VZClusterMod - Public beta

194231 Views 990 Replies 185 Participants Last post by Sturdy, 11 d ago

1337vending

Discussion Starter · May 10, 2013 (Edited)

So I've been working on a program to update the cluster with all the fun new information we've discovered over in the original cluster-hacking thread. After some hours of R&D on what's in the memory we can now:

Turn on the shift light, change shift RPMs
Set custom shutdown text with the HSV logo
Change logos
Turn off the DRL light, and/or the DRLs
Dim the MPH light on 04 clusters
Fix the speedometer error on 04 clusters
Enable the current gear indicator
Recalibrate the temperature gauge

And a whole bunch of other stuff, and in the car too.
This is still beta software, but I've had a few beta testers try it out and had some success in-car. I'd like some feedback from 05-06 people to make sure nothing's different with the heartbeat stuff, so please post in this thread about your results.

I'm releasing vzclustermod under GPLv3, which means that everyone can look at and modify the source should they feel so inclined.

To get the software/documentation, go here:
http://1337vending.com/vzclustermod/

A word on cables:

I've tried this cable here on the bench and in the car: http://www.aldlcable.com/sc/details.asp?item=aldlobd2u
I've also tried the FTDI FT232RL usb to serial adapter for Arduino (found on ebay) on the bench and had good results. I haven't tried it in the car, because I have the good cable. People have reported success using FTDI FT232RL usb-serial adapters in-car, but I know some people have had problems with communication.
Update: If the cable does not explicitly specify ALDL or OBD1 it will not work! R&D at your own risk!

Build your own cable here! Thanks to Shane.

A word on 160°F thermostats:
If you are running a 160°F thermostat, you will need to set the cold shift RPM to whatever shift point you want for all gears! Since the cold shift light is active below 185°F (85°C), it will never look at the other settings. As of this post, no one has located where the temperature is stored in the cluster memory (pretty sure it's not in the eeprom), so we have no way to update it. :smurf:

A word on drivers:
If windows doesn't automatically detect your cable, you may need to go here to get the drivers for your FTDI FT232 cable:
http://www.ftdichip.com/Drivers/VCP.htm

There's a getting started doc on the site, but I'll post it here as well:

Getting Started

If you're using the windows binary, double click the vzclustermod-xxxbeta.exe, which should open a command window like so:

Since the program is all command line, the rest of the getting started will be text rather than screenshots.

To find out what COM ports are available, type listports Example:

Code:

[incar-cluster]$ listports
COM1
COM5
COM4

If you're not sure which COM port is your ALDL Cable, unplug it from the computer, run listports, and plug it back in and run listports again. Whichever one disappeared and reappeared is your cable.

Now open the port:

Code:

[incar-cluster]$ open com4
serial port opened successfully
[incar-cluster-com4]#

Note that the prompt changed from [incar-cluster]$ to [incar-cluster-com4]#

Turn the key on, but leave the engine off.

Now you're ready to work! If you're in the car, no need to change modes, if you're on the bench type bench. This will keep the program from listening for vehicle heartbeats.

To verify your cable is working, run listen and you should see something like this repeated over and over:

Code:

[incar-cluster-com4]# listen
==Heartbeat==
  Module:b8 Mode:A2 Data:B8
  Module:b9 Mode:02 Data:00,00
  Module:40 Mode:C6 Data:39,02
  Module:BCM-data Mode:12 Data:00,00,00,3D,19,00,00,70,F2,1E,00,00,10,00,00,00,94,00
  Module:a8 Mode:03 Data:
  Module:20 Mode:8B Data:
  Module:21 Mode:09 Data:38,2C,00,00,00,00,00,94,94
  Module:90 Mode:1B Data:
  Module:91 Mode:03 Data:18,00,00
  Module:a0 Mode:0B Data:
  Module:Airbag-data Mode:02 Data:08,00
  Module:Transmission-data Mode:07 Data:FF,10,40,05,00,00,00
  Module:b8 Mode:A2 Data:B8
  Module:b9 Mode:02 Data:00,00
  Module:40 Mode:C6 Data:39,02
  Module:BCM-data Mode:12 Data:00,00,00,3D,19,00,00,70,F2,1E,00,00,10,00,00,00,94,00
  Module:20 Mode:8B Data:
  Module:21 Mode:09 Data:38,2C,00,00,00,00,00,94,94

Press Ctrl+C to stop listening, it scrolls quite quickly.

To read table 9, run read 9. This is a stock 2004 table.

