Close

User Tag List

Page 3 of 8 FirstFirst 1234567 ... LastLast
Results 41 to 60 of 153
  1. #41

    Join Date
    Jul 2005
    Posts
    95
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    Quote Originally Posted by kurt97sc2
    Quote Originally Posted by PlasticPower8500
    Sucks this is OBDI only. Would make it really nice to be able to tune a stock OBDII PCM.. Damn encryption.
    On saturnfans there is a guy that has hacked into a 99 PCM OBD2, but hasn't broken down the info into what it all means.
    Mind pointing this guy out?

  2. #42

    Join Date
    May 2010
    Posts
    4
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    Quote Originally Posted by emailer33
    Quote Originally Posted by kurt97sc2
    Quote Originally Posted by PlasticPower8500
    Sucks this is OBDI only. Would make it really nice to be able to tune a stock OBDII PCM.. Damn encryption.
    On saturnfans there is a guy that has hacked into a 99 PCM OBD2, but hasn't broken down the info into what it all means.
    Mind pointing this guy out?
    Right here.

    been doccumenting my exploits over at the delcohacking site. Did have some some stuff going on on the EFILive site, but they irritated me when they suddenly decided to wipe a thread about seed/key retrieval when I posted a little program that would just keep trying key's till it found the right one. If I remember right it should take less than 4 days of continuous pinging (for the record, I have noticed that more often than not the key is a relatively low number). Another guy picked up the mantle on that and put out a better looking program (mine was dos based, functional but not pretty ). Of course with my logic analyzer set up I have now I can get through seed/keys in only a little more than it would take me to get the ECU out of the car and cracked open, it is amazing how fast they jump out when you can see the address and data lines

    By the way the only thing I found encrypting the OBD2, other han the aformentioned seed/key pair, was that they swapped 4 pairs of address lines. Once I figure'd that out it did not take too long to get the data out of the flash. I suppose the other thing is the page swapping they do, the flash is broken down into 4 blocks of 32K. The lower block is always active, the upper block can swap between 3 different sections of the flash depending on the setting of one of the hardware ports (well on the engine side of the ecu, the tranny side only uses the lower 64k) (gotta do something with that electronics degree ya know)

  3. #43
    Approved Vendor ZombieSatty's Avatar
    Join Date
    Feb 2007
    Location
    Omaha, NE
    Posts
    6,414
    Post Thanks / Like
    Blog Entries
    2
    Mentioned
    13 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    wow, I hope you guys figure this out, because most of that might as well have been greek to me.
    It's not my fault, blame the radiation.

  4. #44

    Join Date
    Oct 2006
    Location
    westland, MI
    Posts
    1,775
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    Quote Originally Posted by ZombieSatty
    wow, I hope you guys figure this out, because most of that might as well have been greek to me.
    haha x2

  5. #45
    6S Moderator Natedogg's Avatar
    Join Date
    Nov 2005
    Location
    DE
    Posts
    2,868
    Post Thanks / Like
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    This was done years ago by i forget who and he was selling "hacked" PCMs but he was very secretive about it. He did have a running boosted car on one though.

    Good to see someone is willing to share the info this time around. Keep up the good work.

    Nate
    Former modded N/A 97 SL2, unmolested 96 SC2, and turbo 95 SL2 owner.

    99 SL2 Turbo - Parted out the turbo bits and putting it back to stock. It's already sold in it's stock form.
    00' SC2 DD - SOLD
    2015 Fiesta ST - Recaro package. More fun to drive than a turbo Saturn and more reliable.
    Loaded and cushy 2014 Ford Explorer as the family hauler.

  6. #46

    Join Date
    Jan 2009
    Location
    Ontario, Canada
    Posts
    476
    Post Thanks / Like
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    I also remember a few people that ran hacked ecu's too. Can't wait to see what you have to say
    http://www.sixthsphere.com/forum/image.php?type=sigpic&userid=9581&dateline=1314485  253
    2002 LW200 5 speed

  7. #47

    Join Date
    Jul 2005
    Posts
    95
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    Quote Originally Posted by Natedogg
    This was done years ago by i forget who and he was selling "hacked" PCMs but he was very secretive about it. He did have a running boosted car on one though.

