GM E38 E67 E40 Kernel/Bootloader Development Extravaganza

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
ScarabEpic22
Posts: 21
Joined: Fri Jan 08, 2021 3:36 am
cars: TrailBlazer SS E67 LS2, Sonic E78 LUV
Location: Seattle, WA, USA

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by ScarabEpic22 »

xadonxander wrote:I just found this site. I will be a regular here now. I am working on a 2009 corvette with the e38 pcm. I normally work on BMW, Ferrari, and Lamborghini where I have done extensive work with their ECU's. I have ktag, kess, carprog, several various VCI's. I am willing to help out. HPTuners has bricked 2 PCM's so far.
Make sure you're only flashing the same OS into the ECM, if you try and switch OS' using commercial tools, you will brick the ECM. Only use the full programming operation if you absolutely need to (some VATS, Custom OS', or explicitly stated that it's required), otherwise only do calibration writes and you won't have a problem.

Are you able to revive them by flashing a compatible OS via TDS? If you can communicate on a bench harness, that'll be your best bet.

There are 2 CPUs in E38/E67s, main and slave. Only GM's software so far writes the slave CPU, which contains the DBW/ETC OS+calibration. If there's a mismatch between that OS+cal and the main OS, you'll have a dead pedal, loss of comms errors, or other odd behavior. That's if you're switching between the same year OS' but changing vehicle platforms. If you go between OS years, such as 07 -> 09, there are different corresponding ECM hardware service numbers. Tazzi mentions why that's important earlier in this thread (check out his post here: viewtopic.php?f=38&t=6416&start=360#p100054) as the parameter block, which contains the VIN, ECM serial, and so forth, changes. I had this issue in 2011 when I flashed an 07 (main) OS into an 08 ECM using a commercial tool. When reading the VIN, it was in a scrambled/non-standard format. Flashing back to the correct OS/hardware pair resolved it.
User avatar
Tazzi
Posts: 3431
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Spot on with the above comment.

I have wanted to add slave programming to the application, but its a bit of a gray area legally if using GMs kernel.

From what I have been told, the kernels are produced by the ECM manufacture and given to GM to use with them. I am not sure if there is any copyrights/usage rights with them so its a bit of a "dunno" area.

Those doing OS swaps to technically incompatible OS's with the slave, then a FULL clone option needs to be done to copy the parameter block, and then perform a GM SPS online update which will update the slave.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
xadonxander
Posts: 2
Joined: Fri Jan 29, 2021 8:37 pm
cars: 328i, 325xi, 335i, polaris slingshot, volvo v70

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by xadonxander »

ScarabEpic22 wrote:
xadonxander wrote:I just found this site. I will be a regular here now. I am working on a 2009 corvette with the e38 pcm. I normally work on BMW, Ferrari, and Lamborghini where I have done extensive work with their ECU's. I have ktag, kess, carprog, several various VCI's. I am willing to help out. HPTuners has bricked 2 PCM's so far.
Make sure you're only flashing the same OS into the ECM, if you try and switch OS' using commercial tools, you will brick the ECM. Only use the full programming operation if you absolutely need to (some VATS, Custom OS', or explicitly stated that it's required), otherwise only do calibration writes and you won't have a problem.

Are you able to revive them by flashing a compatible OS via TDS? If you can communicate on a bench harness, that'll be your best bet.

There are 2 CPUs in E38/E67s, main and slave. Only GM's software so far writes the slave CPU, which contains the DBW/ETC OS+calibration. If there's a mismatch between that OS+cal and the main OS, you'll have a dead pedal, loss of comms errors, or other odd behavior. That's if you're switching between the same year OS' but changing vehicle platforms. If you go between OS years, such as 07 -> 09, there are different corresponding ECM hardware service numbers. Tazzi mentions why that's important earlier in this thread (check out his post here: viewtopic.php?f=38&t=6416&start=360#p100054) as the parameter block, which contains the VIN, ECM serial, and so forth, changes. I had this issue in 2011 when I flashed an 07 (main) OS into an 08 ECM using a commercial tool. When reading the VIN, it was in a scrambled/non-standard format. Flashing back to the correct OS/hardware pair resolved it.
I literally read the PCM with HPTuners, purchased a license and changed the transmission to manual. As soon as it started flashing it failed telling me I do not have a license for the PCM. Now when I read the PCM the serial number comes back as garbage but everything else seems fine. I can scan it with my launch and see all the sensors, vin and everything. It was the stock ECU so there should be no issues.

