Search:

Motorola produces tons of custom packages for the
vehicle OEMS.

The key is look for the processors that are "hidden"

Example: if you try to search for the 377 on the
motorola website it's...

All of this info is in a large (79.2MB!) ZIP file hidden on the
Motorola site. :secret:

The file is located at:
...

No, it likely won't be the same.

You need to remove the internal flash memory chip
from the ECU and read it out via an EPROM programmer
into a Binary file.

Then you disassemble the code, and...

No doubt it is.

Most of the Euro OEMS (Bosch/Siemens/etc) base the
seed off of one of the timers, and then the calcs are
included in the code.

They bet (very correctly) that only a very small...

Do you have the contents of the ECU's flash memory?

A lot of European ECU's have the seed/key algorithm
inside the code.

Do you know what processor is used/etc?

Instead of doing "XOR w/ FFFF".

Consider doing logical negation ;D

In boolean logic:

A ^ ONES == *A

Or any variable XOR'd with a varable the same # of
bits all high/one is the same as...

Guys,

As I've said before.. that is NOT the code to be looking
at because it isn't the code that is running on a PCM
that is "programmed". :banghead:

I've already shown the jump table for the...

It isn't the code that's run via normal operations.

The code that is run during "normal" use (ie with the
PCM in a "working" condition is much further down.

There is an indirect table, that in...

Also, if you look at the code between 0x0 and 0x1000 or
so, you'll see the "remnants" of the boot code that is
used before the main code exists.

It has a mode 27 w/o a seed key. (or rather a...

None, until one of my own design is finished.

None of the cables out there can handle "block transfers"
aka mode $36 that I know of.

Don't forget the call to disable normal comms.

Mode 28.. Subfunction 00

:)

Time to cheat then, eh?

Write yourself a little routine to do both, the $27 and
then the $35 right after.

I agree.. but in the interest of "completeness" I won't
be satisfied until I find WHERE the bytes at $6000 thru
$6003 are written.

Call me o/c

Ahh.. but where is the function that PROGRAMS it?

It's in flash.. right?

How do it get there.

Does the Tech-II program it from IT's memory.. or does
it cause it to be programmed when you...

Ok folks, time to get serious. :secret:

To program (or to read) this is the function we need
to crack.

I've done quite a bit, to find that the Seed/Key combo
are actually sourced from FLASH....

Super_Sport,

A note would be that in the "segmented" binaries, the
ones that are 8 separately checksummed areas, which
I believe are the 1999's and later..

The DTC_Options and...

What tool costs 17k??

(See, now you have my curiosity) ;D

Highlander,

Email me direct if you can.

I thought that the SPS is only for PROGRAMMING
and doesn't have the (software) capability to read
out the existing cal... am I wrong about that?

How does one do this with the EASE SPS system?

Has someone written another program for the SPS
hardware?

Jim

On the later (I think it's 1998 or 1998.5+) there are a
total of eight checksums.

Can't vouch for the earlier stuff.

Jim

BTW, guys.. it looks like the LS1/LS6 PCM uses a
variant of Motorola processor (family: 683xx) that
contains the DLC logic internally.

If you are threshing thru code, look for references to...

The later LS-1's and LS-6's use even more.

Essentially "all" of that 4 megabit (aka 512 Kilo BYTE)
flash chip.

If you're talking two posts "up", it's neither..

Its part of the DTC structure.

How the PCM sets different DYCs.

Jim

Oki Semiconductor makes a chip called the MSM6636

It's the only J1850 PWM i/f chip I know of.

It also has nice descriptive documentation 8)

The general datasheet page is:
...

Nope.. be sure that code is executed first.. there are
tons of "flags" that control which DTC's are run/etc.

I've already found RPM, ECT, IAT.. etc.

The units in this ECU are VERY wierd.
...