T87A Bins to Pins - Who's In ?

[kostia111]

This Chevrolet Malibu
instead of a 6-speed gearbox, they installed a 9-speed one
ECM engine E80

[kidturbo]

Would anyone like to proof read these unlock techniques for us?

https://kidturbo.github.io/Flashy/T87A- ... ecipe.html

Tested a few of them couple weeks ago, but haven't had time to verify all of it.

[MPC001]

Would anyone like to proof read these unlock techniques for us?

https://kidturbo.github.io/Flashy/T87A- ... ecipe.html

Tested a few of them couple weeks ago, but haven't had time to verify all of it.

Gotta love the "USBJTAG" heartbeat Sig .

Impressively detailed share on github.io.!!! Is there a 24288336 bin posted here? (with the two OS blocks). I thought when I mapped out a T87A 24286985 that the OS block was 0x180000 to 0x2FFFDF (from index table @ seg ID 0x1C0000 & CVN CS double checking) but need to check again.

[kidturbo]

USBJTAG does nice work getting his name out there.. And his unlock work is quite proper according to chip manuals and bench testing. But didn't always line up with others way of doing it.. So I ask my little buddy to merge, and test those for us. And he loves bins, so dig up that OS and I'll add to our list.

Not bad with an html editor either.

[kidturbo]

Loaded and tested another patched T87A OS # 24288836.

Running list of currently patched, tested, and Verified versions is kept in here.
https://kidturbo.github.io/Flashy/T87A- ... ecipe.html

Screenshot 2026-04-25 124252.png

Download the latest Zip file of the patched bins at.
https://github.com/kidturbo/Flashy/rele ... ary-v1.zip

If NOT listed as "Verified" on page above, use patched files with caution. Verify Checksum with other tools before loading. Having a JTAG recovery option is suggested. Any help check off remainder of this list, be much appreciated. For doing cross-OS swaps on previously patched hardware, use BAM Write or JTAG. Flashy is careful not to overwrite the Boot sector of patched hardware. But has soft bricked a few due to cal or checksum issues. More bench testing to isolate the matched sets is needed.

How to play details here >> https://github.com/kidturbo/Flashy/releases/tag/v1.4.5

[MPC001]

...... so dig up that OS and I'll add to our list.

See you added 24286985. Again awesome detail on github.io.

Slightly aside of the main patching topic:

Checked 24286985 OS block again and the main OS does run:

24286985 - 0x180000 - 0x2FFFDF - A8 - and your A10 examples......
24288836 - 0x180000 - 0x32FFDF - A10
24293216 - 0x180000 - 0x34FFDF - A10
(etc.)

Interesting on the varying lengths. A10's vs A8's? More shifting bigger OS's.

So is the block at 0x40000 - 0x7FFFF maybe a continuation of the boot code (GMBOOT/STM special boot?) that runs out of 0x0000 - 0x7FFF?

[kidturbo]

Thanks for the Updates.

I hope to load up and verify the remaining versions later tonight. Also adding some GM specific Diag tools to the Flashy "How To" collection. Along with nice write up on DPID's I've been looking to do for a while.

Goal is a nice T87A two-step bench unlock'r tool, with a single switch for low speed BAM, or high speed CAN programing mode. Simple connect to TCM, power it up, watch for the blinking light to change colors. Flash or Unlock done..

Currently I have setup on two TCM connectors. Pretty certain it can be condensed to just one.

[ironduke]

Thanks for the Updates.

I hope to load up and verify the remaining versions later tonight. Also adding some GM specific Diag tools to the Flashy "How To" collection. Along with nice write up on DPID's I've been looking to do for a while.

Goal is a nice T87A two-step bench unlock'r tool, with a single switch for low speed BAM, or high speed CAN programing mode. Simple connect to TCM, power it up, watch for the blinking light to change colors. Flash or Unlock done..

Currently I have setup on two TCM connectors. Pretty certain it can be condensed to just one.

I have just been sitting back here eating popcorn and reading.. lol.. but..

As far as the connector for the T87 you can easily do it with one connector. The 2 jumper wires for BCM or gmboot can be left there when in high speed CAN. the only thing that needs to change is the 5 volt BAM/gmboot to 12v for CAN.. I will say that turning on the 5v to try and get BAM/gmboot is a pita. better off setting that to 5volts and then I switched the ground on and off to get into BAM easier.. might have just been me but I could do it 10% of the time with the 5v switch but 90% with switching ground. Hopefully that's understandable..
I do have a question though, have you been working out the different u-link unlocks with the different boot segments? It's been awhile but I think there were 3 different boot segments overall, there might be more? I see OS unlocks but not the ulink unlocks.
It used to be with hpt unlocks they just looked at the seed and key to know if it was unlocked as they recorded them when they were unlocked by them, you would do the unlock with u-link and also change the seed and key and hpt could then see it was unlocked and allow virtual read and actual writes to the tcm. I know there is a new unlock by hpt but I haven't got into that whatsoever.. If I am reading this correctly you still need BAM/gmboot to get it unlocked and then either patch the boot and/or the OS depending on what your going to be reading/writing with..

[kidturbo]

Thanks for conformation on using same ground jumpers on both High and Low speed modes. I wondered if I was just lucky. But most common issues I've experience has been CANbus termination. Then the 5v power timing.

Switching the 5v/12v Ignition on same connector was exactly what I was thinking. I've found fitting a 12 to 5v buck converter inside the connector is easy. Can even stuff the JTAG dongle and 2515 board in there. Stick a toggle switch on the 12V input line and done.

Was thinking an SSR on top of a canbus MCU board. Then it could auto switch the power for ye. But a simple DP switch on the 12 to 5v buck lines, should fit the job just fine.

[Tre-Cool]

forgive me is this is a repeat of information from the thread, but am i correct in that the 8 speed still used a single 12v pullup wire to the tcm for the park/neutral safety detection like the 6l80?

found my answer in e67 to t87 thread. has a wire direct from the box not the tcm.

Anyone got some decent schematics of the various years to compare say 8 speed to 10?

I purchased my next project car, so im going to make use either a Link or Haltech with the 10l80, likely start with a 6L until i get transfer case adapter to suite the nissan transfer case.