|
| Lukeyson |
|
|||
|
I've just located a bunch of PCM Codes for the DSC enabled LPG I6 Falcon in the BFIII/FG range.
It appears that the internal code name for DSC enabled LPG is 'Wombat'. Luke |
|||
| Top | |
|||
| data_mine |
|
|||
|
wombat = unkillable ???
_________________ 1998 DL LTD in Sparkling Burgundy, daily, 302W, stereo, slow |
|||
| Top | |
|||
| Lukeyson |
|
|||
|
Ahh. Unkillable. For some reason when I first looked at it I thought you said Unlikeable....
Lukeyson |
|||
| Top | |
|||
| aumatt |
|
|||
|
Im still waiting for some wrecked FG's to turn up so I can start hacking some new stuff
_________________ 2004 Harvest Green XR6
|
|||
| Top | |
|||
| data_mine |
|
|||
|
Should be fun.
_________________ 1998 DL LTD in Sparkling Burgundy, daily, 302W, stereo, slow |
|||
| Top | |
|||
| sickd |
|
|||
|
s it possible to unlock a locked icc stereo, i sold my color screen unit and swapped it for a standard one, i removed and swapped them into the cars, and mine comes up with code, can it be removed with obd tool
car is a ba ute 2004
_________________ BA XR8 BOSS 260
|
|||
| Top | |
|||
| Lukeyson |
|
|||
|
In theory yes. In practice no. Ford use some sort of security algorithm that works like this:
OBD Tool requests a value in a Mode22 PID from ICC ICC responds with a value from that PID OBD Tool sends a custom high-mode message with a multibyte value (the 'unlock' message) The algorithm that converts the data from the PID into an 'unlock' message is what we don't yet know. Similar to the process used to 'unlock' a PCM for writing a custom tune. If you have a J2534 tool and a subscription to the FMP software mentioned a few times in this thread, then yes, you can unlock your own ICC. But since the cheapest J2534 that I know of is over $300, it would probably be cheaper for you to go to Ford and get them to do it for $50 or so. I've been able to do it a few times now with a J2534 tool. Luke |
|||
| Top | |
|||
| aumatt |
|
|||
|
It would be possible with the right amounts of reverse engineering
Matt
_________________ 2004 Harvest Green XR6
|
|||
| Top | |
|||
| sickd |
|
|||
|
bugga no worries thanks for the help i will go fraud and get them to
unlock it, one ford place told me 110 bucks, thats why i thought i trie this. thanks 
_________________ BA XR8 BOSS 260
|
|||
| Top | |
|||
| Lukeyson |
|
|||
|
Pity you're not near Newcastle....
Lukeyson |
|||
| Top | |
|||
| aumatt |
|
|||
|
Geez I really should get my new scan tool. Hurry up aussie dollar go back to 98c
Matt
_________________ 2004 Harvest Green XR6
|
|||
| Top | |
|||
| Lukeyson |
|
|||
|
Yeah, those were the days.
Lukeyson |
|||
| Top | |
|||
| wheee |
|
|||
|
Hey there.
