Flashy - Arduino Based Tool From Claude

[antus]

nice one! dont suppose you can do e38?

[kidturbo]

nice one! dont suppose you can do e38?

Soon as I unbrick one..

https://github.com/kidturbo/Flashy/releases/tag/v1.4.5

Released a T87A fully vetted kernel and Flashy code today. I tested via terminal on PC and Phone. Also a zip file of the Unlock-Patch bins for anyone to check out. [Bottom of Release Page]

So far, two fully tested with the [5 Patch] boot sector that covers both High Speed Read and Write. Works on bench, should work in the car. As a safety, it won't allow you to overwrite the boot sectors in high speed mode. Or Mismatch OS. That's best left for Bench BAM mode.

====================================================================
HSWRITE: CROSS-OS MISMATCH (pre-check) — ABORTING
Source bin OS PN (offset 0x014638): 24288836
Current TCM OSID (via Mode 9): 24286985

No kernel loaded, no flash touched — TCM untouched.
Flashy HSWRITE is for SAME-OS writes (cal edits).
For cross-OS swaps, use JTAG full-flash.
====================================================================

Menu options added, and full Read Write logging in terminal.
Automatic ECU Reset at end works great in all Reads. Write mode prompt you wen to power cycle ECU.

T87A TCM (algo 569)
----------------------------
1) Cal Read [High Speed]
2) Full Read [High Speed]
3) CAL Write [High Speed]
4) Full Write [High Speed]
5) BAM Read [Bench Tool]
6) BAM Write [Bench Tool]
7) VIN
8) VIN Write
9) Reset
B) Back
HSREAD: T87A HS-CAN 4 MB read (Rollin Smoke kernel)
HSREAD: prerequisite — TCM must be dual-unlocked (5-patch cal)
HSREAD: returnToNormal (broadcast)...
T87: returnToNormalMode (broadcast)...
VIN:3GCUKSEJ2JG218396
OSID:24286985
HSREAD: disableNormalComm (broadcast)...
T87: disableNormalComm (broadcast)...
HSREAD: SecurityAccess...
SEED:98E5E3DE06
KEY: CF4B6D3143
Security unlocked (T87A)
T87A: programmingSession (broadcast)...
T87A: disableNormalComm (broadcast)...
T87A: reportProgrammedState (broadcast)...
T87: requestProgrammingMode (broadcast)...
T87: enableProgrammingMode (broadcast)...
T87A: programming mode active
HSREAD: uploading FLASHY T87A kernel (1980 bytes @ 0x40010000)
HSREAD: $34 accepted
HSREAD: kernel upload complete
HSREAD: streaming 4 MB to SD file /Read/T87A_3GCUKSEJ2JG218396_24286985_HSREAD_260422-165031.bin
EXTKERN: kernel already confirmed alive
EXTKERN: T87A — skipping flash reset (SPC564A80)
READ:START addr=0x0 blocks=2048 bytes=4194304
SD: writing to /Read/T87A_3GCUKSEJ2JG218396_24286985_HSREAD_260422-165031.bin
READ:PROGRESS 64/2048
READ:PROGRESS 128/2048
READ:PROGRESS 192/2048
READ:PROGRESS 256/2048
READ:CHUNK 0x0 (256/2048)
READ:PROGRESS 320/2048
READ:PROGRESS 384/2048
READ:PROGRESS 448/2048
READ:PROGRESS 512/2048
READ:CHUNK 0x80000 (512/2048)
READ:PROGRESS 576/2048
READ:PROGRESS 640/2048
READ:PROGRESS 704/2048
READ:PROGRESS 768/2048
READ:CHUNK 0x100000 (768/2048)
READ:PROGRESS 832/2048
READ:PROGRESS 896/2048
READ:PROGRESS 960/2048
READ:PROGRESS 1024/2048
READ:CHUNK 0x180000 (1024/2048)
READ:PROGRESS 1088/2048
READ:PROGRESS 1152/2048
READ:PROGRESS 1216/2048
READ:PROGRESS 1280/2048
READ:CHUNK 0x200000 (1280/2048)
READ:PROGRESS 1344/2048
READ:PROGRESS 1408/2048
READ:PROGRESS 1472/2048
READ:PROGRESS 1536/2048
READ:CHUNK 0x280000 (1536/2048)
READ:PROGRESS 1600/2048
READ:PROGRESS 1664/2048
READ:PROGRESS 1728/2048
READ:PROGRESS 1792/2048
READ:CHUNK 0x300000 (1792/2048)
READ:PROGRESS 1856/2048
READ:PROGRESS 1920/2048
READ:PROGRESS 1984/2048
READ:PROGRESS 2048/2048
READ:CHUNK 0x380000 (2048/2048)
SD: file size 4194304 bytes
READ:DONE blocks=2048 bytes=4194304 checksum=0x294E888D
OK
HSREAD:DONE
KEXIT: checking kernel liveness via raw $A0...
KEXIT: kernel confirmed alive (responded to $A0)
KEXIT: strategy 1 — silent wait (3 s)...
KEXIT[silent] frames=0 3E=. 20=. stock=.
KEXIT: strategy 2 — 16 MB kill stream + OS-heartbeat wait
KEXIT: this takes ~3 minutes. Don't interrupt.
RAW TX $A0 16MB kill = A0 00 00 00 00 FF FF FF
KEXIT: waiting for OS... t+10s, stream_frames=41198, stream_quiet=0s
KEXIT: waiting for OS... t+20s, stream_frames=81458, stream_quiet=0s
KEXIT: waiting for OS... t+30s, stream_frames=122561, stream_quiet=0s
KEXIT: waiting for OS... t+40s, stream_frames=162571, stream_quiet=0s
KEXIT: waiting for OS... t+50s, stream_frames=202672, stream_quiet=0s
KEXIT: waiting for OS... t+60s, stream_frames=244134, stream_quiet=0s
KEXIT: waiting for OS... t+70s, stream_frames=286419, stream_quiet=0s
KEXIT: waiting for OS... t+80s, stream_frames=328758, stream_quiet=0s
KEXIT: waiting for OS... t+90s, stream_frames=370990, stream_quiet=0s
KEXIT: waiting for OS... t+100s, stream_frames=411935, stream_quiet=0s
KEXIT: waiting for OS... t+110s, stream_frames=451913, stream_quiet=0s
KEXIT: waiting for OS... t+120s, stream_frames=491889, stream_quiet=0s
KEXIT: *** STOCK OS HEARTBEAT DETECTED after 128s — TCM is back ***
OK

