|
data_mine |
|
|||
|
Found the specs for mine...
Code: A_OR_D Model Type SubType Year code CalID Filename strategy PartNum BasePN NewPartNum Catchword Checksum HardwareType RomSizeKb Bit32 CalibrationNumber Comments NotCertified QualifierValueGrpList QualifierValueGrpName QualByCalID Mandatory TSBNum TSBPartNum Calfilelist CalFileGrpName Dependencylist DependencyGrpName BLfilelist BLFileGrpName ModuleDN QualByCalid_new RationaleMngrpname RatMnemonicnames Subfilelist SubFileGrpName
U FALCON 4V 5.4L MY06 (CM_CONNECTOR 16PIN) E43E HADCEN3 5R29-ANE 12A650 5R29-ANF A5NE 7F6E ASU-121 1024 TRUE (User-FORDNA1\ESAYLOR ChangedData) BF - Falcon GT 6spd Auto - Job1 + 90 FALSE QVG_AUTOVHSCPETREM_O6SBF 3 FALSE - PCM 3 SubFileGrp_610 U FALCON 4V 5.4L MY06 (CM_CONNECTOR 16PIN) E43E HADCEN3 5R29-ANE 12A650 5R29-ANF A5NE 7F6E ASU-141 1024 TRUE (User-FORDNA1\ESAYLOR ChangedData) BF - Falcon GT 6spd Auto - Job1 + 90 FALSE QVG_AUTOVHSCPETREM_O6SBF 3 FALSE - PCM 3 SubFileGrp_610 U FALCON 4V 5.4L MY06 (CM_CONNECTOR 16PIN) E43E HADCEN3 5R29-ANE 12A650 5R29-ANF A5NE 7F6E ASU-161 1024 TRUE (User-FORDNA1\ESAYLOR ChangedData) BF - Falcon GT 6spd Auto - Job1 + 90 FALSE QVG_AUTOVHSCPETREM_O6SBF 3 FALSE - PCM 3 SubFileGrp_610 U FALCON 4V 5.4L MY06 (CM_CONNECTOR 16PIN) E43E HADCEN3 5R29-ANE 12A650 5R29-ANF A5NE 7F6E ASU-181 1024 TRUE (User-FORDNA1\ESAYLOR ChangedData) BF - Falcon GT 6spd Auto - Job1 + 90 FALSE QVG_AUTOVHSCPETREM_O6SBF 3 FALSE - PCM 3 SubFileGrp_610 (table is a mess, but the idea is there) Now of the 4 results, they all appear the same, no difference in part numbers, and (I guess) the checksum (that should show even the smallest change being evident).
_________________ 1998 DL LTD in Sparkling Burgundy, daily, 302W, stereo, slow |
|||
Top | |
data_mine |
|
|||
|
Just found something REALLY cool.
Look up the comment for catchword B7LA/B7MA/B8NA/B7PA. And then B8LA/B8LB/B8MA/B8MB Thank me later.
_________________ 1998 DL LTD in Sparkling Burgundy, daily, 302W, stereo, slow |
|||
Top | |
FPV_GTp |
|
||
|
Lukeyson wrote: I mentioned it before, but the IDS software that you can download from Motorcraft will let you manually type in the PCM code from your car and will recognise what type of car you have. Everything you read back to me in one of your PM's, Hard_ware, appears identical to what I found in the IDS.
Interestingly enough, in the IDS, I can enter and locate those two cars - BA Falcon and SX Territory. However, when I enter the PCM codes for the newer models (From about 2005 onwards, the BF '5R29' Falcon and the SY '???' Territory) I can't find them - well for the 5R29 anyway. I might try 8R29 just to be thorough. So some things do seem incomplete in places. I wonder if there's anyone reading this that might have access to an SY Territory of some sort and would be willing to collect and forward us the Code on the PCM? Lukeyson Lukeyson , try Ferntree Gully Auto Salvage forum sponsor http://www.fordmods.com/forums/ferntree ... e-f24.html I sure they might be able to help with code on the PCM's cheers
_________________ WANTED - Complete BTr4 and zf 6hp26 automatic transmission 6 cylinder and V8 transmission(s) suit rebuild? Drop me a PM if you can help would be greatly appreciated - thanks |
||
Top | |
Lukeyson |
|
|||
|
Hi FPV_GTP. Yeah, I've dealt with FTG before. Good bunch of blokes. They are pretty busy so I try not to bug them with too much stuff.