Code:

[incar-cluster-com4]# read 9
Waiting for heartbeat...
Send: ['F2', '57', '01', '09', 'AD']
['01', '09', '05', '00', '00', '00', '00', '00', '50', '79', '7C', '7E', '7E', '7E',
 '60', '80', '00', '00', '00', '00', '00', '00', '00', '00', '00', '00', '00']
ALDL Mode: 0x1 (read configuration table) Table: 0x9
Startup Logo: Pontiac
HSV Serial: 0
HSV Model: XU6
Cold shiftlight 4000 RPM
1st gear shiftlight 6000 RPM
2nd gear shiftlight 6200 RPM
3rd gear shiftlight 6300 RPM
4th gear shiftlight 6300 RPM
5th gear shiftlight 6300 RPM
Shift light on: False
Custom text:>            <

Note that the shift light is off, but the RPM values are set. 2005-2006 GTOs have the RPM values set to 9000.

I want my shiftlight on!!!1 ... Ok, now send preset shiftlight-on

Code:

[incar-cluster-com4]# preset shiftlight-on
===Current Config===
Send: ['F2', '57', '01', '09', 'AD']
['01', '09', '05', '00', '00', '00', '00', '00', '50', '79', '7C', '7E', '7E', '7E',
 '60', '80', '00', '00', '00', '00', '00', '00', '00', '00', '00', '00', '00']
Startup Logo: Pontiac
HSV Serial: 0
HSV Model: XU6
Cold shiftlight 4000 RPM
1st gear shiftlight 6000 RPM
2nd gear shiftlight 6200 RPM
3rd gear shiftlight 6300 RPM
4th gear shiftlight 6300 RPM
5th gear shiftlight 6300 RPM
Shift light on: False
Custom text:>            <
===New Config===
['01', '09', '05', '00', '00', '00', '00', '00', '50', '79', '7C', '7E', '7E', '7E',
 '60', '90', '00', '00', '00', '00', '00', '00', '00', '00', '00', '0 '00']
Startup Logo: Pontiac
HSV Serial: 0
HSV Model: XU6
Cold shiftlight 4000 RPM
1st gear shiftlight 6000 RPM
2nd gear shiftlight 6200 RPM
3rd gear shiftlight 6300 RPM
4th gear shiftlight 6300 RPM
5th gear shiftlight 6300 RPM
Shift light on: True
Custom text:>            <
===Write config===
Send: ['F2', '70', '28', '09', '05', '00', '00', '00', '00', '00', '50', '79', '7C', '7E', '7E', '7E',
'60', '90', '00', '00', '00', '00', '00', '00', '00', '00', '00', '00', '00', 'B9']
['28', '09', '01']

Easy.

Other useful presets are under the Presets documentation. For those averse to RTFM, here are some good presets:
mph-dim
drl-fulloff
custom-text=RTFM

I also want to thank the following people, because I certainly didn't figure this out all by myself:
DSMinVA for the original POC here on LS1GTO
Beerman and 06phantom for figuring out the security algorithm
Tazzi for explaining ALDL stuff and original cluster R&D
Stoopalini for the spreadsheet
Slow for eeprom dumps and the Tech 2 ALDL dumps
Chris White for showing that this is possible

And everyone who beta-tested stuff.:burnout:

Cheers. :gears:

See less See more

Save

981 - 991 of 991 Posts

Sturdy

· #981 · 23 d ago

slacker said:
You can change the lcd brightness, i did on mine.

Was that using the VZClusterMod (or similar tool) to write values back to the relevant table? Is that a different brightness level to the back light slider that's on the headlight switch? (you have that on the GTO right?)

As for my code fumblings, I have the VZAirbag tool compiled and working as before, so that's a good step. The ABS one there's no response trying to read the tables, but I've been doing a lot of reading and I think there's more trickery involved in talking to the ABS module.

I've posted in the existing ABS Reverse Engineering thread on here about it as there's a lot of relevant info in there.

As it looks like the comms may be more 'involved' for ABS messing, I'm getting closer to starting from scratch in C# as I'd be more comfortable implementing the comms in a way I have done from scratch so I know exactly what's happening etc.

I'll keep this thread relatively up to date

Save

Reactions: 1

slacker

· #982 · 23 d ago

Sturdy said:
Was that using the VZClusterMod (or similar tool) to write values back to the relevant table? Is that a different brightness level to the back light slider that's on the headlight switch? (you have that on the GTO right?)

As for my code fumblings, I have the VZAirbag tool compiled and working as before, so that's a good step. The ABS one there's no response trying to read the tables, but I've been doing a lot of reading and I think there's more trickery involved in talking to the ABS module.

I've posted in the existing ABS Reverse Engineering thread on here about it as there's a lot of relevant info in there.

As it looks like the comms may be more 'involved' for ABS messing, I'm getting closer to starting from scratch in C# as I'd be more comfortable implementing the comms in a way I have done from scratch so I know exactly what's happening etc.

I'll keep this thread relatively up to date

Yes i used the vz cluster mod, and its lower all the way around on the LCD screens, i turned the base brightness down on them. Went into god mode and started poking around with different settings other then what the preset stuff was. Yes the gto has a dimmer switch and it still dims the lcd screens. My daylight setting actually is the same as the full bright night.

