It's worthless without full systems integration is what I'm getting at. I understand that it's possible to run the motor on a stand or in a race vehicle but to the general public, where all the money is, it's got little value...
L5P L5P Tuning
- Thread starter Hambone
- Start date
Exactly.. Liability simply outweighs any profits by about 10,000 to 1...
Sure we could make GM stability control talk happily with an aftermarket ECU. Be cool addition for drag racers. But would I bet my a$$, or someones kids on it working exactly as GM designed, no freaking way. What is it most products say?
"For Off Road Race Use Only. Never To Be Used On Public Highways." There for multiple reasons.
But the other side of this, there is some really cool OEM stuff on the market today that can be manipulated or re-purposed for interesting uses. So understanding and re-writing parts of existing ECM's is just a natural progression. What's missing is the good old days of "look what I just found, pass it around" comradery.
Sure GM would love to keep everyone locked out. And I'll bet VW never expected some kids at WVU would stumble onto their hidden emissions "Defeat" coding well tucked away in Proprietary Software. Which tossed a big wrench in the old "manufacture knows best, nothing to see in here" legal strategy.
I say data dump what the experts have learned about these new OS's. Once it's out there, where everyone has access, sure gonna be hard to point fingers at any particular person.
Building the electronics for running the various engine systems is perhaps the biggest pain. Programming, well hell, that's not that big of a deal.
Map ECU connections to processor ports
Isolate JTAG ports on processor
Define data input -> data output mappings
Write simple sign of life program suite to test inputs/outputs
Write Crank/Cam sensor -> injector output program driven by pedal position sensor. (P-pump mentality, pressure and timing)
Add features from there.
Really not that big of a deal, but it does take time. Single programmer, dedicated effort, existing hardware, 3-6 months to P-pump milestone.
Map ECU connections to processor ports
Isolate JTAG ports on processor
Define data input -> data output mappings
Write simple sign of life program suite to test inputs/outputs
Write Crank/Cam sensor -> injector output program driven by pedal position sensor. (P-pump mentality, pressure and timing)
Add features from there.
Really not that big of a deal, but it does take time. Single programmer, dedicated effort, existing hardware, 3-6 months to P-pump milestone.
You could *possibly* re purpose exsisting flashable hardware and cut the work load down a considerable amount is what I’m saying.
I’m not a computer programmer so I could be totally off. It’s just a thought i have had for a while.
I’d the SC research deal is legit, it seems that is what they have done. But I don’t know that for sure. It’s just my uneducated opinion
There are two, actually three parts to the ECM software.
Bootloader- it has several functions, but in essence is the main application that kick starts the processor and allows communications, including the serial port, for tuning.
Tables- This is just a pile of data that is used to make decisions on what to output when. The format is fixed. Example: mm3 vs RPM timing table. This is where most "tuners" live.
Application program- This is the actual program using the above tables and input data to output control signals to the engine. The Bootloader starts and stops this application as needed. Only real programmers play here. It is possible to make meaningful changes, but without the original source, it can be painful. Simple things like changing master block offsets based on an input are reasonable. (DSP5) You are stuck with the data/table format for the most part.
For our ECMs, I believe the processor architecture is Open-PC based. A very mature real time architecture that I have worked on before. The development environment is a candy store of modules that allow fairly easy management of this very powerful processor.
Bootloader- it has several functions, but in essence is the main application that kick starts the processor and allows communications, including the serial port, for tuning.
Tables- This is just a pile of data that is used to make decisions on what to output when. The format is fixed. Example: mm3 vs RPM timing table. This is where most "tuners" live.
Application program- This is the actual program using the above tables and input data to output control signals to the engine. The Bootloader starts and stops this application as needed. Only real programmers play here. It is possible to make meaningful changes, but without the original source, it can be painful. Simple things like changing master block offsets based on an input are reasonable. (DSP5) You are stuck with the data/table format for the most part.
For our ECMs, I believe the processor architecture is Open-PC based. A very mature real time architecture that I have worked on before. The development environment is a candy store of modules that allow fairly easy management of this very powerful processor.
Finding the nerds isn't the problem. I've spoken in depth with a couple of em, who are behind much of what we use today, about this same approach. Without the original source code, and access to specific compiler GM used, writing a new OS for current hardware isn't feasible. Just to many man hours.
While I'll bet these source codes are available somewhere, best thing we have today is decent maps of the original compiled code. Just enough knowledge to let us make changes within limits of existing tables. I kinda think starting from scratch may be the best, fastest,, approach. It's been done successfully on a small scale for the gassers.
While I'll bet these source codes are available somewhere, best thing we have today is decent maps of the original compiled code. Just enough knowledge to let us make changes within limits of existing tables. I kinda think starting from scratch may be the best, fastest,, approach. It's been done successfully on a small scale for the gassers.
No, Writing an application for the hardware is NOT a big deal. Really have to stop this crap that what GM, or anyone has is some sort of magic secret sauce.
Making it street legal with all the EPA crap and such is a big deal. Because, as an off road only diesel application, I am hard pressed to come up with a viable business plan to justify the project.
