2017 GM HMI Calibration / VIN setting

General Discussion
#42

Modules will not chat unless allowed to by the “boss” and depending on the vehicle you are talking to that could be the PCM/ECU. However once you find out what the “wake up” command is you no longer need that in the harness to work with the module because you can just send it yourself.

I found this out in a circuit I had from a 2001 GM small truck. I had the BCM and cluster installed on my board and I couldn’t get it to do anything. Once I installed the PCM on the board everyone was happy and communicating. But I should be able to determine the “wakeup” command from scanning the databus and project that myself allowing the modules to communicate without the PCM in place.

Rodney

#43

Appreciate the info, Rodney!

I can see this really becoming a rabbit hole to dig down into.

The question now is do I just pay someone $200 to get this taken care of or do I continue to dig and program them myself…

Might have to chose the latter. Thanks for your help guys!

#44

I want to learn… just so I can… I just haven’t had time lately. I was able to program from SPS, but there are some things that aren’t working. I think the proper VIN will open those up. It would be nice to figure out how to program the different calibration files without going through SPS. They are saved on the computer in the cache, it’s just a matter of loading them properly.

#45

I hear what you’re saying.

Basically I have 2 trains of thought for getting this done.

One would be to get the module programmed for your version of vehicle but with another VIN. For example, I have a 2014 Sierra. I want an HMI and Radio module from a 2016+ vehicle with up to date software and calibrations. I would obtain an HMI/Radio module from a wrecked 2016 truck, hook them up to the bench, and rewrite the VIN to my 2014 VIN using the M2 and then install them into my older model truck.

The second one would be something along the line of session hijacking. I’m not well-read on this topic, but I have to imagine it’s able to be accomplished. My thought process behind this would be initiate an SPS module program off-board using a 2016+ BCM and ECU bench harness, or directly in a 2016+ vehicle, capture the data being passed to the module, modify it on-the-fly, changing the doner vehicle VIN to our own vehicles VIN, and pass it back thru the harness.Whether software exists to accomplish this or if we are able to pass SPS data after the initial session is started is unknown to me.

Again, just need to wait to get an M2 in and start messing around myself.

Also, not sure where the info is stored on the physical memory of the module but it might be easier to dump the memory of the chip itself, modify the dump and reflash it to the proper VIN.

Just some thoughts for the morning. I’ll keep everyone posted.

#46

I own 2 2017 Camaros. 1 with options I want. The other without. This was how I initially got the new HMI programmed. The problem is that I did not change the VIN. So SPS has OTA locked out. If I program the module using the correct VIN for the car, I go back to the old module (I05)… but I do get OTA. This is kinda why I’d like to figure out how the beat the checksum stuff and push the proper calibration files based on what options I want in the Module.

#47

What options are you trying to gain from the 1 hmi vs the other?

#48

1 car came with I06 with navigation, color changing LEDs… etc. Full package. The other… I05. So far I have Nav working by programming via SPS using the other VIN. OTA calibration file is different when I use the proper VIN vs the other VIN. The hardware (wiring / accent module / display) is installed for the accent lighting, but I need the BCM to have this option enabled now for it to fully work. I’m trying to get ACDELCO to release a VCI number for me to update my BCM.

#49

Please let me know if they ever get back to you.

From what I’ve been told, getting the VCI numbers from them can be a pain. ACDELCO discourages any form of customization to our vehicles.Even dealers have had hard times adding in packages that weren’t initially installed into the vehicle.

Keep me posted.

Also, are you using a clone MDI or an OEM one by Bosch?

I see you had a VCX Nano. I am holding one in my hand that has a return shipping label attached to it. Sketchy flashes and failures.

#50

I have the NANO… but was successful using a clone MDI. I also have the GDS 2 software. So I’ve been able to activate certain things and do different queries while running the M2 connected. Watching for patterns. Still haven’t figured out the right commands needed to send to the appropriate ID (HMIs ID)… to get the VIN to change. Ultimately, it would be awesome to be able to code something that would load the calibration files. I have them cached from programming both cars. lol

#51

I don’t think you’ll be able to hear anything over GDS2 with the M2 in regards to the HMI files you’re after.

I haven’t been able to do anything in GDS2 with my radio. I’m not sure if I can dive deeper but there were no options for volume up, nav testing or anything of the sorts. I haven’t dug in very far though.

I think that we might be able to pull the modules apart, dump the eeproms and potentially rewrite them.

#52

If the EEPROMS are not soldered directly to the board, I could see that as an option. Unless there are only a couple pins needed (serial in/out, ground / power)… then some sort of rig to program them. Knowing the proper addressing would be important too. Where to update the VIN. A simple “clone” of the “Good” I06 module would be cool… but only if the VIN could be fixed.

#53

I have my old 2.0 I05 HMI as well as a newer radio module. I’ll crack them open later and see what we’re dealing with for chips. Worst case I need to desolder the board and put it in a reader. Best case there’s a socket under the chip and I can just pop it out.

I’ll keep you posted.

1 Like
#54

This is all good information guys… With the stuff I am doing with the M2 I expect to be dealing with some of the same stuff once I get it up and running. One of the planned setups is to build an MDI compatible driver for it. This would likely also allow you to dump whatever is being “discussed” directly to an SD card as well.

As far as reprogramming the modules… Good luck with that… You need to know where the VIN is kept and you won’t find that without someone telling you where it is. Some of the modules have multiple memory locations to use for different things. Such as the PCM. You may find that the VIN is stored on a small flash memory within the CPU to keep it secure. The “calibration” or binary files are all the same and are stored in a different memory location than the VIN. In newer vehicles the VIN may be stored in non-reprogrammable ROM and require a new module.

