99 Saturn crack log

[sabercatpuck]

This is bank 3, it resides on the flash from 18000 to 1ffff

[sabercatpuck]

By the way, these are some of the numbers on the IC's on the board just in case it helps:
185
16196452
e87j (this is the 68hc11F1)

18391m64
66285
delco 466

a8372y25
39194
delco 466

a8393p53
51862
delco 466

16132083
a 9832 736 (date code?)
m832316apa

flash
AN28f010 (the flash rom)

185
16185984
2e79n (68hc56fn, the dlc I/O device)

16132083
a 9833 736 (date code?)
m83309apa

18412r31
66285
delco 466

a8403m42
51862
delco

05799
t8383655
466

[sabercatpuck]

Well my agilent logicwave logic analyzers will hopefully show up tomorrow. Probably will take a bit to work the bugs out since they do not have cables (what can you expect for cheap ) but hopefully I can have them hooked up and reading by the end of the month. Then I should be able to start making heads and tails of the code. I think the biggest questionmark is really what do the tables mean (scaling etc) and what ends up in any given memory address. At some point I will have to figure out how to get the stuff out of the eeprom on the CPU as well.

[joecar]

Acquiring the Agilent is cool...

I acquired an old HP (before Agilent) and an old Tektronix (I asked my work if I could have them since they were being thrown out, and my work said yes)...

so now I need (for LS1):
- to get the card out of a spare PCM,
- a way to read the raw bin from it,
- a 68332 disassembler (preferably free).

[sabercatpuck]

Took a quick run arround the net and did not pull up a free dissasembler, IDA is supposed to be good for many processors, but it isn't free.

BTW I do think I have a way of getting the stuff off of the eeprom, once I have the logicwave's hooked up, I just write a small section of code that will set the appropriate register bits then pick a spot and read and write them on the databus, the logic analyzer will pick up the code just fine. Eventually I should be able to do it with just mode $27 stuff I would think, but my early attempts to make that work have been less than fruitfull. At least I have made it past getting the seed/key pair though.

[sabercatpuck]

Well I officially have the logic analyers up and working. Just need to make the connections and away I go.

[sabercatpuck]

Well for those of you playing the home game I have some info from logic analyzer world. The major enhanced mode entry points. This is all in the 3rd upper memory block.

10 $8F26
12 $8FE8
13 $9103
14 $91e2
17 $91F9
18 $946d
19 $964e
20 $98Ac
22 $98Dd
23 $991c
25 $9963
27 $9971
28 $99Fa
29 $9A44
2a $9A42
2b $9C28
2c $9C7c
31 $9DF6
32 $9DF6
33 $9DF6
34 $9E44
35 $9EA6
3b $A4B6
3c $A4B6
3f $A8Cd

The jump table that access these actually shows 4 digits lower, but when the indirect call is made it adds 4 to the address.

[Dust]

Have you gotten any further with this?

[sabercatpuck]

I have been off on honeydo projects for awhile. If things go relatively well this winter I am hoping to have a chance to go at it some more.

[N0DIH]

Any chance the honeydo projects have subsided?