Solved - How to relink Pontiac GTO or Holden VZ ECM to PIM

[dzidaV8]

Hi!
I've been troubleshooting a problem with VTD relearn on my 2006 GTO. E40 ECM was reflashed to stock using SPS and lost VTD code. I was expecting that, so I extracted the PIM PIN code and ran the SPS relink procedure. But on this car it keeps failing.
Relink asks for a PIN, accepts it and then asks if ECM, PIN or both were replaced. No matter what I select it shows "incorrect selection" and ends procedure.

I logged the comms and after successful ECM security access it tries WDBI the PIN to PIM's block 62 and it fails with NRC 31, Request Out Of Range.
I tried resetting PIM and it succeeded. I can see that the reset writes PIN to WDBI block 60 and then WBDI block 6D. After that the last 4 bytes in EEPROM changed to 0. But after the reset the relink still has the same issue.

What I don't understand is why there are no commands to ECM. The PIM is already coded and only ECM lost the key after SPS. There is no communication between PIM-ECM during WDBI 62 request either.
I looked into the E55 PIM tool and the relink procedure seems the same, except WDBI to block 63.

Here's log of first relink attempt and then PIM reset:

Code: Select all

Number	Time (ms)	ID/PID (hex)	Length	D0	D1	D2	D3	D4	D5	D6	D7	D...	
49855	115111.2	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
50042	115543.9	0101	8	FE	02	1A	B0	AA	AA	AA	AA		All Nodes: Report ECU diag address
50047	115552.4	0644	8	10	20	5A	B0	1C	1D	1E	1F		PIM address response FF: 1C, 1D, 1E, 1F
50048	115556.3	07E8	8	03	5A	B0	11	AA	AA	AA	AA		ECM address response: 11
50063	115582.5	0643	8	03	7F	1A	78	00	00	00	00		response pending
50078	115607.5	0643	8	03	5A	B0	43	00	00	00	00		EBTCM address response: 43
50578	116774.5	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
51216	118239.6	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
51433	118739.5	0101	8	FE	02	10	02	AA	AA	AA	AA		All Nodes: Disable All DTCs
51434	118744.3	07E8	8	01	50	AA	AA	AA	AA	AA	AA		ECM Ack
51438	118745.7	0644	8	01	50	5A	B0	1C	1D	1E	1F		PIM Ack
51445	118764.5	0643	8	01	50	00	00	00	00	00	00		EBTCM Ack
51856	119704.4	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52188	120477.3	0101	8	FE	01	28	AA	AA	AA	AA	AA		All Nodes: Disable Normal Comms
52189	120480.9	07E8	8	01	68	AA	AA	AA	AA	AA	AA		ECM Ack
52190	120486.8	0644	8	01	68	5A	B0	1C	1D	1E	1F		PIM Ack
52191	120502.1	0643	8	01	68	00	00	00	00	00	00		EBTCM Ack
52192	121169.1	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52193	122342.0	0101	8	FE	01	A2	AA	AA	AA	AA	AA		All Nodes: Report programmed state
52194	122348.5	0644	8	05	7F	A2	11	00	00	1E	1F		PIM: NRC 11
52195	122355.5	07E8	8	02	E2	00	AA	AA	AA	AA	AA		ECM: fully programmed
52196	122633.8	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52197	124098.4	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52198	124801.0	07E0	8	04	2C	FE	16	44	AA	AA	AA		To ECM: PID 1644 to packet FE
52199	124805.2	07E8	8	02	6C	FE	AA	AA	AA	AA	AA		ECM: Ack
52200	125269.6	07E0	8	03	AA	01	FE	AA	AA	AA	AA		To ECM: read packet FE
52201	125305.3	05E8	8	FE	A0	43	00	00	00	00	00		ECM: packet FE (PID 1644) response
52202	125563.2	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52203	127027.6	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52204	128492.0	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52205	129956.8	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52206	131421.0	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52207	132087.6	07E0	8	02	27	01	AA	AA	AA	AA	AA		To ECM: Req seed
52208	132091.1	07E8	8	04	67	01	19	FB	AA	AA	AA		ECM: Seed resp
52209	132294.4	07E0	8	04	27	02	5F	A2	AA	AA	AA		To ECM: Send key
52210	132302.9	07E8	8	02	67	02	AA	AA	AA	AA	AA		ECM: Key ack
52211	132411.4	0244	8	06	3B	62	32	36	37	31	AA		To PIM: WDBI block 62, PIN 2671
52212	132421.0	0644	8	03	7F	3B	78	00	00	1E	1F		response pending
52213	132513.1	0644	8	03	7F	3B	31	00	00	1E	1F		PIM: request out of range
52214	132885.0	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52215	134349.3	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52216	135813.9	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52217	137278.3	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52218	138742.9	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52219	140207.9	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52220	141672.6	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52221	143136.9	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52222	144601.5	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52223	146066.3	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52224	146359.2	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
52225	147032.5	0101	8	FE	01	20	AA	AA	AA	AA	AA		All Nodes: Return to normal
52226	147037.9	07E8	8	01	60	AA	AA	AA	AA	AA	AA		ECM: ack
52235	147041.3	0644	8	01	60	3B	31	00	00	1E	1F		PIM: Ack
54123	151407.9	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
54331	151875.3	0101	8	FE	02	1A	B0	AA	AA	AA	AA		All Nodes: Report ECU diag address
54332	151883.5	0644	8	10	20	5A	B0	1C	1D	1E	1F		PIM address response FF
54333	151887.6	07E8	8	03	5A	B0	11	AA	AA	AA	AA		ECM address response: 11
54348	151914.1	0643	8	03	7F	1A	78	00	00	00	00		response pending
54362	151939.2	0643	8	03	5A	B0	43	00	00	00	00		EBTCM address response: 43
54763	152873.1	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
55398	154338.5	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
55518	154612.0	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
79023	208883.2	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
79112	209092.2	0101	8	FE	02	1A	B0	AA	AA	AA	AA		All Nodes: Report ECU diag address
79116	209095.8	0644	8	10	20	5A	B0	1C	1D	1E	1F		PIM address response FF
79120	209106.2	07E8	8	03	5A	B0	11	AA	AA	AA	AA		ECM address response: 11
79130	209131.4	0643	8	03	7F	1A	78	00	00	00	00		response pending
79145	209156.6	0643	8	03	5A	B0	43	00	00	00	00		EBTCM address response: 43
79693	210428.8	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
80206	211603.8	0101	8	FE	02	10	02	AA	AA	AA	AA		All Nodes: Disable All DTCs
80211	211612.5	0644	8	01	50	5A	B0	1C	1D	1E	1F		PIM ack
80212	211619.2	07E8	8	01	50	AA	AA	AA	AA	AA	AA		ECM ack
80219	211628.3	0643	8	01	50	00	00	00	00	00	00		EBTCM ack
80333	211893.6	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
80972	213358.5	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
80981	213378.8	0101	8	FE	01	28	AA	AA	AA	AA	AA		All Nodes: Disable Normal Comms
80985	213387.2	0644	8	01	68	5A	B0	1C	1D	1E	1F		PIM ack
80986	213394.0	07E8	8	01	68	AA	AA	AA	AA	AA	AA		ECM ack
80987	213403.2	0643	8	01	68	00	00	00	00	00	00		EBTCM ack
80988	214823.4	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
80989	215125.7	0101	8	FE	01	A2	AA	AA	AA	AA	AA		All Nodes: Report programmed state
80990	215131.1	07E8	8	02	E2	00	AA	AA	AA	AA	AA		ECM: fully programmed
80991	215134.8	0644	8	05	7F	A2	11	00	00	1E	1F		NRC 11
80992	216288.2	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
80993	217416.8	0244	8	06	3B	60	32	36	37	31	AA		To PIM: WDBI PIN (ID 60): 2671
80994	217419.0	0644	8	03	7F	3B	78	00	00	1E	1F		response pending
80995	217428.4	0644	8	02	7B	60	78	00	00	1E	1F		PIM: WDBI OK
80996	217653.0	0244	8	02	3B	6D	AA	AA	AA	AA	AA		To PIM: WDBI (ID 6D)
80997	217654.7	0644	8	03	7F	3B	78	00	00	1E	1F		response pending
80998	217753.4	0101	8	FE	01	3E	AA	AA	AA	AA	AA		Tester Present
80999	217756.7	0644	8	02	7B	6D	78	00	00	1E	1F		PIM: WDBI OK

