GM E38 E67 E40 Kernel/Bootloader Development Extravaganza

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

AFter reading and writing in car, will need to have a pause for a good 2-3seconds to let the ecu restart after kernel is excited to then clear its faults.

I had 85 faults after reading the flash in the ECU in car and couldnt start unless clearing :lol:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
julespatch
Posts: 159
Joined: Fri Aug 25, 2017 5:28 pm
cars: liberty gen 5
Location: Adelaide

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by julespatch »

Tazzi wrote:So cloning an ECU and only changing the immo code doesnt seem to be enough.

I had a fault come up saying invalid transponder key. These keys are my original, so its interesting to hear its saying that.

Ill dump the file after linking to see what changes anyways after doing the security link, which Im about 8mins of 10mins into.
my mate called earlier and said he had that invalid transponder code on one i gave to him to test. he flashed an 09 cal into the 08 computer and said the vin was gone again which is expected but the car runs sweet so the ecu is defintely back in business!!
julespatch
Posts: 159
Joined: Fri Aug 25, 2017 5:28 pm
cars: liberty gen 5
Location: Adelaide

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by julespatch »

Derrrp.

After 3 or so writes it's now throwing the controller unlocker response code. That's pretty expected after changing the OS year though so no issues there. Back to the doctor's office for you little buddy
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

julespatch wrote:Derrrp.

After 3 or so writes it's now throwing the controller unlocker response code. That's pretty expected after changing the OS year though so no issues there. Back to the doctor's office for you little buddy
Did a SPS on it after full write to ensure correct slave??

I have added in clearing vehicles faults (Everything on the HSCAN Line) after exiting the kernel and giving it a bit of time to boot up, which allowed my car to start after reading/writing.

Technically it did already send that command but it was so fast that it didnt really actually do anything since the ecu had yet done a faults check yet.

Couple new things Iv begun implementing:
1) Details form. This gives calibration IDs and seed/key/vin/serial ect of the ECU.
2) And by popular demand, Begin the implementation of slave write.
3) E55, E77 and E37 support

I only have limited E38 slave OSs, can easily be added over time, just need a VIN so I can extract them from GM to add in.
Next, E55 and E77 ecus require no kernel, these have internal kernels so are very straight forward for read/write implementation.

E37 appears to need a kernel, but I *think* it uses the same hardware as the E38. Will know soon enough once I open it up and see whats inside.


*Edit
E37 has he MPC561 and flash M58BW016DB. Assuming all pinout to the flash is the same.. should be able to use the same kernel. Will also need to check the whats needed to keep the slave system happy so will double check what the gm kernel does.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
In-Tech
Posts: 778
Joined: Mon Mar 09, 2020 4:35 pm
Location: California

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by In-Tech »

Hats off to ya Tazzi, great work. It took me a bit to get the VXDIAG j2534 working but all is well. I just picked up an e38 that turned out to be a perfect stock 2009 Pontiac G8 so I read that to have a known good base file. I took the e38 I have with the milled off top and was able to clone it to this 2009 Pontiac G8. I still have to do the 7th slave and 8th module but I am really excited.

Here's how its' fubar'd life was at the end of what I could do to it before it got Tazzinated :punk:

VIN: 1GTHK43K89F184504

PCM Service No: 12625455
PCM Traceability Code: N„ŒŸŸ·TÂ
PCM Security Seed: 0000

PCM Module 1: 12630501
PCM Module 2: 12651309
PCM Module 3: 12651277
PCM Module 4: 12627320
PCM Module 5: 12629186
PCM Module 6: 12651208
PCM Module 7: 12625892
PCM Module 8: 12614521

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Here it is after Tazzinated

VIN: 6G2EC57Y19L195986

PCM Service No: 12624488
PCM Traceability Code: 86YRTMK181018EML
PCM Security Seed: 59A8

PCM Module 1: 12624402
PCM Module 2: 92225785
PCM Module 3: 92225786
PCM Module 4: 92221540
PCM Module 5: 92225621
PCM Module 6: 92225620
PCM Module 7: 12625892
PCM Module 8: 12614521

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Here is the stock G8

VIN: 6G2EC57Y19L195986

PCM Service No: 12624488
PCM Traceability Code: 86YRTMK181018EML
PCM Security Seed: 59A8

PCM Module 1: 12624402
PCM Module 2: 92225785
PCM Module 3: 92225786
PCM Module 4: 92221540
PCM Module 5: 92225621
PCM Module 6: 92225620
PCM Module 7: 12619083
PCM Module 8: 92228514

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

So, now all that's left is to get Module 7,8 written. I've been up all night and it's 11am now so, time for some shuteye.

Great job Tazzi :)
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Mode 7 and 8. Those are both just slave numbers right? Id assume one is the slave operating system and the other is the slave calibration?
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

After a bit of log reviewing, I see now that there is an OS and calibration for the slave.

Things for updating slave:
1) Send kernel
2) Send OS (If required)
3) Send Calibration

OS and cal together are about 30kb, so its tiny in comparison to the main cpu so its incredible quick.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tre-Cool
Posts: 265
Joined: Tue Oct 16, 2012 12:17 pm
cars: VY SS UTE, VX Drag Car
Location: Perth
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Tre-Cool »

I would be happy to "splash some cash" if we could get the later E38 ecu's to work in place of the earlier 64lb injector limited E38's.

Apparently it can be done & I don't think there is anything special about it since someone sell's it as a upgrade for the corvette's.
https://dsxtuning.com/collections/tunin ... 6585401424
They're 2010+ hardware that's flashed with a specially modified operating system, and then the VIN is forced to match your vehicle. The 08+ are super easy to do. 06-07 is what is a lot trickier to accomplish without wiring changes, but I've managed to make it work.


The major advantages are the increased airflow and injector flow rate limits, but there are other additions like the O2 integrator delay, adjustable axis labels, and a few others. These things also help cure the annoying 08 Z06 shutdown issue.
In fact i have a friend with one of these older e38 corvette's that we really need to do an ecu upgrade on before we put a new badder motor in, along with my brother's car.

I do know you need to swap the throttle bodies when using the different ecu years, but i guess if you can flash in the older ecu slave & immo data into a new ecu, then maybe that would keep it as a plug'n'play solution?

Or maybe we just need to put the new os into the older ecu's?
Last edited by Tre-Cool on Sat Apr 18, 2020 1:39 am, edited 1 time in total.
ironduke
Posts: 579
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by ironduke »

It's already doable with Tazzi's program and SPS... Sounds like he's working on doing it alone with his program as well though..

I've done it on the bench without issue, need to use his program to clone a newer bin, then use sps to write the slave calibrations..SPS will see the newer vin and write as needed..
Highlander
Posts: 81
Joined: Sun May 11, 2014 6:36 pm
cars: Z06

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Highlander »

Tre-Cool wrote:I would be happy to "splash some cash" if we could get the later E38 ecu's to work in place of the earlier 64lb injector limited E38's.

Apparently it can be done & I don't think there is anything special about it since someone sell's it as a upgrade for the corvette's.
https://dsxtuning.com/collections/tunin ... 6585401424
They're 2010+ hardware that's flashed with a specially modified operating system, and then the VIN is forced to match your vehicle. The 08+ are super easy to do. 06-07 is what is a lot trickier to accomplish without wiring changes, but I've managed to make it work.


The major advantages are the increased airflow and injector flow rate limits, but there are other additions like the O2 integrator delay, adjustable axis labels, and a few others. These things also help cure the annoying 08 Z06 shutdown issue.
In fact i have a friend with one of these older e38 corvette's that we really need to do an ecu upgrade on before we put a new badder motor in, along with my brother's car.

I do know you need to swap the throttle bodies when using the different ecu years, but i guess if you can flash in the older ecu slave & immo data into a new ecu, then maybe that would keep it as a plug'n'play solution?

Or maybe we just need to put the new os into the older ecu's?
Depending on the year its just a matter of changing a few of the switches for the clutch and certain other things to work. its a direct swap.
Post Reply