|
| Hard_ware |
|
||
|
I think his name is Kerby S. I talked to him before I purchased the McS1. I will PM you so you can send me the app. I am not sure if the files would appear any different to me. As intel, motorola or any other machine language means zip to me. I have viewed them using Hexedit.
|
||
| Top | |
||
| Headsex |
|
||
|
Lukeyson wrote: 23 00 01 00 c0 00 04
23 00 01 00 c4 00 04 23 00 01 00 c8 00 04 23 00 01 00 cc 00 04 23 00 01 00 d0 00 04 .. Your padding bytes here.. why not at least do 23 00 01 00 c0 00 06 23 00 01 00 c6 00 06 23 00 01 00 cc 00 06 Or get funky and do this 23 00 01 00 c0 00 11 and get all 17 bytes in a multipacket response... I dare assume you have to send it a 30 00 00 00 00 "send as fast as you can" multipacket message 
Or, start with 23 00 01 00 00 04 00 and loop every 0x400 bytes and read the entire pcm?
i suspect however... You need to be in mode 27 to read outside certain boundries.. |
||
| Top | |
||
| Headsex |
|
||
|
Hard_ware wrote: I am not sure if the files would appear any different to me. As intel, motorola or any other machine language means zip to me. I have viewed them using Hexedit.
A PHF, is a Packed Hex file.. Here is a example of a "16bit intel hex" file (a 32bit has more per line) :10001300AC12AD13AE10AF1112002F8E0E8F0F2244 :10000300E50B250DF509E50A350CF5081200132259 :03000000020023D8 :0C002300787FE4F6D8FD7581130200031D :10002F00EFF88DF0A4FFEDC5F0CEA42EFEEC88F016 :04003F00A42EFE22CB :00000001FF Now, if yuo open up the PHF file, you will notice that each line is delimited by the ":" char.. each line is in the phf has a header of 2 bytes, 32bytes data, and 2 bytes CRC.. Basically convert the hex file into ascii.. Because a Intel Hex file is basically Raw Ascii
Dont get Boring with hexedit. Think about it.... Once its converted from a packed hex file "phf" to a intel hex file... Open it in IDA Pro... Select processor ppc, and start dissasembling...
|
||
| Top | |
||
| Hard_ware |
|
||
|
I just downloaded IDA trial version. I have a program that I will PM you. See if it makes sense to you. Its written for .net .
|
||
| Top | |
||
| Lukeyson |
|
|||
|
That vin read is simply a capture of the messages the Diagnostics tool did. Blame them for me writing it up as a bunch of 4-byte requests...!
Lukeyson |
|||
| Top | |
|||
| Headsex |
|
||
|
Lukeyson wrote: That vin read is simply a capture of the messages the Diagnostics tool did. Blame them for me writing it up as a bunch of 4-byte requests...!
Lukeyson lol which tool? |
||
| Top | |
||
| Lukeyson |
|
|||
|
WDS
Lukeyson |
|||
| Top | |
|||
| Headsex |
|
||
|
Lukeyson wrote: WDS
poor embedded programming
|
||
| Top | |
||
| Lukeyson |
|
|||
|
Doesn't it stand for 'Won't Do s**t' ?
Lukeyson |
|||
| Top | |
|||
| Lukeyson |
|
|||
|
Bloody thing.
I've just tried to upload this thing as an attchment 3 times - must be too big. (7M) So here's the link, and it's live for as long as the host lets it be live. It's a pdf describing Ford FMP software from buying, downloading, installing and using. http://www.bsecorp.com/files/techtips/F ... 050118.pdf Lukeyson |
|||
| Top | |
|||
| Lukeyson |
|
|||
|
Just found the queries for identifying the PCM version loaded into flash.
Once again, on an elm, set headers on (ath1) and set header address to the PCM (7e0). Then issue the query to get the model type: 23 00 01 00 54 00 04 My response was: 07 e8 05 63 33 52 37 33 00 00 Or 33 52 37 33 = 3R73 Version query is: 23 00 01 00 58 00 04 My Response 07 e8 05 63 42 46 20 2a 00 00 Now, I don;t know about the 20 and 2a, but the first two characters are BF - which is what I have, a 3R73-12A650-BF PCM Flash mapping (SX Territory AWD) There is also another set of data just before all this, which is of the form: 23 00 01 00 46 00 04 23 00 01 00 4a 00 03 This returns: 07 e8 05 63 48 41 41 50 00 00 07 e8 04 63 41 42 32 00 00 00 Which using the same ASCII conversion comes out to HAAPAB2. It just so happens that the filename from that spreadsheet for my PCM Flash is HAAPAB2.... Lukeyson |
|||
| Top | |
|||
| Lukeyson |
|
|||
|
Lukeyson wrote: Bloody thing.
I've just tried to upload this thing as an attchment 3 times - must be too big. (7M) So here's the link, and it's live for as long as the host lets it be live. It's a pdf describing Ford FMP software from buying, downloading, installing and using. http://www.bsecorp.com/files/techtips/F ... 050118.pdf Lukeyson >Cough< Pay attention to the URL on pages >Cough< 24 to 28 and >Cough< the links on the bottom. Just try the URL..... Lukeyson |
|||
| Top | |
|||
| Headsex |
|
||||
|
Lukeyson wrote: Just found the queries for identifying the PCM version loaded into flash.
Once again, on an elm, set headers on (ath1) and set header address to the PCM (7e0). Then issue the query to get the model type: 23 00 01 00 54 00 04 My response was: 07 e8 05 63 33 52 37 33 00 00 Or 33 52 37 33 = 3R73 Version query is: 23 00 01 00 58 00 04 My Response 07 e8 05 63 42 46 20 2a 00 00 Now, I don;t know about the 20 and 2a, but the first two characters are BF - which is what I have, a 3R73-12A650-BF PCM Flash mapping (SX Territory AWD) There is also another set of data just before all this, which is of the form: 23 00 01 00 46 00 04 23 00 01 00 4a 00 03 This returns: 07 e8 05 63 48 41 41 50 00 00 07 e8 04 63 41 42 32 00 00 00 Which using the same ASCII conversion comes out to HAAPAB2. It just so happens that the filename from that spreadsheet for my PCM Flash is HAAPAB2.... Lukeyson Borrrrrrrrrrinnnnnnnng.. It would be easier if i attached this screenshot of the "VID block"
Left column is the Hex address.. Add 0x10000 to them.., ie 0xC0 + 0x10000 = 0x100C0 = Start of VIN 0x10046 = start of filename 0x100C0 = Vin After the vid block there is various encoded bytes which represent speed limitor, axle ratio, axle type.. etc.. 0x101C0 = Strategy 0x101D0 = Guy who released it for production (i believe) ps.. thats not really my vin number
|
||||
| Top | |
||||
| data_mine |
|
|||
|
Looks very similar to what I was playing with from EL ECU dumps.
_________________ 1998 DL LTD in Sparkling Burgundy, daily, 302W, stereo, slow |
|||
| Top | |
|||
| Lukeyson |
|
|||
|
Headsex wrote: ps.. thats not really my vin number
Or your XR6 Turbo then obviously. Pity. Come on mate. You can't go on about 'bytes with axle ratio, speed limiter' etc and not tell us which bytes they are and what they mean right? (Poke poke prod prod....  )
Lukeyson |
|||
| Top | |
|||
| Who is online |
|---|
Users browsing this forum: No registered users and 10 guests |
