E38 Negative Response to read-write ECU

[ironduke]

I have run into this and have gotten it to program.. It was awhile ago though, think I might have posted how I did it here, I was working with Tazzi at the time..
Basically I used a Y cable and inserted the correct response at the right time so the programming would continue and it worked.. Think I just used termite with a function key setup and watched it in real time and when I saw the download request I just spammed it 5 or 6 times with the right message..
Don't remember which program I used, think it was regular sps at the time. hpt,sps, etc all failed the same way..

Easiest way to set it up is just to use a Y cable and some kind of logging program, once of us here can easily look at it and tell you what command it will need, I don't remember but I know I could spot where it's erroring and know what it's looking for..

Actually found what I think is the log from back in 2019..

Below is probably what your seeing..
7E0 05 34 00 00 15 40 00 00
7E8 03 7F 34 22 AA AA AA AA // This is where it's failing..

Below is what your supposed to be getting. I don't even think I actually needed the 03 7F 34 78 command but honestly don't remember..
7E8 03 7F 34 78 AA AA AA AA // This is the please wait reply from the ecm..
7E8 01 74

It was a one time brute force fix thing and this was before I wrote ANY code so I have no record of exactly how I did it.. I am 99% sure all I did was spam the canbus with 7E8 01 74 replies as soon as I saw it unlocking and getting ready to send the download request..

[VX L67 Getrag]

Oh that sounds like a plan, I have managed to get 1 of the three back to full normal working order with sort of hot swapping with a y cable, but I’m not sure if I just got lucky with timing or it just wasn’t as much of a brick!

[VX L67 Getrag]

So this is just the section of what happens when trying to read when getting the negative response....
[08:18:58:865] Received: 7E8 04 67 01 00 00 AA AA AA
[08:18:58:872] Received: 7E8 01 68 AA AA AA AA AA AA
[08:18:58:971] Received: 7E8 02 E2 00 AA AA AA AA AA
[08:18:59:773] No Chatter Detected..59
[08:18:59:971] Received: 7E8 01 E5 AA AA AA AA AA AA
[08:19:00:773] No Chatter Detected..60
[08:19:01:002] Received: 7E8 03 7F 34 22 AA AA AA AA

I've attached the listen in of ECU for entire session just to see all it's doing even when requesting VIN that it can't find & identifying O.S. etc but ECU isn't spitting out any chatter unless requested.

All ECU chatter.txt

[ironduke]

Yes, your log is showing exactly the same as mine with exception that your log is not showing the commands being sent to the ecm. Those start with 7E0.. You need to change the filters or add 07 E0 to the filter list, not sure what your using to log so I have no idea how to tell you to implement it.

The 7E8 03 7F 22 AA AA AA AA is the response to the download request command being sent
that command should be something like this 7E0 05 34 00 00 15 40 00 00
I was able to get mine to program, I just had to fool the tool to believe it got the ok to push data to the ecu with the 7E8 01 74 command..
Not sure if I was using sps or hpt back then, probably sps.. Anyways I was using a teminal program with an elm327 using a Y cable to watch it in real time. As soon as it got close to sending the 34 download request command I used a function key to spam the 7E8 01 74 message repeatedly to hopefully get it in there before the ecm actually responded with the 03 7F 22 error message.. It worked and the ecm was able to be revived..
The terminal program I used was termite and I was using an elm327 to do it. Would be pretty easy to copy and repeat since you have a Y cable. Do you have an elm327? or another J2534 device? what device are you using to log?

Nowadays I'd write up a program to try and automate it a little using a J2434 device like the gm MDi, I don't really use the elm327 anymore.. too much of a pita to work with.

[VX L67 Getrag]

Ahh that all sounds a bit over my head, but yeah the tool I was using to log info I think I had the filter set to 7E8 maybe, I was logging the data with the elm but I do have MDI, AVT & obviously HPT cable but I'm not sure how to make it spam the request to wait till it gets the correct response... I guess I just keep pushing write until I see that response?

[ironduke]

Just trying again and again won’t work. If you use the elm and termite you can set function keys to send a message.. just on my iPad right now, I’ll try and get more detailed later.
You’d set up termite function command to send 07 e8 01 74 /r /n as the command.
Sorry I don’t remember how to set the filters to show 7e0 and 7e8, worst case set it to 7e0 and watch for the 34 command and hit that function key a fast as you can.. I think you can even set up an auto response with termite but it’s been ages since I’ve used it.

[VX L67 Getrag]

ahh o.k. I'll see if I can try that, still a bit over my head but I'll give it a go... Thanks!

[ironduke]

Try and get a log of the 7E0 commands, I'll see if I can find some time to make something up to automate it a bit..

I sent you a pm with a little something I wrote up. If it works or once we get it working we can post it up if there's interest, no sense if it's a dismal failure...

[VX L67 Getrag]

Not sure if I'm doing it correct as I have no idea what I'm doing & not sure if it connected correctly as it says no handshake?

Termite info.png

[ironduke]

Not sure if I'm doing it correct as I have no idea what I'm doing & not sure if it connected correctly as it says no handshake?
Termite info.png

Baudrate looks wrong? but we have something else in the works. If we attempt this with elm and termite I'm gonna have to brush up on those skills a bit...