pcmhacking.net

Anyone know where the security pin is stored on an ebcm for 2010 and up global A vehicle? I watched a video on YouTube where a small 8 pin eeprom was responsible for mileage or Vin on a gm ipc. Curious if there is a way to clear security pin on used modules so they can be programmed to another vehicle. They were using a clamp on ch341a reader to read and write the chip in circuit, though they stated out of circuit was sometimes necessary.

do you know the pin of the module? If you do then you can send that pin to reset it so it can be learned to the new vehicle without having to deal with any actual programming. I've done this on global ebcms. someone here may have more info on writing the pin another way.

When you say send that pin to the module, what process are you using?

it's a a device control ($AE) message sent to the module along with the pin to unlock it. then you can learn the new pin

I thought the security pin code was just a code that all modules were given when vehicle was built. They have to match in order for vehicle to start. I'm not talking about a key to access module for programming. If that code is the same as the key on global A, I don't know. I read that a new module must have all zeros for Vin and blank or zeros for security pin code in order for it to learn the code during programming. How are you communicating with a module to send the device control message? What software and interface?

You're talking about the immobilizer code, which is a vehicle pin code that the modules must learn to function properly. So if you know the pin for the vehicle the controller came out of you can use that to unlock the controller so it will accept a new pin. Log the bus for a SPS write and you might see what I'm talking about. you won't see the old pin being sent but you may see the vehicle's pin being sent to try to learn that pin. however without the pin from the vehicle the controller came out of being sent first, it will not accept the new vehicle pin.

So after the seed/key is satisified you send the pin, then wait ten minutes. After that you can send the vehicle's pin to be learned. you need some type of program that allows you to send can messages. An elm 327 with a console app should work. drewtech also has a decent program that uses standard tools like an MDI or Mongoose.

Gmtech825, are you in USA? I found a company cloning global A BCMs, but no other modules. I'm guessing sniffing the bus is the only way to find the pin?

or brute force

Cincinnatus wrote:Gmtech825, are you in USA? I found a company cloning global A BCMs, but no other modules. I'm guessing sniffing the bus is the only way to find the pin?

sniffing the bus will only give you the pin for the vehicle VIN you are working on, not the pin for the module. Unless you are bench programming that used ebcm and it still has the old VIN in it. Then SPS should send the correct pin. look for the $AE command the scan tool sends after programming. I don't believe there are many tools that support cloning EBCM's but I could be wrong. Otherwise yeah you could just read and write the controller to fix the issue

If you want to use the module of vehicle 1 on vehicle 2, you can clear the security code and frame number in the original module through the XBUS command, and then rewrite the data of vehicle 2 through SPS。