Save

Reactions: 1

Phoenix

· #983 · 23 d ago

I'm posting what I have for Tunerpro regarding the cluster. I don't have a way or reading or writing to it, but maybe the addresses can help you with your program. Just remove the ".txt" from the file name after you download it.

Save

Reactions: 1

GotTogO

· #984 · 22 d ago

Would you be able to create "special" characters to display in the DIC?
I would love to have a middle finger next to the mileage for when I have to take a picture to verify it for the insurance company.

And, yeah, keep up the good work!

Save

slacker

· #985 · 22 d ago

GotTogO said:
Would you be able to create "special" characters to display in the DIC?
I would love to have a middle finger next to the mileage for when I have to take a picture to verify it for the insurance company.

And, yeah, keep up the good work!

Someone in Australia figured out how to do it if e remember reading something right on the interwebz. Where at i dont remember.

Save

GotTogO

· #986 · 22 d ago

Funny

Save

slacker

· #987 · 21 d ago

Oh i lost it when i seen pictures of what the edited on the screen, big ol veiny dong.

Save

GotTogO

· #988 · 21 d ago

Ok, I DON"T want one of those on the screen.

Save

Sturdy

· #989 · 21 d ago

Yeah I'm unlikely to get to that sort of progress, I have no experience at the hardware level, so am at best only going to be able to tinker with it within the parameters of what's already there.

At the moment I'm most curious about whether I can set it up to take over from the BCM, which effectively leads the communications I think, it sends out status request messages which trigger the various modules to broadcast their status.

Current plan is to investigate whether I can use the existing "mode 8" command (this is basically telling the BCM 'shutup, I'll take it from here') and then fire off the normal status request messages from my code and keep everything 'happy' initially.
If that does work, I can then in theory NOT request the status from a module (e.g. the ABS) and instead just broadcast the same ABS response from my code instead.
If that works, I can then broadcast an 'all OK' response from the ABS module in theory even if it's not connected.
For an 05-06 that would still need a couple of wires stuffed into the connector to keep the daisy chain going, but it's an interesting avenue I'd like to explore initially to see if I've understood things right from what I've researched

See less See more

Save

Reactions: 1

1337vending

Discussion Starter · #990 · 11 d ago

@Sturdy - yeah, all of this was in python2.7 so it'd have to get upgraded a decent bit to run on python3. Certainly some questionable design patterns in the code

If I remember correctly, no one was able to get a traffic dump of the TechII doing an ABS bleed procedure, otherwise I should have been able to implement it.

US GTO clusters are still pretty cheap with the red faces, around $100.

Save

Reactions: 1

Sturdy

· #991 · 11 d ago

1337vending said:
@Sturdy - yeah, all of this was in python2.7 so it'd have to get upgraded a decent bit to run on python3. Certainly some questionable design patterns in the code

If I remember correctly, no one was able to get a traffic dump of the TechII doing an ABS bleed procedure, otherwise I should have been able to implement it.

US GTO clusters are still pretty cheap with the red faces, around $100.

Hey, great to hear from you!

Yeah I stumbled across yours and Tazzi's posts about it, but have also stumbled around finding a few other ALDL bits of info and some ABS related stuff from the various forums etc.

It looks like the difficulty is firstly the Tech2 sends that 0x92 message (and repeats it every so often) to keep the ABS module 'ready' for comms, then I think the confusion originally came because Mode 04 messages were expected, instead of all the weird Mode 6 frames Tazzi saw.

What is happening is after the initial handshaking, the Tech2 is actually writing a new program to the EBCM with those 06 commands, and then there would be Mode 4s to run that program. Basically there isn't a command on the EBCM to do the bleed, instead the Tech2 has to program the EBCM and then run it with Mode 4s for each part of the process.

It read to me as if Tazzi never actually got a read of this process being done in car, so I'd imagine the mode 6 stuff was perhaps just spammed out and without a sensible response the whole process fell down somewhere.

I don't have a Tech2 to hand to really test anything with but have been going through working out as much of the protocol as I can, at least in terms of at a high level. Happy to share what I've found if you're interested?

I got VZAirbag working (compiled with PyInstaller) in Python 3.11, there was a bit of messing about because .encode('Hex') doesn't work any more but once I understood what was going on it was actually possible to simplify things a bit and it made some sense to me.

To develop things further I felt I'd be better off starting from a clean slate in a language I know better as I think there'll be a lot of general serial comms watching to understand what's happening and so on. I haven't gone much further than that yet, but I think I have at least a bit of a feel for the ALDL comms which is an improvement from when I started!

See less See more

Save

981 - 991 of 991 Posts

VZClusterMod - Public beta

1337vending

Attachments

Sturdy

slacker

Phoenix

Attachments

GotTogO

slacker

GotTogO

slacker

GotTogO

Sturdy

1337vending

Sturdy

Top Contributors this Month