C5 Scan & Tune Corvette Onboard Diagnostics, Service Advice, Dyno Tuning, Fuel Management, Tuning Software, LS1 Edit, AutoTap, Diablo
Sponsored by:
Sponsored by: Kraken

PCM Hammer

Thread Tools
 
Search this Thread
 
Old 10-25-2018, 01:30 AM
  #1  
NSFW
Burning Brakes
Thread Starter
 
NSFW's Avatar
 
Member Since: Nov 2017
Posts: 1,071
Received 166 Likes on 136 Posts
Default PCM Hammer

I've been working with a few other folks on an open-source tool to read and write the PCMs used in 2000-2004 Corvettes, and we have both reading and writing working now. A handful of other folks have been testing it over the last couple days, and nothing caught fire or melted down, so...

The latest release is listed at the top of this page:
https://github.com/LegacyNsfw/PcmHacks/releases

Click the Assets link below the release description, and then click the zip file name to download it.

Unzip the contents into an empty directory, run PcmHammer.exe, select your device type, and proceed with caution. This stuff is very new, and you're a beta tester. That said, reading is perfectly safe, and I've done a couple dozen calibration updates on my 2002 Z06 with no ill effects.

For more information about this project and what you can do with it:
https://github.com/LegacyNsfw/PcmHacks/wiki

Credits:

Antus from pcmhacking.net - he's taught me a ton about what makes PCMs tick
Tazzi from pcmhacking.net - if you're using a J2534 tool, you owe him a beer
PeteS160 here at ls1tech.com - fluent in J1850 VPW, instrumental in recovering my PCM after I hit it with the hammer.
Dimented24x7 from thirdgen.org - he's been offline for a couple years, but he laid the foundation for this.
EagleMark from gearhead-efi - another pioneer who contributed a lot the community. May he rest in peace.


P.S. Don't use this in your car if you need that car to get to work. Let's stick with project cars for a while until we're all confident that this **** can really be trusted.

Last edited by NSFW; 03-05-2020 at 01:33 PM. Reason: Release #12 is out
The following users liked this post:
Bob Onit (03-04-2023)
Old 12-21-2018, 05:30 PM
  #2  
NSFW
Burning Brakes
Thread Starter
 
NSFW's Avatar
 
Member Since: Nov 2017
Posts: 1,071
Received 166 Likes on 136 Posts
Default

We're getting close to releasing a version that can write changes to the PCM's flash memory... We've reached the "it works on my machine" stage. :-)

Old 12-31-2018, 06:33 PM
  #3  
NSFW
Burning Brakes
Thread Starter
 
NSFW's Avatar
 
Member Since: Nov 2017
Posts: 1,071
Received 166 Likes on 136 Posts
Default

I updated the GitHub link in the first post to point to a new release that supports writing, because today I flashed the PCM in my car for the third time and drove it around without any trouble. My car came with a skip-shift eliminator, but now skip-shift is so disabled that the dash light doesn't even come on. So apparently the app really works. That gives me a lot of confidence. Perhaps more than it should, but here goes anyway...

Before you try this yourself, keep in mind that you can probably count the number of PCMs that have been flashed with PCM Hammer using your fingers. For the number of PCMs that have been flashed in a car, you might only need your thumbs. I strongly suggest letting people with PCMs on their workbenches play with this stuff for a while before you try it in your car. And definitely don't use this in your car if you need that car to get to work. Let's stick with project cars for a while until we're all confident that this **** can really be trusted.

Also, let's talk about what happened the first time I flashed my car: it stopped working. The actual copy operation went perfectly, but the file that I was flashing from had bad checksums (because I was using Tuner Pro with an XDF that I created myself, and that XDF still had no checksum information in it!). Not only would the PCM not run the engine, it wouldn't accept a new flash, so I couldn't put the old file back on it. There is a workaround for this, but it requires removing the PCM, popping the back of the case off, and grounding a pin before you reflash it. That worked, and the same PCM is back in the car now and working perfectly.

And then I added some code to PCM Hammer so that it will validate checksums before it will let you flash. So hopefully nobody else will run into exactly that kind of problem again...