That xls is a bit of a bonanza. I thought I'd work through many of the model numbers and PCM types. For the Falcons: 3R23 - BA + BAII 5R29 - BF 7R29 - BFII 8R29 - Orion (!!!!) So THAT's what you mean by MY08! (Orion Production starts in April 2008) For Territory 3R73 - SX 5R79 - SY 6R79 - SY Turbo 7R79 - Not sure. I see reference to Thailand and FSA (South Africa) for this, but I also see these references for 5R79. Could this be the new FPV Enhanced Turbo Territory? Each of these have a number of different flash types. This defined by the first letter aftert he 12A650 bit. I'll see if I can figure out the relevant of each letter. For example, 3R73-12A650-A* is the 2WD SX terry, 3R73-12A650-B* is the 4WD SX Terry. It's interesting that the SY Turbo get's it's own model designation. But how about the Orion stuff eh! That's cool. Lukeyson |
|||
Top | |
Lukeyson |
|
|||
|
data_mine wrote: Just found something REALLY cool.
Look up the comment for catchword B7LA/B7MA/B8NA/B7PA. And then B8LA/B8LB/B8MA/B8MB Thank me later. My goodness. I was spinning at seeing the Orion in there. I wonder if this is really a GTHO, or if it was just renamed Cobra at the last minute? Do we dare spread the news? Because it might be spurious. Lukeyson |
|||
Top | |
data_mine |
|
|||
|
I'm thinking it's what became the Cobra.
Glad they didn't call it a HO.
_________________ 1998 DL LTD in Sparkling Burgundy, daily, 302W, stereo, slow |
|||
Top | |
Lukeyson |
|
|||
|
Orion Codes - for those with any interest in the information it reveals:
8R29-12A650-AAB - I6 5A Sedan 8R29-12A650-ABB - I6 5A Ute 8R29-12A650-ACB - I6 6M Sedan 8R29-12A650-ADB - I6 5A Col Shift Ute Dual Fan 8R29-12A650-AEB - I6 6A Sedan 8R29-12A650-AFB - I6 5A Col Shift Ute SIngle Fan 8R29-12A650-ALB - I6 5A Col Shift Ute Dual Fan (One of these may be Brolga/RTV - notsure which) 8R29-12A650-ANB - I6T 6M Sedan 8R29-12A650-APB - I6T 6M Ute Dual Fan 8R29-12A650-ARB - I6T 6A Sedan 8R29-12A650-ASB - I6T 6A Ute Dual Fan 8R29-12A650-ATB - I6 5A Ute Single Fan 8R29-12A650-AUB - I6 6M Ute Single Fan 8R29-12A650-AVB - XR8 6M Sedan 8R29-12A650-AZB - XR8 6M Ute Dual Fan 8R29-12A650-BAB - XR8 6A Sedan 8R29-12A650-BBB - XR8 6A Ute Dual Fan 8R29-12A650-BCB - I6LPG 4A Sedan 8R29-12A650-BEB - I6LPG 4A Ute Dual Fan 8R29-12A650-BFB - I6LPG 4A Ute SIngle Fan 8R29-12A650-BGB - I6T 6A Sedan (F6) 8R29-12A650-BHB - I6T 6M Sedan (F6) 8R29-12A650-BJB - I6T 6A Ute (F6) 8R29-12A650-BKB - I6T 6M Ute (F6) 8R29-12A650-BLB - GT 6A Sedan 8R29-12A650-BMB - GT 6M Sedan 8R29-12A650-BRB - Pursuit 6A Dual Fan 8R29-12A650-BSB - Pursuit 6M Dual Fan Lukeyson |
|||
Top | |
data_mine |
|
|||
|
4, 6, and now a 5spd auto? wtf?
_________________ 1998 DL LTD in Sparkling Burgundy, daily, 302W, stereo, slow |
|||
Top | |
Lukeyson |
|
|||
|
GTHO (But probably just Cobra 302) Codes:
7R29-12A650-BLA - GTHO 6A Sedan 7R29-12A650-BMA - GTHO 6M Sedan 7R29-12A650-BNA - GTHO 6A Ute 7R29-12A650-BPA - GTHO 6M Ute Lukeyson |
|||
Top | |
motrocco |
|
||
|
hi guys. Great work, especially Luke for starting it all.
Came across this site http://www.obd-2.com/#download Has software, seemingly all the new CODES CAN, etc. Also mentions SOMEWHERE that in WDS or IDS (Ford software & hardware solution) that you must enter the VIN number when using the Ford software, it reads VIN from Control Module (PWM??), does a little hashing (ford alg&VIN#) on it and then ALL updates to and from the Control Module are encrypted using the VIN. This means that people can't rob modules code and reuse, as every car is encrypted with it's own VIN. This hashing stuff is built-in to the FOrd specific device. Sorry I can't find the link now but this is the general gist. Was just wondering if you guys were aware. Sorry if this is actually not such a helpful first post but it's a thought anyway. Keep up the good work. I'm interested as I hope to soon buy a Transit and would like to be able to update the chips myself, and not have to pay big bucks for a mod/tune blah blah. edited: loads of manuals lads!!!! http://www.fordscorpio.co.uk/emmanuals.htm this can tell you what network is used PWM/ISO http://www.obd-2.com/dlcnet.html I selected 1998 transit, then also selected 1998 Transit Body and Chassis. Two different networks selected. m - dublin ireland |
||
Top | |
Lukeyson |
|
|||
|
There's some work been done on getting into the PCM already down these parts.
