'99 Saturn Dissassembly
-
- Posts: 67
- Joined: Thu Jan 14, 2010 1:03 am
- cars: 1999 Saturn SL1
2003 Monte Carlo
'99 Saturn Dissassembly
This is the bin files for the '99 Saturn DOHC Auto box I am working on. By the way do not try flashing these directly to the eeprom and then put them in cause they wont work as they are in these files. The Saturn engineers did something clever and swapped 4 pairs of address lines so that when you unsolder the flash and put it in the eeprom burner to read it it comes out garbage, but the system doesn't care so long as the lines are correct. These were done after making a modified carrier to unscramble the lines before the willem programmer.
- Attachments
-
- saturnBIN.zip
- 99 Saturn DOHC BIN file
- (101.33 KiB) Downloaded 626 times
Last edited by sabercatpuck on Thu Jan 14, 2010 3:51 pm, edited 1 time in total.
-
- Posts: 67
- Joined: Thu Jan 14, 2010 1:03 am
- cars: 1999 Saturn SL1
2003 Monte Carlo
Re: GNU assembler for HC11
This is the dissasembly for the flash (quadrents 1+2), note still very raw so no comments and I still need to figure out what is happening in the ram for good annotations (waiting on cables for the logic analyzer). Again the code in the area of $5666 is where the page switching is happening.
- Attachments
-
- ESATURN3.zip
- Quadrent 3, physically located from $18000 to $1ffff
- (51.44 KiB) Downloaded 598 times
-
- ESATURN2.zip
- Quadrent 2, physically located from $10000 to $17fff
- (52.81 KiB) Downloaded 583 times
-
- ESATURN1.zip
- The first half of the flash disassembled (from $2000 to $ffff)
- (131.26 KiB) Downloaded 618 times
-
- Posts: 67
- Joined: Thu Jan 14, 2010 1:03 am
- cars: 1999 Saturn SL1
2003 Monte Carlo
Re: GNU assembler for HC11
And finally the tranny side of the ECM. It only uses the lower 64k so no page swapping needed.
- Attachments
-
- T99SATURN.zip
- Tranny dissasembly of 99 Saturn
- (113.23 KiB) Downloaded 583 times
- antus
- Site Admin
- Posts: 8258
- Joined: Sat Feb 28, 2009 8:34 pm
- cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B - Contact:
Re: '99 Saturn Dissassembly
Interesting stuff to read. It sounds like the bank switching mechanism works the same as the holden ecus here. Interesting that they swap the address pins. Ive not heard of that before on GM based vehicles, only the software seed/key challenges on some of the later ecus. Welcome to the forums, its always good to have more reverse engineers around
PS I split your topic in to a thread of its own to keep the 99 saturn info findable.
PS I split your topic in to a thread of its own to keep the 99 saturn info findable.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
-
- Posts: 67
- Joined: Thu Jan 14, 2010 1:03 am
- cars: 1999 Saturn SL1
2003 Monte Carlo
Re: '99 Saturn Dissassembly
In my opinion there is nothing more fun han reverse engineering something. You get to play detective, psycologist, and technician all at once. Gotta do something productive with that BSEET degree I am just waiting for a couple cables to get in for a couple of logicwave logic analyzers that I picked up off ebay and then I can start going to town with these things (well after I finish finishing the basement, wife project must come first i have mentioned the project to a few people and they think I am a nut, I figure I am just re-aquainting myself with my inner engineer. One other project I had recently was designing a method of getting the seed key pair out, very simple program for a really simple lock. All seemed to be going well on EFI live, forum mods egging me on etc, untill they started getting calls and all the sudden the whole thread was gone. Ohh well, luckily there were a few that directed me this way.
-
- Posts: 67
- Joined: Thu Jan 14, 2010 1:03 am
- cars: 1999 Saturn SL1
2003 Monte Carlo
Re: '99 Saturn Dissassembly
by the way specifically it was the A1-A13, A2-A12, A3-A11, and A10-A14 pairs that were swapped
-
- Posts: 67
- Joined: Thu Jan 14, 2010 1:03 am
- cars: 1999 Saturn SL1
2003 Monte Carlo
Re: '99 Saturn Dissassembly
ohh one more post script before I head to bed, I also snagged the SDM(airbag), ABS and RKE modules from the same junk yard car and eventually plan to get to them too. SDM might be a bit easier just because I know what processor it has, I have not been able to cross the one in the abs yet, but agin that is what the logic analyzer is for
- VL400
- Posts: 4991
- Joined: Sun Mar 01, 2009 2:54 pm
- cars: VL Calais and Toyota Landcruiser. Plus some toys :)
- Location: Perth, WA
- Contact:
Re: '99 Saturn Dissassembly
Welcome aboard, some great info you have posted so far. The seed/key stuff is just what I am looking at now actually
-
- Posts: 67
- Joined: Thu Jan 14, 2010 1:03 am
- cars: 1999 Saturn SL1
2003 Monte Carlo
Re: '99 Saturn Dissassembly
The really funny thing is that I don't have much of a clue about this stuff yet. I am only an OK mechanic, and have little to no experience knowing what a spark table looks like compared to a MAF table (or if they are even the same), I am sure I will pick that up as I go allong. What I am though is a real good electronics guy. I can mentally take something appart in my head and figure out what it is doing or why it isn't working (I think I irritate allot of the other ET's at work because of it though).
Oh well, my logic analyzer cables arrived today so hopefully I will be able to add some stuff to my knowledge base soon (64 channels of data and 4 clocks between the two of them, ohh yeah )
Oh well, my logic analyzer cables arrived today so hopefully I will be able to add some stuff to my knowledge base soon (64 channels of data and 4 clocks between the two of them, ohh yeah )
-
- Posts: 67
- Joined: Thu Jan 14, 2010 1:03 am
- cars: 1999 Saturn SL1
2003 Monte Carlo
Re: '99 Saturn Dissassembly
there is a 40 pin headder on the boards. Edited in pins 7 and 11 as going to the flash pins A15 and A16. A15 on pin 27 still goes directly to the A15 on the HC11. It goes as follows
Code: Select all
A4 1 2
A3 3 4 Ground
A2 5 6
Flash A15 7 8 A1
9 10 A0
Flash A16 11 12 A5
A6 13 14 A8
A7 15 16 A9
A10 17 18 D7
A11 19 20 D6
A12 21 22 D5
A13 23 24 D4
A14 24 25 D0
A15 27 28 D1
R/W 29 30 D2
Reset 31 32 D3
Moda/LIR 33 34 PD1/TXTD
PD1/RXD 35 36 E
ModB/Vstby 37 38 ground
XIRQ 39 40
Last edited by sabercatpuck on Sat Jan 16, 2010 1:18 am, edited 3 times in total.