GM ALDL Logging and Scanning

[TazzI]

Yeah not "100%" wiped, but it set is back to factory settings. Meaning, fresh off the production line. Doesnt reset the odo though. Nothing wipes that unless manually changing it or over aldl with the right knowledge.

Been doing some logging of the SRS module and BCM modules fault codes.
SRS faults found:

Code: Select all

161 HISTORY: CONFIGURATION MISMATCH TO INSTRUMENT
163 HISTORY: SDM Internal Fault

133 HISTORY: LEFT PERIPHERAL ACCELERATION SENSOR IDENTIFICATION FAULT
134 HISTORY: RIGHT PERIPHERAL ACCELERATION SENSOR IDENTIFICATION FAULT
135 HISTORY: LEFT PERIPHERAL ACCELERATION SENSOR HARDWARE FAULT
136 HISTORY: RIGHT PERIPHERAL ACCELERATION SENSOR HARDWARE FAULT
129 HISTORY: LEFT PERIPHERAL ACCELERATION SENSOR LINE FAULT
130 HISTORY: RIGHT PERIPHERAL ACCELERATION SENSOR LINE FAULT
131 HISTORY: LEFT PERIPHERAL ACCELERATION SENSOR COMMUNICATION FAULT
132 HISTORY: RIGHT PERIPHERAL ACCELERATION  SENSOR COMMUNICATION FAULT

97 HISTORY: RIGHT HAND SIDE AIRBAG CIRCUIT SHORT TO BATTERY
98 HISTORY: RIGHT HAND SIDE AIRBAG CIRCUIT SHORT TO GROUND
99 HISTORY: RIGHT HAND SIDE AIRBAG CIRCUIT CAPACITANCE TOO HIGH
100 HISTORY: RIGHT HAND SIDE AIRBAG CIRCUIT CAPACITANCE TOO LOW
101 HISTORY: RIGHT HAND SIDE AIRBAG CIRCUIT RESISTANCE TOO HIGH
102 HISTORY: RIGHT HAND SIDE AIRBAG CIRCUIT RESISTANCE TOO LOW
247 HISTORY: RIGHT SIDE AIRBAG CIRCUIT POWER STAGE ERROR

81 HISTORY: LEFT HAND SIDE AIRBAG CIRCUIT SHORT TO BATTERY
82 HISTORY: LEFT HAND SIDE AIRBAG CIRCUIT SHORT TO GROUND
83 HISTORY: LEFT HAND SIDE AIRBAG CIRCUIT CAPACITANCE TOO HIGH
84 HISTORY: LEFT HAND SIDE AIRBAG CIRCUIT CAPACITANCE TOO LOW
85 HISTORY: LEFT HAND SIDE AIRBAG CIRCUIT RESISTANCE TOO HIGH
86 HISTORY: LEFT HAND SIDE AIRBAG CIRCUIT RESISTANCE TOO LOW
247 HISTORY: LEFT HAND SIDE AIRBAG CIRCUIT POWER STAGE ERROR

65 HISTORY: RIGHT HAND PRETENSIONER CIRCUIT SHORT TO BATTERY
66 HISTORY: RIGHT HAND PRETENSIONER CIRCUIT SHORT TO GROUND
67 HISTORY: RIGHT HAND PRETENSIONER CIRCUIT CAPACITANCE TOO HIGH
68 HISTORY: RIGHT HAND PRETENSIONER CIRCUIT CAPACITANCE TOO LOW
69 HISTORY: RIGHT HAND PRETENSIONER CIRCUIT RESISTANCE TOO HIGH
70 HISTORY: RIGHT HAND PRETENSIONER CIRCUIT RESISTANCE TOO LOW
247 HISTORY: RIGHT HAND BELT PRETENSIONER CIRCUIT POWER STAGE ERROR

49 HISTORY: LEFT HAND PRETENSIONER CIRCUIT SHORT TO BATTERY
50 HISTORY: LEFT HAND PRETENSIONER CIRCUIT SHORT TO GROUND
51 HISTORY: LEFT HAND PRETENSIONER CIRCUIT CAPACITANCE TOO HIGH
52 HISTORY: LEFT HAND PRETENSIONER CIRCUIT CAPACITANCE TOO LOW
53 HISTORY: LEFT HAND PRETENSIONER CIRCUIT RESISTANCE TOO HIGH
54 HISTORY: LEFT HAND PRETENSIONER CIRCUIT RESISTANCE TOO LOW
247 HISTORY: LEFT HAND BELT PRETENSIONER CIRCUIT POWER STAGE ERROR