I'm working on developing a custom ICC for my 2006 BF XR8 using some custom built hardware, and will be using the OBD-II connector to receive and display the status of the HVAC controls. While I am at it I thought I would see what else I could intercept through the broadcast messages that may be of interest to display on the screen. Here's what I've found in the last couple of hours (FYI- This is from a 2006 BF XR8 Auto MCC Prem Sound) Code: $3E9 AA BB ?? ?? ?? ?? CC DD AA seems to indicate the current status of the transmission Code: AA = 3F (Transmission Is Changing Between Any Of Gears 1-6) AA = 31 (1st Gear Engaged) AA = 32 (2nd Gear Engaged) AA = 33 (3rd Gear Engaged) AA = 34 (4th Gear Engaged) AA = 35 (5th Gear Engaged) AA = 36 (6th Gear Engaged) AA = 1F (Transmission Is Changing Into Reverse) AA = 1C (Reverse Engaged) AA = 20 (Neutral) AA = 00 (Park) BB seems to indicate the chosen shift mode (Adaptive/Performance) Code: BB = 00 (Adapative Shift) BB = 01 (Performance Shift - Automatic) BB = 06 (Performance Shift - Tiptronic Mode) CC seems to indicate the drivers currently selected gear Code: CC = 00 (Neutral/Park Selected) CC = 01 (1st Gear Selected) CC = 02 (2nd Gear Selected) CC = 03 (3rd Gear Selected) CC = 04 (4th Gear Selected) CC = 05 (5th Gear Selected) CC = 06 (6th Gear Selected) CC = 0C (Reverse Selected) AA & CC seem to be interrelated, while BB seems to be totally seperate. A typical drive seems to read like this: Code: AA = 3F CC = 01 : Transmission changing into 1st gear AA = 31 CC = 01 : Transmission in 1st gear AA = 3F CC = 02 : Transmission changing into 2nd gear AA = 32 CC = 02 : Transmission in 2nd gear AA = 3F CC = 03 : Transmission changing into 3rd gear AA = 33 CC = 03 : Transmission in 3rd gear AA = 3F CC = 04 : Transmission changing into 4th gear AA = 34 CC = 04 : Transmission in 4th gear AA = 3F CC = 05 : Transmission changing into 5th gear AA = 35 CC = 05 : Transmission in 5th gear AA = 3F CC = 06 : Transmission changing into 6th gear AA = 36 CC = 06 : Transmission in 6th gear AA = 3F CC = 05 : Transmission changing into 5th gear AA = 35 CC = 05 : Transmission in 5th gear There are a number of other values that come through for AA when the gear selector is pushed half-way between the different gears. I haven't worked out what these fully mean yet. For example when AA reads: FF : Started moving from reverse into park F0 : Holding gear selector between reverse and park (but not in either gear fully) FF : Started moving from drive into neutral F1 : Holding gear selector between drive and neutral (but not in either gear fully) FF : Started moving from reverse into neutral 2F : Holding gear selector between reverse and neutral (but not in either gear fully) Whenever AA reads any of these values the gear indicator on the dashboard goes blank. My best guess is that these values indicate the transmission is in transition between gears. The value DD I cannot work out either, but it seems to always be accompanied by a noticable rise/fall in the rear of the car- for example when changing between reverse and neutral. Code: 3E9 2F 00 68 82 00 00 00 B2 << SELECTOR MOVED FROM NEUTRAL TO REVERSE
