PCM Hammer
Thread Starter
Drifting
Joined: Nov 2017
Posts: 1,392
Likes: 303
PCM Hammer
I've been working with a few other folks on an open-source tool to read and write the PCMs used in 2000-2004 Corvettes, and we have both reading and writing working now. A handful of other folks have been testing it over the last couple days, and nothing caught fire or melted down, so...
The latest release is listed at the top of this page:
https://github.com/LegacyNsfw/PcmHacks/releases
Click the Assets link below the release description, and then click the zip file name to download it.
Unzip the contents into an empty directory, run PcmHammer.exe, select your device type, and proceed with caution. This stuff is very new, and you're a beta tester. That said, reading is perfectly safe, and I've done a couple dozen calibration updates on my 2002 Z06 with no ill effects.
For more information about this project and what you can do with it:
https://github.com/LegacyNsfw/PcmHacks/wiki
Credits:
Antus from pcmhacking.net - he's taught me a ton about what makes PCMs tick
Tazzi from pcmhacking.net - if you're using a J2534 tool, you owe him a beer
PeteS160 here at ls1tech.com - fluent in J1850 VPW, instrumental in recovering my PCM after I hit it with the hammer.
Dimented24x7 from thirdgen.org - he's been offline for a couple years, but he laid the foundation for this.
EagleMark from gearhead-efi - another pioneer who contributed a lot the community. May he rest in peace.
P.S. Don't use this in your car if you need that car to get to work. Let's stick with project cars for a while until we're all confident that this **** can really be trusted.
The latest release is listed at the top of this page:
https://github.com/LegacyNsfw/PcmHacks/releases
Click the Assets link below the release description, and then click the zip file name to download it.
Unzip the contents into an empty directory, run PcmHammer.exe, select your device type, and proceed with caution. This stuff is very new, and you're a beta tester. That said, reading is perfectly safe, and I've done a couple dozen calibration updates on my 2002 Z06 with no ill effects.
For more information about this project and what you can do with it:
https://github.com/LegacyNsfw/PcmHacks/wiki
Credits:
Antus from pcmhacking.net - he's taught me a ton about what makes PCMs tick
Tazzi from pcmhacking.net - if you're using a J2534 tool, you owe him a beer
PeteS160 here at ls1tech.com - fluent in J1850 VPW, instrumental in recovering my PCM after I hit it with the hammer.
Dimented24x7 from thirdgen.org - he's been offline for a couple years, but he laid the foundation for this.
EagleMark from gearhead-efi - another pioneer who contributed a lot the community. May he rest in peace.
P.S. Don't use this in your car if you need that car to get to work. Let's stick with project cars for a while until we're all confident that this **** can really be trusted.
Last edited by NSFW; Mar 5, 2020 at 01:33 PM. Reason: Release #12 is out
Thread Starter
Drifting
Joined: Nov 2017
Posts: 1,392
Likes: 303
I updated the GitHub link in the first post to point to a new release that supports writing, because today I flashed the PCM in my car for the third time and drove it around without any trouble. My car came with a skip-shift eliminator, but now skip-shift is so disabled that the dash light doesn't even come on. So apparently the app really works. That gives me a lot of confidence. Perhaps more than it should, but here goes anyway...
Before you try this yourself, keep in mind that you can probably count the number of PCMs that have been flashed with PCM Hammer using your fingers. For the number of PCMs that have been flashed in a car, you might only need your thumbs. I strongly suggest letting people with PCMs on their workbenches play with this stuff for a while before you try it in your car. And definitely don't use this in your car if you need that car to get to work. Let's stick with project cars for a while until we're all confident that this **** can really be trusted.
Also, let's talk about what happened the first time I flashed my car: it stopped working. The actual copy operation went perfectly, but the file that I was flashing from had bad checksums (because I was using Tuner Pro with an XDF that I created myself, and that XDF still had no checksum information in it!). Not only would the PCM not run the engine, it wouldn't accept a new flash, so I couldn't put the old file back on it. There is a workaround for this, but it requires removing the PCM, popping the back of the case off, and grounding a pin before you reflash it. That worked, and the same PCM is back in the car now and working perfectly.
And then I added some code to PCM Hammer so that it will validate checksums before it will let you flash. So hopefully nobody else will run into exactly that kind of problem again...
But we still haven't added code to compare the OS ID in your bin file with the OS that's on your PCM. So the app will cheerfully flash a calibration from one OS into a PCM that's running a different OS, and you'll be taking apart your PCM before you drive the car again. So, be careful.
So far, we haven't truly bricked anybody's PCM.
