GM Reverse Engineering

[VX L67 Getrag]

Haven't got my car A.T.M. due to Mrs having my car as her's is in the panel shop... so I can't test factory radio!

But I had a VX Berlina with climate control & these were the responses I got...

10:00:54 AM Tx'd Frame = EA, 57, 1, 0, BE,
10:00:54 AM Rx'd Frame = EA, 66, 1, 0, 8E, 82, 8C, 5D, 32, 0, 83, 2A, 0, 0, 36, FE, 1, 39, 0, 69,
10:01:09 AM Tx'd Frame = EA, 57, 1, 1, BD,
10:01:09 AM Rx'd Frame = EA, 66, 1, 1, 34, B6, D7, 0, 35, 80, 0, 0, 0, 11, 68, 0, 3B, FF, C4, C1,
10:01:16 AM Tx'd Frame = EA, 57, 1, 2, BC,
10:01:16 AM Rx'd Frame = EA, 66, 1, 2, D6, 53, FF, 80, 71, 3B, FF, B1, 3F, 0, FC, FF, B, 85, 0, DF,
10:01:22 AM Tx'd Frame = EA, 57, 1, 3, BB,
10:01:22 AM Rx'd Frame = EA, 66, 1, 3, 35, 1, B, 0, 63, 36, 12, 0, 0, 0, 0, 67, 82, 68, 71, FE,
10:01:27 AM Tx'd Frame = EA, 57, 1, 4, BA,
10:01:27 AM Rx'd Frame = EA, 66, 1, 4, 8E, 82, 8C, 5D, 0, B6, 83, 2A, 0, C4, 53, 80, 71, 3B, FF, D,
10:01:31 AM Tx'd Frame = EA, 57, 1, 5, B9,
10:01:31 AM Rx'd Frame = EA, 66, 1, 5, 66, 5D, 88, 0, 35, 80, 0, 0, 3, 11, 68, 0, 3B, FF, C4, 30,
10:01:37 AM Tx'd Frame = EA, 57, 1, 6, B8,
10:01:37 AM No Response

I tried sending too 6 a few times & no response so assuming 5 is it's limit!

Hope it helps & I can get more for you later!

[Jayme]

I can log some responses with my VY stock radio if needed. jsut send me the frames you want to send and ill log the response in VL400's flash tool ?

[VX L67 Getrag]

Yeah I just used VL's flash tool!

Just send EB,57,1,0 (auto checksum ticked)
Then send EB,57,1,1 then EB,57,1,2 etc till you get no response!

Can just copy paste what I typed & ready to go!

[Tazzi]

Cheers for the offer VL, I may take you up on that after Iv done a couple other modules. Since I expect the PIM to be massive somehow.. and it will request a heap of tables at once.

Cheers VXGetrag! I'll see what happens when tinkering with those responses from the vx. Doubt it will work for vy/vz's but when I move onto the vt/vx's im sure it'll come in handy!

Jayme if you could grab some responses that would be great! U'll need to send: EB,57,01,00,BD
And if you could try a few other variations that would be brilliant. eg EB,57,01,01,checksum

Not sure if I have a vt/vx cluster here on the bench (think its vx) but seems the tech is happy to communicate to it using the vy bcm chatter. VZ must have additional chatter that Im missing hence it failed to work.

[VX L67 Getrag]

in regards to sending commands using flashtool... don't need the 0 before anything so what I had will work & I will do VY when 1 comes in too!

[VX L67 Getrag]

Well I did some sending commands on my 2003 VY Berlina today....

