t87a unlocking

[usbbdm]

27 command only work when in regular can mode. Gmboot does not have readvan command working.
Type help to see what commands are available.

[Ironduke]

ok, thanks.. I did not try help and I'll try that for sure.. What I did was edit the script for gmboot to add an option for tcm info like in CAN mode, thought I could get that to work BEFORE connecting in gmboot mode but it didn't like my edit.. It failed with what I remember as a bad command error. Same lines of code worked in t87aCAN script but I kinda understand now. Help shows different commands depending on what module/programming method I have selected..

I will need to edit the gmboot unlock commands to read the eeprom segment, then use the e command to edit it, and then write it back.. Planning on copying the commands used to read,erase, and write back the boot segment with just editing the range.

Oh.. I'll try and figure it out but when reading the seed request is there a way to make sure it displays it correctly..
as it is now if seed is 0102030406 it displays it missing all the zero's. 12346, it truncates them..

Also is it by design that when using T87aCAN or T87aCAN1 that if I change something in the eeprom area it doesn't seem to write? Changes aren't sticking?

The power command, is there a particular pin it controls.. Say I wanted to wire up a relay to power up the tcm for gmboot mode, kinda automate it a little?

[usbbdm]

If anyone interested I can setup a zoom meeting discuss this issue. I think we have very good idea how the "unlock" work and it is a matter what we want to do with it.

[Ironduke]

I was successful modifying the T87agmboot script.. copied in it's entirety below.. You'll see how I write the seed and key in 2 different locations, feel free to change the seed and key to one of your own if you wish..

cls
dialog 6
Connect (Enter DEBUG ON)
Read Flash
Load Flash
Write Flash
Unlock T87A
Exit
begin:
option 1 connect 2 backup 3 load 4 restore 5 unlock 6 end
connect:
if DEBUG == 0
echo Give Power within one second after detect
detect
endif
goto continue
backup:
if DEBUG == 0
echo Please try again
goto continue
endif
echo Read Flash
getram 0 400000
goto continue
load:
echo Load Flash
ldram 0
goto continue
restore:
confirmdlg
if CONFIRM == 0
goto continue
endif
if DEBUG == 0
detect
wait 2000
if DEBUG == 0
echo Please try again
goto continue
endif
endif
echo Write Flash
flashchk 0
if FLASHSET == 0
echo flash not defined
goto continue
endif
checkmdw 0
if MEMORY == FFFFFFFF
echo Your Flash does not seems to be right. This might brick the ECU
goto continue
endif
erase 0 400000
sprogram 0 400000
cmpram 0 400000
goto continue
unlock:
if DEBUG == 0
echo Please enter DEBUG ON
goto continue
endif
checkmdw 20000
if MEMORY == FFFFFFFF
getram 8000 40000
endif
ulkblt87A
confirmdlg
if CONFIRM == 0
goto continue
endif
e 825c 8E B3 C6 C7 06
e 8264 60 1A 5F 2C 7A
e 1425c 8E B3 C6 C7 06
e 14264 60 1A 5F 2C 7A
erase 8000 40000
sprogram 8000 40000
cmpram 8000 40000
continue:
goto begin
end:

[usbbdm]

Does this get you hpt recognized?

[Ironduke]

Yes it does.. with changing just the seed and key hpt sees the tcm as unlocked and lets you perform a virtual read and if you license it you can write back to it.
One thing to mention is I had the script change the serial to something like "T87a_Unlocked.." just to make it easier to see if the script worked and hpt still saw it as unlocked and let me perform a virtual read but it would not even give me the option of licensing it, can't screw around with the serial too much.. Changed the serial back and it gave me licensing options..

[sevinn]

Yes it does.. with changing just the seed and key hpt sees the tcm as unlocked and lets you perform a virtual read and if you license it you can write back to it.
One thing to mention is I had the script change the serial to something like "T87a_Unlocked.." just to make it easier to see if the script worked and hpt still saw it as unlocked and let me perform a virtual read but it would not even give me the option of licensing it, can't screw around with the serial too much.. Changed the serial back and it gave me licensing options..

Good to know!

[ToolPro]

Hey fellas,

It looks like some of you got this down completely and all of the info is great!

The one thing I never see is what SERVICE NUMBER module you are working on... I imagine its extremely important as I understand the

moderator only has one unit. To the best of my records T87a come with service #'s as follows.... (please add to this if you know others)

2017 & 2018 ------ 24279973 Vette Camaro Denali Tahoe

2019 --------------- 24290348 Tahoe Possibly 10 speed

2019 --------------- 24289543 Vette

I doubt the memory layout is the same for each module, but hopefully the BOOT is kinda standard.

I would appreciate it if anyone on here knows definitively what differences there are if any.

Thanks
ToolPro

[veee8]

Did you just overwrite the T87AGMBoot.USP file with this? I assume this writes the change just to the Boot segment so HPT recognizes it to be unlocked, but does the BootBlock have to be modified first ike the original script would do at address 20000? Can both functions be applied to the same script?
Also, are you guys manually correcting the checksum by right clicking for each segment?