33 HISTORY: PASSENGER AIRBAG CIRCUIT SHORT TO BATTERY
34 HISTORY: PASSENGER AIRBAG CIRCUIT SHORT TO GROUND
35 HISTORY: PASSENGER AIRBAG CIRCUIT CAPACITANCE TOO HIGH
36 HISTORY: PASSENGER AIRBAG CIRCUIT CAPACITANCE TOO LOW
37 HISTORY: PASSENGER AIRBAG CIRCUIT RESISTANCE TOO HIGH
38 HISTORY: PASSENGER AIRBAG CIRCUIT RESISTANCE TOO LOW
247 HISTORY: PASSENGER AIRBAG CIRCUIT POWER STAGE ERROR

17 HISTORY: DRIVER AIRBAG CIRCUIT SHORT TO BATTERY
18 HISTORY: DRIVER AIRBAG CIRCUIT SHORT TO GROUND
19 HISTORY: DRIVER AIRBAG CIRCUIT CAPACITANCE TOO HIGH
20 HISTORY: DRIVER AIRBAG CIRCUIT CAPACITANCE TOO LOW
21 HISTORY: DRIVER AIRBAG CIRCUIT RESISTANCE TOO HIGH
22 HISTORY: DRIVER AIRBAG CIRCUIT RESISTANCE TOO LOW
247 HISTORY: DRIVER AIRBAG CIRCUIT POWER STAGE ERROR

BCM faults found:

Code: Select all

DTC#1 HISTORY: OutPut OverLoad
DTC#28 HISTORY : Antenna Drive Circuit Overload
DTC#18 HISTORY : Auxiliary Serial Data Bus Fault

DTC#17 Current: Not Okay to Start, Received from PCM
DTC#24 Current:Key Rolling Code Error
DTC#25 Current:Engine Start without Slip ring Communication
DTC#7 Current: PCM Data Lost
DTC#26 Current: ABS Data Lost
DTC#27 Current: Instrument Data Lost

DTC#22 Current: Battery Voltage too High
DTC#21 Current: Battery Voltage Too Low
DTC#23 Current: Door Lock/Unlock circuit Overload
DTC#5 Current: Rear Lamp Bulb Fail
DTC#6 Current: Rear Break Bulb Fail
DTC#29 Current: Stoplamp or Parklamp Fuse Failure

DTC#1 Current: Output Overload
DTC#28 Current: Antenna Drive Circuit Overload
DTC#17 Current: Not Okay to Start, Received from PCM
DTC#18 Current: Auxiliary Serial Data Bus Fault
DTC#19 Current:  EEPROM Error
DTC#20 Current:  RAM Error


The BCM fault codes were a bit weird, since they also had "times occurred" and "ignition cycles" which was hard to work out what went with what?
And also thought there would be more fault codes in the bcm, but looks like it more revolves around whether it is receiving data from the modules.


Also found Alarm codes:

Code: Select all

Bonnet Alarm   Triggered
Rear Compartment Alarm   Triggered
Passenger’s Door Alarm      Triggered
Driver’s Door Alarm   Triggered
Ignition Alarm      Triggered

Bonnet Alarm   History
Rear Compartment Alarm   History
Passenger’s Door Alarm      History
Driver’s Door Alarm   History
Ignition Alarm      History


I actually had each of these triggered in my car, so either its had a rough history or dodgy connections.

[shifte]

As for the calculating the security/cluster unlocking code, I have almost got it sussed. So the 1st Byte response works out to be the inverse of the 2nd Byte recieved plus BD hex ( 189 Decimal) and the 2nd Byte Response is the inverse of the 1st Byte received plus 86 hex (134 Decimal).
i.e. Recieved 92, 97

I have also got the AAPL decompiled source code in VB6 however to open in VB2012 I need VB2008 to convert it which I don't have handy at the moment so the files are of little use yet.

[TazzI]

As for the calculating the security/cluster unlocking code, I have almost got it sussed. So the 1st Byte response works out to be the inverse of the 2nd Byte recieved plus BD hex ( 189 Decimal) and the 2nd Byte Response is the inverse of the 1st Byte received plus 86 hex (134 Decimal).
i.e. Recieved 92, 97

I have also got the AAPL decompiled source code in VB6 however to open in VB2012 I need VB2008 to convert it which I don't have handy at the moment so the files are of little use yet.