New documents index here. I've been refreshing my html skills.

https://github.com/kidturbo/Flashy/wiki ... tion-Index

[kidturbo]

nice one! dont suppose you can do e38?

Found another E38 in a box today of unknown origin.

Next up on operating table. Soon as it finishes hacking out a kernel for this T42 I cut it loose on last night. 5hrs, 15 test runs, an it's almost got it doing a good read I believe..

[kidturbo]

Latest updates live in repo now.
Had a member report issue with reading the late model E92 units. C and I totally missed that Early / Late model difference. We used a 2016 unit to hack it all out originally.

Luckily found a 2020 E92 donor unit that's seen better days. To the donor, it actually booted... At least CAN still squawking, so was able to get full Read working late last night. Latest Flashy firmware now reads the E92 OSID at first connection, then selects correct Algo for matching model. At least that was the plan..

Hopefully get CAL and FULL WRITE working on both units over the weekend. But it's making progress.

Screenshot 2026-04-25 010131.png

T42 is a different story. Spent last 24hrs trying to get the FLASHY kernel to respond correctly, and on time. Made good progress that first day, then hit a wall. Runs captured kernels just fine.. But I told it not to cheat, build it's own from scratch. After 100 attempts logged, I told it to use anything it could get it's imaginary fingers on.. Say's it will have T42 sorted for us by tomorrow now...

Sharing a few of it's handy py scripts written for reversing all types of fun stuff. I think all of these are safe to run..

https://kidturbo.github.io/Flashy/Tools-Reference.html

[kur4o]

t42 should be 68k cpu similar to e40. Maybe that is what makes it hard for AI to decipher.

Do you mind posting the already done read kernels for analysis[deep review] in IDA. Maybe I can give some hints for future optimization.

[kidturbo]

Thanks to all for the help and feedback. I'm going to jump back on the E38 tonight, an continue debugging the late model E92 OS quarks.