    Good to see someone is willing to share the info this time around. Keep up the good work.

    Nate
    BBB did, ya while I did coax out of him datastream info for 91 - 95, he wasn't too forthcoming after that. I do have a 92 SC2 prom he modified for boost, don't know how much I'd use it though since he doesn't bother to back off timing under boost

    [EDIT] On a side note I have finally identified all of the A/D values going to the PCM, so if you wanted to it'd be possible to re-purpose an input or output for another task, such as using the EVO duty cycle output to control a nitrous solenoid, or the A/C button to control an economy or power fuel tables.

    And good job sabercatpuck, I probably won't ever be touching OBD2 but I can say using IDAPro helped out immensely. Saw your txt files and I didn't know what you were using to disassemble

  8. #48
    6S Moderator S.Bretz's Avatar
    Join Date
    Apr 2004
    Location
    Lutz, Fl
    Posts
    15,226
    Post Thanks / Like
    Mentioned
    27 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    The page swap is probable for something like limp mode or WOT (80%) throttle....At least I would assume. And the low block for closed loop operations.
    -6S Resident Mechanical Forensics member #001.
    1995 SC2 Turbo 3.6L DOHC, 6sp manual, Ford 8.8 rearend running on MS3x.
    1998 F-250 5.4L triton...stock.

  9. #49
    6S Moderator Natedogg's Avatar
    Join Date
    Nov 2005
    Location
    DE
    Posts
    2,868
    Post Thanks / Like
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    I just want to be able to tweak a few things like the CEL coming on when my MS turns the fans on and the PCM doesn't expect them on, or the EGR error code.

    "OMFG YOUR FANS ARE ON AT 195 DEGREES!!! YOU'D BETTER SERVICE YOUR ENGINE! WE'D RATHER HAVE THEM TURN ON AFTER YOUR BLOCK IS MELTED INTO A POOL OF MOLTEN ALUMINUM!"

    Stupid...

    Nate
    Former modded N/A 97 SL2, unmolested 96 SC2, and turbo 95 SL2 owner.

    99 SL2 Turbo - Parted out the turbo bits and putting it back to stock. It's already sold in it's stock form.
    00' SC2 DD - SOLD
    2015 Fiesta ST - Recaro package. More fun to drive than a turbo Saturn and more reliable.
    Loaded and cushy 2014 Ford Explorer as the family hauler.

  10. #50

    Join Date
    May 2010
    Posts
    4
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    Quote Originally Posted by S.Bretz
    The page swap is probable for something like limp mode or WOT (80%) throttle....At least I would assume. And the low block for closed loop operations.
    Some things I remember with the page swapping was the lower section had the initialization stuff, set registers, test the rom, handle the page swapping I think at least some of the tables, though there are some in upper memory page 2. UM page 3 handles the user interface primarily such as sending commands through the OBD port. It's where I have done most of my commenting so far because it is fairly easy to tell what sort of steps it will be performing when you do a mode 27 security access command for instance there are logical steps to follow through so it is not too hard to see what is happening. likewise the logic analyzers help this out quite a bit too since I can see exactly what is going on while it is stepping through. I am hoping that after stepping through these real well I might have a decent handle on where certain IO info comes through, any registers and pointers that they set up in RAM and what they are for etc.

  11. #51
    chrispel's Avatar
    Join Date
    Feb 2006
    Location
    Raleigh, NC
    Posts
    1,270
    Post Thanks / Like
    Mentioned
    2 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification


    BBB did, ya while I did coax out of him datastream info for 91 - 95, he wasn't too forthcoming after that. I do have a 92 SC2 prom he modified for boost, don't know how much I'd use it though since he doesn't bother to back off timing under boost
    Talking about my old PCM? When I bought it off of BBB he said that it pulled timing. I don't recall how much and when it started to do so.

