ironduke wrote: Sat Nov 01, 2025 4:09 pmAt the end of programming it will try to write the vin but likely fail and it will definitely fail at writing the immo code since it's derived from the vin and it has to be unlocked first..
Side question:
How do you unlock and write the correct VIN and immo code to a second hand E39A that's already linked to the wrecked vehicle it came from?
I started looking at it right before I finished work Friday. Hadn't connected to vehicle yet, but I was manually typing in the correct VIN for the vehicle into vehicle selection and TLC/SPS didn't recognise it. I changed region to Australia and was still getting the same thing. Then I packed up and went home.
Haven't had to do it in a long time the way your wanting to, I use IO prog or other programs to write the eeprom section of the flash to just write the vin and immo as needed.. The vin writing you can already do, the immo changing is a lot more work.
for pincode you unlock with seed and key, then sent the current immo code and unlock it.. Then wait 12 minutes and reset it, or reset it and then wait 12 minutes, You can poll the timer countdown with a mode 22 request I think, then after the timer you can write a new pincode.. You need the pincode it currently has, then you need to know the pincode you want programmed into it..
I will read the flash of the ecm or bcm of the vehicle I am setting it up to, or I'll usually just clear it out and virginize the ecm and use sps2 to do a theft learn as it's easier in the long run..
What do you mean it wasn't recognizing the vin? in the first screen where your selecting the vehicle? If it's not recognized there try clicking next on the lower right.. It doesn't always pull the vehicle there but usually on the main tlc or sps2 screen it'll get the vehicle..
btw.. I think t he cheapest solution for complete read and write capability for the e39a is the ulink-nt.. Under $100, I don't think anything can beat that.. No fighting with unlocks, trying to find out immo codes, etc.. Easy cloning.. https://www.usbjtag.com/
I'll have to have another look at it when I'm back Wednesday.
Basically we've got a vehicle there where original ECM is dead, can't communicate with it so I assume we can't read anything off it.
And another replacement ECM from the wreckers, which I'm going to assume they didn't reset before they removed.
Is there any way to do that with the GM software? Or are we shit out of luck without having the pin code the second hand ECM came from?
How would you go about it?
pman92 wrote: Sun Nov 02, 2025 8:30 pm
I'll have to have another look at it when I'm back Wednesday.
Basically we've got a vehicle there where original ECM is dead, can't communicate with it so I assume we can't read anything off it.
And another replacement ECM from the wreckers, which I'm going to assume they didn't reset before they removed.
Is there any way to do that with the GM software? Or are we shit out of luck without having the pin code the second hand ECM came from?
How would you go about it?
Dukes on the ball there.
If the original is no good, then theres a few ways through:
1) Using a full reflash software (like ioterminal or similar), flash in a file from a brand new unit, then program using techline as per normal.
2) Some people try use DPS. Would mean you need to get immo codes for both the vehicle and replacement ECU, required calibration files plus config and setup files.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
@Ironduke.. Is there a way that you can determine which number of the 256 you have to use to calculate the correct key. This ecu i have on my table is calculated with 0xDB for the 2byte key. SPS seems to know which calculation to make instead of trying all 256.
Archimedes wrote: Tue Nov 04, 2025 4:04 pm
@Ironduke.. Is there a way that you can determine which number of the 256 you have to use to calculate the correct key. This ecu i have on my table is calculated with 0xDB for the 2byte key. SPS seems to know which calculation to make instead of trying all 256.
I'm afraid I'm confused by that question? You are using algo 0xdb for the key algo.
The utility file that is used with sps has the algo and table right in the beginning, usually step 2 I think.
E39 and E39a should use the same algo for all e39 and e39a ecm's..
@Ironduke I have a few other E39A ecms and I tryed algo 0xDB and that does give me security access so it must be the same across that family ecu so thank you for that. So I changed the vin in my donor ecm to the correct vin but however i get the FE03 error when i try to do immo learn. Is there a way i can read and write the ecm pincode manually to make it match the pincode of the BCM or reset the ecm pincode to all 0's or whatever a virgin pincode would be so that sps can do the immo matching. Also what x22 request do you use for the immo timer. I would like to implement this function in my application. Do you have any suggestions? I know about i/o terminal and the other software you talked about but i am building an application thats user friendly for the E39A ecus
There is no easy way to do what your trying without a LOT more knowledge than I have. Thought this was gone over by both Tazzi and myself fairly decently.
If you can read the ecm or bcm and get the pincode then you can use that pincode/immo to unlock immo, reset immo, wait for timer, then write new immo.. If you don't have it I do not know about brute forcing it. I have tried, I don't know what the timer is for guessing/brute forcing it but I would hazard a guess it's at least 10 seconds in between tries like seed and key???
There are other programs out there that use a write kernel that can access the virtual eeprom segment of the flash and rewrite as needed.
For me the best bang for the buck at the moment is U-link nt device. Think it's still under $100 and it can read and write the entire E39 and E39a flash. You would need to know where the eeprom segment is(2 places) and then find and either blank out the pincode with ff's and perform immo learn with sps2 or you could paste in the pincode you want..
IO-prog does a good job as well and it may point out the pincode for you and let you change it as needed. I haven't used it in awhile and don't know if I have with an E39a.
Universal patcher does a good job of breaking down the bin into the calibration segments but usually only points out 1 section of eeprom. It will be repeated somewhere else in the flash as when the eeprom data needs to be changed it sets a flag to read the other section and then writes to that section and flip/flops back and forth between the 2 sections of eeprom. E39a should be 0-0x4000 and 0x1c000 to 0x20000.
To do this yourself and automate it your going to need to write a kernel that can read and write to the eeprom areas of flash. You can unlock it with seed and key and send a kernel but the rest will be up to you.