While searching thru a stack of ECU's looking for specific OS version, I ask Claude to write up some scripts to help the sorting digitally. Along with some One Click DTC tools, for live bench work. It wrote some nifty desktop py stuff in about two minutes. Then while I verified, ask it to update the onboard firmware with the same menu options. Fix RTC set time at startup bug, along with couple more reported.

Currently under DIAG we have a Network [Fast Scan] which returns simple ECU type by OBD-2 ID position. And the programmed VIN of each unit. Gonna test that one one the phone, along with VIN WRITE, which is still buggy on some hardware.

Screenshot 2026-04-25 192518.png

Screenshot 2026-04-25 192830.png

Then ask it to build us a [Full Scan] version. Pulling all data it can find from each ECU on the bus, without loading any kernels. I let it use some scripts I'm not sharing, to flash, log, and debug it's self. Spit this out in about 10 minutes.. Not to shabby for 10 minutes of serial port control, by scripts only. It has already ask write this dump to the SD, so we can to build an OS sanity checklist to determine what ECU matches what tools..

Code: Select all

SCAN:START (FULL — Mode 9 dump per module)
SCAN:PROBE 0x7E0 ECM
SCAN:FOUND 0x7E0/0x7E8 ECM
  VIN:        1G1FH1R7XL0106235
  ECU Name:   ECM
  CAL IDs (8):
    0: 12699552
    1: 12692155
    2: 12698727
    3: 12667480
    4: 12675534
    5: 12692161
    6: 12692176
    7: 12692167
  CVNs (8):
    0: 0x000025B9
    1: 0x0000CCD9
    2: 0x0000777E
    3: 0x0000F46E
    4: 0x00002722
    5: 0x00004B4E
    6: 0x0000AE8F
    7: 0x00005C19
  $1A B4:    111921731301VSXP
SCAN:PROBE 0x7E2 TCM
SCAN:FOUND 0x7E2/0x7EA TCM
  VIN:        2G1WB58K689263630
  CAL IDs (4):
    0: 24234275
    1: 24236279
    2: 24236271
    3: 24236275
  CVNs (4):
    0: 0x00004164
    1: 0x0000F52E
    2: 0x000060B3
    3: 0x00008116
  $1A B4:    BKYLDKK072990668
SCAN:PROBE 0x7E1 ECM2
SCAN:PROBE 0x7E3 ABS
SCAN:FOUND 0x7E3/0x7EB ABS
  VIN:        1G1FF1R76G0179694
  ECU Name:   FPCM-FuelPumpCtrl
  CAL IDs (3):
    0: 23482558
    1: 23155677
    2: 23330342
  CVNs (3):
    0: 0x0000AC2B
    1: 0x0000813E
    2: 0x0000F557
  $1A B4:    GA1816DA61160557
SCAN:PROBE 0x7E4 IPC
SCAN:PROBE 0x7E5 BCM
SCAN:PROBE 0x7E6 RCDLR
SCAN:PROBE 0x7E7 HVAC
SCAN:DONE 3 module(s) found
OK

Will add these latest tools to the repo for anyone to test drive. I can only say this AI model accelerates at creating python tools on the fly. Just ask it to do something, and creates a script to do it in about 30 seconds. Maps them for further use also.. This project locally has a couple dozen really slick ones racked up to call on now.

[antus]

I split the AI tools conversation out in to its own thread here: viewtopic.php?t=9265

Lets keep that going, but as a topic of its own.

[kidturbo]

Used flashy to do a little sniffing capture on a private bus over the weekend. Handy as butter in a tub, when all your other tools are in use, and only device handy is your cell phone.

[yoheer]

Died? No updates on Github for 2 months...
The app reads/updates VIN, flashes the board (feather) and thats it.

[kidturbo]

Sorry been off on other projects.
I purposely left it vague, as to encourage some participation on adding new hardware to the list. IF ya drop that in VScode, and run cluade code on it, will pick up where I left off and fill in the blanks. Writing custom kernels takes time and few spare ECM's to brick. I'm short on both this week. But the scripts are there to reverse any other CAN tools ya might use. I've got my copy reading and writing more than GM now.

Will try to update sometime next week.