Already been down that path..
Source code will not run no matter what you open it in. Its old software, Using old vb. Most vb decompiled "source" code simply provides an idea of how the program runs.. its not an actual copy, and doesnt work either

[shifte]

Hi All, So I've figured out the slight error in calculating the security code mentioned above. The formula is (BE86-(Byte 2 & Byte1)). For example 9792 = 38802Dec & BE86 = 48774Dec therefore 48774-38802=9972 which equals 26F4 in hex. So to put this into picture:
Sending frame F2571100A6 and getting a response of F2581192977C you would then do the above maths and send
F259110126F489 (updating the checksum accordingly). The cluster would then send F2581126F48B confirming the unlock was successful.

Next challenge = Retrieving the bin over aldl... I've heard we need to use mode 22 for read access but haven't tried it yet.

ShiftE

[TazzI]

Been doing a bit of work on the abs module lately when the tech2 has decided it wants to work again.

Gave a go at logging the ABS bleed procedure.
It requests a few tables and status before hand:
First requests from the tech2 are: F9,57,01,00,AF
And F9,57,01,04,AB
And also: 92,55,19
Which gave a response back of: 93,5E,08,02,FF,04,02,02,02,02,00,chksum

When entering the abs bleed procedure, it runs the through a series of steps an requirements that must be completed prior to performing the bleed (usual bleed stuff).

After doing that and clicking continue once ready, it fires off whole heap of info:

Code: Select all

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 17 20 40 28 A4 E0 A3 01 A2 20 1C A3 01 AC 20 1E A2 1D 00 00 E1 50 00 02 DF 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 25 10 00 00 12 00 00 30 00 10 00 00 00 00 00 E2 A8

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 01 00 A0 20 E0 F0 A3 01 A2 20 1C A3 01 AC 20 1E 22 20 08 05 58 00 11 89 FA 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 01 20 00 00 00 00 08 16 00 00 40 20 0C 00 00 10 00

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 03 20 80 08 F0 E0 A3 01 A2 20 1C A3 01 AC 20 1E A2 1D 08 02 79 A1 03 12 FA F7 44 06 49 E9 5D 1F 21 21 24 59 24 49 4D 92 52 AE 50 52 10 20 81 00 00 18 20 00 02 04 10 00 00 00 00

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 17 20 40 28 A0 D0 A3 01 A2 20 1C A3 01 AC 20 1E A2 1D 00 40 2A F0 20 40 BC 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 25 11 00 08 00 10 00 A0 04 22 20 00 00 E8 00 00 10

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 07 20 80 28 C4 F0 A3 01 A2 20 1C A3 01 AC 20 1E A2 1D 00 80 E1 40 00 02 DF 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 25 10 00 00 12 00 00 00 70 18 00 10 00 00 00 00 00

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 17 00 40 40 A8 C0 A3 01 A2 20 1C A3 01 AC 20 1E A2 1D 00 40 2A F0 20 40 BC 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 25 11 00 14 01 00 00 20 88 00 C1 11 01 02 80 04 04

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 17 40 40 40 50 C0 A3 01 A2 20 1C A3 01 AC 20 1E A2 1D 00 00 CA B8 04 22 DF 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 25 80 00 00 12 20 00 80 04 00 00 00 00 00 00 00 E2

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 17 00 40 40 A8 C0 A3 01 A2 20 1C A3 01 AC 20 1E A2 1D 00 41 94 78 00 40 BE 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 25 B1 00 41 01 00 00 20 00 00 60 A0 00 00 00 04 08

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 07 20 A0 00 C8 F0 A3 01 A2 20 1C A3 01 AC 20 1E A2 01 00 00 F2 30 20 44 DF 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 01 00 00 00 00 00 48 89 00 30 20 40 00 00 04 08 08

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 17 40 20 28 68 F0 A3 01 A2 20 1C A3 01 AC 20 1E A2 01 00 00 CC 60 48 88 7D 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 25 40 00 10 00 00 00 28 44 00 00 40 38 2C 00 00 00

F9 D8 06 04 00 01 00 00 12 06 00 6B 01 A6 20 78 D1 01 F0 05 7A D6 21 95 02 36 A3 01 9C 20 2A A2 2B 7C A2 2B 7E A2 2B 7A 09 01 7A B1 04 28 B2 2B 20 28 1E E0 28 F8 07 40 A0 7C 78 04 7E 7C B1 30 20 AD 14 28 28 0B 99 08 29 DF 05 17 00 80 00 20 F0 A3 01 A2 20 1C A3 01 AC 20 1E A2 1D 40 00 E4 50 00 04 DF 1F 94 20 22 D7 F1 08 0A 22 64 1E 22 A2 22 22 71 07 25 21 02 08 10 00 20 00 12 40 40 00 08 07 09 00 20

After several retries with multiple loggers, I still get the same rubbish, although its slightly different.
I suspect its actually ment to be a mode 4 (manual control), which would be increment a single byte to manual configure the values and such.

