flashing/reading the 28F400

[Chris@HPTuners]

guys, new this board but heaps of real useful and impressive info here - lots of hard work for sure.

I have read that the LS1 PCM uses the 28F400 flash chip and that it seems i can get everything i need to read and write the flash using the Pocket Programmer 2 with the right 28F400 adapter.

Is this the right way to go?

Any help appreciated.

[Keith@HPTuners]

PSOP 44 pin package, Intel 28F400 bottom boot block flash chip.

I believe the maker of the pocket programmer was going to build an adapter for the flash chip, not sure what the latest is on that.

You'll also need tools to remove and reinstall the chip. I like the heat gun meathod, you'll still need a fine tipped soldering iron just in case.

Once you do read it though, you'll just be looking at a bunch of hex. Very hard, near impossible, to decipher.

What are your objectives?

[RoboGeek]

Does LS1 Edit flash through the port? I thought it did but it wouldn't be the first time I was wrong ;D

[Chris@HPTuners]

my objectives are this (roughly in this order):

1. Be able to recover a fried PCM (due to interrupted flash via edit)
2. Do some table mapping (I know there are things in there that edit doesnt have)
3. start dasm'ing the code (long term objective since until i get a unencrypted binary i really dont know how hard this will be or how long it will take - expecting very hard and very long)

I see that http://xtronics.com/memory/EPROM.htm list the 28F400 adapter.

LS1 edit can flash thru the port but i use a bench harness since many people more experienced than me believe it to be more reliable.

Hex is fine, means i can write scripts/code to do all kinds of time saving things that edit doesn't do (eg. copying spark, VE tables from text files or excel spreadsheets) - of course i need to find the tables first Also, i think i should be able to find all the tables that edit has with some modified pattern matching scripts.

I approaching this with a pretty open mind and realise i have a steep learning curve - but it's addictive isn't it ;D

[Chris@HPTuners]

also in regards to flashing, LS1edit uses its own encrypted format and so converting your hacked flash file to a edit conformat format would be challenging. Also, it only writes back a small amount of data compared to the read.

tech2 may work but i dont know enough about it.

[RoboGeek]

Its too addicting - in fact I now play with the hex in regular computer programs too! (which is why I reformatted 50 times already!)

[capone]

I'm real new at this stuff, but I've been trying to figure out the data (in hex) of a few flash files I've found for an LS1. I've found a hypertech file, ls1 edit file (both came in notebook format), and a .bin file (unknown origin). Is it possible that each "block" of data ends in 0A (hex). After looking at the data I keep coming up with the same answer. Please let me know if I need to keep my day job.

[Keith@HPTuners]

capone, chances are the formats you are looking at are either encrypted or junk.. it's too hard to tell.

Just DL an LS1 binary from the flash files page on this site. That way you know you have a real flash image to work with rather than go crazy trying to map out one that's encrypted.

[RoboGeek]

Is GM using encryption on anything yet? I had heard that they were heading that way. If I remember right if you pulled the chip you got a clean binary, but if you read it through the port it was encrypted.
Maybe I'll have to fire up my Beowulf cluster to crack some code.. ;D

[Keith@HPTuners]

I haven't found any signs of GM using encryption on any of the newer stuff.

[capone]

i've got a beowulf....need some help? ;D

[RoboGeek]

11 nodes here.. almost all 233's (I've had it a while!). I use it to crack passwords and encrypted files so it might be handy if they ever do encrypt anything

My electric bill goes to $400/mo if I run them constantly :P

[capone]

hey robogeek, i'm interested in knowing a little about your beowulf setup... OS, software, etc., would it be alright if i emailed some questions?