But we still haven't added code to compare the OS ID in your bin file with the OS that's on your PCM. So the app will cheerfully flash a calibration from one OS into a PCM that's running a different OS, and you'll be taking apart your PCM before you drive the car again. So, be careful.

So far, we haven't truly bricked anybody's PCM.

So far.

The least risky way to use PCM Hammer is to read the bin file from your PCM, tune it using Tuner Pro and a known-good XDF, and write the updated file back to the PCM. But I still wouldn't recommend doing that with your daily driver until more cars have been reflashed than you can count on your fingers. And toes.

Happy new year!
Old 01-08-2019, 01:18 AM
  #4  
gimp
Drifting
Support Corvetteforum!
 
gimp's Avatar
 
Member Since: Jul 2015
Location: San Jose, CA
Posts: 1,844
Received 364 Likes on 281 Posts
Default

Super sexy!

I don't have any windows machines, but looking at the kernel code, it appears all (or at least the vast majority) of the non-UI code is happily portable to any other OS. I suppose it wouldn't be much work to replace the UI with config files and a command line invocation.

Now, an entirely different question: Do y'all have any sort of reference schematic, original or reverse-engineered or otherwise, of either the whole PCM or the most relevant portions? PCB layout files are (I'm sure) asking for far too much, of course.
Old 01-08-2019, 03:39 AM
  #5  
NSFW
Burning Brakes
Thread Starter
 
NSFW's Avatar
 
Member Since: Nov 2017
Posts: 1,071
Received 166 Likes on 136 Posts
Default

Thanks!

I'd be delighted to see it ported to other platforms, and yes that should just be matter of rewriting the UI. We had a guy working on a command-line version for Linux a while back. Unfortunately his employer objected so he had to pull the code... He only had a couple hundred lines of code written if I remember right, but it was enough to show that it could be done.

Good timing, by the way... You made me realize that the code I added tonight really belongs in the library layer rather than the UI layer. I'll fix that tomorrow.

I have no schematics, but I do have data sheets for the CPU, a couple flash chips, and the data link controller (the OBD2 interface). I'll send you copies if you shoot me an email. Nsfw, outlook, you can guess the rest.
Old 01-08-2019, 07:14 PM
  #6  
gimp
Drifting
Support Corvetteforum!
 
gimp's Avatar
 
Member Since: Jul 2015
Location: San Jose, CA
Posts: 1,844
Received 364 Likes on 281 Posts
Default

That's a hell of a nice email address. I'll shoot you an email. Thanks!

I tend to add reference docs right into my git repos in a docs directory, of course git doesn't really like to track non-text files but I don't really ask its opinion. Hah! But I dunno if certain git web hosts (like github) complain.
Old 01-17-2019, 02:31 AM
  #7  
NSFW
Burning Brakes
Thread Starter
 
NSFW's Avatar
 
Member Since: Nov 2017
Posts: 1,071
Received 166 Likes on 136 Posts
Default

Release #4 is ready for testing!

https://github.com/LegacyNsfw/PcmHacks/releases/tag/2019.01.16.02

The biggest improvement in this release is that the app will prevent you from writing if the operating system in the PCM doesn't match the operating system in the file you have selected.

If you run it while connected to the internet, it will check github for a new release. Ordinarily it will just say "Thank you for using PCM Hammer" when it starts up, but when have a new release that will change to something like "Hey, we have a new release!"

Last edited by NSFW; 01-17-2019 at 03:09 AM.
Old 01-25-2019, 02:49 AM
  #8  
Sub8
Pro
 
Sub8's Avatar
 
Member Since: Feb 2014
Location: England
Posts: 688
Received 107 Likes on 94 Posts

Default

WoW thats a great addition to the tool box - thanks to you guys!. So next question for the casual user - where can I get a properly configured xdf file for an 01 Z06?
Old 01-25-2019, 04:40 AM
  #9  
NSFW
Burning Brakes
Thread Starter
 
NSFW's Avatar
 
Member Since: Nov 2017
Posts: 1,071
Received 166 Likes on 136 Posts
Default

Originally Posted by Sub8
WoW thats a great addition to the tool box - thanks to you guys!. So next question for the casual user - where can I get a properly configured xdf file for an 01 Z06?
There's a guy over on Gearhead-EFI who just posted a bunch of XDF files:

http://www.gearhead-efi.com/Fuel-Inj...ed-is-TunerPro)