But to why im not able to log this...Im guessing its something to do with the bench setup.. somethings off somewhere.

I noticed when first entering the abs/tc section when it brings up the modules information, it sends off a few of the "rubbish" lines, so will plug it into the car and log what it is actually sending.
Also saw it fire off a F9,59,04,00,FF,01,chksum. Thats sent also when looking at the general information of the module.

[TazzI]

Some more fiddling with the PCM/Engine side of things with the tech2. I thought the tech2 would have had some "program" features for the pcm such as changing the VIN, although didnt find anything!.
Im sure I saw that somewhere in the tool.. could be wrong.

But I grabbed a whole heap of mode4 frames which allow manual control of various parameter eg RPM, EGR ect.

Code: Select all

-IAC System
       -RPM Control
  “Clicking increase!”
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C3 5E 00 00 00 00 00 00 00 00 78
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C3 62 00 00 00 00 00 00 00 00 74
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C3 64 00 00 00 00 00 00 00 00 72
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C3 66 00 00 00 00 00 00 00 00 70
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C3 68 00 00 00 00 00 00 00 00 6E
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C3 6A 00 00 00 00 00 00 00 00 6C
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C3 70 00 00 00 00 00 00 00 00 66
When Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

       -IAC Control
Clicking increase
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C1 64 00 00 00 00 00 00 00 00 74
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C1 7D 00 00 00 00 00 00 00 00 5B
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C1 96 00 00 00 00 00 00 00 00 42
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C1 AF 00 00 00 00 00 00 00 00 29
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C1 C8 00 00 00 00 00 00 00 00 10
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C1 E1 00 00 00 00 00 00 00 00 F7
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C1 FA 00 00 00 00 00 00 00 00 DE
When Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

       -IAC Reset
Click reset
From Tech2: F7 6C 04 00 00 00 00 10 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 C9
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

       -Base Idle
Request to hold 2000rpms then click continue:
From Tech2: F7 6C 04 24 00 00 00 04 00 00 00 00 00 00 00 C5 00 8C 00 00 00 00 00 00 00 20

then Requests to adjust TPS back to desired idle
When exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

-EGR Control
Click increase
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 13 00 00 00 00 00 06
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 26 00 00 00 00 00 F3
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 39 00 00 00 00 00 E0
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 4C 00 00 00 00 00 CD
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 5F 00 00 00 00 00 BA
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 72 00 00 00 00 00 A7
When Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9
 
-Reset Cells
From Tech2: F7 6C 04 00 00 00 00 08 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D1
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

-Bypass Spark
Spark mode is on Bypass…
Clicking EST
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

Clicking Bypass
From Tech2: F7 6C 04 00 00 00 00 04 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D5


-Air Fuel Ratio
Currently on 14.7 : 1
Clicking increase:
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C4 00 98 00 00 00 00 00 00 00 3D
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C4 00 9D 00 00 00 00 00 00 00 38
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C4 00 A2 00 00 00 00 00 00 00 33
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C4 00 A7 00 00 00 00 00 00 00 2E
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C4 00 AC 00 00 00 00 00 00 00 29
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C4 00 B1 00 00 00 00 00 00 00 24
When Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9


-Output Tests
     -Fuel Pump
Turn On: From Tech2: F7 6C 04 40 40 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 59
Turn Off: From Tech2: F7 6C 04 40 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 99
Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

     -A/C Clutch
Turn On: From Tech2: F7 6C 04 20 20 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 99
Turn Off: From Tech2: F7 6C 04 20 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 B9
Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

     -Check powertrain Lamp
Turn On: From Tech2: F7 6C 04 10 10 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 B9
Turn Off: From Tech2: F7 6C 04 10 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 C9
Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

     -High Fan
Turn On: From Tech2: F7 6C 04 04 04 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D1
Turn Off: From Tech2: F7 6C 04 04 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D5
Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

