Gm radio unlock 2015 trax

[04colyZQ8]

Can this be done with a script via universal patcher? I think it’s over mosi medium speed can?

Otherwise can it be done via gds2 or sps2? The vin was changed on my pcm and bcm causing this error..

[ironduke]

Should be done over high speed I believe, if it's just like the trucks it's fairly easy..
You just try unlocking it with 00 00 00 00
ae fe 80 00 00 00 00 is the command.
Keep doing it for 10-15 times with a break in between..
should eventually get the eefe response instead of the 7f error reply.. Once you get that just cycle the ignition..

Would be better to just keep the right vin in the ecm and bcm and see if onstar eventually shows the remote start button on the app though..

Can't do it with gds2 or sps2. Can use a J2534 device and patcher, not sure how to write the script up.
Address is 252 and reply will be coming from 652 , module ID is 8F I think?

I also wonder now if your going to have problems with the radio itself, EBCM, and possible the SDM?

[04colyZQ8]

Ok seems like it’s adress 80 on gm low speed can

Still send same message?

[04colyZQ8]

Should be done over high speed I believe, if it's just like the trucks it's fairly easy..
You just try unlocking it with 00 00 00 00
ae fe 80 00 00 00 00 is the command.
Keep doing it for 10-15 times with a break in between..
should eventually get the eefe response instead of the 7f error reply.. Once you get that just cycle the ignition..

Would be better to just keep the right vin in the ecm and bcm and see if onstar eventually shows the remote start button on the app though..

Can't do it with gds2 or sps2. Can use a J2534 device and patcher, not sure how to write the script up.
Address is 252 and reply will be coming from 652 , module ID is 8F I think?

I also wonder now if your going to have problems with the radio itself, EBCM, and possible the SDM?

Radio address is 80 on pin 1, 33.3 k baud responds to 244, with 644 ack

[22:13:06.881] 00 00 06 24 00 20 00 00 00 00 00 00
[22:13:07.487] 00 00 06 21 00 40 00 00 00 00 00 00
[22:13:09.882] 00 00 06 24 00 20 00 00 00 00 00 00
[22:13:13.153] 00 00 01 01 FE 02 1A B0 00 00
[22:13:13.210] 00 00 06 24 00 20 00 00 00 00 00 00
[22:13:13.221] 00 00 01 01 FE 01 3E 00 00 00
[22:13:13.273] 00 00 06 4D 03 5A B0 97 00 00 00 00
[22:13:13.313] 00 00 01 01 FE 02 10 02 00 00
[22:13:13.365] 00 00 06 44 03 5A B0 80 AA AA AA AA
[22:13:13.373] 00 00 01 01 FE 01 3E 00 00 00
[22:13:13.428] 00 00 06 45 03 5A B0 59 AA AA AA AA
[22:13:13.436] 00 00 01 01 FE 01 28 00 00 00
[22:13:13.491] 00 00 06 47 03 5A B0 58 00 00 00 00
[22:13:13.535] 00 00 01 01 FE 01 3E 00 00 00
[22:13:13.599] 00 00 06 4C 03 5A B0 60 00 06 C3 67
[22:13:13.607] 00 00 01 01 FE 01 A2 00 00 00
[22:13:13.662] 00 00 06 51 03 5A B0 99 00 00 00 00
[22:13:13.688] 00 00 01 01 FE 01 3E 00 00 00
[22:13:13.754] 00 00 06 59 03 5A B0 BB 00 00 00 00
[22:13:13.762] 00 00 01 01 FE 01 3E 00 00 00
[22:13:13.817] 00 00 06 41 03 5A B0 40 00 00 00 00
[22:13:13.825] 00 00 02 44 07 FE 2A 80 00 00 00 00
[22:13:13.879] 00 00 06 45 01 50 AA AA AA AA AA AA
[22:13:13.898] 00 00 02 44 07 FE 2A 80 00 00 00 00
[22:13:13.957] 00 00 06 44 01 50 AA AA AA AA AA AA

It doesn't seem to work?
But here is my script...

