Anyone know how to restore factory seed and Key E67

[Boostedda]

trying to pull a tune off of a ctsv via hptuners. it is locked from previous car owner. i also have winols etc. can anyone point me in the direction on how to restore the factory seed and key?

[radrace19]

I used the brute force tool to find the key for my E67 that was corrupt. I used IO Terminal to flash a file but it is still using the incorrect key. Anyone know how to fix this? EFI Live does this, but I don't have it and HPTuners does not have an unlock for the E67

I didn't want to bin the ECM, but that might be the end use for it.

[antus]

If it supports BDM it would seem USBJTAGNT or USBBDMNT should be able to read it, if there is a config file available, or one was able to develop it. On that topic, I have learnt from GM PCMs, that you would usually use IDA or Ghidra to inspect the bootloader (and there is your chicken and egg problem right there) and see if you can find what registers to poke what data in to, to configure the CPUs inputs and outputs to suit flash access and then where to read from or write too. In this case it would probably include enabling BDM mode from the application note too.

[Tazzi]

I used the brute force tool to find the key for my E67 that was corrupt. I used IO Terminal to flash a file but it is still using the incorrect key. Anyone know how to fix this? EFI Live does this, but I don't have it and HPTuners does not have an unlock for the E67

I didn't want to bin the ECM, but that might be the end use for it.

Sounds like you might have a mismatched boot/os/emulated eeprom section.

What is the service number on that ECU?

[radrace19]

I used the brute force tool to find the key for my E67 that was corrupt. I used IO Terminal to flash a file but it is still using the incorrect key. Anyone know how to fix this? EFI Live does this, but I don't have it and HPTuners does not have an unlock for the E67

I didn't want to bin the ECM, but that might be the end use for it.

Sounds like you might have a mismatched boot/os/emulated eeprom section.

What is the service number on that ECU?

My HPTuners will read and write to the ECM once I put in the lock code.

The module number is 12678511

I've read a valid and complete .bin from a similar ECU to program it thinking it would fix it, but it is still locked.

[ironduke]

2 ways I know of to get a screwed up seed/key is with tuner lock or writing a mismatching OS/full write to an ECM. The different OS is looking elsewhere or for a different eeprom layout and it's locked just like a tuner lock. a full write only writes the OS and calibration files, it does NOT write the eeprom which contains the seed and key..

If you want to change the key you need to write the eeprom segment. The only ecm that hpt lets you do that with is the e38 ecm.. So you need to either write back a compatible OS if that's what's wrong or write the eeprom segment with another tool besides hpt. It has to support cloning.

[radrace19]

2 ways I know of to get a screwed up seed/key is with tuner lock or writing a mismatching OS/full write to an ECM. The different OS is looking elsewhere or for a different eeprom layout and it's locked just like a tuner lock. a full write only writes the OS and calibration files, it does NOT write the eeprom which contains the seed and key..

If you want to change the key you need to write the eeprom segment. The only ecm that hpt lets you do that with is the e38 ecm.. So you need to either write back a compatible OS if that's what's wrong or write the eeprom segment with another tool besides hpt. It has to support cloning.

Ironduke
Thanks for the info on where the lock was stored. I flashed just the eeprom section and it fixed the problem. I'm not sure if I was power cycling the ECM incorrectly when doing the full write or what, but it is fixed now. Thanks for the input everyone.