  12. #52

    Join Date
    Jul 2005
    Posts
    95
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    Quote Originally Posted by chrispel

    BBB did, ya while I did coax out of him datastream info for 91 - 95, he wasn't too forthcoming after that. I do have a 92 SC2 prom he modified for boost, don't know how much I'd use it though since he doesn't bother to back off timing under boost
    Talking about my old PCM? When I bought it off of BBB he said that it pulled timing. I don't recall how much and when it started to do so.
    That must be it, but here's the only modified code I found. This was a quick glance, but his work is pretty easy to recognize at the end of the rom.
    Code:
    ROM:E5F7 ; =============== S U B R O U T I N E =======================================
    ROM:E5F7
    ROM:E5F7 ; Converts the 2bar MAP value to 1bar, and sets the read MAP bit
    ROM:E5F7
    ROM:E5F7 ModifyMAPAD:              ; CODE XREF: ROM:8328P
    ROM:E5F7                     ; ROM:8949P ...
    ROM:E5F7         staa  Bar2MAPA_D
    ROM:E5FA         psha
    ROM:E5FB         lsra          ; /8 + 1
    ROM:E5FC         lsra
    ROM:E5FD         lsra
    ROM:E5FE         inca
    ROM:E5FF         staa  byte_1DE    ; maximum is 20h
    ROM:E602         pula
    ROM:E603         asla          ; *2
    ROM:E604         bcc   loc_E60A
    ROM:E606
    ROM:E606 loc_E606:                ; CODE XREF: ModifyMAPAD+16j
    ROM:E606         ldaa  #$FF
    ROM:E608         bra   loc_E60F
    ROM:E60A ; ---------------------------------------------------------------------------
    ROM:E60A
    ROM:E60A loc_E60A:                ; CODE XREF: ModifyMAPAD+Dj
    ROM:E60A         adda  byte_1DE
    ROM:E60D         bcs   loc_E606
    ROM:E60F
    ROM:E60F loc_E60F:                ; CODE XREF: ModifyMAPAD+11j
    ROM:E60F         staa  MAP_AD_1Bar
    ROM:E611         bset  byte_67 $40 ; '@' ; Mask $40 - MAP Read
    ROM:E614         rts
    ROM:E614 ; End of function ModifyMAPAD
    He also had a routine that increased the base pulse constant only when under boost
    Code:
    ; =============== S U B R O U T I N E =======================================
    ROM:E615
    ROM:E615
    ROM:E615 Retrieve2BarMap:            ; CODE XREF: OC4I+8C3P
    ROM:E615         ldab  #$97 ; ''
    ROM:E617         ldaa  Bar2MAPA_D
    ROM:E61A         rts
    ROM:E61A ; End of function Retrieve2BarMap
    ROM:E61A
    ROM:E61B
    ROM:E61B ; =============== S U B R O U T I N E =======================================
    ROM:E61B
    ROM:E61B
    ROM:E61B InjConstAdderBBB:            ; CODE XREF: OC4I+19D0P
    ROM:E61B                     ; sub_A501:loc_A54EP
    ROM:E61B         pshb
    ROM:E61C         pshx
    ROM:E61D         ldaa  Bar2MAPA_D
    ROM:E620         ldx   #$E810
    ROM:E623         jsr   ld2vartable
    ROM:E626         adda  InjectorConst  ; New Injector Constant
    ROM:E629         pulx
    ROM:E62A         pulb
    ROM:E62B         rts
    ROM:E62B ; End of function InjConstAdderBBB
    ROM:E790 InjectorConst: fcb $51         ; DATA XREF: InjConstAdderBBB+Br
    ROM:E790                     ; New Injector Constant
    ROM:E810         fcb 0, 0, 0, 0, 0, 0, 0, 0, $B, $13, $1B, $23, $2B, $33, $3B, $43, $4B ; Injector Const Adder Table (based on MAP)
    And lastly, he would force open loop if the vehicle went over atmospheric pressure.
    Code:
    OM:E62C ; =============== S U B R O U T I N E =======================================
    ROM:E62C
    ROM:E62C
    ROM:E62C sub_E62C:                ; CODE XREF: sub_A501:loc_A707P
    ROM:E62C         psha
    ROM:E62D         pshb
    ROM:E62E         ldaa  Bar2MAPA_D
    ROM:E631         ldab  byte_A   ; Baro
    ROM:E633         lsrb
    ROM:E634         cba
    ROM:E635         bcc   loc_E63C
    ROM:E637         bset  byte_66 $80 ; '' ; Mask $80 - Closed Loop
    ROM:E63A         bra   loc_E63F
    ROM:E63C ; ---------------------------------------------------------------------------
    ROM:E63C
    ROM:E63C loc_E63C:                ; CODE XREF: sub_E62C+9j
    ROM:E63C         bclr  byte_66 $80 ; '' ; Mask $80 - Closed Loop
    ROM:E63F
    ROM:E63F loc_E63F:                ; CODE XREF: sub_E62C+Ej
    ROM:E63F         pulb
    ROM:E640         pula
    ROM:E641         rts
    ROM:E641 ; End of function sub_E62C
    Unfortunately I see nothing related to timing, so even though the timing procedures would be using very low advance values due to the 1bar value being maxed out, timing advance would still increase as the engine went faster.


