unlocked E41( and t87a) swapping to another vehicle

Bosch Motronic etc ECUs and PCMs
Post Reply
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

unlocked E41( and t87a) swapping to another vehicle

Post by gmtech825 »

I have an E41 and t87a that have been previously unlocked by hp, and installed in a truck. that vehicle was put back to stock and the modules removed. I contacted hp to see if I license these modules I'll be able to use them on another vehicle. They said that if the immobilizer was learned then they need to unlock the modules again which would cost the same as unlocking a fresh module...

I'm not sure I buy that response. The 87a lets me write a new vin, the E41 doesn't but I think after a full OS write it would take a new vin. So are they saying this because the module identifiers will be wrong and need to be cleared, or is this a money grab?

any insight,help or thread derailments are welcome
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: unlocked E41( and t87a) swapping to another vehicle

Post by Tazzi »

Interesting. They make it sound like an OS update will undo what they have done.

Anyways, the issue is that you have to remove the old immobiliser code, then write the correct one for the next vehicle, and finally perform a immobiliser learn through SPS to make the environment identifiers all update and match.

The immo change is not something you can do by itself with any GM tools, which is why hptuners has said that.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: unlocked E41( and t87a) swapping to another vehicle

Post by gmtech825 »

can the immobilizer be reset with a 3b command of any sort?
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: unlocked E41( and t87a) swapping to another vehicle

Post by Tazzi »

gmtech825 wrote:can the immobilizer be reset with a 3b command of any sort?
Unfortunately not, it’s actually an AE command, and requires sending the correct value first so the ecu accepts the code to “delink” it, then have to wait 10mins to be able to write the new code after.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: unlocked E41( and t87a) swapping to another vehicle

Post by gmtech825 »

Tazzi wrote:
gmtech825 wrote:can the immobilizer be reset with a 3b command of any sort?
Unfortunately not, it’s actually an AE command, and requires sending the correct value first so the ecu accepts the code to “delink” it, then have to wait 10mins to be able to write the new code after.
interesting, I will do some messing around i guess.
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: unlocked E41( and t87a) swapping to another vehicle

Post by gmtech825 »

small update on this. I've been messing around with the E41 and can change the VIN if I write a different OS to it first, but I still can't get it to accept the known good Immo. value.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: unlocked E41( and t87a) swapping to another vehicle

Post by Tazzi »

gmtech825 wrote:small update on this. I've been messing around with the E41 and can change the VIN if I write a different OS to it first, but I still can't get it to accept the known good Immo. value.
When you say you write a different OS, are you referring to using SPS to do so? Or HP?

As for the immo, it will be a matter of sending the original immo to the ECU first (Matches the original VIN) which unlocks the immo security (This is where key writing or changing immo can be done), wait 10minutes and then finally you can write the replacement immo in.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
gmtech825
Posts: 186
Joined: Fri Feb 24, 2017 11:27 am

Re: unlocked E41( and t87a) swapping to another vehicle

Post by gmtech825 »

thats where I'm confused...I'm sending the immo value that matches the VIN for the truck the module came out of but it still rejects it. I get a response back of: 7F AE E3 FE 05

I've had similar issues trying this on the bench with an E92 module so it is possible it needs to be in the vehicle for it to work. I just don't have a truck to put it in and find out.
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: unlocked E41( and t87a) swapping to another vehicle

Post by ironduke »

I'm kind of standing here watching this topic out of interest, all I can do is offer suggestions and they may be out there as it is, lol.. For the immo on the E92 there doesn't seem to be a timeout of 10 seconds like the seed and key from my experimenting a while ago. For the E55 project that mattyjf01 has posted up here he originally had code to go thru all the immo keys until it reported unlocked and that gave me an idea awhile ago on an E92 I had on t he bench. I went looking earlier today for my own code when I experimented with an E92 but basically I had logged a failed E92 write that failed at the end and copied the code that pushed the immo and wrote some code that cycled thru all the keys 0-10,000 and spit out the response.. I was able to unlock it with minimal delay between attempts.. If I find the code I'll post it up, I remember it differing from the E55 code but not by a lot..
This might be a possibility for the E41 and T87a?
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: unlocked E41( and t87a) swapping to another vehicle

Post by Tazzi »

ironduke wrote:I was able to unlock it with minimal delay between attempts.
Im pretty sure I still had a 10 second delay when attempting that, You can tell by the error responses code returned (I cant recall exactly off top of my head). First thing I tried was spamming at 1 second intervals but it would only actually register the 10th second item as that was within the wait limit. Although this could be an ECU specific kinda thing... even though its suppose to be standardized.

I knew there was a time limit since testing on an ECU with a known code resulted in it skipping over it it time limit was not satisfied.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Post Reply