10:34:31 AM Tx'd Frame = EA, 57, 1, 0, BE,
10:34:31 AM Rx'd Frame = EA, 77, 1, 0, 2, 5, 7, A, 2, 2, 1, 4, 2, 3, 6, 3, 1, 3, 92, 8, 42, 29, 0, 0, 0, 9, 1, 40, F4, 1C, 1, 0, 0, 0, 0, 0, B,
10:34:37 AM Tx'd Frame = EA, 57, 1, 1, BD,
10:34:37 AM Rx'd Frame = EA, 77, 1, 1, 7A, 43, 8C, 84, 7E, 7E, 28, 95, 0, FF, 0, 0, 0, 3A, 2D, 0, 21, 8, 37, E5, 0, 0, 0, 53, 19, 64, 7E, 7E, 21, 2, 0, 0, 7D,
10:34:44 AM Tx'd Frame = EA, 57, 1, 2, BC,
10:34:45 AM Rx'd Frame = EA, 77, 1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 98,
10:34:51 AM Tx'd Frame = EA, 57, 1, 3, BB,
10:34:51 AM Rx'd Frame = EA, 77, 1, 3, 0, 0, 46, 0, 8, 3A, 14, 3A, 0, 46, AA, BD, 0, F0, 3, 3, 3, 14, 36, 21, 14, 41, 0, 46, AA, AB, 0, F0, 3, 3, 6, 14, B4,
10:35:04 AM Tx'd Frame = EA, 57, 1, 4, BA,
10:35:04 AM Rx'd Frame = EA, 77, 1, 4, 94, 28, 43, 83, 3A, 21, FF, 0, E8, FF, 0, 1C, 42, 0, 26, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 53,
10:35:12 AM Tx'd Frame = EA, 57, 1, 5, B9,
10:35:12 AM Rx'd Frame = EA, 77, 1, 5, 7E, 7E, 95, 7F, 7F, 7F, 8C, 53, 53, 64, 64, 0, 4B, 0, 4B, FC, 8B, FC, 8B, FC, 8B, 0, 2D, 0, 0, 0, 1, 87, F, 6, 37, 0, 65,
10:35:20 AM Tx'd Frame = EA, 57, 1, 6, B8,
10:35:20 AM Rx'd Frame = EA, 77, 1, 6, 7E, 53, 0, 4E, FF, 6, 0, 8C, 41, 28, 57, 6C, A, 50, 28, 28, 64, 0, 0, 0, 1, 87, F, 6, 37, 12, 0, 27, 0, 0, 0, 0, A1,
10:35:26 AM Tx'd Frame = EA, 57, 1, 7, B7,
10:35:26 AM Rx'd Frame = EA, 67, 1, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, A7,
10:35:31 AM Tx'd Frame = EA, 57, 1, 8, B6,
10:35:31 AM No Response

10:35:51 AM Tx'd Frame = EB, 57, 1, 0, BD,
10:35:51 AM Rx'd Frame = EB, 79, 1, 0, 1, D6, 7, 3E, 25, 0, 0, 19, 0, 0, 0, 0, 4, 2, 1, 0, 1, 0, 0, 1, 0, 2, 0, 0, 4, 2, 0, FF, 6, E, 0, 0, 6, 95, 82,
10:35:57 AM Tx'd Frame = EB, 57, 1, 1, BC,
10:35:57 AM Rx'd Frame = EB, 5B, 1, 1, 0, 0, 0, 0, B8,
10:36:09 AM Tx'd Frame = EB, 57, 1, 2, BB,
10:36:09 AM Rx'd Frame = EB, 80, 1, 2, 3, 4, 5, 5, 3, 22, 1, 18, 24, 92, 9, 64, 66, 1, 60, 98, 55, 33, 44, 33, 55, 4E, 37, 35, 43, 33, 30, 4C, 35, 36, 37, 1D, 17, 21, C, 0, 0, 0, 0, 0, 1, 8C,
10:36:14 AM Tx'd Frame = EB, 57, 1, 3, BA,
10:36:14 AM Rx'd Frame = EB, 69, 1, 3, 0, 0, 7, 0, 1, 1A, FF, 3F, 0, 0, 0, 59, AB, FF, 1, 15, 56, 0, D9,
10:36:19 AM Tx'd Frame = EB, 57, 1, 4, B9,
10:36:19 AM Rx'd Frame = EB, 59, 1, 4, 63, 32, 22,
10:36:38 AM Tx'd Frame = EB, 57, 1, 5, B8,
10:36:38 AM No Response
10:36:38 AM Too Many ReSends, Aborted Task
10:36:43 AM Tx'd Frame = EB, 57, 1, 6, B7,
10:36:43 AM No Response
10:36:50 AM Too Many ReSends, Aborted Task

10:37:15 AM Tx'd Frame = E4, 57, 1, 0, C4,
10:37:15 AM No Response

[Tazzi]

Well I did some sending commands on my 2003 VY Berlina today....

Nice work!. Feel like a kid in a candy store.

Will update later with what I find out.

[Tazzi]

Did a bit of tinkering this morning, and didnt quite find what I wanted. Hoping to find the radio pin and also a "rear speaker" enable option although havent found either. Only place I know the pin is stored is in the bcm although that doesnt help when a new radio is plugged in.

I do think I have found out how to display messages on instrument cluster lcd screen, all a matter of spamming the radios message (ID is B9) and the cluster should display whatever is written in the message. I looked into this a little bit with another member but didnt have the tools/software at the time to mess with. You can see in the image below that nothing is filled in as it is waiting for the radios message from the car chatter although I havent added that in yet! Will have to test that more with the tech2.


