Uplander/montana/relay locked bcm

[04colyZQ8]

Ok, tried mode 23 no good response. It is bricked now from bad bdm program:(

However I did get some great progress on a Tool I wrote a BCM simulator using python for avt 852. Here is its output while using a tech 2 to setup bcm:

COM port is: COM1
AVT reset ok Model is 852 and version is 1.5
Entered VPW J1850 ok.
Received: 6C 10 F1 3C 01 //read vin from PCM*
Received: 6C 10 F1 3C 02 //read vin from PCM*
Received: 6C 10 F1 3C 03 //read vin from PCM*
Received: 6C 10 F1 20//read ?? from PCM* IDK what this is? I tired a pcm I had laying around 2009 Colorado E67, response was 6C F1 11 7C 20 60, so I faked that same response?
Received: 6C 40 F1 3C A0 //read MEC from BCM I faked response of 0xff or 255
Received: 6C 40 F1 3C A0 //read MEC from BCM I faked response of 0xff or 255
Received: 6C 40 F1 3C A0 //read MEC from BCM I faked response of 0xff or 255
Received: 6C 58 F1 3C 80 //read sdm last 4 digits of part number faked correct response of 76 37
Received: 6C 58 F1 3C 71 //read who knows what from sdm?? faked response of 0xff seemed to like it.. lol
Received: 6C 40 F1 3B A8 76 37 //program bcm with sdm part number read from sdm
Received: 6C 40 F1 3B 01 00 31 47 4D 44 55 //program bcm with vin read from pcm
Received: 6C 40 F1 3B 02 30 33 31 32 39 44 //program bcm with vin read from pcm
Received: 6C 40 F1 3B 03 31 30 31 38 38 39 //program bcm with vin read from pcm
Received: 6C 40 F1 3C A4 //stuck here idk what A4 is? will go sniff my working van to see what this is!
Received: 6C 40 F1 3C A4
Received: 6C 40 F1 3C A4
Received: 6C 40 F1 3C A4
Received: 6C 40 F1 3C A4
Received: 6C 40 F1 3C A4

*Note: very interesting my 2009 Pontiac Montana does indeed use E67 but with vpw address of 10, I have never seen a e67 use that typically they use address 11. I changed my bench E67 address from 11 to 10, still didn't seem to like it? But my faked pcm is working well..lol

Also using "some software...read between the lines" reports the correct bcm part numbers and vin from my fake bcm:)

[04colyZQ8]

However trying to get bcm part numbers using the tech 2, with my simulator, always gives the dreaded error message...
VClib.c
1120
1

Any ideas why that is?

I am sending periodic bcm/pcm health message of 08 ff 10 03, 08 ff 40 03, and if I get 28 00 I send 6c f1 40 68 00

[04colyZQ8]

Mmm read the a4 from working van it is
7f a4 3b 00 00

It seems to crash after I fake that same response?

Maybe my program runs too slow?

I’m even faking the positive ack of writing the vin and sdm to bcm. So either I’m not sending the correct a4 response? Or it’s not fast enough?

[antus]

The 3C packets are like an API to certain pieces of data. It seems to be standardized on platforms that suppot 3C, so if you can find out what data 3C A4 is returning for any GM hardware, it should be the same here.

[Gatecrasher]

To expand on what Antus said, it's the equivalent of mode 1A Read DID on a GMLAN module. Data blocks 01 - 3F are corporate common blocks. 40 - 7F are application specific common blocks. So data in these blocks would be common to all ABS modules for example, but could have a different meaning on a BCM or other module. 80 through FE are application specific with the exception of A0, which is the enable counter.

[antus]

Good to know Thanks for the extra detail.

[04colyZQ8]

Nice thanks guys! Sdm part number doesn’t ever seem consistent. Can be 90, 80, a8.

What I find strange here is tech 2 for bcm setup requests sdm part number via 80, and 71, then programmed the Bcm using a8.

I believe this is because there are two different sdms used if you have rear side airbags the plug and sdm are completely different. Therefore it goes something like this ..

Read sdm 80, 71
Which ever reports neg response 31, don’t use and use which ever reports a 4 digit number.

I tried it with my simulator and that’s how it seems to work.

[04colyZQ8]

Front side air bags with or without uses 80, and rear side airbags uses 71 to report sdm part number.

Also kms are not stored in the bcm that I can tell?

This car used a separate module for tpms and key fobs likely the fob and tpms id is in that module. I think the only thing to setup on a new bcm is brake pedal learn, sdm part number and vin, maybe a theft deterrent password? But that is likely in the theft module.

Idk what a4 could possibly be for? But likely on a new module it should be blank eeprom ie ff ff ff, so on my programmed module a4 reports 3b 00 00 I’ll try sending it ff ff ff and see if that is happy?

[04colyZQ8]

The cool thing about my simulator is that it strips out other class 2 traffic since nothing is in the bus and using tech 2 makes it really easy to see what is sending.

For example I clicked learn brake pedal and all I seen on my program output:
6c 40 f1 ae 00 xxxxxxxxx

Of something I didn’t copy if but neat!

[antus]

You're logic sounds correct. KMs in the GM that I have seen are usually just in the cluster.