Although I am trying to work through the logistics of the format for mode $35. What I have so far is that it should be 35 00 xx xx yy yy yy. I do know that xx xx cannot be greater than $0480. I am not sure if the ELM is capable of this one though. This is what I have so far piecing together the code...

This is so I don't loose this site again . lots of good info, but the page indexed is for ECM pinouts.

http://www.saturnwiki.net/index.php/PCM_connectors

VL400 wrote:The mode 35 is used to upload routines and then execute them, can use it for uploading a bin dumper routine or a flash erase/write routine.

I thought mode 34 and 35 were from the modules perspective so 34 would send things to the module and 35 would get stuff back

well quick look through the code shows that there are things that it will do different if $200A = $DEAD in mode $27 (security access), $2C(define diagnostic data packet), $34(request download), $35(request upload), and $3F(test device present). Seems likely this is some sort of developer mode, or th...

That adds another key that is in the lower half of the range. Looks like you are moving right allong. I know with the GM ECM's they do the VIN and ECM ID number with Mode $3c requests (3c 01 for VIN first digit, etc). At least I know I have a companion in the creation of a seed/key finder.

I wanted to make sure I had the memory (especially the eeprom) mapped out before I started messing arround with things that might put it into a mode where it is looking for something and would wipe out the eeprom on me. Now that I have that... Here are the pertinate numbers from my eeprom section, e...

if you do not know the key (or the algorythim to calculate it) then you will not be able to do tuning through the OBD port. Most tuning software packages out there do have the algorythims so if you are using one you are already covered.

Hmm interesting. I made the two changes above and it worked, I can now make changes to the source code at will without it faulting out. What is interesting is that I then added a small snippet of program to try and read in the ram areas of memory from $0000 to $2000 whenever I would run the mode $27...

If nothing else yours is a whole lot more polished than the hatchet thing I threw together (I bet my EXE was smaler though )

Well now that I have my board together to make reflashing the memory easier, I satarted looking at the rom sanity check area for ways to easily disable it without totally blowing it out of the water. It looks to me like there are 2 (looks like the checksum at $200A may be the sections that are vehic...