Code: Select all

globaldelay:50
delay:500
00 00 01 01 FE 02 1A B0 00 00
00 00 01 01 FE 01 3E 00 00 00
00 00 01 01 FE 02 10 02 00 00 
00 00 01 01 FE 01 3E 00 00 00 
00 00 01 01 FE 01 28 00 00 00
00 00 01 01 FE 01 3E 00 00 00  
00 00 01 01 FE 01 A2 00 00 00
00 00 01 01 FE 01 3E 00 00 00
00 00 01 01 FE 01 3E 00 00 00 
00 00 02 44 07 AE 2A 80 00 00 00 00
#loop:80
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10
00 00 02 44 07 AE 2A 80 00 00 00 00
delay:10

[04colyZQ8]

https://www.reddit.com/r/CarHacking/com ... lan_radio/
[youtube]https://m.youtube.com/watch?v=wDJmtKbX-vQ[/youtube]

These above links are promising...

I just want my radio back while I try to spoof Onstar... I may switch it back if it doesn't work but miss my music in the mean time!

[ironduke]

I gave you information for hmi unlock. Radio unlock has been working with regular sps but can't say I've done it with a trax.
I must have been brain cramping. Remove the hmi from your post heading, lol.. Trax's do not have hmi modules..

The log is showing 00 00 02 44 07 FE 2A 80 00 00 00 00 >> What is this???

Your script is 00 00 02 44 07 AE 2A 80 00 00 00 00 >>> huh??? why is the script not matching the log?

Should look more like 00 00 02 44 07 AE FE 80 00 00 00 00

[04colyZQ8]

I guess I didn't update the log.. I tired both 00 00 02 44 07 AE 2A 80 00 00 00 00, and 00 00 02 44 07 AE FE 80 00 00 00 00
00 00 02 44 07 FE 2A 80 00 00 00 00 >> This was from a spelling mistake which was done manually, in the script I changed it to
AE FE, and AE 2A, neither worked.
More research showing same thing but maybe a way to read the partial VIN?
https://forum.macchina.cc/t/2017-gm-hmi ... ing/713/39

I am doing this at low speed, high speed I don't think works on the radio.

Misty Portwood
HMI:
0x252 07 AE FE 80 00 00 00 00
0x652 02 EE FE
Radio:
0x244 07 AE 2A 80 00 00 00 00
0x644 02 EE 2A

[04colyZQ8]

Through SPS? I just see programming and USB stick... anyone have the info on a USB stick?


Summary
Software Description
Module Part Number CVN
Copy files to Memory Stick 42564316 Unknown
Selected Options:
VIN: 3GNC..............
Salesmake: Chevrolet (GM Korea)
Model Year: 2015
Model: TRAX / TRACKER
Engine: 1.4L (LUV)
Controller: A11 Radio
Function: USB File Transfer
RADIO: (&UF7) - RADIO AM/FM STEREO, SEEK/SCAN, ETR, CLOCK DSP, MP3/WMA USB, AUX/IN, WIRELESS INTERFACE

[ironduke]

Yes.. Low speed for radio..

The 00 00 02, 44 07 ae FE 80 00 00 00 00 should have worked.. I remember it takes more than one message, I think I waited 3 seconds in between and kept sending it.. Under 10 I think but probably more than 3..

Radio vin command below.. I believe the 1st digit is always missing.
00 00 02 44 02 1a 2f 00 00 00 00 00

[04colyZQ8]

Yes.. Low speed for radio..

The 00 00 02, 44 07 ae FE 80 00 00 00 00 should have worked.. I remember it takes more than one message, I think I waited 3 seconds in between and kept sending it.. Under 10 I think but probably more than 3..

Radio vin command below.. I believe the 1st digit is always missing.
00 00 02 44 02 1a 2f 00 00 00 00 00

It worked!!

Is there a similar command to unlock or allow the cluster to change its vin?