Colorado / H3 BCM hacking

[04colyZQ8]

I have never had to desolder it chip clip works fine in place.

Interesting I wonder why the 7b/3b didn’t work for me probably the elm327 format. I can try again someday with a j2534. Or avt852.

However you need to program the chip anyway for mileage.

[SickFinga]

I have never had to desolder it chip clip works fine in place.

Weird. I tried reading it with a clip, tried it with a pogo probe, and it would return garbled data all the time. Maybe it's different from part number to part number.

Interesting I wonder why the 7b/3b didn’t work for me probably the elm327 format. I can try again someday with a j2534. Or avt852.

Keep in mind, it only worked on two part numbers. Other part number from the same model year didn't not work and would always return "permission denied".
I was testing with the OBDLink MX+

[ironduke]

I have never had to desolder it chip clip works fine in place.

Interesting I wonder why the 7b/3b didn’t work for me probably the elm327 format. I can try again someday with a j2534. Or avt852.

However you need to program the chip anyway for mileage.

I wonder if it's like writing the vin in ecm's and tcm's where a code clear command prior is usually needed?

[SickFinga]

Well, I just got another 15951589 BCM and I tried to change the VIN via command and the change wasn't allowed. I suspect it has something to do with the calibration version rather than a part number.

On P/N 15802491 I was able to change the VIN via the command.

I have never had to desolder it chip clip works fine in place.

Interesting I wonder why the 7b/3b didn’t work for me probably the elm327 format. I can try again someday with a j2534. Or avt852.

However you need to program the chip anyway for mileage.

Which programmer did you use to read the chip in-circuit?

[04colyZQ8]

Ch341a

[gmtech825]

does anyone know if the the can based bcm's from this era in the other platforms use the same processors? like the malibu, corvettes etc, not the fujitsu based stuff. Anyone have a .bin from any of these already? they are not writable with sps, only setup with a tech2.

[theY4Kman]

I've got a 2008 Colorado, which I mostly use for leisure drives at night, since I work from home all day and need some semblance of fresh air. I drive up and down the local Central Ave going 10mph avg, and it's my goal to remove the minimum speed requirements on the cruise control

I also have a Claude subscription and a dream. I've spent the last few weeks poring over the TMS370C16 reference with Claude to develop a working Ghidra processor spec. I can't say it's perfect, but it has been good enough for me to perform some detailed analysis (and when I say "me", I mean I discovered there are MCP servers for Ghidra, and Claude essentially performed the entire analysis). I'll attach the processor here as an extension .zip; at some point, I'll pull it out of my private "car-hacking" mess of a repo and push it to github.

[zack4200]

Just a heads up - the bcm isn't involved in the cruise control at all on the Colorado, the minimum speed inhibit is controlled by the ecm.
https://charm.li/Chevrolet/2008/Colorad ... Operation/

[T3klock]

does anyone know if the the can based bcm's from this era in the other platforms use the same processors? like the malibu, corvettes etc, not the fujitsu based stuff. Anyone have a .bin from any of these already? they are not writable with sps, only setup with a tech2.

I have the BCM bin for a 2010 Cobalt which I believe uses the same BCM as the Malibu. It's the BCM that's not in SPS. You can only set it up via the Tech2 but it has to be "unlocked" which I haven't figured out how to do. I'll post it for ya...

[gmtech825]

maybe try changing the MEC value using 02 44 3b a0? just a shot in the dark idea, it might not let you though. make sure you unlock with the seed/key first