    [EDIT]
    Also I've found an old 91 SC EEPROM that uses the same programming as a factory 91, but different calibration values. I believe someone said it was used by a GM sponsored saturn racing team? I vaguely recall one, they bored out the engine to 2.0L and had a different cam? Hopefully someone has a better memory than me.

  13. #53
    greensteeldragon's Avatar
    Join Date
    Feb 2009
    Posts
    723
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    bump? any updates its all greek to me but i been lurking hopping for a update
    <magpie> i bet you just hit a deer with your vehicle
    <magpie> and call it "hunting"
    <JustNoodle> I drive a saturn, I'd have more of a chance of my car exploding then killing a deer when I hit one
    __________________________________________________ ____________________________
    I am getting a paint job, but not yet i have the ultimate sleeper!!

  14. #54

    Join Date
    Jul 2005
    Posts
    95
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    Not much to update you on. I'm working on it in my spare time, and am investigating IAC operation

  15. #55
    tylersloan's Avatar
    Join Date
    Mar 2009
    Posts
    861
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    wow this is so cool to read i never would have thought that this would happen
    great work
    <br /><br />[quote author=JRSTANGE link=topic=43776.msg738596#msg738596 date=1240792003]<br />&nbsp; this time the penatration was awesome! I love your turd<br />[/quote]

  16. #56
    SC_EXTREME's Avatar
    Join Date
    Jun 2010
    Posts
    744
    Post Thanks / Like
    Mentioned
    7 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    what will i need to do that to mine. its an obd1. that will help alot with my greddy.
    p'm me

  17. #57

    Join Date
    Jul 2005
    Posts
    95
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    Quote Originally Posted by perryd727
    what will i need to do that to mine. its an obd1. that will help alot with my greddy.
    p'm me
    Chip it. Check the wiki

  18. #58
    6S Moderator S.Bretz's Avatar
    Join Date
    Apr 2004
    Location
    Lutz, Fl
    Posts
    15,226
    Post Thanks / Like
    Mentioned
    27 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    If you chip the PCM, you can set the greddy in the trash.
    -6S Resident Mechanical Forensics member #001.
    1995 SC2 Turbo 3.6L DOHC, 6sp manual, Ford 8.8 rearend running on MS3x.
    1998 F-250 5.4L triton...stock.

  19. #59
    SC_EXTREME's Avatar
    Join Date
    Jun 2010
    Posts
    744
    Post Thanks / Like
    Mentioned
    7 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    son of a bitch

  20. #60
    tylersloan's Avatar
    Join Date
    Mar 2009
    Posts
    861
    Post Thanks / Like
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: OBD1 PCM Modification

    i would love to have a file for a 95 dohc 5 speed pcm .
    would you still recommend ruining a ms unit for fuel with this or dose the modified pcm correct every thing ?
    <br /><br />[quote author=JRSTANGE link=topic=43776.msg738596#msg738596 date=1240792003]<br />&nbsp; this time the penatration was awesome! I love your turd<br />[/quote]

Page 3 of 8 FirstFirst 1234567 ... LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •