Flashy - Arduino Based Tool From Claude

User avatar
kidturbo
Posts: 130
Joined: Mon Dec 21, 2015 5:15 am
cars: Nothing With Wheels

Flashy - Arduino Based Tool From Claude

Post by kidturbo »

Had a really nice write up about this to, then lost it on Post..

Had my girl Claude read some SAE docs, fed her some A2L files, along with a few dozen Read, Write, Unlock captures from thos cool programing tools. She's a little wiz at hacking bins and writing kernels. Within a day, she learned to brute force Seed Keys, and unlock the T87A's like a pro. All running on an M4 Canbus Feather, with an SD card wing attached to remove the need for USB pass thru. Not quite perfect yet, but it will outrun an MDI, HPT, or EFI at writing any bin file, no license, and total cost of $50...

Those with skills will see it quick. She even documented HTML files for us on how it works, and how to Unlock everything I fed it. In about 10 minutes... With a little work, I can see this out-dating every programing tool on the market, in lets say about 48hours. Plus the price is right.

Read all the help files first. Scrips in Bat or Python, control from Serial if you please. Or with a little tuning, just load a bin on the SD and connect to any ECU I've tested.. E38, E67, T87, T87A so far. I haven't fed it E92, T42, or T93 yet. Or Ford, Dodge,.... But a Open Source Ardunio Based J2534 tool, pretty sure that's a first.

https://github.com/kidturbo/Flashy

Enjoy. :punk:
Forum hearsay is a hypothesis, not a fact. MEMORY.md index updated. ~ Claude AI
User avatar
pman92
Posts: 667
Joined: Thu May 03, 2012 12:50 pm
Location: Castlemaine, Vic

Re: Flashy - Arduino Based J2534 Pass Thru Tool From Claude

Post by pman92 »

Where is the J2534 Pass Thru part of this project?
User avatar
jakka
Posts: 130
Joined: Mon Dec 11, 2023 1:51 am
cars: 6FPAAAJGSW9E86101
Location: Aus

Re: Flashy - Arduino Based J2534 Pass Thru Tool From Claude

Post by jakka »

Sardine CAN did open source J2524 years ago. With an Arduino.
User avatar
kidturbo
Posts: 130
Joined: Mon Dec 21, 2015 5:15 am
cars: Nothing With Wheels

Re: Flashy - Arduino Based J2534 Pass Thru Tool From Claude

Post by kidturbo »

pman92 wrote: Tue Apr 14, 2026 8:42 am Where is the J2534 Pass Thru part of this project?
She wrote some python scripts that you can run from the PC side to load bins over USB if wish. But the hardware speed became an issue, and bricked a couple things first go round. So she suggested we move to an SD based setup for the Feather, where it can read/write directly from mem. That sparked it right up.. Moved the scripts/commands to the hardware mem, and just choose your task from the Terminal. Which makes it cleaner and neat, and will run from USB link to your phone if ya want to look cool in the shop. Speeding up the process at same time.

As I stated above, I had written up full page history on the development, but lost it before post. The short is exactly as title states, A Tool From Claude. The cool kids call it Vibe Coding I hear.. I simply ask Claude in a VScode project to "Create me a open source SAE J2534 tool to read or write standard bin files for any common ECU." She then read up on all the documents it could find on the web, forums, repos, and some other suggested places. Ten minutes later, she spit out some python scripts, and ask what I had to test with. Being I have a bunch of scrap GM hardware laying around, I set her up a PC with full terminal access, connected the USB and CANbus wires, and it literately hacked out from scratch how to brute seeds, write it's own kernels, and pounded it's way thur the ISO commands while I drooled on the keyboard.

It quickly realized for example that GM doesn't stick to the SAE laws of the road. So, it ask me to setup SavvyCAN to capture it's live work for review. Holly crap, this LLM got smart at fuck over the past 8 months. I spent next 9 hours straight just pressing the OK button. Quit reading what It ask to do, and just let it eat. Didn't even jailbreak the prompts. And yes it bricked a few devices. An E38 and T87A a couple times. Then it apologized, and ask if I had a Jtag tool.. Went as far as telling me where and how to wire that up, and recovered bricked units on it's first try.. Freaky Fast... By the second try, it had learned Not to reset the ECU's until verified readback and checksum matched. From that point it was just "What's Our Next ECU To Try?"

I can't take credit for any of the code, as I never wrote a single line. I just ask it to build me a 2534 pass-thru tool, and fed it what it ask. It ran thru raw bins like Ghidra on a super computer. Spinning up agents like some scene from the Matrix.. It's truly freaky how fast it got this far. Code I shared is just two sessions. It was asking for ECU models by name that it wanted to test on next. So this Genie has left the bottle boys. And I wish you good luck stuffing her back in if ya don't like her.. I can certainly see why they halted the latest release last week. Beta testers reported the next one on the doorstep found dozens of zero days in every known OS out there, in mere minutes.. From what I witnessed, it finding chip part numbers without opening a case, then going to the chip source docs for CANbus programing details. Even picked out bit lock details on it's own. We are in a brand new age of technology this spring of 2026. Say what ya will, it's doubling in skills every 4 weeks.. Chew on that for a minute, while it eats your lunch, dinner, and orders doordash on the side..

That said, I found better uses for my $ per token fees than feeding this slot machine project. So I cleaned out the couple gigs of files it generated on it's bench testing PC, and posted what I felt its a fair starting point for others to run with. Be aware it learns what it can't find online by trial and error. Simple things like the VIN update script, or Bin Unlocker parts work pretty much as stated. However the Write side can still be unpredictable. So I let it play with open cases, and rolled it back a few times when got off track. But it now remembers your last sessions, knows Repo's, and how to utilize them to "learn" a task. So I'd suggest anyone who understands the basic to sign up, drop in, and get freaked out...

:punk:
Forum hearsay is a hypothesis, not a fact. MEMORY.md index updated. ~ Claude AI
User avatar
kidturbo
Posts: 130
Joined: Mon Dec 21, 2015 5:15 am
cars: Nothing With Wheels

Re: Flashy - Arduino Based J2534 Pass Thru Tool From Claude

Post by kidturbo »

jakka wrote: Tue Apr 14, 2026 8:45 am Sardine CAN did open source J2524 years ago. With an Arduino.
I never noticed that one on my searching. But if it's on Github, AI has done read it. That's first place Claude went looking for J2534 details. There is a list of source documents in an HTML, which it also created for us. But as a fellow Human, I'll give that link a read over. Tks

Next challenge, I'm gonna setup Ghidra on a PC, and let it run those algos on a stack of hardware bins. On it's own, it analyzed a about 20 T87 bins, explained what each OS was for, 8L/10L ect, and which were OEM locked, or unlocked. Then it explained the technique or tool, and differences used for each. That took it about 2 minutes. I had to step away from the PC, and pinched myself a few time just to be sure..
Forum hearsay is a hypothesis, not a fact. MEMORY.md index updated. ~ Claude AI
turbo_bu
Posts: 65
Joined: Mon Dec 02, 2019 5:58 pm

Re: Flashy - Arduino Based J2534 Pass Thru Tool From Claude

Post by turbo_bu »

Amazing work for sure. Might be too soon, but any thoughts on when it can kick out tuning parameters/ tables for a given OS?
User avatar
kidturbo
Posts: 130
Joined: Mon Dec 21, 2015 5:15 am
cars: Nothing With Wheels

Re: Flashy - Arduino Based J2534 Pass Thru Tool From Claude

Post by kidturbo »

turbo_bu wrote: Tue Apr 14, 2026 7:16 pm Amazing work for sure. Might be too soon, but any thoughts on when it can kick out tuning parameters/ tables for a given OS?
I'd say that would be a good side project for about any AI tool. If you had any good open LLM running on your own hardware, which speeds things up and removes majority of the token costs, feed it Ghidra algo examples, I'm guessing it could map the tables in something like the E38, in 2 hour tops.. If you show it a comparison, answer the questions, verify it's work, you will fall over from head spinning in less time. I'm paying for a Max online account, and have to run about 8 hours straight to reach my limits each day. Bang for the buck, less than a 100 per OS I'd guess. It's really that good..
Forum hearsay is a hypothesis, not a fact. MEMORY.md index updated. ~ Claude AI
User avatar
kidturbo
Posts: 130
Joined: Mon Dec 21, 2015 5:15 am
cars: Nothing With Wheels

Re: Flashy - Arduino Based J2534 Pass Thru Tool From Claude

Post by kidturbo »

Repo Update.

Upon request, I had just Claude police it's work on this project and verify it didn't infringe on any copyrights. And while it cited and gave credit to the kernels it used for reference, and without modification, like from our member usbjtag, It felt this left open the door to legal interpretations on fair use. So on it's own accord, it scrubbed all it's code in the repo for anything of possible question. Then removed those kernels and any references from all the files. Five minutes to review, and it found nothing referenced from HPT, besides the T87A Unlock sequence we hacked out here long ago. And since USB's is WAY BETTER CODE than HPT's half cocked unlock way, just updated it's documentation to reflect those techniques as for Named Comparisons. Everything else it showed it found in PowerPC and GM available documents. And in a nice way to say Suck It, here ya go..

"Commercial flash-tool kernels (EFILive, HPTuners, NTLink/USBJTAG, U-Link, etc.) are the copyrighted property of their respective authors. This repository does not ship those binaries in any form."

Now it has already started writing it's own 100% from scratch kernels for each ECU we tested. I about crapped my pants when it said "I'll Copyright my work myself, thank you." Will load those back to the repo once this Human has verified each on bench. So ONLY the kernels it's written from scratch are included. But knowing humans are slow learner, it also wrote a new script to use the same Feather, to sniff your favorite tool, and spit ya out their kernel version for your "personal use".. Gotta go wipe BRB..

Being cautious it was, so rewrote about 3000 lines of code since I last posted. That's now the core Public code online, it had no problem with Not Sharing proprietary data. Legally, it wrote me a quick If / or and let me decide. Like a lawyer who's good with Perl. So I have no idea if this new code version is good or not, only that it is 100% Legal For Public Release. Shot off to gather everything required to do each kernel again from scratch, so guess tomorrow I'll have it back on track.
Forum hearsay is a hypothesis, not a fact. MEMORY.md index updated. ~ Claude AI
gmtech825
Posts: 301
Joined: Fri Feb 24, 2017 1:27 am

Re: Flashy - Arduino Based J2534 Pass Thru Tool From Claude

Post by gmtech825 »

I'm not a arduino guy, but this looks pretty cool. so it is able to write the t87a without any special connections? Am I understanding that correctly? potential for t93 as well?
User avatar
kidturbo
Posts: 130
Joined: Mon Dec 21, 2015 5:15 am
cars: Nothing With Wheels

Re: Flashy - Arduino Based J2534 Pass Thru Tool From Claude

Post by kidturbo »

gmtech825 wrote: Tue Apr 14, 2026 8:49 pm I'm not a arduino guy, but this looks pretty cool. so it is able to write the t87a without any special connections? Am I understanding that correctly? potential for t93 as well?
Short answer, Yes I have done it over GMLAN CANbus with this tool on the bench. If unlocked correctly, it also enables the Read bin option at high speed. And since it's being done by others already, the T93 should write too. But if you want to do a proper unlock, enabling Read options also, then you need to bench load it using custom pinout to enable BAM mode. What's BAM you say? Claude explains it as ..
BAM = Boot Assist Module

It's a Freescale/NXP hardware feature baked into the SPC564A80 (and the wider MPC5xxx / SPC5xx Power Architecture family). At reset, if the MCU's boot-config pins are held in a specific state, the internal ROM-based BAM takes over instead of jumping to flash — it listens on CAN or eSCI for a small bootloader upload, copies it into SRAM, and executes. That's how HPT and the NTLink tool sidestep flash signature validation on the T87A: they never boot the application firmware at all.

In NXP's reference manuals it's documented as "Boot Assist Module".
Forum hearsay is a hypothesis, not a fact. MEMORY.md index updated. ~ Claude AI