But please keep an eye on that thread - the guy made those XDF files unknowningly used a Tuner Pro checksum plugin which had the author's name stripped out by a third party. (Probably someone who was also selling other free tools on ebay with credits and copyright info stripped out - it's a long story.) The plugin author was Antus from pcmhacking.net, who also happens to be one of the biggest contributors to the PCM Hammer project. Antus and LRT (the XDF author) are going to resolve the plugin issue, so there will probably be an update soon. The functionality won't change, it's just the principle of the thing.
Old 01-28-2019, 10:19 AM
  #10  
digitaloutsider
Instructor
 
digitaloutsider's Avatar
 
Member Since: Dec 2017
Location: Fort Worth, TX
Posts: 139
Received 43 Likes on 33 Posts
Default

This is FANTASTIC. I have an AVT-852 I bought for DHP/tuning 3800s a while back. Once I'm off work I'll give it a shot and try it out.
The following users liked this post:
NSFW (01-28-2019)
Old 01-28-2019, 08:15 PM
  #11  
digitaloutsider
Instructor
 
digitaloutsider's Avatar
 
Member Since: Dec 2017
Location: Fort Worth, TX
Posts: 139
Received 43 Likes on 33 Posts
Default

Played with PCM Hammer a little tonight, man it's so nice to see something grassroots that's actually promising in the GM tuning community.

As stated above, I am using an AVT-852 box. I was able to successfully read the PCM from my '01 C5 (0411), and was able to open that saved file in TunerCATS. I have not tried writing to the PCM because I don't have a spare LS one sitting around. Next time I go to the junkyard I'll grab one just in case and give it a shot.

The "Read Properties" button seems to sporadically not-work when connected to the Corvette. Unfortunately I'm a moron and didn't get the "Results" log, but I have attached the Debug Log where the failure happens. You'll click it, get an error in the Results (I believe about the VIN), then click it again and usually it works fine. It happens once every 3 or 4 times.

For ***** and giggles, I connected this to my Regal (12209624) and wasn't able to do anything. However, I do have a PCM sitting here that I believe is from an '03 GP GT (also PN 9624) and connected it up to my offboard and actually was able to pull some data back from the "Read Properties" function, but then the application seems to loop and lock after "Reading Serial Number: xxxx". I know you haven't baked this support in yet, but thought it seemed interesting enough. A read is not possible, obviously, and throws back an error about the unlock response being an invalid length.

If there's anything you'd like me to try or do with either the 'Vette or 3800 PCMs, let me know. I'm happy to help.
Attached Files

Last edited by digitaloutsider; 01-28-2019 at 08:18 PM.
Old 01-28-2019, 11:39 PM
  #12  
NSFW
Burning Brakes
Thread Starter
 
NSFW's Avatar
 
Member Since: Nov 2017
Posts: 1,071
Received 166 Likes on 136 Posts
Default

First of all, thanks for giving it a try. The PCM is unreliable for about ten seconds after being powered up, how long had it been powered when you made that log? The PCM on my desk will fail about half of the "get properties" operations during the first ten seconds after being powered up. This is also why the read and write operations start with waiting ten seconds.

Regardless of how long the PCM was powered, there's a line at the top of the log that says "[06:41:27:253] Failed to disable AVT Acks" so that suggests that something else was going wrong. The AVT stuff was written by Antus so I'll follow up with him to see if he knows what would cause that, and if that would cause the sort of trouble you saw.
The following users liked this post:
digitaloutsider (01-29-2019)
Old 01-29-2019, 12:05 AM
  #13  
digitaloutsider
Instructor
 
digitaloutsider's Avatar
 
Member Since: Dec 2017
Location: Fort Worth, TX
Posts: 139
Received 43 Likes on 33 Posts
Default

Trying it out is the least I can do. A free flashing tool is a dream come true for this community, and not worrying about credits, vendor locks, and other nonsense is the way it should be for cars that are creeping up on (or surpassing) 20 years old.