So far.
The least risky way to use PCM Hammer is to read the bin file from your PCM, tune it using Tuner Pro and a known-good XDF, and write the updated file back to the PCM. But I still wouldn't recommend doing that with your daily driver until more cars have been reflashed than you can count on your fingers. And toes.
Happy new year!
Before you try this yourself, keep in mind that you can probably count the number of PCMs that have been flashed with PCM Hammer using your fingers. For the number of PCMs that have been flashed in a car, you might only need your thumbs. I strongly suggest letting people with PCMs on their workbenches play with this stuff for a while before you try it in your car. And definitely don't use this in your car if you need that car to get to work. Let's stick with project cars for a while until we're all confident that this **** can really be trusted.
Also, let's talk about what happened the first time I flashed my car: it stopped working. The actual copy operation went perfectly, but the file that I was flashing from had bad checksums (because I was using Tuner Pro with an XDF that I created myself, and that XDF still had no checksum information in it!). Not only would the PCM not run the engine, it wouldn't accept a new flash, so I couldn't put the old file back on it. There is a workaround for this, but it requires removing the PCM, popping the back of the case off, and grounding a pin before you reflash it. That worked, and the same PCM is back in the car now and working perfectly.
And then I added some code to PCM Hammer so that it will validate checksums before it will let you flash. So hopefully nobody else will run into exactly that kind of problem again...
But we still haven't added code to compare the OS ID in your bin file with the OS that's on your PCM. So the app will cheerfully flash a calibration from one OS into a PCM that's running a different OS, and you'll be taking apart your PCM before you drive the car again. So, be careful.
So far, we haven't truly bricked anybody's PCM.
So far.
The least risky way to use PCM Hammer is to read the bin file from your PCM, tune it using Tuner Pro and a known-good XDF, and write the updated file back to the PCM. But I still wouldn't recommend doing that with your daily driver until more cars have been reflashed than you can count on your fingers. And toes.
Happy new year!
Drifting
Joined: Jul 2015
Posts: 1,844
Likes: 375
From: San Jose, CA
Super sexy!
I don't have any windows machines, but looking at the kernel code, it appears all (or at least the vast majority) of the non-UI code is happily portable to any other OS. I suppose it wouldn't be much work to replace the UI with config files and a command line invocation.
Now, an entirely different question: Do y'all have any sort of reference schematic, original or reverse-engineered or otherwise, of either the whole PCM or the most relevant portions? PCB layout files are (I'm sure) asking for far too much, of course.
I don't have any windows machines, but looking at the kernel code, it appears all (or at least the vast majority) of the non-UI code is happily portable to any other OS. I suppose it wouldn't be much work to replace the UI with config files and a command line invocation.
Now, an entirely different question: Do y'all have any sort of reference schematic, original or reverse-engineered or otherwise, of either the whole PCM or the most relevant portions? PCB layout files are (I'm sure) asking for far too much, of course.
Thread Starter
Drifting
Joined: Nov 2017
Posts: 1,392
Likes: 303
Thanks!
I'd be delighted to see it ported to other platforms, and yes that should just be matter of rewriting the UI. We had a guy working on a command-line version for Linux a while back. Unfortunately his employer objected so he had to pull the code... He only had a couple hundred lines of code written if I remember right, but it was enough to show that it could be done.
Good timing, by the way... You made me realize that the code I added tonight really belongs in the library layer rather than the UI layer. I'll fix that tomorrow.
I have no schematics, but I do have data sheets for the CPU, a couple flash chips, and the data link controller (the OBD2 interface). I'll send you copies if you shoot me an email. Nsfw, outlook, you can guess the rest.
I'd be delighted to see it ported to other platforms, and yes that should just be matter of rewriting the UI. We had a guy working on a command-line version for Linux a while back. Unfortunately his employer objected so he had to pull the code... He only had a couple hundred lines of code written if I remember right, but it was enough to show that it could be done.
Good timing, by the way... You made me realize that the code I added tonight really belongs in the library layer rather than the UI layer. I'll fix that tomorrow.
I have no schematics, but I do have data sheets for the CPU, a couple flash chips, and the data link controller (the OBD2 interface). I'll send you copies if you shoot me an email. Nsfw, outlook, you can guess the rest.
Drifting
Joined: Jul 2015
Posts: 1,844
Likes: 375
From: San Jose, CA
That's a hell of a nice email address. I'll shoot you an email. Thanks!
I tend to add reference docs right into my git repos in a docs directory, of course git doesn't really like to track non-text files but I don't really ask its opinion. Hah! But I dunno if certain git web hosts (like github) complain.
