mon ECU ID : 32920-27GA
10    Start Diagnostic Session
11    ECU Reset
12    Read Freeze Frame Data
13    Read Diagnostic Trouble Codes
14    Clear Diagnostic Information
17    Read Status Of Diagnostic Trouble Codes
18    Read Diagnostic Trouble Codes By Status
1A    Read Ecu Id
20    Stop Diagnostic Session
21    Read Data By Local Id
22    Read Data By Common Id
23    Read Memory By Address
25    Stop Repeated Data Transmission
26    Set Data Rates
27    Security Access
2C    Dynamically Define Local Id
2E    Write Data By Common Id
2F    Input Output Control By Common Id
30    Input Output Control By Local Id
31    Start Routine By Local ID
32    Stop Routine By Local ID
33    Request Routine Results By Local Id
34    Request Download
35    Request Upload
36    Transfer data
37    Request transfer exit
38    Start Routine By Address
39    Stop Routine By Address
3A    Request Routine Results By Address
3B    Write Data By Local Id
3D    Write Memory By Address
3E    Tester Present
81 -> xx xx    Start Communication
82    Stop Communication
83    Access Timing Parameters
85    Start Programming Mode

I bolded the ones we've already seen with the SDS software.

I wonder if command 23 could be used to loop through all the addresses and read out the original program without needing to access the AUD port. 

Sensor : Command, Byte
TPS      : 08,20
IAP#1  : 08,21
Temp   : 08,22
IAT       : 08,23
O2S      : 08,26
IAP#2   : 08,28 


On command 21 Read by Local ID supports the following arguments

0x08 (returns 50 bytes)
0x80 (returns 100 bytes)
0x90 (returns 70 bytes)
0xC0 (returns 60 bytes)

0x40 (returns 16 bytes)
0x41 (returns 16 bytes)
0x42 (returns 16 bytes)
0x43 (returns 16 bytes)
0x44 (returns 16 bytes)
0x45 (returns 16 bytes)

0x50 (returns 16 bytes)
0x51 (returns 16 bytes)
0x52 (returns 16 bytes)
0x53 (returns 16 bytes)
0x54 (returns 16 bytes)
0x55 (returns 16 bytes)

I found the code where the commands are parsed. It is at 0x00007840.

It looks like only the following commands are supported:

14 Clear Diagnostic Information
18 Read Diagnostic Trouble Codes By Status
1A Read Ecu Id
21 Read Data By Local Id
3E Tester Present
82 Stop Communication
A5 Test outputs

81 establish communications is not in the list but I'm assuming it is a special case.

I should be able to find the list of 'Local IDs' pretty quickly. 

So for example 80 F1 12 03 C1 EA 8F C0 reads as

packet from ECU ( 80 F1 12 )
3 bytes in data ( 03 )
data is C1 EA 8F
checksum = (80 + F1 + 12 + 03 + C1 + EA + 8f) & 00FF


Initialize:
From SDS: 81 12 F1 81 05
From ECU: 80 F1 12 03 C1 EA 8F C0

Keep alive:
From SDS: 80 12 F1 01 3E C2
From ECU: 80 F1 12 01 7E 02

Quit (disconnects from ECU)
From SDS: 80 12 F1 01 82 06
From ECU: 80 F1 12 01 C2 46

80 12 F1 02 21 08             monitor sensor data
80 12 F1 03 14 00 00          clear dtc
80 12 F1 04 18 00 00 00       dtc monitoring
80 12 F1 01 3e                keep alive


Sensor : argument , Byte
TPS      : 08,20
IAP#1  : 08,21
Temp   : 08,22
IAT       : 08,23
O2S      : 08,26
IAP#2   : 08,28



Initialization sequence
02 1A 9A
02 1A 91

then only keepalives
01 3E

and when data monitoring starts
02 21 08

When closing connection
01 82


RPM = Value*100/255
Throttle position (°) = Value*125/255
Manifold pressure = (Value*5 - 153)*133/4/255
Temperature (C) = Value*160/255 - 30
Temperature (F) = Value*288/255 - 22
Voltage = Value*20/255
Secondary throttle position (%) = Value*100/255
EXCVA sensor = Value*100/255



Some more commands:

Clear Trouble codes: 80 12 F1 03 14 00 00 9A

EVAP purge valve:
On: 80 12 F1 06 A5 07 80 00 00 00 B5

PAIR solenoid:
On: 80 12 F1 06 A5 01 80 00 00 00 AF
Off: 80 12 F1 06 A5 01 00 00 00 00 2F

for testing purposes also this may be useful:

80 12 F1 06 a5 01 80 00 00 00 set pair on
80 12 F1 06 a5 01 00 00 00 00 set pair off

Secondary throttle:
Full open: 80 12 F1 06 A5 03 80 80 00 00 31
Full closed: 80 12 F1 06 A5 03 80 00 00 00 B1

Here's some ECU responses to 2.5v sensor inputs, differences highlighted in purple:

No sensor inputs
80 F1 12 34 61 08 0C 16 50 E0 17 50 E1 FF FF FF FF 00 00 01 FF 00
00 FF 00 FF 00 FF 7C FF 00 00 00 00 00 00 00 00 FF FF 40 40 40 40
FF 00 FF FF 26 00 00 01 22 FF FF D0