ECM also has block 6D so I'm suspicious if something should be done there:

Code: Select all

ECM avaliable blocks:
TX: 1A 20
RX: 5A 20 00 00 00 00
TX: 1A 30
RX: 5A 30 33 03 3C 3C
TX: 1A 31
RX: 5A 31 05 0F 14 64 32 0C 05
TX: 1A 32
RX: 5A 32 02
TX: 1A 6D
RX: 5A 6D FE
TX: 1A 75
RX: 5A 75 A5 A5
TX: 1A 90
RX: 5A 90 36 47 32 56 58 31 32 55 58 36 4C 35 34 34 39 36 34
TX: 1A 97
RX: 5A 97 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
TX: 1A 98
RX: 5A 98 39 39 39 39 39 30 30 30 38 38
TX: 1A 99
RX: 5A 99 20 25 08 31
TX: 1A 9A
RX: 5A 9A 80 01
TX: 1A A0
RX: 5A A0 00
TX: 1A B0
RX: 5A B0 11
TX: 1A B2
RX: 5A B2 FF FF FF FF FF
TX: 1A B4
RX: 5A B4 38 36 59 4D 4D 59 4D 30 35 32 37 36 32 56 35 52
TX: 1A B6
RX: 5A B6 FF FF FF FF FF
TX: 1A B7
RX: 5A B7 FF FF FF FF FF
TX: 1A B8
RX: 5A B8 FF FF FF FF FF
TX: 1A B9
RX: 5A B9 00 00
TX: 1A C1
RX: 5A C1 00 C0 55 78
TX: 1A C2
RX: 5A C2 05 7E B1 62
TX: 1A C3
RX: 5A C3 05 7E B1 64
TX: 1A C4
RX: 5A C4 05 7E B1 66
TX: 1A C5
RX: 5A C5 05 7F 0E 39
TX: 1A C6
RX: 5A C6 05 7E B1 60
TX: 1A C9
RX: 5A C9 00 C0 3A 00
TX: 1A CA
RX: 5A CA 05 7E B1 6A
TX: 1A CB
RX: 5A CB 00 C0 4F FE
TX: 1A CC
RX: 5A CC 00 C0 33 23
TX: 1A D1
RX: 5A D1 41 41
TX: 1A D2
RX: 5A D2 41 42
TX: 1A D3
RX: 5A D3 41 42
TX: 1A D4
RX: 5A D4 41 42
TX: 1A D5
RX: 5A D5 41 42
TX: 1A D6
RX: 5A D6 41 42
TX: 1A D9
RX: 5A D9 41 41
TX: 1A DA
RX: 5A DA 41 42
TX: 1A DB
RX: 5A DB 20 20
TX: 1A DC
RX: 5A DC 20 20

