|
Rank: Newbie
Groups: ProTuner, Registered Users, Subscribers
Joined: 7/13/2008
Posts: 2
|
Hey guys, Is there a way or will OmniTuner offer a software way to erase LS1 PCMs? Currently I pull the chips and do it the hardware way and its time consuming and risky. Reading the locked tune would be good but 95% of the time i dont care. Not up for fixing other peoples tunes, would rather do it from scratch. But sometimes a customer/friend doesnt want to head back to their old tuner to wipe it. Cheers guys. Jez |
|
Rank: Administration  Groups: ForumAdmin, ProTuner, Registered Users, Subscribers Joined: 5/20/2008 Posts: 6 |
Jez, That's the plan, using J2534 compliant device like mongoose or GM MDI. A utility that could cycle a pcm to find the correct seed and key would be nice..... Cheers Mick Rev it up, Drop the clutch, See what happens..... |
|
Rank: Administration  Groups: ForumAdmin, ProTuner, Registered Users, Subscribers Joined: 5/17/2008 Posts: 23 |
Jez, That is something we are going to do before long but it will take a while. After you guess wrong a few times the PCM puts in a delay between each try so it could take a week or more. You could also use a BDM (Background Debugging Module) to unlock a PCM. This lets you read the entire ROM without removing it but you do have to do a bit of soldering. You can hook the BDM up to the header block on the top corner of the board. Once it is hooked up no one can block it from reading or writing to the ROM. http://www.pemicro.com/products/product_viewDetails.cfm?product_id=164&menu_id=details&CFID=1796272&CFTOKEN=36392617 Looking at the back of the PCM circuit board with the main connector facing you the test pads will be in the upper right hand corner of the board: ____________________________________________________
1 30 |
o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o |
o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o |
o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o |
61 90 Using the above pin numbering (which is arbitrary) and the following BDM cable connector: 2 10 o o o o o o o o o o 1 9 with the BDM signals defined as: PIN SIGNAL 1 DS 2 BERR 3 GND 4 BKPT/DSCLK 5 GND 6 FREEZE 7 RESET 8 IFETCH/DSI 9 Vdd 10 IPIPE/DSO you'll need to make the following connections BDM PCM 1 7 2 42 3 4 4 89 5 4 6 90 7 73 8 11 9 25 10 13 |
|
Rank: Newbie
Groups: ProTuner, Registered Users, Subscribers
Joined: 7/13/2008
Posts: 2
|
I know of some software that isnt released that can read out the entire EEPROM tune via software and an old LS1Edit cable. It can be done. Good work guys, im watching this site with interest. If there is anything i can help with, give me a yell. Im a bit rusty on the old C++ though Jez PS Just purchased a Mongoose to do some experimenting....think its time to roll the sleeves up |
|
Rank: Administration Groups: ForumAdmin, ProTuner, Registered Users, Subscribers Joined: 5/17/2008 Posts: 23 |
Sounds great! I sent you an email with more information. If anyone else want to help you are more than welcome . I would like to start sharing profiles and tunes before long. We can start a file share for this. |
|
Rank: Newbie
Groups:
Joined: 9/5/2008
Posts: 1
|
The E40 & E38 ECM's i think is where a program that can scroll through a work out the key to allow the file to be over written is where i think your program will come in to it's own . There are people out there doing it now so it can be done . the time it takes to find the key does not worry me i have been told the e38 will only test once every 5 seconds so there could be a time frame of over a week if any help is needed let me know Geoff |
|
Rank: Newbie
Groups: Registered Users, Subscribers
Joined: 1/15/2010
Posts: 5
|
Has anyone made any progress on this stuff or once you find out, do you go hush hush? |
|
Rank: Administration Groups: ForumAdmin, ProTuner, Registered Users, Subscribers Joined: 5/17/2008 Posts: 23 |
Tre-Cool wrote:Has anyone made any progress on this stuff or once you find out, do you go hush hush? Actually we have but it is easier with a LS1 PCM to just lift the flash chip and reprogram it in a flash burner. I have not had much time to do much work with this on the E38 but the header is on the board and you can get it apart. The only barrier is that the connection to the header is so small I have to get a special part made to connect a BDM to it. I have spent most of my time working on the DUAL-FLASH module and OmniTuner software. If you are interested in working on it I am will to answer any questions you might have and point you in in the correct direction. Roger |
|
Rank: Newbie
Groups: Registered Users, Subscribers
Joined: 1/15/2010
Posts: 5
|
Roger wrote:Tre-Cool wrote:Has anyone made any progress on this stuff or once you find out, do you go hush hush? Actually we have but it is easier with a LS1 PCM to just lift the flash chip and reprogram it in a flash burner. I have not had much time to do much work with this on the E38 but the header is on the board and you can get it apart. The only barrier is that the connection to the header is so small I have to get a special part made to connect a BDM to it. I have spent most of my time working on the DUAL-FLASH module and OmniTuner software. If you are interested in working on it I am will to answer any questions you might have and point you in in the correct direction. Roger Sorry Roger, I actually meant the LS1 controller. (though i do have a spare e38 doing nothing) Wheres a good place to start to get a hold the software/hardware for the flashburner? i've had a look on the moates website but I couldnt find/tell if you can burn to the ls1 eproms with his burn1,burn2 devices. I also like your idea of using the BDM to flash,burn the epprom, but again im not sure how you "download" the bin file from the flash, unless they give you some form of software to do this. Then i guess it's a matter of going through the bin or uploading a clean bin file. never mind found this site http://www.digitalgraphics.com.au/xeltek/sp501s.html |
|
Guest |