2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
04colyZQ8
Posts: 461
Joined: Thu Jan 16, 2014 12:41 pm
cars: 2004 Colorado 4.8L swap
86/90 Jimmy 6.5L diesel swap
80 Chevrolet Silverado TBI swap
88dodge W100 LPG conversion

2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by 04colyZQ8 »

The silicon is a upd78f0835 nec 78k0 chip. It’s programmed by uart or csi. Can’t find any reasonably priced debugging solutions. I think it’s a simple serial interface… I have an old pc with serial port I think. Then it’s just a few resistors.

Idk what software to use?

Also seems like it’s erase, write only. And read? It has onboard flash only 60k I think. Tried mode 35 reads won’t except, 7f 11 responses. Tried mode 36 upload of two bytes to ram also 7f 11 responses.

Got a positive unlock back with known seed and key.

It’s a vpw gm unit.
ironduke
Posts: 634
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: 2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by ironduke »

Were you getting 7f 11 11 replies?
04colyZQ8
Posts: 461
Joined: Thu Jan 16, 2014 12:41 pm
cars: 2004 Colorado 4.8L swap
86/90 Jimmy 6.5L diesel swap
80 Chevrolet Silverado TBI swap
88dodge W100 LPG conversion

Re: 2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by 04colyZQ8 »

If I sent 6c 60 f0 35 00 10 00 00 80
I got 6c f0 60 35 00 10 00 00 80 11
6c 60 7f 11

I think I’ll try to post up a log
ironduke
Posts: 634
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: 2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by ironduke »

I was just wondering if there's something wrong with how your sending messages.. For some reason I thought you had typed out that you were trying mode 23 read attempts and I was not familiar with 7f 11 responses for mode 23 request.. my bad..
What hardware/software are you sending the messages with? You are sending the checkbyte at the end?
04colyZQ8
Posts: 461
Joined: Thu Jan 16, 2014 12:41 pm
cars: 2004 Colorado 4.8L swap
86/90 Jimmy 6.5L diesel swap
80 Chevrolet Silverado TBI swap
88dodge W100 LPG conversion

Re: 2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by 04colyZQ8 »

Using vpw explorer I assume it sends a check byte? And mongoose pro cable
kur4o
Posts: 1019
Joined: Sun Apr 10, 2016 9:20 pm

Re: 2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by kur4o »

You are only bet is to test mode 23 dump 4 bytes at a time.

First unlock module than start dumping here is some example.

If you know the seed/key pair, we can find the algo needed, and I can send you some script for dumping bin to log and convert log to bin.


[11:05:37.620] 6C FE F1 28 00
[11:05:37.636] 6C F1 A2 68 00
[11:05:37.641] 6C F1 10 68 00
[11:05:37.647] 6C F1 29 68 00
[11:05:37.652] 6C F1 1A 68 00
[11:05:37.657] 6C F1 40 68 00
[11:05:37.662] 6C F1 58 68 00
[11:05:37.667] 6C F1 60 68 00
[11:05:37.690] 6C 60 F0 27 01
[11:05:37.673] 6C F1 98 68 00
[11:05:37.678] 6C F1 A0 68 00
[11:05:37.683] 6C F1 A1 68 00
[11:05:37.688] 6C F1 A7 68 00
[11:05:37.694] 6C F1 A6 68 00
[11:05:37.699] 6C F1 C0 68 00
[11:05:37.705] 6C F1 AA 68 00
[11:05:37.724] 6C F0 60 67 01 10 71
[11:05:37.759] 6C 60 F0 27 02 27 B0
[11:05:37.781] 6C F0 60 67 02 34
[11:05:47.908] 8C 60 F0 23 00 00 00 01
[11:05:47.935] 8C F0 60 63 00 00 FA 00 00 02
[11:05:47.935] 6C FE F0 3F
[11:05:47.952] 8C 60 F0 23 00 00 04 01
[11:05:47.979] 8C F0 60 63 00 04 FA 01 04 90
[11:05:47.979] 6C FE F0 3F
[11:05:47.996] 8C 60 F0 23 00 00 08 01
[11:05:48.025] 8C F0 60 63 00 08 FA 00 6A 10
[11:05:48.025] 6C FE F0 3F
[11:05:48.042] 8C 60 F0 23 00 00 0C 01
[11:05:48.067] 8C F0 60 63 00 0C FA 01 0C 90
[11:05:48.067] 6C FE F0 3F
[11:05:48.084] 8C 60 F0 23 00 00 10 01
[11:05:48.112] 8C F0 60 63 00 10 FA 00 00 00
04colyZQ8
Posts: 461
Joined: Thu Jan 16, 2014 12:41 pm
cars: 2004 Colorado 4.8L swap
86/90 Jimmy 6.5L diesel swap
80 Chevrolet Silverado TBI swap
88dodge W100 LPG conversion

Re: 2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by 04colyZQ8 »

