GM E38 E67 E40 Kernel/Bootloader Development Extravaganza

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 E40 Kernel/Bootloader Development Extravaganz

Post by Tazzi »

For those asking about licenses for the app, the application and also licensing system are completely down at this time. I have begun moving everything to a Windows server (SOOO much better for development) and also the application has begun is change from just a flashing tool into a full editor program.

This has required a huge overhaul of both licensing and application code thus its currently sitting in a completely broken state. I will eventually get back to it but priority is currently with OBDX Pro's scantools and upcoming Editor.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
julespatch
Posts: 159
Joined: Fri Aug 25, 2017 5:28 pm
cars: liberty gen 5
Location: Adelaide

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by julespatch »

In-Tech wrote:Thanks Tre-Cool, I saved those for future.

Obviously mine/ironduke to add is:

seed - 3F80
key - 3F80
wow i had one that had no serial number with that seed key and the unlock worked. unreal. it's almost back to life
User avatar
Tre-Cool
Posts: 265
Joined: Tue Oct 16, 2012 12:17 pm
cars: VY SS UTE, VX Drag Car
Location: Perth
Contact:

Re: GM E38 E67 E40 Kernel/Bootloader Development Extravaganz

Post by Tre-Cool »

ejukated wrote:
Tazzi wrote:
ejukated wrote:when cloning the E38, does it write the 2nd cpu for throttle as well?
I did not add that in due to:
1) Requires decompiling and understanding how the original slave update kernel worked (If wanting to make a true custom one)
2) There is no recovery for the slave, fail mid flash means slave completely dies.

The factory GM kernel could be used... its a bit of a grey area legally though.
Ah makes sense. From memory HPT worked it out for the E40 and read it out of controllers but never did it for the E38.
I think hpt did work it out for the e38, because they added a slave segment which gives access to additional throttle failure settings. I used it the other week to get a later model gold blade throttlebody working on an early e38.

you then need to perform a full flash, and it's doing it after it writes to the ecu. it does 2 write sessions. so clearly programming a different module.
julespatch
Posts: 159
Joined: Fri Aug 25, 2017 5:28 pm
cars: liberty gen 5
Location: Adelaide

Re: GM E38 E67 E40 Kernel/Bootloader Development Extravaganz

Post by julespatch »

i didnt even try that. i used the nvs flasher to get the right OS in there and then i loaded up SPS2 and went over the top of it.... and now shes fucked again hahaha.
ahh well.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 E40 Kernel/Bootloader Development Extravaganz

Post by Tazzi »

julespatch wrote:i didnt even try that. i used the nvs flasher to get the right OS in there and then i loaded up SPS2 and went over the top of it.... and now shes fucked again hahaha.
ahh well.
That the usual method to do it!! So note sure why its not happy there.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Phoenix
Posts: 112
Joined: Sat Aug 22, 2020 5:02 am
cars: 1983 Chevy C10
1993 Ford Mustang LX 5.0
2004 Pontiac GTO
2005 Pontiac GTO
Location: Anna, TX

Re: GM E38 E67 E40 Kernel/Bootloader Development Extravaganz

Post by Phoenix »

Does this work with the E40? I've got a 2005 GTO and would not mind trying it out. Did you ever get the license issue fixed? I downloaded the file in the first post, but obviously I can't do much without a license. Thanks!
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 E40 Kernel/Bootloader Development Extravaganz

Post by Tazzi »

Phoenix wrote:Does this work with the E40? I've got a 2005 GTO and would not mind trying it out. Did you ever get the license issue fixed? I downloaded the file in the first post, but obviously I can't do much without a license. Thanks!
For the E40, I got as far as making the E40 respond back to my custom kernel's CAN frame request, but I did not go any further due to development with OBDX.
It is on the cards to complete once Pete releases his next version of LS Droid, since the following release of that will including E38/E67 and possibly E40 if completed in time :thumbup:

Licensing server is completely down. It needs to be remade/implemented onto a windows server so that it can be permanently up again.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
julespatch
Posts: 159
Joined: Fri Aug 25, 2017 5:28 pm
cars: liberty gen 5
Location: Adelaide

Re: GM E38 E67 E40 Kernel/Bootloader Development Extravaganz

Post by julespatch »

Tazzi wrote:
julespatch wrote:i didnt even try that. i used the nvs flasher to get the right OS in there and then i loaded up SPS2 and went over the top of it.... and now shes fucked again hahaha.
ahh well.
That the usual method to do it!! So note sure why its not happy there.
I put the wrong vin in there, so now it's just a regular old SPS brick.
This thing was proper cactus before though. No vin, no serial number, no hardware key. I made a DPS package up that kind of recovered it enough to use NVS then changed the vin. I should have just left it there.
It's on the unlocker now. Seed key came out as A00 after SPS and the serial is scrambled again.
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: GM E38 E67 E40 Kernel/Bootloader Development Extravaganz

Post by ironduke »

julespatch wrote:
Tazzi wrote:
julespatch wrote:i didnt even try that. i used the nvs flasher to get the right OS in there and then i loaded up SPS2 and went over the top of it.... and now shes fucked again hahaha.
ahh well.
That the usual method to do it!! So note sure why its not happy there.
I put the wrong vin in there, so now it's just a regular old SPS brick.
This thing was proper cactus before though. No vin, no serial number, no hardware key. I made a DPS package up that kind of recovered it enough to use NVS then changed the vin. I should have just left it there.
It's on the unlocker now. Seed key came out as A00 after SPS and the serial is scrambled again.
Something I wondered, I haven't had to try, but.. If you had a valid read prior to the brick and look in the eeprom section for the seed that it's giving you, you just might be able to guess the key needed..
I have it written down somewhere but the E38 has the key approx 8 bytes before the seed.. I think that offset will probably stay the same, just the eeprom location has changed due to the OS change? Anyways if you find what it's giving you for a seed you can try different keys starting say 10 bytes before the seed and make 5 or 6 guesses and see if you get lucky...
User avatar
FriskyDingo
Posts: 45
Joined: Wed May 19, 2021 6:11 am

Re: GM E38 E67 E40 Kernel/Bootloader Development Extravaganz

Post by FriskyDingo »

I have hp tuners and an a car with an e37 ecu is there anything i can do to help?
Post Reply