Help with PCM data extraction, please

[Schmieder]

Okay, I don't like being told I can't do something. It just makes me find a way, but I need a little skilled help. Hopefully someone knows the answer.

I located the data lines from the PCM to the DLC under the dash.

I plan to capture any 'feed' data I get through the line into a raw binary file.

But how do I command the PCM to feed the data? There has to be some sort of signal that tells the PCM, "Hey, give me what you got!"

I considered using HPTuner to command the read and tap the data lines during but I'm afraid of misc communications corrupting the file.

If anyone has any info please help.

I WILL get the Binary form of the PCM one way or another. I just don't want to hunt down a DHP or hold a GM Tech at gun point, lol (just kidding mr. officermer)



Or is there a way to solder to the ROM and access the memory like it was a HD?

[robertisaar]

couple of ways here, but cheap isn't easy and easy isn't cheap...

HPT won't save the binaries it pulls as BINs IIRC, just as .hpt files, which are compressed(possibly encrypted) BINs. i believe a member of the HPT team will convert it to a BIN, but you would have to ask about it on their forums.

it MIGHT be possible to JTAG the EEPROM and read off the BIN that way, but i don't think you would have any way of verifying that it pulled correctly, and of course, you would also need a PROM burner to actually grab the BIN....

on the DIY-EFI boards, there was mention of a BDM port on the ~96-97 PCMs that can be used to force the BIN out, but i can't find the link at the moment.

and, if you have the soldering skills for it, you could always remove the PROM(it's a PLCC part), throw it into a PLCC-DIP adapter and then read it out in a PROM burner.



those are all of the "cheap" options i can think of...

[Schmieder]

Maybe I should try the HPT staff again.

I meant tapping the data line ahead of the DLC and use HPT to initiate data transfer......hmmm, maybe I can figure out what binary sequence HPT uses to initiate communications. Kind of like spying on the data line before the data reaches the HPT cable interface. If anything, running the extraction line along side the data line would be a non-invasive method if tapping the line corrupts the signals.

I did read about triggering an extraction a LONG time ago, but I too can not remember enough to search and find it.

Thanks Rob, for cheap options they are pretty good ones.

couple of ways here, but cheap isn't easy and easy isn't cheap...

That reminds me of, .......

AFFORDABLE - RELIABLE - POWERFUL and you can only pick 2 out of 3.

[robertisaar]

could be done.... i believe you'll need to remove all of the header and footer stuff though from the packets the PCM sends out. since the PCM only spits out and accepts BINs when in 4X mode, you'll need to have whatever auxiliary cable setup to capture at ~41.2Kbps or whatever it is...

simple idea in theory.

[Schmieder]

Yeah, you know how picky electronics can be. I figured any simple USB cable, when using the proper data line, can capture the data easily enough as the bandwidth capability is far greater then 41.2 Kbs. I would have to use linux and address the USB port as a storage media. The trick is having the system ready to receive the data, or else I would be sending it into thin air.

Maybe the staff at HPT will have a soft heart and decrypt the extracted bin file. But last time I tried they responded with, "It will expose the encyption key". Though I knew that isn't true. Electronic encryption is very good these days. Even if I had an exact file to compare with, generating a key is still next to impossible. Even if I had the root frequency used to generate the random seed or something along those lines. I'm not an encryption hacker.

As for headers, it should be easy. Most data streams I know of space the package from the headers with a slew of zeros. And knowing the bin itself is 512Kb really helps too.

Removing the header and footer is as simple as cutting them out in a Hex Editor. My last PCM, I had a bin but it wouldn't hold the VIN. So opening in HPT made it unflashable. I found the VIN address in a 98 controller and injected that into the 97 controller manually through the hex editor. Ends up it scrambled a section of the bin dealing with the supercharger settings. Something I never needed anyways. I gambled and won.

But this time is different. I believe my PCM was bricked from the bad battery but I can't be sure. So I have to get the original BIN.

I may just have to find a user with DHP and ship my PCM off to them, have it extracted and ship it back. But I have a history of not giving up until I succeed, lol.

Thanks Rob

[Schmieder]

Robert, you were right! I found info on a BDM port for most 96-97 PCM's. I have a spare 96 PCM (untunable for HPT) that I can try it on first.

PART 1

PART 2

Some software/drivers were said to only work on WIN2000/NT but Win7 has the ability to sort of emulate previous OS's per file. This is going to be an interesting project. Though I am still interested in spying on the HPT data signals to find what they command to get the PCM to spit out the binary. Heck, maybe I'll either build my own Tuning device or get bought out, lol.

[robertisaar]

it also requires a parallel port... and you can technically reflash it with that setup, but takes 30 hours for a 256KB BIN? an ELM cable or any other VPW x4 capable setup does the same thing if it doesn't support block-write capabilites.

[Schmieder]

it also requires a parallel port... and you can technically reflash it with that setup, but takes 30 hours for a 256KB BIN? an ELM cable or any other VPW x4 capable setup does the same thing if it doesn't support block-write capabilites.

I think I found the file HP Tuner uses in cache when the PCM is uploaded into memory. Not sure though, I found a large binary read/write interaction going in/out the registry. I'll be darned but the software may still operate the bin and only encrypt when saving. If this works out, I may have found a way to extract the bin from hpt files.

[robertisaar]

good deal.

the BINs you play with should be 512KB in size.