Making it street legal with all the EPA crap and such is a big deal. Because, as an off road only diesel application, I am hard pressed to come up with a viable business plan to justify the project.
Hey guys, we're all on the same team here. GM and the EPA are the "enemies".
Let's work together, not tear each other apart.
Let's work together, not tear each other apart.
Overall, I have to agree with kidturbo, that writing a new OS from scratch to load into a street truck to replace GM's OS isn't feasible. It is possible. There is also the issue of loading the code onto the ECU. I have never heard publicly if the OS and calibration is digitally signed, and if so, even a custom basic OS wouldn't load without replacing the bootloader, which probably requires JTAG (if they didn't disable that too).
In terms of a basic OS to just run the engine, why not use a different ECU? I strongly suspect a LB7 or LLY ECU and FICM would physically run the L5P, though you might have to put a LB7 crank reluctor back on the front. This is probably the cheapest way to get an L5P running in a standalone race only application. But I don't think that is what people are asking for. They want the full integration of the factory OS, but remapped.
I think we are just waiting for someone to invest the time to figure out how to extract the stock OS from the L5P so we can start poking at that. But it appears much more difficult than previous ECUs, so the cost is higher. And we are right back into the cost/business/lawsuit discussion all over.
If anyone has any specific technical details on the L5P OS, bootloader, code signing, bus encryption, etc. I would love to hear it. Sometimes you don't have to break the encryption, you just have to find a flaw in the implementation to get access.
In terms of a basic OS to just run the engine, why not use a different ECU? I strongly suspect a LB7 or LLY ECU and FICM would physically run the L5P, though you might have to put a LB7 crank reluctor back on the front. This is probably the cheapest way to get an L5P running in a standalone race only application. But I don't think that is what people are asking for. They want the full integration of the factory OS, but remapped.
I think we are just waiting for someone to invest the time to figure out how to extract the stock OS from the L5P so we can start poking at that. But it appears much more difficult than previous ECUs, so the cost is higher. And we are right back into the cost/business/lawsuit discussion all over.
If anyone has any specific technical details on the L5P OS, bootloader, code signing, bus encryption, etc. I would love to hear it. Sometimes you don't have to break the encryption, you just have to find a flaw in the implementation to get access.
I think your question may be answered here:
https://forum.efilive.com/showthread.php?27554-2017-Duramax
Its a pretty good technical, in-depth discussion about the L5Ps ECM coding
GMC_2002_Dmax
The Still Master
Just a side note, the reason the LML never got a DSP5 custom OS from EFI-LIVE is because the RSA could not be broken and allow a custom OS to be programmed into the ecm.
The backend boot pin was also open on the LML and those of use with certain hardware/software can yank the bin out of the ecm.
The back and front door is locked up on the L5P.........there is also some people who claim the SHA-256 is not breakable, so I am not sure if it is or is not........but, it will not be easy due to the fact it uses a different HASH on each ECM/Build.
To my knowledge each segment, which is how GM builds the stock calibration to account for various differences in the final build for options, etc is also protected by protocols for each individual segment, further complicating the process.
So whatever effort is used to break even one ecm, will not even work on all the rest of the trucks an their ecms.
Now then, we will have an issue with GM TIS moving forward and getting a valid login to even flash any of these modules, its not as easy as just having a subscription anymore..........
GM has implemented some changes to TIS and has tightened up a lot of doors that used to be open...............they have closed, including a nasty single VIN USE Fee for each vehicle, that expires, that is if they authorize the flash to begin with from TIS.
Never say never, but at some point a cost outweighs the financial benefit.
If the signing keys can be changed then anyone can sign whatever they want for a flash, but the keys are not available.........and most likely cannot be reversed as I was told its a rolling key anyways............
The backend boot pin was also open on the LML and those of use with certain hardware/software can yank the bin out of the ecm.
The back and front door is locked up on the L5P.........there is also some people who claim the SHA-256 is not breakable, so I am not sure if it is or is not........but, it will not be easy due to the fact it uses a different HASH on each ECM/Build.
To my knowledge each segment, which is how GM builds the stock calibration to account for various differences in the final build for options, etc is also protected by protocols for each individual segment, further complicating the process.
So whatever effort is used to break even one ecm, will not even work on all the rest of the trucks an their ecms.
Now then, we will have an issue with GM TIS moving forward and getting a valid login to even flash any of these modules, its not as easy as just having a subscription anymore..........
GM has implemented some changes to TIS and has tightened up a lot of doors that used to be open...............they have closed, including a nasty single VIN USE Fee for each vehicle, that expires, that is if they authorize the flash to begin with from TIS.
Never say never, but at some point a cost outweighs the financial benefit.
If the signing keys can be changed then anyone can sign whatever they want for a flash, but the keys are not available.........and most likely cannot be reversed as I was told its a rolling key anyways............
At some point the cost will outweigh the demand... how many L5P's will want tuning? a few thousand? How much will someone pay? $1,500.00 would be the max id personally pay... Do you guys see "cheaper" price points?
I don't think it's just the cost. I think the risk is what's holding many back. Invest millions to get sued.