We understand that the system uses a method of securing the PCM by requiring both a Voltage on a specific pin of the OBD2 port, and by use of a challenge/response process as defined in US Standard J2168 (Or ISO15031-7 in Europe) using Mode27, when the appropriate PCM access for writing is required. From what I've seen, the subsequent data exchange doesn't look encrypted, but I'll keep my mind open! I know that 3rd Party custom tuning boxes will lock themselves to a VIN, but that's more about the makers of the 'box' wanting to sell you a box-per-car than it is about any limit with the PCM. We have 'sniffed' PCM reflashing conducted by aftermarket tools and can clearly see these messages being exchanged. The flashing of the ECU between the factory tune and aftermarket tune have been captured for the 3R23-12A650-AKD (My 5.4L 4V V8 XR8 - a prime target for custom tuning...). I've also got captures with the 3R73-12A650-BF when I disabled and enabled the Cruise Control in quick succession. I plan to compare my capture against the files that Hard_Ware has shown how to download. I also have some traces from the start of a WDS diagnostic session, that result in the system being able to display the VIN, the PCM Flash version and, and the versions from all the other modules in the vehicle. This is done via a Mode 23 request, which is defined in J2190 as a 'Request by Memory Address'. We've already done quite a bit using the other two request methods - Mode21 = Request by Offset, Mode22 = Request by PID. I can already see the VIN in ASCII encoded HEX, and was in the process of trying to decode other parts before moving onto a few other things. Maybe it's time to take a second look now that I know the Checksum and file version values from that table. Hold tight, I'll post up some vin details next. Lukeyson Last edited by Lukeyson on Mon Dec 10, 2007 9:51 am, edited 3 times in total. |
|||
Top | |
Lukeyson |
|
|||
|
motrocco wrote: hi guys. Great work, especially Luke for starting it all.
Came across this site http://www.obd-2.com/#download Has software, seemingly all the new CODES CAN, etc. m - dublin ireland I had a go at those files quite some time ago. The data files can be downloaded separately. If you have an idea how to decode them you'll be ahead of us! Lukeyson |
|||
Top | |
Lukeyson |
|
|||
|
This is part of a bigger 'ID Vehicle' Process, but the bit of interest with the VIN I'll just plug up here.
On a Territory SX Ghia, the sequence of commands that grabbed the VIN, (with some additional bits for setting up the ELM327 session) were: ath1 atsh7E0 23 00 01 00 c0 00 04 23 00 01 00 c4 00 04 23 00 01 00 c8 00 04 23 00 01 00 cc 00 04 23 00 01 00 d0 00 04 This returned: 7e8 05 63 36 46 50 41 00 00 7e8 05 63 41 41 4a 47 00 00 7e8 05 63 41 54 34 4b 00 00 7e8 05 63 32 33 32 39 00 00 7e8 05 63 31 FF FF FF 00 00 Ignore all the 7e8 (header for response) 05 (Byte Count) and 63 (Response to 23) and the empty values beyond the number of bytes specified by the counter and you get: 36 46 50 41 41 41 4a 47 41 54 34 4b 32 33 32 39 31 FF FF FF The ff's can also be ignored as they are just padding. 0x36 = Decimal 054 = ASCII 6 0x46 = Decimal 070 = ASCII F And onwards till you get a VIN of 6FPAAAJGAT4K23291 This is the 'hard core' way to do it. I also think that you might be able to get it using J1979 and a Mode09 PID02 query - but I can't confirm that at the moment, I just know that there's data there. Luke |
|||
Top | |
Headsex |
|
||
|
Lukeyson wrote: I took a bit of a look at your attachment and it's difficult to make out the format of the data or it's application. It's looking to me like we'd need either a decoding miracle
Or you need me.. I've written a program which unpacks it.. its mearly just a "packed Hex file" took me all of 2 minutes to work out how to convert it.. the end product is just a intel hex file. Message me tonight and i'll sent ya the app i wrote.. |
||
Top | |
Headsex |
|
||
|
Lukeyson wrote: I've got to say, I'm not real impressed with that EEPod website (). There's absolutely no mention of the fact that it's a J2534 tool, and looking at it, I can't tell WTF it does. Does it do full J2534 - or some sort of subset? Who can tell? As a customer, I'd hit those guys up for a better website. It is, in all honesty, crap. I would never buy anything based on such a poor level of information. And if it does what you say it does, they'll sell more off your comments than that website...!
EEpod is run by a ex employee of Drewtech.. Little to say, he took a little bit of drewtech knowledge with him and developed his own product |
||
Top | |
Who is online |
---|
Users browsing this forum: No registered users and 26 guests |