GM Reverse Engineering

[Tazzi]

That makes sense. Yeah, wouldnt mid trying to sniff those "packets" sent from BCM to PIM. Iv actually probably seen it a thousand times but havent payed enough attention.
So with that info.. A PIM could possibly be bruteforced... hmmmm...

Well, I guess the next action is to try captures these frames, see what happens if they get sent to PIM quickly.

[Tazzi]

VZ V6 immob code.. check
BCM security code.. check
PIM immob code.. No go.

With the ecu, bcm and pim all hooked up. The tech2 says "OK ready to start" since the security is all linked.
BUT, when I try try to emulate the data with only the PIM hooked up.. its "Not ok to start". Grrrrrrrrr, it is byte perfect for every last response. Iv quadruple checkd with our monitors on the bus to ensure the correct data is being sent/read.

Only cables used are the standard CAN,ALDL power and ground.. no other hidden wires. This one really has me stumped!

[Tazzi]

Wake up today, fire up the bench setup... and the PIM is happy now.. have made no changes. Well.. might as well attack it while its working.

So the plan here.. from what I understand of the PIM anyways. Is that the BCM will fire off the immob key to the PIM, PIM compares with what it has saved, then it fires that off to the ECU.
So the bruteforce attack I was thinking of, is what If I kept spamming keys at the PIM, and just listen at the other side until a response is sent? That *should* work.
First on the list.. is identifying the bytes that hold the key.

[Gareth]

Wake up today, fire up the bench setup... and the PIM is happy now.. have made no changes

volatile little pricks aren't they

[Tazzi]

hmm.... PIM has me stumped.. I dont seem to see the code sent.
I imagine it isnt sent in plain text.. but its still being a pain to identify. Dont like being beat but have spent stupid amount of hours on this now.

On positive side, Found both E55 and E38 can be bruteforced for immob as well. I assume all ECU's could be done the same.

[jca]

hi Tazzi , are you using your elm cable and software to gather the ecm code? i have a ecm i want to link in to the vehicle i have the mob codes from the dealer but it rejects the codes when i try a reset i'm wondering if the code they supply is the actual pim code as i can reset the pim with the code they supplied for the vehicle with the faulty ecm but i can't link the new s/h ecm in to the vehicle as it won't let me reset it on the bench harness so I'm thinking i.e. holden have give me the wrong code for the new s/h ecm based on the vin i gave them or the code or the vin in the ecm has been changed previous some how

[Tazzi]

hi Tazzi , are you using your elm cable and software to gather the ecm code? i have a ecm i want to link in to the vehicle i have the mob codes from the dealer but it rejects the codes when i try a reset i'm wondering if the code they supply is the actual pim code as i can reset the pim with the code they supplied for the vehicle with the faulty ecm but i can't link the new s/h ecm in to the vehicle as it won't let me reset it on the bench harness so I'm thinking i.e. holden have give me the wrong code for the new s/h ecm based on the vin i gave them or the code or the vin in the ecm has been changed previous some how

Gday, Im using a variety of tools actually. AVT, ELMs and my own little CAN module to emulate some traffic ect.

Ouch, sounds like the second hand ECM your using has either had the VIN changed, or it has been previously reset and set to a different value.

After I reset my PIM and ECU, when I go to link them again I get the choice to enter in a custom Immob code. Now this is by far the stupidest idea they could have implemented as now this code cannot be retrieved by Holden!!!

I havent tried less than 10seconds yet. But looks like the immob in the ecu can be figured out. With a max of 10000 combinations.. would be ~27.8hours.
Pretty sure theres no time limit from when I did my testing, Im yet to double check that, but if not Id say it could be checked maybe 30times per second.. so every combo could be attempted in about 5minutes. (Maybe!!)

Need to relink the ECU I have here again and see what it does after getting it wrong 10+times ect.

[jca]

hi tazzi yes I'm thinking some one has changed something along the way so to get the ecm mob code could i retrieve the code using the same process as we use with the elm to get seed? for the ls1s etc

[Tazzi]

hi tazzi yes I'm thinking some one has changed something along the way so to get the ecm mob code could i retrieve the code using the same process as we use with the elm to get seed? for the ls1s etc

Nah, its nothing like the method for the LS1's at all.
As it is "security" related Im not very keen to provide any tools to perform said task.

[Tre-Cool]

any idea how the e38 ecu links with the bcm? I have put in a later model e38 in my brothers car (better os for larger injectors/quasi launch control) and cannot work out how the frack it re-links. I've gone as far as disabling vats in the tune to get it running for now, but it still logs p0513, P1629.

I have a tech 2 and efilive and I've tried telling the ecu to relink via efilive just like I do with ls1 pcm's and nada.