E67 to T87/T87A TCM interface needed

[Tre-Cool]

I see HPT have released an update to flash the T87A now without having to send the controller in.

Any guesses as to what they are doing/have done to allow this?

[ironduke]

Do they have a kit to purchase? Does that include a TCM plug?

If so I'm assuming they're shorting a couple of pins to each other and feeding 5v to the ign feed to get the tcm into 'gm boot' mode similar to the way ulink NT is doing it so they can read/write/change the bootloader accordingly.

[Tre-Cool]

that's the thing. it says just plug into the obdi port & away you go.

[hjtrbo]

Should that be the case I can't imagine it'll be long for some sniffing to reveal it's secrets.

[koolky]

I've been working on this CAX to lay out the CAN messages on the E67. I don't have an A2L so I've been looking for patterns that look similar to what Tre-cool had shared in a T43 CAX. I have not fully tested it so use caution. I don't have the device ID's and would appreciate if someone is able to share them.

12618164.txt

[Tre-Cool]

if you want to know the ID's for TX & RX.

Your generally pretty safe to do a search for something like 00C108

That will generally be the first RX object ID in the OS portion of the bin file.

the 08 is the amount of bytes or length of the ID.
Example E67 file.

e67.png

[koolky]

I think I mapped the ID's in the CAX as you described. What I couldn't figure out it how to decode the values. My guess was that 0=invalid vs T43 0=ECM, 14(or highest value?)=invalid.