Found the specs for mine...

(table is a mess, but the idea is there)

Now of the 4 results, they all appear the same, no difference in part numbers, and (I guess) the checksum (that should show even the smallest change being evident).

Just found something REALLY cool.

Look up the comment for catchword B7LA/B7MA/B8NA/B7PA. And then B8LA/B8LB/B8MA/B8MB

Thank me later.

Lukeyson , try Ferntree Gully Auto Salvage forum sponsor http://www.fordmods.com/forums/ferntree ... e-f24.html

I sure they might be able to help with code on the PCM's

cheers

Hi FPV_GTP. Yeah, I've dealt with FTG before. Good bunch of blokes. They are pretty busy so I try not to bug them with too much stuff.

That xls is a bit of a bonanza. I thought I'd work through many of the model numbers and PCM types.

For the Falcons:
3R23 - BA + BAII
5R29 - BF
7R29 - BFII
8R29 - Orion (!!!!) So THAT's what you mean by MY08! (Orion Production starts in April 2008)

For Territory
3R73 - SX
5R79 - SY
6R79 - SY Turbo
7R79 - Not sure. I see reference to Thailand and FSA (South Africa) for this, but I also see these references for 5R79. Could this be the new FPV Enhanced Turbo Territory?

Each of these have a number of different flash types. This defined by the first letter aftert he 12A650 bit. I'll see if I can figure out the relevant of each letter.

For example, 3R73-12A650-A* is the 2WD SX terry, 3R73-12A650-B* is the 4WD SX Terry. It's interesting that the SY Turbo get's it's own model designation.

But how about the Orion stuff eh! That's cool.


Lukeyson

My goodness. I was spinning at seeing the Orion in there.

I wonder if this is really a GTHO, or if it was just renamed Cobra at the last minute?

Do we dare spread the news? Because it might be spurious.


Lukeyson

I'm thinking it's what became the Cobra.

Glad they didn't call it a HO.

Orion Codes - for those with any interest in the information it reveals:

8R29-12A650-AAB - I6 5A Sedan
8R29-12A650-ABB - I6 5A Ute
8R29-12A650-ACB - I6 6M Sedan
8R29-12A650-ADB - I6 5A Col Shift Ute Dual Fan
8R29-12A650-AEB - I6 6A Sedan
8R29-12A650-AFB - I6 5A Col Shift Ute SIngle Fan
8R29-12A650-ALB - I6 5A Col Shift Ute Dual Fan (One of these may be Brolga/RTV - notsure which)
8R29-12A650-ANB - I6T 6M Sedan
8R29-12A650-APB - I6T 6M Ute Dual Fan
8R29-12A650-ARB - I6T 6A Sedan
8R29-12A650-ASB - I6T 6A Ute Dual Fan
8R29-12A650-ATB - I6 5A Ute Single Fan
8R29-12A650-AUB - I6 6M Ute Single Fan
8R29-12A650-AVB - XR8 6M Sedan
8R29-12A650-AZB - XR8 6M Ute Dual Fan
8R29-12A650-BAB - XR8 6A Sedan
8R29-12A650-BBB - XR8 6A Ute Dual Fan
8R29-12A650-BCB - I6LPG 4A Sedan
8R29-12A650-BEB - I6LPG 4A Ute Dual Fan
8R29-12A650-BFB - I6LPG 4A Ute SIngle Fan
8R29-12A650-BGB - I6T 6A Sedan (F6)
8R29-12A650-BHB - I6T 6M Sedan (F6)
8R29-12A650-BJB - I6T 6A Ute (F6)
8R29-12A650-BKB - I6T 6M Ute (F6)
8R29-12A650-BLB - GT 6A Sedan
8R29-12A650-BMB - GT 6M Sedan
8R29-12A650-BRB - Pursuit 6A Dual Fan
8R29-12A650-BSB - Pursuit 6M Dual Fan


Lukeyson

4, 6, and now a 5spd auto? wtf?

GTHO (But probably just Cobra 302) Codes:

7R29-12A650-BLA - GTHO 6A Sedan
7R29-12A650-BMA - GTHO 6M Sedan
7R29-12A650-BNA - GTHO 6A Ute
7R29-12A650-BPA - GTHO 6M Ute


Lukeyson

hi guys. Great work, especially Luke for starting it all.

Came across this site

{DESCRIPTION}

Has software, seemingly all the new CODES CAN, etc.