*****
Log File: C:\AVT_Term\cluster_read2.log
Date: 02-12-2024
Time: 18:29:31
*****

--> 06 00 6C FE F1 28 00
--> 05 00 A8 FF 60 02
--> 05 00 49 FE 60 06
--> 05 00 6C FE F1 3F
--> 06 00 6C 60 F1 27 01
--> 08 00 6C F1 60 67 01 55 55
--> 08 00 6C 60 F1 27 02 AA AA
--> 07 00 6C F1 60 67 02 34
--> 0A 00 6C 60 F1 23 00 00 00 04 01
--> 0C 00 6C F1 60 7F 23 00 00 00 04 01 11
--> 05 00 6C F1 60 60
--> 06 00 6C FE F1 28 00
--> 06 00 6C F1 60 68 00
--> 05 00 6C FE F1 3F
--> 06 00 6C 60 F1 27 01
--> 08 00 6C F1 60 67 01 55 55
--> 08 00 6C 60 F1 27 02 AA AA
--> 07 00 6C F1 60 67 02 34
--> 05 00 6C F1 60 60
--> 07 00 88 EA 60 01 00 00
--> 07 00 88 EA 60 01 00 00
--> 0A 00 6C 60 F1 23 00 00 00 00 01
--> 0C 00 6C F1 60 7F 23 00 00 00 00 01 11
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 06 00 CB EB 60 20 91
--> 06 00 6C FE F1 28 00
--> 05 00 A8 FF 60 02
--> 05 00 49 FE 60 06
--> 05 00 6C FE F1 3F
--> 06 00 6C 60 F1 27 01
--> 08 00 6C F1 60 67 01 55 55
--> 08 00 6C 60 F1 27 02 AA AA
--> 07 00 6C F1 60 67 02 34
--> 0A 00 6C 60 F1 23 00 00 00 08 01
--> 0C 00 6C F1 60 7F 23 00 00 00 08 01 11
--> 05 00 6C F1 60 60
--> 06 00 6C FE F1 28 00
--> 06 00 6C F1 60 68 00
--> 05 00 6C FE F1 3F
--> 06 00 6C 60 F1 27 01
--> 08 00 6C F1 60 67 01 55 55
--> 08 00 6C 60 F1 27 02 AA AA
--> 07 00 6C F1 60 67 02 34
--> 05 00 6C F1 60 60
--> 07 00 88 EA 60 01 00 00
--> 07 00 88 EA 60 01 00 00
--> 0A 00 6C 60 F1 23 00 00 00 10 01
--> 0C 00 6C F1 60 7F 23 00 00 00 10 01 11
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 07 00 88 EA 60 01 00 00
--> 06 00 CB EB 60 20 91
--> 05 00 49 FE 60 06
--> 06 00 CB C4 60 20 00
--> 05 00 69 C4 60 38
--> 05 00 69 C4 60 3A
--> 05 00 C9 C4 60 3C
--> 05 00 C9 C6 60 20
--> 05 00 69 C6 60 3A
--> 05 00 C9 C6 60 3C
--> 05 00 C9 DE 60 11
--> 06 00 CB EB 60 20 91
04colyZQ8
Posts: 461
Joined: Thu Jan 16, 2014 12:41 pm
cars: 2004 Colorado 4.8L swap
86/90 Jimmy 6.5L diesel swap
80 Chevrolet Silverado TBI swap
88dodge W100 LPG conversion

Re: 2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by 04colyZQ8 »

So far as I know this is the problem:
6C F1 60 7F 23 00 00 00 08 01 11

And from what I know it’s not a wrong address it means that mode is not supported period!

So that sucks similar 6c f1 60 7f 35 xx xx xx xx xx 11
Response trying mode 35!

And 36 can’t seem to make that work either!
04colyZQ8
Posts: 461
Joined: Thu Jan 16, 2014 12:41 pm
cars: 2004 Colorado 4.8L swap
86/90 Jimmy 6.5L diesel swap
80 Chevrolet Silverado TBI swap
88dodge W100 LPG conversion

Re: 2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by 04colyZQ8 »

The algoro is 0.
roughneck427
Posts: 55
Joined: Thu Feb 07, 2013 1:49 pm
cars: 2002 Camaro
2008 Pontiac G8

Re: 2004 to 2012 Colorado and 2006 -10 h3 cluster programming

Post by roughneck427 »

Service Used Rq Value Pos rsp Neg resp value

Request Download N/A $34 74 12, 22, 23
Request Upload N/A $35 75 12, 22, 23
Data Transfer N/A $36 76 12, 22, 72, 74, 75, 76, 77, 83, 84, 85, 87, 88, 89, 8A, 8B, F0-FE
Write Data Block X $3B 7 12, 22, 23, 31, 33
Read Data Block X $3C 7C 12, 23, 31
Test Device Present X $3F None 12, 22
Request High Speed Mode N/A $A0 E0 12, 22, 23
Begin High Speed Mode Communication N/A $A1 None 12, 22
Programming Prompt N/A $A2 Any mode required for programming None
Post Reply