The second PCM was flashed with tech2, car started and ran with jumpered neutral safety switch. Exact same thing happened when trying to change the trans to manual in the PCM.

It sorta seems like HPTuners is trying to write the file to the wrong memory address and overwriting the serial number.
ScarabEpic22
Posts: 21
Joined: Fri Jan 08, 2021 3:36 am
cars: TrailBlazer SS E67 LS2, Sonic E78 LUV
Location: Seattle, WA, USA

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by ScarabEpic22 »

xadonxander wrote:
ScarabEpic22 wrote:
xadonxander wrote:I just found this site. I will be a regular here now. I am working on a 2009 corvette with the e38 pcm. I normally work on BMW, Ferrari, and Lamborghini where I have done extensive work with their ECU's. I have ktag, kess, carprog, several various VCI's. I am willing to help out. HPTuners has bricked 2 PCM's so far.
Make sure you're only flashing the same OS into the ECM, if you try and switch OS' using commercial tools, you will brick the ECM. Only use the full programming operation if you absolutely need to (some VATS, Custom OS', or explicitly stated that it's required), otherwise only do calibration writes and you won't have a problem.

Are you able to revive them by flashing a compatible OS via TDS? If you can communicate on a bench harness, that'll be your best bet.

There are 2 CPUs in E38/E67s, main and slave. Only GM's software so far writes the slave CPU, which contains the DBW/ETC OS+calibration. If there's a mismatch between that OS+cal and the main OS, you'll have a dead pedal, loss of comms errors, or other odd behavior. That's if you're switching between the same year OS' but changing vehicle platforms. If you go between OS years, such as 07 -> 09, there are different corresponding ECM hardware service numbers. Tazzi mentions why that's important earlier in this thread (check out his post here: viewtopic.php?f=38&t=6416&start=360#p100054) as the parameter block, which contains the VIN, ECM serial, and so forth, changes. I had this issue in 2011 when I flashed an 07 (main) OS into an 08 ECM using a commercial tool. When reading the VIN, it was in a scrambled/non-standard format. Flashing back to the correct OS/hardware pair resolved it.
I literally read the PCM with HPTuners, purchased a license and changed the transmission to manual. As soon as it started flashing it failed telling me I do not have a license for the PCM. Now when I read the PCM the serial number comes back as garbage but everything else seems fine. I can scan it with my launch and see all the sensors, vin and everything. It was the stock ECU so there should be no issues.

The second PCM was flashed with tech2, car started and ran with jumpered neutral safety switch. Exact same thing happened when trying to change the trans to manual in the PCM.

It sorta seems like HPTuners is trying to write the file to the wrong memory address and overwriting the serial number.
Bench or in car?

Just changing the Transmission type from Auto to Manual on a Gen IV (or Gen IIIs) doesn't turn an automatic OS into a manual one. You need to use a manual OS and/or segment swap the necessary segments from a manual file into the auto one to make it work properly.
User avatar
Tazzi
Posts: 3431
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Aus post lost a (semi) cheap E40 that I had on the way.
Went down the rabbit hole of trying to find a replacement from USA, it it seems theres an identical ECM but called a P12.

From what I understand the difference is the P12 uses VPW primarily including updates, wheres the E40 uses CANbus.
Not sure if it would be possible to flash the firmware from a E40 into a P12.. but Id need them side by side to look at them internally to check.

Kinda annoyed since cheapest I can find now is around $500usd :roll:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Gatecrasher
Posts: 273
Joined: Sat Apr 25, 2020 6:09 am

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Gatecrasher »

Is this a mostly complete list of E40 applications? Is E40 cast into the case like on the E67s?