I was successful modifying the T87agmboot script.. copied in it's entirety below.. You'll see how I write the seed and key in 2 different locations, feel free to change the seed and key to one of your own if you wish..

cls
dialog 6
Connect (Enter DEBUG ON)
Read Flash
Load Flash
Write Flash
Unlock T87A
Exit
begin:
option 1 connect 2 backup 3 load 4 restore 5 unlock 6 end
connect:
if DEBUG == 0
echo Give Power within one second after detect
detect
endif
goto continue
backup:
if DEBUG == 0
echo Please try again
goto continue
endif
echo Read Flash
getram 0 400000
goto continue
load:
echo Load Flash
ldram 0
goto continue
restore:
confirmdlg
if CONFIRM == 0
goto continue
endif
if DEBUG == 0
detect
wait 2000
if DEBUG == 0
echo Please try again
goto continue
endif
endif
echo Write Flash
flashchk 0
if FLASHSET == 0
echo flash not defined
goto continue
endif
checkmdw 0
if MEMORY == FFFFFFFF
echo Your Flash does not seems to be right. This might brick the ECU
goto continue
endif
erase 0 400000
sprogram 0 400000
cmpram 0 400000
goto continue
unlock:
if DEBUG == 0
echo Please enter DEBUG ON
goto continue
endif
checkmdw 20000
if MEMORY == FFFFFFFF
getram 8000 40000
endif
ulkblt87A
confirmdlg
if CONFIRM == 0
goto continue
endif
e 825c 8E B3 C6 C7 06
e 8264 60 1A 5F 2C 7A
e 1425c 8E B3 C6 C7 06
e 14264 60 1A 5F 2C 7A
erase 8000 40000
sprogram 8000 40000
cmpram 8000 40000
continue:
goto begin
end:

[Ironduke]

Yes, that is my TCUT87AGMBoot.USP file. if you scroll down to "unlock:" you can see how I changed the read addresses so it also reads the eeprom sections. This script unlocks for hpt and for TCUT87ACAN or TCUT87ACAN1 as it normally did but it also changes the seed and key in both sections of the eeprom to a set known by hpt to already be unlocked.

You connect and get gmboot running and then click Unlock on the right at the bottom. It should connect and download the boot segment, prompt to save it, prompt to unlock and then unlock it.. I did just notice that it will likely save from 0x8000-0x40000 so it's saving a bit more than the actual boot segment. Not sure how to change that up or if it's really needed?

Did you just overwrite the T87AGMBoot.USP file with this? I assume this writes the change just to the Boot segment so HPT recognizes it to be unlocked, but does the BootBlock have to be modified first ike the original script would do at address 20000? Can both functions be applied to the same script?
Also, are you guys manually correcting the checksum by right clicking for each segment?

[sevinn]

Hey fellas,

It looks like some of you got this down completely and all of the info is great!

The one thing I never see is what SERVICE NUMBER module you are working on... I imagine its extremely important as I understand the

moderator only has one unit. To the best of my records T87a come with service #'s as follows.... (please add to this if you know others)

2017 & 2018 ------ 24279973 Vette Camaro Denali Tahoe

2019 --------------- 24290348 Tahoe Possibly 10 speed

2019 --------------- 24289543 Vette

I doubt the memory layout is the same for each module, but hopefully the BOOT is kinda standard.

I would appreciate it if anyone on here knows definitively what differences there are if any.

Thanks
ToolPro

It's been the same addresses on all the ones I've checked

[veee8]

We did run into an issue with a 24290348 from a 2019 Camaro A10 that USBBDM is looking into.

[SubnetMask]

I'm not SURE, but I believe all 10-speeeds have a T93, not a T87A.

Hey fellas,

It looks like some of you got this down completely and all of the info is great!

The one thing I never see is what SERVICE NUMBER module you are working on... I imagine its extremely important as I understand the

moderator only has one unit. To the best of my records T87a come with service #'s as follows.... (please add to this if you know others)

2017 & 2018 ------ 24279973 Vette Camaro Denali Tahoe

2019 --------------- 24290348 Tahoe Possibly 10 speed

2019 --------------- 24289543 Vette

I doubt the memory layout is the same for each module, but hopefully the BOOT is kinda standard.

I would appreciate it if anyone on here knows definitively what differences there are if any.

Thanks
ToolPro

[veee8]

I'm not SURE, but I believe all 10-speeeds have a T93, not a T87A.

Nah, the T87A was used 2017-2019 on A8 and A10, and then T93 starting in 2020

[SubnetMask]

My 2019 CT6 for sure has a T93.

Edit: I did some searching, and it seems you're right - some 10 speeds did in fact get a T87A. Odd. From wha\t I had previously gathered, the T93 was expressly developed for the electronic shifter 10 speed, which as far as I had gathered, was meant to be a fully electronic shift like my CT6 has and a LOT of other vehicles have been going to. It seems (according to HP Tuners) they were mostly 'trucks' that got the T87A and 10 speed, with the 17-19 Corvette, Camaro and ATS & CTS mixed in. My 2019 CT6 Sport got the T93 with the 10 speed.