3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 B2 3E9 2F 00 68 82 00 00 00 AF << DD BEGINS CHANGING ACCOMPANIED BY CHANGE IN HEIGHT OF REAR OF CAR 3E9 2F 00 68 82 00 00 00 AE 3E9 2F 00 68 82 00 00 00 AD 3E9 2F 00 68 82 00 00 00 AB 3E9 2F 00 68 82 00 00 00 AA 3E9 2F 00 68 82 00 00 00 A8 3E9 2F 00 68 82 00 00 00 A7 3E9 2F 00 68 82 00 00 00 A5 3E9 2F 00 68 82 00 00 00 A4 3E9 2F 00 68 82 00 00 00 A3 3E9 2F 00 68 82 00 00 00 A1 3E9 2F 00 68 82 00 00 00 9E 3E9 2F 00 68 82 00 00 00 9C 3E9 2F 00 68 82 00 00 00 9A 3E9 2F 00 68 82 00 00 00 98 3E9 2F 00 68 82 00 00 00 97 3E9 2F 00 68 82 00 00 00 94 3E9 2F 00 68 82 00 00 00 93 3E9 2F 00 68 82 00 00 00 90 3E9 2F 00 68 82 00 00 00 8E 3E9 2F 00 68 82 00 00 00 8C 3E9 2F 00 68 82 00 00 00 8A 3E9 2F 00 68 82 00 00 00 88 3E9 2F 00 68 82 00 00 00 88 3E9 2F 00 68 82 00 00 00 87 3E9 2F 00 68 82 00 00 00 85 3E9 2F 00 68 82 00 00 00 84 3E9 2F 00 68 82 00 00 00 83 3E9 2F 00 68 82 00 00 00 82 3E9 2F 00 68 82 00 00 00 81 3E9 2F 00 68 82 00 00 00 80 3E9 2F 00 68 82 00 00 00 7F 3E9 2F 00 68 82 00 00 00 7E 3E9 2F 00 68 82 00 00 00 7D 3E9 2F 00 68 82 00 00 00 7D 3E9 2F 00 68 82 00 00 00 7C 3E9 2F 00 68 82 00 00 00 7B 3E9 2F 00 68 82 00 00 00 7A 3E9 2F 00 68 82 00 00 00 79 3E9 2F 00 68 82 00 00 00 78 3E9 2F 00 68 82 00 00 00 78 3E9 2F 00 68 82 00 00 00 77 3E9 2F 00 68 82 00 00 00 76 3E9 2F 00 68 82 00 00 00 75 3E9 2F 00 68 82 00 00 00 75 3E9 2F 00 68 82 00 00 00 74 3E9 2F 00 68 82 00 00 00 72 3E9 2F 00 68 82 00 00 00 71 3E9 2F 00 68 82 00 00 00 71 3E9 2F 00 68 82 00 00 00 71 3E9 2F 00 68 82 00 00 00 70 3E9 2F 00 68 82 00 00 00 70 3E9 2F 00 68 82 00 00 00 6F 3E9 2F 00 68 82 00 00 00 6F 3E9 2F 00 68 82 00 00 00 6D 3E9 2F 00 68 82 00 00 00 6D 3E9 20 00 68 82 00 00 00 6C << REVERSE ENGAGED 3E9 20 00 68 82 00 00 00 6B 3E9 20 00 68 82 00 00 00 69 3E9 20 00 68 82 00 00 00 69 3E9 20 00 68 82 00 00 00 68 3E9 20 00 68 82 00 00 00 66 3E9 20 00 68 82 00 00 00 65 3E9 20 00 68 82 00 00 00 64 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 3E9 20 00 68 82 00 00 00 63 I'm not sure that this is of any use to anybody- but thought i'd put my 2 cents in. Must give a special thanks to Lukeyson, your posts have saved me considerable work deciphering the HVAC messages.
_________________ 2006 BF XR8 Ego - Pod Filter, Air Box, Twin Throttle Body, Yella Terra Plenum, Herrod Cams, Oil Pump & Gears, 25% Underdrive, Extractors, High Flow Cats, 3" DPE Exhaust, 3.9 Diff Gears, 245/40/18 Kuhmo KU36, Custom Tune @ HP-F. |
|||
| Top | |
|||
| aumatt |
|
|||
|
Some nice work, but im in no state to do any reversing as I can barely even type this, will probably read this again when i am actually sober. That might help.
Matt
_________________ 2004 Harvest Green XR6
|
|||
| Top | |
|||
| Lukeyson |
|
|||
|
Yikes. That's awesome. Back on page 20 of this thread I had access to an SY 6 Sp Terry and managed to determine that 3E9 was a ZF message, but didn't have the chance to do any more than that. The ZF has a separate ECU to control the transmissinon, as opposed to the 4A's which are controlled direct from the PCM. I have one car with a 5M and the other with a 4A so long-term analysis of ZF messages are off limits to me. Both cars have Blackoak PCM's as well, so the extra Spanish-Oak broadcasts messages are also a mystery to me.
0C9 seems to be a ZF message as well if you ever have the chance to look into that one. I suspect that the extra Spaish Oak messages are there so that the ZF can make intelligent shift decisions. The extra PCM messages I don't know anything about are 097, 0FC, 120, 12D, 44D, 4C0, and 650. I've done some analysis on the other PCM stuff - 200, 207, 230, 623, 640, 6F6, 6F8 - and have maybe 1/3 to 1/2 of it worked out. But some stuff will forever be beyond me, like the Smartshield messages in 6F6 and 6F8. Lukeyson |
|||
| Top | |
|||
| Who is online |
|---|
Users browsing this forum: No registered users and 0 guests |