Also mentions SOMEWHERE that in WDS or IDS (Ford software & hardware solution) that you must enter the VIN number when using the Ford software, it reads VIN from Control Module (PWM??), does a little hashing (ford alg&VIN#) on it and then ALL updates to and from the Control Module are encrypted using the VIN.

This means that people can't rob modules code and reuse, as every car is encrypted with it's own VIN. This hashing stuff is built-in to the FOrd specific device. Sorry I can't find the link now but this is the general gist. Was just wondering if you guys were aware.

Sorry if this is actually not such a helpful first post but it's a thought anyway. Keep up the good work. I'm interested as I hope to soon buy a Transit and would like to be able to update the chips myself, and not have to pay big bucks for a mod/tune blah blah.

edited: loads of manuals lads!!!!
{DESCRIPTION}


this can tell you what network is used PWM/ISO

{DESCRIPTION}
I selected 1998 transit, then also selected 1998 Transit Body and Chassis.
Two different networks selected.


m - dublin ireland

There's some work been done on getting into the PCM already down these parts.

We understand that the system uses a method of securing the PCM by requiring both a Voltage on a specific pin of the OBD2 port, and by use of a challenge/response process as defined in US Standard J2168 (Or ISO15031-7 in Europe) using Mode27, when the appropriate PCM access for writing is required. From what I've seen, the subsequent data exchange doesn't look encrypted, but I'll keep my mind open!

I know that 3rd Party custom tuning boxes will lock themselves to a VIN, but that's more about the makers of the 'box' wanting to sell you a box-per-car than it is about any limit with the PCM.

We have 'sniffed' PCM reflashing conducted by aftermarket tools and can clearly see these messages being exchanged. The flashing of the ECU between the factory tune and aftermarket tune have been captured for the 3R23-12A650-AKD (My 5.4L 4V V8 XR8 - a prime target for custom tuning...). I've also got captures with the 3R73-12A650-BF when I disabled and enabled the Cruise Control in quick succession. I plan to compare my capture against the files that Hard_Ware has shown how to download.

I also have some traces from the start of a WDS diagnostic session, that result in the system being able to display the VIN, the PCM Flash version and, and the versions from all the other modules in the vehicle. This is done via a Mode 23 request, which is defined in J2190 as a 'Request by Memory Address'.

We've already done quite a bit using the other two request methods - Mode21 = Request by Offset, Mode22 = Request by PID.

I can already see the VIN in ASCII encoded HEX, and was in the process of trying to decode other parts before moving onto a few other things. Maybe it's time to take a second look now that I know the Checksum and file version values from that table.

Hold tight, I'll post up some vin details next.


Lukeyson

Last edited by Lukeyson on Mon Dec 10, 2007 9:51 am, edited 3 times in total.

I had a go at those files quite some time ago. The data files can be downloaded separately. If you have an idea how to decode them you'll be ahead of us!


Lukeyson

This is part of a bigger 'ID Vehicle' Process, but the bit of interest with the VIN I'll just plug up here.

On a Territory SX Ghia, the sequence of commands that grabbed the VIN, (with some additional bits for setting up the ELM327 session) were:

ath1
atsh7E0

23 00 01 00 c0 00 04
23 00 01 00 c4 00 04
23 00 01 00 c8 00 04
23 00 01 00 cc 00 04
23 00 01 00 d0 00 04

This returned:

7e8 05 63 36 46 50 41 00 00
7e8 05 63 41 41 4a 47 00 00
7e8 05 63 41 54 34 4b 00 00
7e8 05 63 32 33 32 39 00 00
7e8 05 63 31 FF FF FF 00 00

Ignore all the 7e8 (header for response) 05 (Byte Count) and 63 (Response to 23) and the empty values beyond the number of bytes specified by the counter and you get:

36 46 50 41
41 41 4a 47
41 54 34 4b
32 33 32 39
31 FF FF FF

The ff's can also be ignored as they are just padding.

0x36 = Decimal 054 = ASCII 6
0x46 = Decimal 070 = ASCII F

And onwards till you get a VIN of 6FPAAAJGAT4K23291

This is the 'hard core' way to do it. I also think that you might be able to get it using J1979 and a Mode09 PID02 query - but I can't confirm that at the moment, I just know that there's data there.


Luke

Or you need me.. I've written a program which unpacks it.. its mearly just a "packed Hex file"

took me all of 2 minutes to work out how to convert it.. the end product is just a intel hex file.

Message me tonight and i'll sent ya the app i wrote..

EEpod is run by a ex employee of Drewtech.. Little to say, he took a little bit of drewtech knowledge with him and developed his own product