05 Chevrolet Corvette 6.0L
06 Chevrolet Impala SS 5.3L
06 Chevrolet Monte Carlo SS 5.3L
05-06 Holden Special Vehicles (HSV) 6.0L
05-06 Pontiac Grand Prix GXP 5.3L
05-06 Pontiac GTO 6.0L
05-06 Buick Rainier 5.3L
05-06 Chevrolet Trailblazer 5.3L
06 Chevrolet Trailblazer SS 6.0L
05-06 GMC Envoy 5.3L
05-06 Isuzu Ascender 5.3L
05-06 Saab 9-7x 5.3L
05-06 Chevrolet SSR 6.0L

I can keep an eye out for these or anything else at the local self serve yards. The SUVs and W-body cars come through pretty regularly.
Vampyre
Posts: 261
Joined: Wed Dec 06, 2017 1:02 pm
cars: grand am, trans am

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Vampyre »

I've got 3 e40s sitting on the shelf in garage
User avatar
Tazzi
Posts: 3431
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by Tazzi »

Gatecrasher wrote:Is this a mostly complete list of E40 applications? Is E40 cast into the case like on the E67s?

05 Chevrolet Corvette 6.0L
06 Chevrolet Impala SS 5.3L
06 Chevrolet Monte Carlo SS 5.3L
05-06 Holden Special Vehicles (HSV) 6.0L
05-06 Pontiac Grand Prix GXP 5.3L
05-06 Pontiac GTO 6.0L
05-06 Buick Rainier 5.3L
05-06 Chevrolet Trailblazer 5.3L
06 Chevrolet Trailblazer SS 6.0L
05-06 GMC Envoy 5.3L
05-06 Isuzu Ascender 5.3L
05-06 Saab 9-7x 5.3L
05-06 Chevrolet SSR 6.0L

I can keep an eye out for these or anything else at the local self serve yards. The SUVs and W-body cars come through pretty regularly.
Thanks for that, Im starting to make one hell of a list to watch for certain words on Ebay being listed.
Vampyre wrote:I've got 3 e40s sitting on the shelf in garage
If one or any are for sale, please do let me know. :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
ironduke
Posts: 583
Joined: Thu Feb 13, 2020 11:32 pm
cars: Mainly GM trucks, a Cruze and an Equinox for dailys..

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by ironduke »

I have half a dozen with the 3 plugs that match an E40 on Ebay but they don't say E40 on them.. If anyone has a listing of part numbers post them up.. If I have one it's gonna get sent to Tazzi..

Some quick googling..
2005-12597883
2005-12597191
2006-12596679

Some service numbers on another site listed as E40
12597883, 12578554, 12597191, 12596733, 19210071

I'll check what I have at the shop tomrrow, looked at home and I don't have any of the 3 plug ecm's besides an E92 on the bench.
ScarabEpic22
Posts: 21
Joined: Fri Jan 08, 2021 3:36 am
cars: TrailBlazer SS E67 LS2, Sonic E78 LUV
Location: Seattle, WA, USA

Re: GM E38 E67 Kernel/Bootloader Development Extravaganza

Post by ScarabEpic22 »

E40 was V8 (maybe a random V6 too?) only, P12 was used on inline engines only and does transmission control as well (last PCM from GM). From what I've read, they're in the same case, but have different hardware internally. The E60/LLY Duramax ECM uses the same case and harness connectors as E40+P12, you can use the same bench harness to communicate with all 3 of them (P12, E40, E60/LLY).

P12 was used mainly on Atlas I4/5/6 engines and a few other 2L I4s (Cobalt SS comes to mind). It's also the successor to the P10 for 4.2 I6 engines. [If you ever want to dig into an old oddball PCM with the P10 (02-05, 1 engine, 1 platform), I've got extra PCMs and would be happy to ship you a few. Might be more up antus/NSFW's alley with the VPW comms though.] I've got a dead P12 (believe it's 06, I'll go dig it out), happy to cut it open and provide numbers off the chips it if that'd help.

I know that:
P12 MY 04-06, 7x crank reluctor, 1MB flash
P12 MY 07, 58x crank reluctor, 2MB flash (not sure why GM didn't just go to the E67+T42?)
E40s have different service numbers 05 to 06. I'm going to speculate it was done for the same reason the E38/67s had different service numbers: parameter block changes...

The 07 P12 I have here has p/n 12613427, service no 12602010.
Post Reply