 
   -Canister Purge
Turn On: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 08 FF 00 00 C0 00 00 00 00 00 00 00 00 00 D2
Turn Off: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 08 00 00 00 C0 00 00 00 00 00 00 00 00 00 D1
Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

     -Starter Relay
Turn On: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 02 00 D7
Turn Off: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 02 02 D5
Exiting: From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9


Clicking On Function Tests
-IAC Circuit
Informs user engine must be hot! Cant be cold! (roughly 80degs)
“IAC Will Be Cycled Automatically. Do Not Move the Throttle!”
From Tech2: F7 6C 04 04 04 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D1
From Tech2: F7 6C 04 04 04 00 00 00 00 00 00 00 00 00 00 C1 D5 00 00 00 00 00 00 00 00 FB
From Tech2: F7 6C 04 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D9

-02 Sensor (Need closed loop to perform this.. will come back)

-Power Balance
“Injectors will be turned off Sequentially”
(Does a whole heap of frames turning each injector on and off and checks change in rpm)

-Low Fan
Turn Low speed fan request:
On: From Tech2: F7 6C 04 08 08 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 C9
Off: From Tech2: F7 6C 04 08 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D1
Exiting: From Tech2: F7 6C 04 08 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 D1

[Micks]

Guys been reading through posts on adjusting & modding settings on the VY-VZ.
Made some progress using the OSE tool in setting start up symbols & shutdown text on both my Crewman SS & Maloo clusters. Previously sent my SS cluster to a fellow on another forum who made some adjustments for fuel cal & shutdown text, redline etc. Though later found a heap of other settings that were previously fine were now messed up! The SS was a manual though changed to an auto now always showing the P symbol constantly that with intermittant service intervals too. Have used Stoops XL spreadsheet for changing settings like the cold redline shiftup feature. Very keen to do some more with these VZ clusters.

[vpgts076]

What Can I say appart from you guys ROCK.

I have been starting out with these clusters.......

Just a Tip if you unlock the cluster then use the AAPL software it opens way more doors....

Can anybody point me in the right direction of downloading a complete bin via AlDl? PLEASE


thanks
Daniel

[Micks]

Been a while though with help of a friend have produced a spreadsheet similar to the "stoop" XL sheet getting around the net. So far it will change most desired settings including Fuel guage cal, Temp guage cal, PPK settings, SRS cal & fault reset. Manual/Auto , V6/V8.
Once complete & fully tested, will post up here for anyone to use freely.
Obviously you will need an aldl cable or arduino board etc along with the freeware OSE program which is very reliable.

[CommodoreNut]

Im not actually 100% sure on the pinout of the vy/vz clusters. They both differ and neither match up to the pinouts diagrams on carmodder. The vt.vx cluster pinouts do match though if you check the vt/vx specifications section, but looks like you sussed out the pins anyways, Least that one is working!

Iv grabbed a couple harness from vy/vz's and use those instead of the pins, so I only know the wiring colour pinout for the vy/vz.

Yeah looks like a typical response for the vt cluster. Could already see the kms in the responses eg.
F2, 67, 1, 2, 3, 16, 4, 0, 0, 0, 3F, 0, 0, 0, 0, 0, 92, 4, 77, 72, C9,
0x031604 = 202244kms

And also the part number: 92, 4, 77, 72 = 92047772
Not sure why they did they part number like that.

F2, 67, 1, 3, E1, 1, C5, FF, 0, 64, C, E, 18, 8C, 3, E8, 5, 32, 29, 0, 90,
Can also see the speedo cal in there (ppk) = 6284

And table 0 general has what is currently going on, such as which lights are on, engine status, gear status, voltage ect.

Those responses are the "generic" codes that can be obtained from the cluster. I think most main changes can be done there... I think? eg v6/v8,auto/manual, speedo, airbags ect.
But I find it better attacking the direct eeprom location for each parameter.
Try sending F2,57,11,00,chksum. That should send back a seed that you will need a key for.

Done a bit of work on the vt/vx clusters, be good to dig into them some more.

Hi Tazzi

Great work,
Im a newby to this cluster stuff.
I have many yearsexperiance with memcals and ecu flashing ( inc HP Tuners ) as well.

But playing with cluster, BCM's really interests me.

i have a working ALDL cable using OSE flash tool.
Also have a Tech 2 Scanner

Played around with http://757goat.org/gto_cluster/Worksheet.php

now want to get more involved

How can i read Cluster part number and k's through the OSE tool?

Also want to be able to read Air bag setup as well