T43 Dissasembly
Re: T43 Dissasembly
Address workbook has been updated to v1 in the first post.
Re: T43 Dissasembly
Attached mode 6 OBD diag doc variant 7 for MYD 2014 Camaro / CTS-V (Same as VF HSV)
- Attachments
-
- 14OBDG07 Transmission Diagnostics.pdf
- (591.3 KiB) Downloaded 93 times
Re: T43 Dissasembly
Any help with checksum calcs would be appreciated.
I'm just concentrating on the trans segment for now. I've found a few functions that sent me down a rabbit hole, however I'm yet to work out how the checksum is verified which would then tell me how it is calculated.
Side note, if you set the first byte after the 2nd checksum location to 1 in the trans segment, checksum verification is disabled as reported by efilive.
I'm just concentrating on the trans segment for now. I've found a few functions that sent me down a rabbit hole, however I'm yet to work out how the checksum is verified which would then tell me how it is calculated.
Side note, if you set the first byte after the 2nd checksum location to 1 in the trans segment, checksum verification is disabled as reported by efilive.
Re: T43 Dissasembly
universal patcher has the checksum calcs figured out for you already. see the t43 xml
Re: T43 Dissasembly
Thanks gm. This software continues to amaze me.
Re: T43 Dissasembly
Fuck UPatcher is the shiz dizzle!
Trans segment range: 1C0000 - 1FCB57
CS1 offset = 0x0
CS2 offset = 0x1c
CS length = 2 bytes
With both CS set to 0x0: Segment is CRC16. Result is byte swapped and written to CS2. Then entire segment is word summed (incl. the newly calc'd CS2), 2's compliment and written to CS1.
My next move is to give back to the UP team and define what I have so far into an xdf => xml for this OS. About 90% of the HP def with every table needed to get a good tune up and running.
Trans segment range: 1C0000 - 1FCB57
CS1 offset = 0x0
CS2 offset = 0x1c
CS length = 2 bytes
With both CS set to 0x0: Segment is CRC16. Result is byte swapped and written to CS2. Then entire segment is word summed (incl. the newly calc'd CS2), 2's compliment and written to CS1.
My next move is to give back to the UP team and define what I have so far into an xdf => xml for this OS. About 90% of the HP def with every table needed to get a good tune up and running.
Re: T43 Dissasembly
xdf uploaded. Corresponding hpt tune attached which you can use to cross reference if needed.
Edit: 31/12/23 xdf updated to v1
Removed universal patcher xml, awaiting information on xdf import for row major and minor stride settings.
Edit: 03/01/24 xdf updated to v2
Added checksum dll
Edit: 03/01/24
As per @antus, hold my beer
Edit: 03/01/24
Fixed up uuid. Please delete earlier copies of the xdf and dll
xdf is v3. dll is v0.1
Edit: 31/12/23 xdf updated to v1
Removed universal patcher xml, awaiting information on xdf import for row major and minor stride settings.
Edit: 03/01/24 xdf updated to v2
Added checksum dll
Edit: 03/01/24
As per @antus, hold my beer
Edit: 03/01/24
Fixed up uuid. Please delete earlier copies of the xdf and dll
xdf is v3. dll is v0.1
- Attachments
-
- v3 xdf changelog.txt
- (435 Bytes) Downloaded 67 times
-
- T43 OS 24264923.xdf
- (363.93 KiB) Downloaded 68 times
-
- T43_Trans_Segment_Checksum.dll
- (42 KiB) Downloaded 61 times
-
- Stock_24264923.bin
- (2 MiB) Downloaded 68 times
-
- Stock_24264923.hpt
- (1.34 MiB) Downloaded 66 times
Last edited by hjtrbo on Wed Jan 03, 2024 9:16 pm, edited 7 times in total.
Re: T43 Dissasembly
Making some great progress!! Fucking awesome work!hjtrbo wrote: ↑Thu Dec 28, 2023 12:05 pm Fuck UPatcher is the shiz dizzle!
Trans segment range: 1C0000 - 1FCB57
CS1 offset = 0x0
CS2 offset = 0x1c
CS length = 2 bytes
With both CS set to 0x0: Segment is CRC16. Result is byte swapped and written to CS2. Then entire segment is word summed (incl. the newly calc'd CS2), 2's compliment and written to CS1.
My next move is to give back to the UP team and define what I have so far into an xdf => xml for this OS. About 90% of the HP def with every table needed to get a good tune up and running.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Re: T43 Dissasembly
I built this handy little utility to help me. It speeds up analysis considerably. Pictures describe usage.
As is the case when one builds there own tools, the usual quirks and bugs apply. If anyone wants to improve on it, knock yourselves out. Send me back what you've done.
Parse data table out to array Convert hex array into a scaled table. 1D and 2D supported. Auto detect of table size by GM length bytes supported Parse out an assembly function to minimal text to simplify analysis
As is the case when one builds there own tools, the usual quirks and bugs apply. If anyone wants to improve on it, knock yourselves out. Send me back what you've done.
Parse data table out to array Convert hex array into a scaled table. 1D and 2D supported. Auto detect of table size by GM length bytes supported Parse out an assembly function to minimal text to simplify analysis
- Attachments
-
- T43 Ghidra Tools.zip
- (244.08 KiB) Downloaded 88 times
Re: T43 Dissasembly
[youtube][/youtube]
Last edited by hjtrbo on Wed Jan 03, 2024 6:33 pm, edited 2 times in total.