnt get it from OS 12587603. makes no sense.

[radrace19]

I spent some time messing with the 2003 cluster that i swapped into my 2000 silverado. mind you my truck is also running a P59 thats converted to DBC to match the 2000 truck as well. anyhow i deleted the ABS off of my truck because its a PITA. started out with the ABS light on my dash because the ABS ECU is no longer there obviously. thats very annoying to me so i went on a mission to see if i could find a flag bit or bits that tells the cluster to ignore looking for the ABS ECU on the class 2 data network.

to start im using 15104999 cluster firmware for a 2003 cluster that comes with IPChammer 016.9. i was comparing various BIN files in fairdell HEXcmp and realized that between 0x440 and 0x749 looked like a big bank of flag bits. as a test on a spare cluster i made that whole area 0x00, corrected the checksum and flashed it. that most definitely made the cluster quit talking to damn near everything on the class 2 data network so i was in the neighborhood of where i wanted to be. so than i took another file, started at 0x440 and started changing very bit pair that was not already 0x00 to 0x00 than flashing it to the cluster. when i changed 0x458 which was 0x01 and i flipped it to 0x00 the ABS light on my dash quit coming on so im going to say its safe to say that this is the bit that shuts off the class 2 communication to the ABS ECU.

to correct the checksum on a cluster file you can use IPC hammer. just do a checksum test on your modified file with IPChammer, it will tell you what the actual checksum is on the BIN and what is needed to be correct. the very first 2 bit pairs in the BIN are the checksum (0x0 & 0x1). when you see it it will make sense. once the checksum is correct IPChammer will successfully flash the BIN file to the cluster.

I'm also working on a 2003 cluster, but using 15124091 - OS and 15104997 cal file.
Here are my notes I just made

Cal#2
0x446 - 01 Brake light flag // 00 Brake light off
0x44C - 01 Fuel light flag // 00 Fuel light off
0x44E - 01 ABS light flag // 00 ABS light off
0x450 - 01 Airbag light flag // 00 Airbag light off
0x45A - 01 Battery light flag // 00 Battery light off
0x492 - 01 Service Airbag Message flag // 00 Service Airbag message off
0x4C2 - 01 Low Fue Message flag // 00 Low Fuel message off
0x4CA - Message order changed??