Tazzi, just wondering if you were able to try any of those other algorithms? Well none seemed to match your exact pair, although this could be GM trickery since I dont have a 5byte BCM on the bench currently, and am using an IOB radio but requesting different algos.. this could be the issue :lol: W...

kur4o wrote:

dmaxben wrote: Tazzi, just wondering if you were able to try any of those other algorithms?

Why not unlock with regular key and than read eeprom memory and extract the dvt pairs from there.

How do you read arbitrary locations of EEPROM via CAN?

DVT is dynamic vehicle test. It's a battery of automated tests that are run right after the car comes off the assembly line. Does GDS2 make use of these secured device control modes? You'd think it would have to have the algos buried in a DLL or something. Great thought, but seems GDS2 assumes the ...

You're not wrong about the lockouts, but that's not what DVT means. https://www.corvettemuseum.org/demystifying-the-corvette-order-and-build-process/ “The first thing that happens is alignment. The car is driven over an alignment pit with operators under the car doing the work with about 30 individ...

DVT is dynamic vehicle test. It's a battery of automated tests that are run right after the car comes off the assembly line. Does GDS2 make use of these secured device control modes? You'd think it would have to have the algos buried in a DLL or something. No, the device control security/DVT's are ...

hmm, my docos dont indicate 27 FB, only about 27 03 which is designed for DVT access. DVT access allows lots of different things including messing with seed/key. I tried generate for a none 06 key, and it doesnt generate a matching key. Could be a different table algo so requires more investigation...

Maybe something related to the security changes they started implementing in the 2017 model year? No doubt... Just like the MY17+ BCM OS wont allow you use mode AE device control (like command lights on and off, etc) with the engine running. Only works key-on engine-off. MY16 and older you could se...

Hmm, I will have to bring up my documentation, but supplier security seed/key might be what I am referring to, as its the access they utilize to flash specific information in such as serial/Seed/key ect. Ill spin up a session later today and see if I cant get a matching key to your previous values....

It came out of a wrecked 16 Corvette. PN 13510531. Looks like they only ever issued one OS for this thing. 13511493. It's about as crude as you can get for this test, so maybe that's working in my favor? I've got just the BCM on my desk, hooked to an MDI. I'm copying and pasting commands one by one...

Ohhhh I see. 27 03 is actually called engineer/manufacture access. I was not aware of the 2017+ locking out after moving though, thats a new one. The algorithm is on GM's servers, but.. can generate the required seeds by simulating a module to GM though, so I can give that a go. GM does call 27 03/...