Intake Air Temp Sensor:

80 F1 12 34 61 08 0B 16 50 E0 17 50 E1 FF FF FF FF 00 00 01 FF 00

42 FF 00 FF 00 FF 60 7C FF 00 00 00 00 00 00 00 00 FF FF 40 40 40

40 FF 00 FF FF 26 00 00 01 22 FF FF 11

Intake Air Pressure #1:

80 F1 12 34 61 08 0C 16 50 E0 17 50 E1 FF FF FF FF 00 00 01 80 00

00 FF 00 FF 00 FF 60 7C FF 00 00 00 00 00 00 00 00 FF FF 40 40 40

40 FF 00 FF FF 26 00 00 01 22 FF FF 51

Intake Air Pressure #2

80 F1 12 34 61 08 0C 16 50 E0 17 50 A1 FF FF FF FF 00 00 01 FF 00

00 FF 00 FF 00 80 60 7C FF 00 00 00 00 00 00 00 00 FF FF 40 40 40

40 FF 00 FF FF 26 00 00 01 22 FF FF 11

Oxygen Sensor

80 F1 12 34 61 08 0C 05 05 E0 16 50 E0 FF FF FF FF 00 00 01 FF 00

00 FF 00 80 00 FF 60 7C FF 00 00 00 00 00 00 00 00 FF FF 40 40 40

40 FF 00 FF FF 26 00 00 01 22 FF FF F3

Throttle position sensor

80 F1 12 34 61 08 0C 05 05 E0 16 50 E0 FF FF FF FF 00 00 80 FF 00

00 FF 00 FF 00 FF 60 7C FF 00 00 00 00 00 00 00 00 FF FF 40 40 40

40 FF 00 FF FF 26 00 00 01 22 FF FF F1

Engine temperature

80 F1 12 34 61 08 0C 05 05 E0 01 05 E1 FF FF FF FF 00 00 01 FF 4B

00 FF 00 FF 00 FF 71 7C FF 00 00 00 00 00 00 00 00 FF FF 40 40 40

40 FF 00 FF FF 26 00 00 01 22 FF FF 6F 


I found the code where the commands are parsed. It is at 0x00007840.

It looks like only the following commands are supported:

0x14 Clear Diagnostic Information
0x18 Read Diagnostic Trouble Codes By Status
0x1A Read Ecu Id
0x21 Read Data By Local Id
0x3E Tester Present
0x82 Stop Communication
0xA5 Test outputs

81 establish communications is not in the list but I'm assuming it is a special case.

I should be able to find the list of 'Local IDs' pretty quickly. 

The physical interface is assumed to be a K-line using the KWP2000/ISO-14230 protocol. Right now I am using inverted RS-232 to read the data on that K-line as it's exchanged between the SDS box and ECU.

The initiation has not been determined yet. The protocol spec on the swiftcomm site shows the following for initialization, but I've been letting the SDS box take care of this so far.

This is what I managed to figure until now (Please note that I might be wrong, more or less!):
Pos. Value Data

0 80 Header byte
1 F1 Tester ID
2 12 ECU ID
3 34 Message length
4 61 Message type (Sensor data)
5 08
6 02
7 05
8 05
9 A0
10 17
11 69
12 A2
13 FF
14 FF
15 FF
16 00 Speed = byte 16 * 2 in km/h
17 00 RPM byte 1 
18 00 RPM byte 2: RPM = 10 * byte 17 +byte 18 / 10
19 37 Throttle position: 0x37 = 0%, 0xDD = 100%
20 B8
21 6B Engine Temperature = (byte 21 - 48) / 1.6 in Celsius degrees
22 61 Intake Air Temperature, same formula as above
23 B9
24 00
25 FF
26 00 Gear indicator 0-neutral; 1- 1st gear... a.s.o.
27 FF
28 5E
29 1F
30 FF
31 00
32 00
33 00
34 00
35 00
36 00
37 00
38 00
39 FF
40 FF
41 40
42 40
43 40
44 40
45 FF
46 1A
47 00
48 CB
49 1A
50 30
51 00
52 04 Clutch sensor (bit 8?): 0x04 = clutch released, 0x14 clutch "pressed"
53 00 Neutral sensor (bit 1?): 0x00 = neutral, 0x02 = in gear
54 FF
55 FF
56 07 Checksum

mon retour en hexa

reference
Starting comunication (fastinit) // lignes du code retour des capteurs
Throtle Position: 7E //19
Intake Air Pressure_1: FF //20
Engine Coolant Temp: 0 //21
Intake Air Temp: B //22
Gear: 0 //26
Intake Air Pressure_2: FF //27
Second Throtle Valve: 0 //46

i= : 19 Throtle Position: 61
i= : 20 Intake Air Pressure_1: 13
i= : 21 Engine Coolant Temp: -30
i= : 22 Intake Air Temp: -24
i= : 26 Gear: 0
i= : 27 Intake Air Pressure_2: 13
i= : 46 Second Throtle Valve: 0