Uplander/montana/relay locked bcm

[04colyZQ8]

I have a 2009 Pontiac Montana in my roster now. And course I’m going to mod it! Especially since I have a spare 09 parts van!

Already swapped seats to side airbags will need to add wires and also swap sdm, then setup new part number in the bcm. Added steering wheel controls easily reprogram the radio options using just a tech 2 it lets you check weather it has a dvd player or steering wheel controls very cool!

Now I’d like to add the up level IPC personal preferences option that is installed on the parts van. And here is the trouble both bcms look the same both are the same part number. No programming through sps?? I’m assuming it’s similar to the radio and we just check what options are installed and it programs it likely using dpids. When I try this it says it’s vin locked. What would be required to Virginize this bad boy? And what options are actually available when using a new bcm with tech 2? We could maybe fool the tech 2. Into thinking it’s new then sniff what it sends out for all selected options.

I’m assuming it’s checking the manufacturer enable counter to be non zero and for a blank vin! What’s a blank vin fffff or 0000? Might also be a valid calibration flag it’s checking?

Otherwise maybe I can dump the flash via vpw over the obd 2 port, then write a Trojan in assembly to make changes to the eeprom section. No visible eeprom like a 9sc56 etc. the vin and kms are typically there but seem to be on the actual silicone on this bcm.

mc9s12db128vpve is the mcu and I have j tag Pinots it’s manual is very good and found easily online. Just a simple 4 wire hookup. Trouble is it’s coated with some kind of goo, and the pads are gone must solder or use some steady probes directly to the processor pins!

If anyone has a dump please share!!

Other interesting things the 05-07 uplander has a recall for a bcm dtc and does provide a sps flash! I ripped that file from tis2000, and found the utility file! Using that utility file I found my seed and key and was able to get a successful unlock! I’m getting a code 34 unlock response back from the bcm, after sending in the key.

[04colyZQ8]

[04colyZQ8]

I could swap bcms, but then I go from 149,000 kms to 300,170 kms!! I’m sure the bcm stores the kms!! Could I try swapping anyway I don’t see any cluster programming available on sps either seems like it might display what ever the bcm does! Just don’t want to permanently up the kms on my cluster

[antus]

If you can scratch enough coating off the pins of the chip you can use a BDM frame to balance connections where they need to be on the bench.

[04colyZQ8]

�1GMDV33169D107192ÿ87ÿÿÿ0HJAÿÿVÿÿÿÿÿMÿVJGR�ò2É���ò2É��ŠX��?VBCMÿÿ
%5E!1A������������;�� µ<àààø����ª��ª�UUUUÿ��ÿ�UªªU€!id��ÿ0ÀÁÊ�Ȇ��Nd22þåû$€û$€<���ðÿÿÿÿbp~Œš¨

In business dumping code!
Globaldelay:60

6C FE F1 28 00:10:50

8c fe f0 3f

getseed:5:0
6c 40 f0 27 01
6c 40 f0 27 02 key

variable:varread:1:0

loop:255
6c 40 f0 3c varread:1:50
variable:varread:1:+1
6c fe f0 3f:0:15

anyway to make this script output just the code being dumped to the screen?
like make it strip the first 5 bytes?

[6C F0 40 7C E1] 14 5A FA 00 02 14

[kur4o]

Can you log what t2 checks for controller locked, If it is only mec, you can increase it and than setup bcm as new unit, or reconfigure options.
It is possible there is built in mode35 to read the bcm also. The algo is the simplest one bitflipped.

[kur4o]

Some test for mode35 support

[04colyZQ8]

Some test for mode35 support

I’m pretty sure this will work but still output a really difficult text to put into bin file!

I could write a parser to ignore the first few bytes and any string containing 31 in the 5th ? Position but just wondering if there is a way to change the script fed into patchernaster to fix this?

[04colyZQ8]

Some test for mode35 support

No go... huh mode 35 works on other BCMs that's to bad.. so mode 3C did pull a bunch of interesting things though Or do we just not have the correct memory range? for mode 35?
[08:55:03.210] 6C F0 40 67 02 34
[08:55:03.215] 6C 40 F0 35 00
[08:55:03.289] 6C F0 40 7F 35 00 11
[08:55:03.299] 6C FE F0 3F
[08:55:03.369] 6C 40 F0 35 01
[08:55:03.447] 6C F0 40 7F 35 01 11
[08:55:03.458] 6C FE F0 3F
[08:55:03.527] 6C 40 F0 35 02
[08:55:03.606] 6C F0 40 7F 35 02 11
[08:55:03.608] 6C FE F0 3F
[08:55:03.685] 6C 40 F0 35 03
[08:55:03.765] 6C F0 40 7F 35 03 11
[08:55:03.768] 6C FE F0 3F
[08:55:03.844] 6C 40 F0 35 04
[08:55:03.923] 6C F0 40 7F 35 04 11
[08:55:03.925] 6C FE F0 3F
[08:55:04.002] 6C 40 F0 35 05
[08:55:04.081] 6C F0 40 7F 35 05 11
[08:55:04.089] 6C FE F0 3F
[08:55:04.161] 6C 40 F0 35 06
[08:55:04.241] 6C F0 40 7F 35 06 11
[08:55:04.248] 6C FE F0 3F
[08:55:04.321] 6C 40 F0 35 07
[08:55:04.400] 6C F0 40 7F 35 07 11

[04colyZQ8]

I think this might be kms since it is repeated twice, what would this be? could try mode 3B to change this? could you convert this to kms?
6C F0 40 7C 08 00 F2 32 C9 00 00