I have also attached EEPROM read from the PIM.

I event tried sending mode AE FE 80 to ECM as described in GMW3110 to relearn theft (getting security access first), but it didn't change a thing.

I've spent far too much time on this relink, thanks for any help!

[kur4o]

Send me the VIN, there might be some special files that need to be run through programming for successful relearn. Usually some timers are needed to be exact match and happens in timely manner.

[kur4o]

I found the vin in attached file. There are 2 files but are some dlls and can`t be run without tis2000,

I noticed vin is written backwards, that may be also valid for pin, you can try 1762 for pin.

Do you know pin is present in e40 ecm eeprom.

[gametech]

There was a thread about this issue on the ls1gto site a while back. The proper "by the book" procedure did not work, but they eventually figured it out. I forget the exact details, but a search on the site would bring up the thread.

[dzidaV8]

I found the vin in attached file. There are 2 files but are some dlls and can`t be run without tis2000,

I noticed vin is written backwards, that may be also valid for pin, you can try 1762 for pin.

Do you know pin is present in e40 ecm eeprom.

E40 has DTC set for theft deterrent not programmed, and SPS makes no request to write it. VIN being backwards in PIM is normal, it reports correctly. I tried two different ECMs with same result. Something with this particular VIN is off.

Also, 2671 PIN is correct as it accepts it for PIM reset. I tried earlier the reversed one you proposed and PIM reset failed.

[kur4o]

Why not just disable vats within ecm, it will be way easier that trying a relearn.

Do you have the bin out of the e40 ecm.

[kur4o]

To disable vats change at address 9cbe3 --> 7e01 to 7e00,
rewrite OS

[dzidaV8]

OK, so I figured it out.
SPS must have this bugged for some VINs, it tries to write to a wrong block.
Logged the successful relink with PIM/ECM reflashed to different VIN and the correct went as follows:

Code: Select all

Number	t (ms)	ID	Len	D0	D1	D2	D3	D4	D5	D6	D7
1	8618.9	07E0	8	02	27	01	AA	AA	AA	AA	AA
2	8629.9	07E8	8	04	67	01	19	FB	AA	AA	AA
3	10157.1	07E0	8	04	27	02	5F	A2	AA	AA	AA
4	10166.8	07E8	8	02	67	02	AA	AA	AA	AA	AA
5	15162.2	0244	8	06	3B	60	32	36	37	31	AA
6	15168.7	0644	8	03	7F	3B	78	00	00	00	00
7	15250.7	0644	8	02	7B	60	78	00	00	00	00
8	62229.7	0244	8	02	3B	63	AA	AA	AA	AA	AA
9	62238	0644	8	03	7F	3B	78	00	00	00	00
10	62268.7	0488	8	10	30	3B	63	32	36	37	31
11	62371.1	0488	8	21	00	00	00	00	00	00	00
12	62473.5	0488	8	22	00	00	00	00	00	00	00
13	62575.9	0488	8	23	00	00	00	00	00	00	00
14	62678.2	0488	8	24	00	00	00	00	00	36	BB
15	62780.8	0488	8	25	CE	8B	48	12	88	EF	AA
16	62883.1	0488	8	26	84	93	6D	5E	0F	EF	06
17	68207.9	0644	8	02	7F	10	78	00	00	00	00
18	80421.8	07E8	8	01	60	AA	AA	AA	AA	AA	AA

So, to relink VZ/GTO E40 ECM to PIN the procedure is:

1. Gain ECM security access
2. On frame 0x244 send to PIM write block 60 request with PIN in ASCII format
3. On frame 0x244 send to PIM write block 63 request with no data
4. PIM writes theft deterrent data to ECM, transmitting on frame 0x488
5. Done