Anyone looked at the content on this page? Is this of any use?
http://canbushack.com/hate-the-vin-wanna-change-it/
Think you could program the module on the bench with the wrong VIN in SPS, then update the VIN using the details above?
SPS does not allow Bench programming anymore, it will show a message (Offboard programming detected!) and some people report having their accounts being suspended for that.
any way to upload programming if you have the files from TIS and know the seed key? or do offboard programming?
I believe the 2017 Global TIS had SPS included but not sure if it works for all GM line or Just for European.
1 Like
Hi there, I’m new here.
I might be helpful with researching of reprogramming the HMI modules
Does anyone here got SPS access?
I only got GME access but no GM NAO
On the GME HMI units the VIN doesnt get written by SPS.
Only the binary blobs get block transferred and those (as it seems) are signed by GM
After reprogramming, the programming date (DID 99) and Shopcode (DID 98) get written.
Didnt GlobalTIS go till early 2012 ?
Last version with SPS that I know of was v32b
The very last version was 45 but no where to be found.
I have SPS access for my vehicles. I have since traded the 2017 Camaro RS that I was attempting to program for. My solution was programming it in my 2017 ZL1 using it’s data while physically installed in the ZL1. After programming, I moved it to the 2017 RS. What do you need from SPS?
Sent you a PM 
talk about bringing back the dead, was this ever figured out i know now there are many websites that figured it out and offer programming still want to figure this out as a pass time
Hey Tazzi,
Have you got an email address I could contact you on please??
Also curious about that. I know @th3magpi3 was able to get it figured out after help from the community, but now it seems he is more interested in profiting off of their help than giving back. I cannot help with bench flashing, as that seems to be an issue, but I did contact tjshadyluver through a different means and he gave me some decent info. He said to “send CAN id 252 ,- 0x07, 0xAE, 0xFE, 0x80, 0, 0, 0, 0” and “You should see that the vin will be cleared. you could even loop it until you get a 03,7F,AE,78,AA,AA,AA,AA on the can id 652. Then send the command one more time then you will get 02,EE,FE,AA,AA,AA,AA,AA on 652 can id. That will mean vin is cleared”
I do not have the mechanisms to test this but given that it is summer I might grab a used 2.5 and tinker around with it in my truck. TJ also said he uses a bench setup with a virgin BCM (no vin), although that was a year ago and I imagine since then GM has put in the checks to see is SPS is being done on a bench setup.
gm-trucks. He now has a website and offers services similar in price to the usual suspects. If only this hacking community was more open, imagine what we could have accomplished by now. I’m personally holding out for full on root HMI access or custom OS’s for them. But maybe my dreams are far too ambitious.
I can confirm this works. Just tried it.
thanks good to know
where can a beginner like me start into learning bench flashing and how are codes actually sent to these modules
Super helpful, thanks. Now if someone could explain how magpie is getting the newer 2017-2018 software on the HMIs for older trucks that allow things like the app store and wifi software updates, that would be awesome.
That’s easy he’s using a VIN from a 2017 truck with similiar if not the same options on it to flash the software to a 2014-2016 Truck through SPS. Now when I do it I don’t use SPS ended up hacking GM DPS so that I can make custom SPS-like flashes, I’ve come a long way and learned most of everything going on, putting in hours on the bench, finding GM Proprietary manuals that break down the OP Codes(Request IDs). its been a journey, I’ll help where I can but its hard and almost impossible to sit down and teach this stuff…LOL maybe I’ll have a class and teach this stuff for a fee, it’d put Magpie out of business… I’d know because I’ve made alot of money playing with the HMI modules and custom programming 
1 Like
Could you help me with finding the utility file needed to build the flashable zip?
I’m aware there is this method used to flash custom calibration files to GM car modules using a modified Global tis installation, installed to an online website or a local PC. This gives the user the ability to flash custom calibration files to any year GM cars for changing the car module VIN number, activating hidden feature with custom calibration files. Installing a working activated GDS 2 install to any PC and maybe much more.
Can you take a look at the attached youtube video, which illustrates the process.
Does anyone care to share this data and method with me? I am willing to pay.
From researching and inspecting, I see a combination of Global tis V32 and V36 was used. The Sps-client.jar webwindow.jar, techlinecache-client.jar and a few other java jar files were edited to achieve this.
I have all the edited Jar files if need be from an archive captured.
The issue, I am not versatile with java coding, and this will take me a long time to wrap my head around,
If anyone out there has the knowledge and data for this method and wish to sell it to me, drop me a PM.
Or if anyone out there who is into GM cars and have an understanding of java codes and would like to tinkle and inspect these edited Global tis java files to replicate the method. Drop me a PM.
Thanks
YouTube video for illustration purposes.
See how its done.
The edited jar files I have.
The Tiger has escaped from the cage and is now running free in the jungle.
Here is a video that demonstrates how to change vin numbers in GM ECU modules. You can use it to remove the theft lock from second-hand HMI 2 and HMI 2.5 units, fix instrument cluster mileage, add RPO to GM cars, plus much more.
Check the video description for the needed files or drop me a PM.
Maybe someone who has knowledge of CAN-bus and software coding could use a CAN-bus sniffer, a Totalphase Beagle USB Protocol Analyzer, or other means to inspect data then create a program for easier use.
Then offer it for free.
Long live free information.
As in, a long life to all the folks out there who use their time and knowledge to create things, then offer it for free to all.
4 Likes
Hi,
This command…
cansend can1 252#021A2F0000000000
shows the VIN (whitout the first letter) stored in the HMI, Correct?