Also if what I understand is true with the modules of newer vehicles as is with older vehicles you need a Kernel that is compatible with the module in order to program it. This is not non-trivial. Basically the kernel is uploaded to a special portion of ram, the module rebooted and the kernel receives the new binary and writes it to the flash. Then the kernel reboots the module again and your running the new software.

All of the older modules are 68k based and can be disassembled via IDA Pro. This includes the kernels.

Oh and if all you want to do is change the VIN in a radio/nav/HMI module… Try looking up Global Automotive on Ebay. They reprogrammed my Nav unit for $100 which included testing the unit. Would have been $50 to just update the VIN. Good luck!

Again, I do expect to develop the M2 to be able to do the programming if you have the Kernel and Binaries you want to play with. You can use Ida Pro to look through the binaries to see things you want to change and then be able to upload them.

Something else that may help. There are Arduino projects out there that can read and write flash memories in circuit. Basically you need a compatible clip and cable, connect to an Arduino (Mega I believe) and it will work as a chip programmer while the chip is in circuit.

2 Likes
#55

HMI does not use a conventional EEPROM. It’s all in the MCU, so desoldering it is not a viable option.
DID on mine is F2, not the typical 90 on the pre global A boxes.

As far as benching, yes you need to send a “turn on” command. You can do this with a BCM, a PAC 11bit radio adapter, or just manually send the proper commands with the M2.

I’m pretty convinced the VIN change just needs a mode $34 read until you find the proper memory address, then mode $36 (and supporting modes as outlined in GMW3110) to write to the memory blocks.

You can sniff the MDI’s commands from SPS / GDS2 using an OBD Y cable. Easy day there.

2 Likes
#56

Cracked open a radio module and an HMI to see what we’re dealing with and there are a few points of interest, the main being potential programming ports on both modules. (Please not the HMI I cracked open is a 2.0 not 2.5. Don’t think we’ll be using a eeprom programmer for these bad boys. I still believe can bus programming will be the most effective way to reprogram the VINs as long as we can get security access. Enjoy the pics.

Radio Module (Google Photos link)

HMI

IMG_20180825_180621
IMG_20180825_180621.jpg1200×1600 535 KB
IMG_20180825_180905
IMG_20180825_180905.jpg1200×1600 464 KB
IMG_20180825_180912
IMG_20180825_180912.jpg1200×1600 607 KB
IMG_20180825_180922
IMG_20180825_180922.jpg1200×1600 472 KB

#58

Looks like the HMI’s use a similar style factory/dev programming header like the GM Mylinks. From my R&D with the mylink, all debug options to suit the MCU are from there. With a suitable programmer and software, would be able to read the MCU firmware (If it has onboard flash) and the external connected flash chips.

There was another set of (Big… couple gigs) sandisk flash chips which were connected to another renesas processor, that appeared to be where the actual main firmware was held. (Getting a little off topic now!)

To have everything power up and continue to stay awake, you will need a BCM connected with the ignition status on. Easily achieved with a switch between to wires, or depending on year (2015+), having a remote start button also connected.
Full flashing without a BCM connected can be a little dangerous, some modules will fall asleep mid update (… like doing USB update on mylink) so its a sure way of killing them.

#59

Tazzi according to the white papers the modules will ignore everything else while being programmed. So once they are woken up and programming started, they should be good until mode $20 is sent. Right?

I know you’re a few steps ahead of me on the global A stuff. You helped me out with the VY/VZ cluster stuff a few years back, and I believe the VE SIC also. Am I on the right track with $34/$36 to change the VIN?

Did you figure out VIM for the mylink yet?

#60

Not quite, once programming state is initiated, a “tester present” frame needs to be sent every couple seconds to keep everything happy. Mode 20 (Return to normal) can be sent at the end but isnt necessarily required. I tend to only use mode 20 at the beginning to ensure the module is present and ensure its out of any possible diagnostic mode.

But I can say (from my own testing) that its not always the way. Case and point is with the mylinks, USB update needs the BCM to say stay awake otherwise it shutsdown mid update and will corrupt the memory

I personally havent had the chance to play with HMI’s as they aren’t in our vehicles here. Well, I think we started coming in from now onwards (2018+). Would need to have one in hand to know whats needed.

As for VIM, not quite. The chevy ss/holden vf mylink has 1000’s of potential ‘switches’ which can be enabled/disabled which change all sorts of things. It would only be a matter of time with trial and error, but its not a massive ‘request’ from the public to continue. I have been providing a plug in device which does the same job, the bonus of that is it can be onsold later on to recover majority of costs.

Personally Iv been more interested in R&D on BCM’s. Since this is where alot of the addons like TPMS, push start ect all come from. :+1:

#61

I’ve recently moved on to a 14 Cadillac CTS V sport. It’s got about every option imaginable in a current vehicle. If I can figure out how to dump the memory i’ll give you a copy of the contents.

MVI has the VIM figured out for the mylink as a software update (as opposed to a hardware hack). I think CW had a hand in that somehow, but i’m not positive.

I can see how the USB update could cause problems. Most bus programming is done in a different manner. The USB push is done after the module is booted and operational.

These switches, are they accomplished via mode $36 or via DID $3B ?

#62

I have some sniffing done with a Y cable, the M2 and SPS / GDS2. If I can find the logs I saved, I’ll upload… if it helps at all.