I tend to add reference docs right into my git repos in a docs directory, of course git doesn't really like to track non-text files but I don't really ask its opinion. Hah! But I dunno if certain git web hosts (like github) complain.
Thread Starter
Drifting
Joined: Nov 2017
Posts: 1,392
Likes: 303
Release #4 is ready for testing!
https://github.com/LegacyNsfw/PcmHacks/releases/tag/2019.01.16.02
The biggest improvement in this release is that the app will prevent you from writing if the operating system in the PCM doesn't match the operating system in the file you have selected.
If you run it while connected to the internet, it will check github for a new release. Ordinarily it will just say "Thank you for using PCM Hammer" when it starts up, but when have a new release that will change to something like "Hey, we have a new release!"
https://github.com/LegacyNsfw/PcmHacks/releases/tag/2019.01.16.02
The biggest improvement in this release is that the app will prevent you from writing if the operating system in the PCM doesn't match the operating system in the file you have selected.
If you run it while connected to the internet, it will check github for a new release. Ordinarily it will just say "Thank you for using PCM Hammer" when it starts up, but when have a new release that will change to something like "Hey, we have a new release!"
Last edited by NSFW; Jan 17, 2019 at 03:09 AM.
Corvette Stories
The Best of Corvette for Corvette Enthusiasts
Top 10 Most Expensive Corvettes Ever Sold on Bring A Trailer
Brett Foote
10 Things Every Corvette Owner Needs (2026 Edition)
Michael S. Palmer
8 Most "Only Corvette Owners Understand" Quirks and Problems
Pouria Savadkouei
10 Reasons the C6 Z06 is Still A Performance Benchmark After 20 Years
Joe Kucinski
How Much Horsepower Every Corvette Engine "LOST" in 1972
Joe Kucinski
Top 10 DOs and DON'Ts for Protecting Your Convertible Top!
Michael S. Palmer
Top 10 Most Explosive Corvettes Ever Made: Power-to-Weight Ratio Ranked!
Joe Kucinski
150 hp to 1,250 hp: Every Corvette Generation Compared by the Specs That Matter
Joe Kucinski
8 Coolest Corvette Pace Cars (and Replicas) of All Time
Verdad Gallardo
Thread Starter
Drifting
Joined: Nov 2017
Posts: 1,392
Likes: 303
http://www.gearhead-efi.com/Fuel-Inj...ed-is-TunerPro)
But please keep an eye on that thread - the guy made those XDF files unknowningly used a Tuner Pro checksum plugin which had the author's name stripped out by a third party. (Probably someone who was also selling other free tools on ebay with credits and copyright info stripped out - it's a long story.) The plugin author was Antus from pcmhacking.net, who also happens to be one of the biggest contributors to the PCM Hammer project. Antus and LRT (the XDF author) are going to resolve the plugin issue, so there will probably be an update soon. The functionality won't change, it's just the principle of the thing.
Instructor
Joined: Dec 2017
Posts: 139
Likes: 44
From: Fort Worth, TX
Played with PCM Hammer a little tonight, man it's so nice to see something grassroots that's actually promising in the GM tuning community.
As stated above, I am using an AVT-852 box. I was able to successfully read the PCM from my '01 C5 (0411), and was able to open that saved file in TunerCATS. I have not tried writing to the PCM because I don't have a spare LS one sitting around. Next time I go to the junkyard I'll grab one just in case and give it a shot.
The "Read Properties" button seems to sporadically not-work when connected to the Corvette. Unfortunately I'm a moron and didn't get the "Results" log, but I have attached the Debug Log where the failure happens. You'll click it, get an error in the Results (I believe about the VIN), then click it again and usually it works fine. It happens once every 3 or 4 times.
For ***** and giggles, I connected this to my Regal (12209624) and wasn't able to do anything. However, I do have a PCM sitting here that I believe is from an '03 GP GT (also PN 9624) and connected it up to my offboard and actually was able to pull some data back from the "Read Properties" function, but then the application seems to loop and lock after "Reading Serial Number: xxxx". I know you haven't baked this support in yet, but thought it seemed interesting enough. A read is not possible, obviously, and throws back an error about the unlock response being an invalid length.
If there's anything you'd like me to try or do with either the 'Vette or 3800 PCMs, let me know. I'm happy to help.
As stated above, I am using an AVT-852 box. I was able to successfully read the PCM from my '01 C5 (0411), and was able to open that saved file in TunerCATS. I have not tried writing to the PCM because I don't have a spare LS one sitting around. Next time I go to the junkyard I'll grab one just in case and give it a shot.