Getting back to enabling the rear speakers. The only two things I could program on the tech2 were the "code index" and also the "antenna". Im guessing that if I wrote a sedans code index into a utes radio (non-rear speaker enabled) that would do the trick?
Alternatively, when clicking the on the audio system at first, it brings up general information about it eg firmware,software,serial,ect. Possibly work out what each byte corresponds to on the tech2 then trying one change at a time writing back to the radio to see if rear speakers enable? Annoying part of this is I will need a ute radio to work on... or at least compare its info with that of a standard sedan.
Also the write "mode" for the radio is 0C. I wrote a code index of 8 (I think) and tech2 sent: EB 6C 0C 01 00 00 08 00 01 0A 00 3F 08 00 00 59 AB FF 01 15 56 00 02 03 01 CD
And for a code index of 9: EB 6C 0C 01 00 00 09 00 02 1A 00 3F 04 00 00 59 AB FF 01 15 56 00 02 03 00 C0


And incase anyones interested in how Im "mimicing" a module, my cluttered screen looks like this:


Again any ideas are appreciated!

[antus]

I think I will have access to my mates vy pano (ute body) this arvo. I'll see what I can do.

[antus]

This is from an 04 VY SS Sandman (ute body):

5:44:19 PM Tx'd Frame = EA, 57, 1, 0, BE,
5:44:19 PM Rx'd Frame = EA, 77, 1, 0, 2, 5, 7, A, 2, 2, 4, 4, 4, 4, 3, 4, 1, 3, 92, 16, 42, 17, 0, 0, 0, 9, 3, 40, F4, 1D, 1, 0, 0, 0, 0, 0, 8,
5:44:26 PM Tx'd Frame = EA, 57, 1, 1, BD,
5:44:26 PM Rx'd Frame = EA, 77, 1, 1, 77, 3E, 90, 73, 8A, 8A, 2B, 91, 0, FF, 0, 0, 0, 35, 2D, 0, 21, 8, 27, E8, 0, 0, 0, 42, 19, 4, 72, 72, 9, 7, 0, 0, 29,
<2 no response>
5:44:40 PM Tx'd Frame = EA, 57, 1, 3, BB,
5:44:40 PM Rx'd Frame = EA, 77, 1, 3, 0, 0, 46, 0, 8, 35, 14, 36, 0, 46, AA, B6, 0, F0, 3, 3, 3, 14, 36, 21, 14, 32, 0, 46, AA, AA, 0, F0, 3, 3, 6, 14, D4,
5:44:46 PM Tx'd Frame = EA, 57, 1, 4, BA,
5:44:46 PM Rx'd Frame = EA, 77, 1, 4, 91, 2B, 3E, 73, 35, 21, FF, 2, E8, FF, 0, 1C, 3, 0, 26, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, AA,
5:44:56 PM Tx'd Frame = EA, 57, 1, 5, B9,
5:44:56 PM Rx'd Frame = EA, 77, 1, 5, 72, 72, 91, 8A, 8A, 8A, 90, 42, 42, 4, 4, 0, 2F, 0, 2F, FA, E1, FA, E1, FA, E1, 0, 2D, 0, 0, 0, 1, B7, 0, 4, 27, 0, 6B,
5:45:53 PM Tx'd Frame = EA, 77, 1, 6, BC, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, DC,
5:45:53 PM Rx'd Frame = EA, 77, 1, 6, 8A, 42, 0, 2F, FF, 2D, 0, 8C, 41, 28, 57, 6C, A, 50, 28, 28, 64, 0, 0, 0, 1, B7, 0, 4, 27, 0, F, 28, 0, 0, 0, 0, 91,
5:46:01 PM Tx'd Frame = EA, 77, 1, 7, BC, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, DB,
5:46:01 PM Rx'd Frame = EA, 67, 1, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, A7,

5:47:22 PM Tx'd Frame = EB, 57, 1, 0, BD,
5:47:22 PM Rx'd Frame = EB, 79, 1, 0, 12, 0, 0, 0, 0, 3E, 8, B, 0, 0, 3, 1, 5, 3, 1, 0, 1, 0, 0, 1, 0, 2, 0, B, 8, 4, 1, FF, 6, E, 0, 6, 6, D1, 1F,
5:47:55 PM Tx'd Frame = EB, 57, 1, 1, BC,
5:47:55 PM Rx'd Frame = EB, 5B, 1, 1, 0, 0, 0, 0, B8,
5:48:10 PM Tx'd Frame = EB, 57, 1, 2, BB,
5:48:10 PM Rx'd Frame = EB, 80, 1, 2, 3, 8, 10, 12, 3, 35, 27, 18, 24, 92, 11, 20, 88, 2, 68, 78, 42, 36, 47, 31, 59, 4B, 34, 32, 46, 58, 34, 4C, 32, 35, 31, 38, 33, 39, C, 0, 0, 0, 0, 0, 1, 3C,
5:48:17 PM Tx'd Frame = EB, 57, 1, 3, BA,
5:48:17 PM Rx'd Frame = EB, 69, 1, 3, 0, 0, 9, 0, 1, 1A, 0, 3F, 4, 0, 0, 59, AB, FF, 1, 15, 56, 0, D2,