To ensure that this wasn't a PEBCAK issue, I'm on my tuning laptop in the garage right now. I left the key on for 30 seconds before trying again, and this is the error as displayed in the Results tab:

Code:
[10:48:27:862] PCM Hammer 004
[10:48:28:080] AVT 852 Reset OK
[10:48:28:080] AVT Firmware 2.6
[10:48:49:202] VIN query failed: Truncated
[10:48:56:332] VIN: 1G1YY22G7151*****
[10:48:56:410] OS ID: 12593358
[10:48:56:488] Calibration ID: 12204901
[10:48:56:566] Hardware ID: 9386530
[10:48:56:659] Serial Number query failed: Truncated
[10:48:56:737] Broad Cast Code: DHYN
[10:48:56:815] MEC: 0
49:202 was the first press. 56:332 was clicking it again after it failed the first time. From the debug log:

Code:
[10:48:27:862] PCM Hammer 004
[10:48:27:862] Initializing AVT (842/852) on COM3
[10:48:28:080] Sending 'reset' message.
[10:48:28:080] AVT 852 Reset OK
[10:48:28:080] Looking for Firmware message
[10:48:28:080] AVT Firmware 2.6
[10:48:28:096] Set VPW Mode
[10:48:28:096] Failed to disable AVT Acks
[10:48:49:171] TX: 6C 10 F0 3C 01
[10:48:49:171] RX: E8 FF 60 03
[10:48:49:171] AVT: no message waiting.
[10:48:49:171] TX: 6C 10 F0 3C 02
[10:48:49:187] RX: 88 25 28 07 00
[10:48:49:187] AVT: no message waiting.
[10:48:49:187] TX: 6C 10 F0 3C 03
[10:48:49:202] RX: 6C F0 10 7C 01 00 31 47 31 59 59
[10:48:49:202] AVT: no message waiting.
[10:48:49:202] VIN query failed: Truncated
[10:48:49:374] AVT setting VPW 4X
[10:48:49:889] TX: 6C 10 F0 20
[10:48:49:889] AVT setting VPW 1X
[10:48:49:998] TX: 6C 10 F0 20
[10:48:56:254] TX: 6C 10 F0 3C 01
[10:48:56:269] RX: 6C F0 10 7C 01 00 31 47 31 59 59
[10:48:56:285] AVT: no message waiting.
[10:48:56:285] TX: 6C 10 F0 3C 02
[10:48:56:300] RX: 6C F0 10 7C 02 32 32 47 37 31 35
[10:48:56:300] AVT: no message waiting.
[10:48:56:300] TX: 6C 10 F0 3C 03
[10:48:56:332] RX: 6C F0 10 7C 03 31 33 34 37 37 36
[10:48:56:332] AVT: no message waiting.
[10:48:56:332] VIN: 1G1YY22G7151*****
[10:48:56:394] TX: 6C 10 F0 3C 0A
[10:48:56:410] RX: 6C F0 10 7C 0A 00 C0 28 CE
[10:48:56:410] AVT: no message waiting.
[10:48:56:410] OS ID: 12593358
[10:48:56:472] TX: 6C 10 F0 3C 08
[10:48:56:472] RX: E8 FF 10 03
[10:48:56:472] AVT: no message waiting.
[10:48:56:472] Received an unexpected response. Attempt #1, status Error.
[10:48:56:488] RX: 6C F0 10 7C 08 00 BA 3B 65
[10:48:56:488] AVT: no message waiting.
[10:48:56:488] Calibration ID: 12204901
[10:48:56:550] TX: 6C 10 F0 3C 04
[10:48:56:550] RX: A8 83 10 13 0F 0D
[10:48:56:550] AVT: no message waiting.
[10:48:56:550] Received an unexpected response. Attempt #1, status Error.
[10:48:56:566] RX: 6C F0 10 7C 04 00 8F 3A 22
[10:48:56:566] AVT: no message waiting.
[10:48:56:566] Hardware ID: 9386530
[10:48:56:628] TX: 6C 10 F0 3C 05
[10:48:56:628] RX: E8 FF 28 03
[10:48:56:628] AVT: no message waiting.
[10:48:56:628] TX: 6C 10 F0 3C 06
[10:48:56:644] RX: 6C F0 10 7C 06 4C 44 57 47
[10:48:56:644] AVT: no message waiting.
[10:48:56:644] TX: 6C 10 F0 3C 07
[10:48:56:659] RX: 88 25 28 07 00
[10:48:56:659] AVT: no message waiting.
[10:48:56:659] Serial Number query failed: Truncated
[10:48:56:722] TX: 6C 10 F0 3C 14
[10:48:56:722] RX: 6C F0 10 7C 07 31 31 35 38
[10:48:56:722] AVT: no message waiting.
[10:48:56:722] Received an unexpected response. Attempt #1, status UnexpectedResponse.
[10:48:56:737] RX: 6C F0 10 7C 14 44 48 59 4E
[10:48:56:737] AVT: no message waiting.
[10:48:56:737] Broad Cast Code: DHYN
[10:48:56:800] TX: 6C 10 F0 3C A0
[10:48:56:815] RX: 6C F0 10 7C A0 00
[10:48:56:815] AVT: no message waiting.
[10:48:56:815] MEC: 0
This brought back the Properties, except for the Serial Number:

Code:
[10:48:56:659] Serial Number query failed: Truncated
Hope that helps some!
Old 01-29-2019, 12:37 AM
  #14  
NSFW
Burning Brakes
Thread Starter
 
NSFW's Avatar
 
Member Since: Nov 2017
Posts: 1,071
Received 166 Likes on 136 Posts
Default

Yep, that rules out the PCM-still-booting thing as a possible cause. We'll see what we can do.
Old 01-29-2019, 12:57 AM
  #15  
NSFW
Burning Brakes
Thread Starter
 
NSFW's Avatar
 
Member Since: Nov 2017
Posts: 1,071
Received 166 Likes on 136 Posts
Default

Tazzi, one of the other devs, tells me that this is probably related to that error message in the log, and he's got some changes coming that should help. If you PM me an email address I'll send you something to test as soon as his changes are in.
The following users liked this post:
gimp (01-29-2019)
Old 01-29-2019, 01:11 AM
  #16  
digitaloutsider
Instructor
 
digitaloutsider's Avatar
 
Member Since: Dec 2017
Location: Fort Worth, TX
Posts: 139
Received 43 Likes on 33 Posts
Default

PM sent!
Old 01-30-2019, 07:21 PM
  #17  
antus
2nd Gear
 
antus's Avatar
 
Member Since: Jan 2019
Location: Australia
Posts: 2
Likes: 0
Received 2 Likes on 2 Posts
Default

Hi,

I think what his happening, is that there is lots of communication on your car data bus, and there is (was) a very narrow window of time where the avt is in VPW mode, and trying to turn on the filter, where an unfiltered packet can get through and confuse pcm hammer. Ive added a fix here https://github.com/LegacyNsfw/PcmHac...4a560397515429

I'll PM you a compiled copy. It'd be great if you could test and report back. This copy still tests fine on my bench.
The following users liked this post:
NSFW (01-31-2019)

Get notified of new replies

To PCM Hammer

Old 01-30-2019, 08:20 PM
  #18  
digitaloutsider
Instructor
 
digitaloutsider's Avatar
 
Member Since: Dec 2017
Location: Fort Worth, TX
Posts: 139
Received 43 Likes on 33 Posts
Default

@antus @NSFW The fix works. Read Properties worked every time I clicked it. I went ahead and re-read the PCM just to ensure nothing went crazy, and the read was successful. Good stuff!
The following users liked this post:
NSFW (01-31-2019)
Old 01-30-2019, 08:28 PM
  #19  
antus
2nd Gear
 
antus's Avatar
 
Member Since: Jan 2019
Location: Australia
Posts: 2
Likes: 0
Received 2 Likes on 2 Posts
Default

Great! Thanks for testing and the report.
The following users liked this post:
digitaloutsider (01-30-2019)
Old 01-30-2019, 08:31 PM
  #20  
digitaloutsider
Instructor
 
digitaloutsider's Avatar
 
Member Since: Dec 2017
Location: Fort Worth, TX
Posts: 139
Received 43 Likes on 33 Posts
Default

Glad I could help!


Quick Reply: PCM Hammer



All times are GMT -4. The time now is 05:02 AM.