The "Read Properties" button seems to sporadically not-work when connected to the Corvette. Unfortunately I'm a moron and didn't get the "Results" log, but I have attached the Debug Log where the failure happens. You'll click it, get an error in the Results (I believe about the VIN), then click it again and usually it works fine. It happens once every 3 or 4 times.
For ***** and giggles, I connected this to my Regal (12209624) and wasn't able to do anything. However, I do have a PCM sitting here that I believe is from an '03 GP GT (also PN 9624) and connected it up to my offboard and actually was able to pull some data back from the "Read Properties" function, but then the application seems to loop and lock after "Reading Serial Number: xxxx". I know you haven't baked this support in yet, but thought it seemed interesting enough. A read is not possible, obviously, and throws back an error about the unlock response being an invalid length.
If there's anything you'd like me to try or do with either the 'Vette or 3800 PCMs, let me know. I'm happy to help.
Last edited by digitaloutsider; Jan 28, 2019 at 08:18 PM.
Thread Starter
Drifting
Joined: Nov 2017
Posts: 1,392
Likes: 303
First of all, thanks for giving it a try. The PCM is unreliable for about ten seconds after being powered up, how long had it been powered when you made that log? The PCM on my desk will fail about half of the "get properties" operations during the first ten seconds after being powered up. This is also why the read and write operations start with waiting ten seconds.
Regardless of how long the PCM was powered, there's a line at the top of the log that says "[06:41:27:253] Failed to disable AVT Acks" so that suggests that something else was going wrong. The AVT stuff was written by Antus so I'll follow up with him to see if he knows what would cause that, and if that would cause the sort of trouble you saw.
The PCM is unreliable for about ten seconds after being powered up, how long had it been powered when you made that log? The PCM on my desk will fail about half of the "get properties" operations during the first ten seconds after being powered up. This is also why the read and write operations start with waiting ten seconds.Regardless of how long the PCM was powered, there's a line at the top of the log that says "[06:41:27:253] Failed to disable AVT Acks" so that suggests that something else was going wrong. The AVT stuff was written by Antus so I'll follow up with him to see if he knows what would cause that, and if that would cause the sort of trouble you saw.
Instructor
Joined: Dec 2017
Posts: 139
Likes: 44
From: Fort Worth, TX
Trying it out is the least I can do. A free flashing tool is a dream come true for this community, and not worrying about credits, vendor locks, and other nonsense is the way it should be for cars that are creeping up on (or surpassing) 20 years old.
To ensure that this wasn't a PEBCAK issue, I'm on my tuning laptop in the garage right now. I left the key on for 30 seconds before trying again, and this is the error as displayed in the Results tab:
49:202 was the first press. 56:332 was clicking it again after it failed the first time. From the debug log:
This brought back the Properties, except for the Serial Number:
Hope that helps some!
To ensure that this wasn't a PEBCAK issue, I'm on my tuning laptop in the garage right now. I left the key on for 30 seconds before trying again, and this is the error as displayed in the Results tab:
Code:
[10:48:27:862] PCM Hammer 004 [10:48:28:080] AVT 852 Reset OK [10:48:28:080] AVT Firmware 2.6 [10:48:49:202] VIN query failed: Truncated [10:48:56:332] VIN: 1G1YY22G7151***** [10:48:56:410] OS ID: 12593358 [10:48:56:488] Calibration ID: 12204901 [10:48:56:566] Hardware ID: 9386530 [10:48:56:659] Serial Number query failed: Truncated [10:48:56:737] Broad Cast Code: DHYN [10:48:56:815] MEC: 0
Code:
[10:48:27:862] PCM Hammer 004 [10:48:27:862] Initializing AVT (842/852) on COM3 [10:48:28:080] Sending 'reset' message. [10:48:28:080] AVT 852 Reset OK [10:48:28:080] Looking for Firmware message [10:48:28:080] AVT Firmware 2.6 [10:48:28:096] Set VPW Mode [10:48:28:096] Failed to disable AVT Acks [10:48:49:171] TX: 6C 10 F0 3C 01 [10:48:49:171] RX: E8 FF 60 03 [10:48:49:171] AVT: no message waiting. [10:48:49:171] TX: 6C 10 F0 3C 02 [10:48:49:187] RX: 88 25 28 07 00 [10:48:49:187] AVT: no message waiting. [10:48:49:187] TX: 6C 10 F0 3C 03 [10:48:49:202] RX: 6C F0 10 7C 01 00 31 47 31 59 59 [10:48:49:202] AVT: no message waiting. [10:48:49:202] VIN query failed: Truncated [10:48:49:374] AVT setting VPW 4X [10:48:49:889] TX: 6C 10 F0 20 [10:48:49:889] AVT setting VPW 1X [10:48:49:998] TX: 6C 10 F0 20 [10:48:56:254] TX: 6C 10 F0 3C 01 [10:48:56:269] RX: 6C F0 10 7C 01 00 31 47 31 59 59 [10:48:56:285] AVT: no message waiting. [10:48:56:285] TX: 6C 10 F0 3C 02 [10:48:56:300] RX: 6C F0 10 7C 02 32 32 47 37 31 35 [10:48:56:300] AVT: no message waiting. [10:48:56:300] TX: 6C 10 F0 3C 03 [10:48:56:332] RX: 6C F0 10 7C 03 31 33 34 37 37 36 [10:48:56:332] AVT: no message waiting. [10:48:56:332] VIN: 1G1YY22G7151***** [10:48:56:394] TX: 6C 10 F0 3C 0A [10:48:56:410] RX: 6C F0 10 7C 0A 00 C0 28 CE [10:48:56:410] AVT: no message waiting. [10:48:56:410] OS ID: 12593358 [10:48:56:472] TX: 6C 10 F0 3C 08 [10:48:56:472] RX: E8 FF 10 03 [10:48:56:472] AVT: no message waiting. [10:48:56:472] Received an unexpected response. Attempt #1, status Error. [10:48:56:488] RX: 6C F0 10 7C 08 00 BA 3B 65 [10:48:56:488] AVT: no message waiting. [10:48:56:488] Calibration ID: 12204901 [10:48:56:550] TX: 6C 10 F0 3C 04 [10:48:56:550] RX: A8 83 10 13 0F 0D [10:48:56:550] AVT: no message waiting. [10:48:56:550] Received an unexpected response. Attempt #1, status Error. [10:48:56:566] RX: 6C F0 10 7C 04 00 8F 3A 22 [10:48:56:566] AVT: no message waiting. [10:48:56:566] Hardware ID: 9386530 [10:48:56:628] TX: 6C 10 F0 3C 05 [10:48:56:628] RX: E8 FF 28 03 [10:48:56:628] AVT: no message waiting. [10:48:56:628] TX: 6C 10 F0 3C 06 [10:48:56:644] RX: 6C F0 10 7C 06 4C 44 57 47 [10:48:56:644] AVT: no message waiting. [10:48:56:644] TX: 6C 10 F0 3C 07 [10:48:56:659] RX: 88 25 28 07 00 [10:48:56:659] AVT: no message waiting. [10:48:56:659] Serial Number query failed: Truncated [10:48:56:722] TX: 6C 10 F0 3C 14 [10:48:56:722] RX: 6C F0 10 7C 07 31 31 35 38 [10:48:56:722] AVT: no message waiting. [10:48:56:722] Received an unexpected response. Attempt #1, status UnexpectedResponse. [10:48:56:737] RX: 6C F0 10 7C 14 44 48 59 4E [10:48:56:737] AVT: no message waiting. [10:48:56:737] Broad Cast Code: DHYN [10:48:56:800] TX: 6C 10 F0 3C A0 [10:48:56:815] RX: 6C F0 10 7C A0 00 [10:48:56:815] AVT: no message waiting. [10:48:56:815] MEC: 0
Code:
[10:48:56:659] Serial Number query failed: Truncated
Thread Starter
Drifting
Joined: Nov 2017
Posts: 1,392
Likes: 303
Tazzi, one of the other devs, tells me that this is probably related to that error message in the log, and he's got some changes coming that should help. If you PM me an email address I'll send you something to test as soon as his changes are in.
2nd Gear
Joined: Jan 2019
Posts: 2
Likes: 2
From: Australia
Hi,
I think what his happening, is that there is lots of communication on your car data bus, and there is (was) a very narrow window of time where the avt is in VPW mode, and trying to turn on the filter, where an unfiltered packet can get through and confuse pcm hammer. Ive added a fix here https://github.com/LegacyNsfw/PcmHac...4a560397515429
I'll PM you a compiled copy. It'd be great if you could test and report back. This copy still tests fine on my bench.
I think what his happening, is that there is lots of communication on your car data bus, and there is (was) a very narrow window of time where the avt is in VPW mode, and trying to turn on the filter, where an unfiltered packet can get through and confuse pcm hammer. Ive added a fix here https://github.com/LegacyNsfw/PcmHac...4a560397515429
I'll PM you a compiled copy. It'd be great if you could test and report back. This copy still tests fine on my bench.
