t87a unlocking

[jodeyb]

I tried to unlock my first t87a recently and found an issue, I was able to connect read, modify, write, and re-read the unlocked file to confirm that changes were made and held within the tcu. Unfortunately, I then hooked up to my hptuners and tried to read the module for tuning the lockup schedule and ran into the same error that the software throws if you have not unlocked the ecu. I guess my question is, does anyone have experience with this process or has anyone had this problem before and if so how did you solve it. Also if you're reading this and have interest in tcu/ecu files I also have unlocked and locked t93 tcu's to read if anyone has figured out how to do so.

[Ironduke]

hpt is evidently using the serial number, ecu id, and the seed and key to check and see if it is unlocked before it will allow a virtual read and then write to the ecu with the newer versions of their software. Working with someone a little bit and with those changes from an hpt unlocked tcm hpt let him do a virtual read and then write. Didn't go any deeper yet to see if it's just the seed and key but I am guessing it's at least 2 of them, I had already tried the ecu ID and serial number without success.
Can only guess that hpt isn’t happy about losing possible revenue over unlocking the tcm themselves..

[sevinn]

Ran into the same boat. The key is somewhere in the actual BOOT block not the bootblock block for hptuners. I have a couple of unlocked reads but it's hard to tell exactly what the rhyme or reason for the changes is.

I was able to read and write one, but the tcm wasn't happy with the solenoid data after.

[usbbdm]

I will have more testing done next week. Out of town now.

[jodeyb]

Honestly, due to dealing with this issue over the last few weeks I think our best bet is just to do the reading and writing through the ulink while its locked, as I do this for work and would prefer it that way. I have spent the last few days finding a few basic maps such as the torque converter scheduling maps and have I believe made the changes that I wanted to make with hp. The only problem I have is correcting the checksums at this point, so although its not part of this forum specifically I would love some help if anyone knew how to do this and am willing to share the information I have as far as table addresses and bin readouts. tia

[Ironduke]

I have made up some files for universal patcher if they're not already included with the latest version on github.I don't see how to upload a file here so maybe pm me for the files if the github doesn't have them. That'll set you up with the fix for checksums and cvn's.. If you don't mind sharing what you have done I can either work them out myself or see if one of the guys with patcher can work them out across all the OS's and work on an xml file for the tables.


btw.. If you made up a connector for the T87a for bench programming to make this easier you can leave the jumpers to put it in boot mode permanent. You just need to switch the 5v ign feed on and then detect for gm boot mode. Feed it 12v and it boots up regular.

You can also set up a resistor ladder to get the 5 volts from 12v if your trying to do it in vehicle with just a bench harness connector and don't have 5 volts readily available.

[usbbdm]

I have checksum for the boot block done. I think the similar algorithm exist for the other fields. So we can work on a better dll to do ANYTHING we want and make a script to automate the process.

[usbbdm]

I will soon work on unlock T87A to allow custom kernel which make the T87A more open to any tuning software.

[jodeyb]

I was able to correct the checksums with the help of Ironduke and would offer any assistance needed to get a checksum correction utility working if you do not already have the information required. I appreciate everyone's help and am happy with the possibilities of this hardware and software combination.

[sevinn]

I have made up some files for universal patcher if they're not already included with the latest version on github.I don't see how to upload a file here so maybe pm me for the files if the github doesn't have them. That'll set you up with the fix for checksums and cvn's.. If you don't mind sharing what you have done I can either work them out myself or see if one of the guys with patcher can work them out across all the OS's and work on an xml file for the tables.


btw.. If you made up a connector for the T87a for bench programming to make this easier you can leave the jumpers to put it in boot mode permanent. You just need to switch the 5v ign feed on and then detect for gm boot mode. Feed it 12v and it boots up regular.

You can also set up a resistor ladder to get the 5 volts from 12v if your trying to do it in vehicle with just a bench harness connector and don't have 5 volts readily available.

Unfortunately this is cumbersome on a camaro because of where they placed the tcm.

I'm new to universal patcher, but was trying to get the boot block segment added and wasn't having any luck.

I keep trying to get my pcmhacking account activated but I haven't had any luck to reply to your threads there.

[Ironduke]

Is your username the same?? I can ask Antus to keep an eye out to approve you. There is so much spamming going on there I know he has been fighting bigtime with approving new users..

If your not in a rush I would try and wait a little bit. usbbdm is working on a CAN only solution involving straight CAN programming and unlocking to allow writing much easier. Not sure if he's working on an in vehicle solution but it should be doable to incorporate that was well.

I can send the xml files I have for t87a which does include the boot segment and checksum and CVN.
boot is 20000 - 3FFFF
checksum is 0x28700
CVN is 0x28720

[sevinn]

My account was finally approved!

I'm finding that the key to the hptuners unlocking is something they are doing in the 0-20000 segment. I honestly think they are implanting a known unlocked serial in there, as I've compared a few back to back and have changed a few lines in that segment and was able to read it in hpt. But any time we mess with that segment it seems that the tcm loses its solenoid data.

And I'm in no hurry, I've enjoyed this process anyway.

[Ironduke]

Yes, that's the eeprom segment. 0-0x10000 is first eeprom and 0x10001-0x20000 is the second. They're pretty much of a copy of each other. As you make changes to the eeprom like changing the vin or something it tic-toks to the other eeprom segment writing the changes..

I can tell you it's more than just the serial, I know seed and key are involved as well.

Would be nice if we can just change those 2 things in the eeprom and be good to go..

[sevinn]

Yes, that's the eeprom segment. 0-0x10000 is first eeprom and 0x10001-0x20000 is the second. They're pretty much of a copy of each other. As you make changes to the eeprom like changing the vin or something it tic-toks to the other eeprom segment writing the changes..

I can tell you it's more than just the serial, I know seed and key are involved as well.

Would be nice if we can just change those 2 things in the eeprom and be good to go..

I successfully unlocked one just changing a couple of spots in the first 20000, and the usbjtag patch. I'll try to share the bins on pcmhacking.

[Ironduke]

I would be very curious on what you had to change. I know seed and key needs to be done but haven't completed testing as to if the vin and the serial need to be changed as well?