Adding remote start to 2007 ctsv with 04 Colorado body.

[04colyZQ8]

Ok the vpw messages beginning with
28 seems to be related to starting

[Gatecrasher]

You really need a copy of GMW3119. It's got a ton of info about the RVS systems. Way too much for me to copy and paste here. My copy is licensed, so I can't share it.

28 would indicate a high priority functionally addressed message, so you might be on to something there. Post some examples of the whole message and I'll see if it's in the document.

[04colyZQ8]

Ok well I unplugged the theft deterrent module.
Turned ignition to run with non chipped key,
depressed clutch sent fuel continue password
Sent crank request fired right up!

So I either got to put a relay to cut power and possibly class 2 to the theft deterrent module? Or put it to sleep?

Tried samething with module pluged in and it worked... as long as I send the messages very fast!

However now I have 3 codes in the theft module
Loss of class 2
Key not modulated
Checksum error

So that again leaves me to believe I need to put it to sleep or cut it out temp with relay.

This is why I’m pretty sure my hunch is correct and that gm doesn’t power up a theft module for remote start, and or sends a specific RVS message to bypass it

[Tazzi]

Excellent advice, your always helpful. I too have had success this way .. for my 2015 trax I did exactly that. Compared to one that had remote start and added those Booleans to my code, get ap3 key fob done!

Unfortunately GM rolled out remote start in 2004 Malibu, then uplander, hhr, in 05/06, a few select caddy's and in late 07 full size pickups. And by 2010 most vehicles you could add it. Especially if they used the new can biased denso bcm.

However they neglected the Colorado and h3 that ran to 2012, and 2010. Never updating the bcm to can, and never offered ap8, or ap3 extended range or remote start ready.

So I have to re-invent the wheel!

Only class 2 vehicle that I see that uses class 2 remote start is the uplander and that bcm is completely different:(. I the Monte Carlo might use a class 2 signal to start, but also uses gm lan, can.

'generally' speaking, the overall layout for the calibrations are the same, just at different offsets.
As in, if the BCM in your car has the same calibration categories (System, powertrain, theft ect) then it means you can use findings from other vehicles and apply it to your situtation.
I have done alot of work relating to this for various GM modules (BCM, EBCM, Clusters, HMIs, Radios, HVAC ect ect).

I would find a variant of car that has the option I am after, and then another that does not (of the same model). Id find the offsets that change specifically, and then would compare on the actual vehicle I am wanting to apply them on.
Typically you can compare other bytes around to narrow down potential locations to alter.

Otherwise if not going down that path, you will need to send off the correct frame keep the ECM happy, and then finally the start frame. Unsure if this is time critical, since once you turn your ignition on, theres no time limit to when you actual start the car.

[04colyZQ8]

I’ve use that method as well! Unfortunately there is not any module that’s close to this one that uses remote start!

The layout on the uplander and Monte Carlo are so different!

Uplander has same code for any optioned vehicle only 128kb Colorado is 1 Meg I think. Uplander has one segment Colorado has 6. Monte Carlo had 19 I think?

So no luck there!

Only bcm close enough is out of a 2004-2006 silverado and it never had remote start:(

[04colyZQ8]

On a positive note

Just two jumper wires!
To main relay, and acc.

No key used what so ever..

Depressed clutch and sent a few vpw
Messages fired up stayed running


Issue is afterwards doing a normal start
I have several dtcs stored in theft module.

Can I tell it to sleep?

Otherwise I will need to clear dtcs, as part of mr remote
Start routine:(

So how do I clear dtcs ? I can sniff tech 2, but if someone
knows it might was well use that info...

[ironduke]

Send an 04 to clear codes.. One issue you may have is it erases emission flags. Not a concern if you don't have emission testing that checks that.

Can you use BCM outputs that turn oon the ign relay to power up the ECM and ign switch outputs to power up the theft module?

BCM sees ign outputs and powers up ecm so vehicle starts and runs normally.. This is how I see it done with new vehicles.
Use actual ign outputs to power up the theft module.

Question is can you command the BCM to power up those relays using remote start commands?
You have it working now with 2 relays, does this time out after 10 minutes or so?

[04colyZQ8]

Send an 04 to clear codes.. One issue you may have is it erases emission flags. Not a concern if you don't have emission testing that checks that.

Can you use BCM outputs that turn oon the ign relay to power up the ECM and ign switch outputs to power up the theft module?

BCM sees ign outputs and powers up ecm so vehicle starts and runs normally.. This is how I see it done with new vehicles.
Use actual ign outputs to power up the theft module.

Question is can you command the BCM to power up those relays using remote start commands?
You have it working now with 2 relays, does this time out after 10 minutes or so?

Ok I think the theft module is address c0?

So clear it’s codes would be 6c c0 F0 04 ?

Don’t care about any flags on that module.

Except gm didn’t setup well! Because the bcm ignition voltage 1 and 0, is hardwired straight through, all the bcm does is read its voltage, it can’t possibly enable it, or disconnect. Basically or the bcm was completely fried or blew all its fuses the action of the ignition switch would still pass all its voltage to the pcm pin 18, 19 ignition 0 and ignition 1.

So I can only attempt to find a option I’m not using to ground a aftermarket relay to power up the ignition voltage 0, and 1.

Current in just using two jumper wires to test, that correct vpw signals.

No time out it thinks it’s a regular start ounce running it ran for 30 min a gave up and pulled the jumper wire lol!

So id still like to actually send a proper remote start signal

[04colyZQ8]

I have termite now looks really hard to use! How do you edit the function keys Macros?

[ironduke]

I have termite now looks really hard to use! How do you edit the function keys Macros?

Click settings and set up your com port. All you should really need is Port and Baudrate, can leave the rest alone.

You'll want to Append CR-LF. this means when you press enter it will send a carriage return and a new line command. If I remember you don't need one of them but having both on doesn't hurt.

In the plug-ins on the right you can see Function Keys.. double click on it..
Functionkeys filter settings should show up.. F1 - F12..

All you do is type what you want the key to do.. You should add \r\n at the end of each line so it will send a carriage return and a new line command to tell the elm to process that command.

If your connected and have CAN formatting turned on. ATcaf1 then you can make F1 = 1a 90 \r\n and click ok..

Now when your connected you can hit F1 and it will send a vin request.. You can do multiline commands but honestly it is hit or miss because the timing is pretty tight with the ecu's but this does work just for goofing around and trying commands, figuring out things...

Universal patcher can do this and a lot more with the logger built into that, I haven't messed with it very much but I definitely see LOTS of potential in it.. Last I knew they were working on some simply elm327 logging capabilities but it'd be better with a J2534 device for sure..