My Aveo ECU hacking journey has begun

I was finally able to unlock an Aveo ECM using a very crude brute force script. Uses the same seed/key arrangement as any other GM/Delphi module. Anyway, when I find something useful like lookup tables or interesting DIDs I will be sure to share. Once I nail down the memory address registers I should be able to pull some calibration data out of it, and possibly even grab the operating module, but I am no guru when it comes to hex/assembly code.

They say pics or it didn't happen....


Attachment 10477

That just happened... ;)

Tip: If your seed is 204E - The key is going to be 8B96. This is from an 05 module.

Attachment 10478
FYI

ps: if anything in this thread sounds like greek geek speak, just click on to the next thread, this is going to get really BORING for the casual driver! I am posting this info for the hard core Aveo guru's, and you know who you are! If anyone would like to play along at home, don't hesitate to chime in, I will share any code/data R&D I have on the subject.

subscribed. not a hard core guru though, but i speak geek a bit. don't know anything about car computers. looks like you know a lot about object oriented language. it would be awesome to open source something like this, and provide a free gui and compiler with the car imho

Well im just one guy with some time on the side of my day job as a programmer, one day I hope more will dive in to decode this stuff.

Here is a short snippet if you want to pull the VIN and hold it in a variable.

# Scripted version ======Get VIN ============
$ecuPort.open()
$ecuPort.writeline("0902" + [char]13) # Vin request
start-sleep -m 200
$input = $port.ReadExisting() # -split(" ")
$vin = $input.split(" ")[6,10,11,12,13,17,18,19,20,24,25,26,27,31,32,33,34] |
ForEach-Object { [Convert]::ToInt32($_,16) } |
ForEach-Object { [Convert]::ToChar($_) } |
ForEach-Object { $_ }
$vin -join ""

Here is the script with the brute force cracker routine for anyone wanting to play.

Just remove the .txt on the end to edit with powershell. Will need to point it to your interface port. Tested using ST1110 'clone' chip.
Enjoy

What interface are you using to communicate with the ecu?

Just the garden variety $4-$10 cheapo OBD scanner, this has a 'vgate' logo. That worked the best, I have a wired interface as well, but it would reset every 30 seconds or so, so I stuck the Bluetooth one on and it has run with no issues. Any 'ELM compatible' interface should do the trick.

Attachment 10486

I have an 08 aveo myself, up until I saw your post I figured simpler methods of engine modifications were non existant. If needed I can acquire data from the ecu currently in use in my vehicle. Id like to see this taken further.

A peek inside of an MT34 ECU for amusement..

It's a Hitachi board with some high end chips, notice the Hitachi logo in the lower right corner.
Attachment 10489

This particular unit was given to me as a 'broken' unit, it has nothing on the serial port, but I do see reference voltage on the reference pins, but no data on C31. With any luck I can reflash it to use it again.

Close up of J5
Attachment 10490

Very nice quality work!

FYI - For those of us with the first gen Aveo's, this info should apply, with the exception of the 04/05 MY I have yet to confirm they use the same platform:

So the chip in the lower left with 'AM29bl....' is our flash memory, according to the datasheet for it this is the 8MB chip. The larger chip with 'TriCore' is the main MCU/CPU - and is quite a capable little chip for an econo-box. This is TOP shelf stuff in the EMS world! The 'Delphi' chip with a 466 on it is most likely the memory management/watchdog chip. (only speculation at this point on the Delphi chip) The others are just voltage regulators/filters, some DC motor driver(s), injector drivers, and other ancillary stuff we need.

FWIW: there are open source tools, and an RTOS 'OS' available that has been ported to the tricore 32-bit. see www.hightec-rt.com for the scoop. The GCC tool-chain is Eclipse ready and slaps right in. So make note, the entire chain of tools is available in the open source flavors to individuals for learning or reworking your own rig.

For some background: Operating Systems - Infineon Technologies

Link to the free toolchain: Free TriCore™ Entry Tool Chain - Activation & Download

Be sure and use google if you are curious, Infineon is quite proud of this chip line and shares a lot of detail about it.
Enjoy!

Quote:

---

Originally Posted by 06T200

FWIW: there are open source tools, and an RTOS 'OS' available that has been ported to the tricore 32-bit. see www.hightec-rt.com for the scoop. The GCC tool-chain is Eclipse ready and slaps right in. So make note, the entire chain of tools is available in the open source flavors to individuals for learning or reworking your own rig.

For some background: Operating Systems - Infineon Technologies

---

Years ago at IBM I worked on system management systems using H8s. Good chip. I read up on the tri core:
https://en.wikipedia.org/wiki/Infineon_TriCore

So what is your goal in getting inside the MCU, more power? Better efficiency? I find it interesting that they are using DSP tech (not surprised either) and I get that is for getting good data on the o2 sensors, timing, and figure the spark quality.

Quote:

---

Originally Posted by xintersecty

Years ago at IBM I worked on system management systems using H8s. Good chip. I read up on the tri core:
https://en.wikipedia.org/wiki/Infineon_TriCore

So what is your goal in getting inside the MCU, more power? Better efficiency? I find it interesting that they are using DSP tech (not surprised either) and I get that is for getting good data on the o2 sensors, timing, and figure the spark quality.

---

Very cool! At some point your skills may be able to steer some ideas.

Actually - to be honest, no real goal with this one, (which makes it fun in itself!) just exploring the space ‘in the box’.

My crazy idea, was to gather the bits on the operating software/mcal, and just have a look. The table locations/formulas’ would be some peripheral bennies from the work, especially for anyone wanting to change them, knowing table locations, etc, and just for lack of better words WTF is this thing doing? Lol

So I discovered I can’t just throw a ‘roll-my-own’ boot loader on without the secret squirrel magic ‘signature’ that is in the Delphi chip, we will call this the ‘EMS COP’ chip. With the ‘bounds checking’ not much I can do over the K-line/CAN. Kinda sucks!

Just knowing what the cpu/mcu/dsp is capable of has been a help in not wasting tons of time. So I will need to pull the amd flash chip, and use a reader (these are available im told) to pull the data off it, and just grab the whole 8MB contents. Then process the data/reflection. I have some help from another forum much more advanced than myself, im just a nerd mechanic - I turn the screw driver, and write code ;)

I’ve been more curious at the possibility of just using an open source RTOS/OSEK system on it, (using most of the same standards, ie. AUTOSAR/OSEK and other so-called ‘open standards’ (with closed source!) in much the same way the oem market does, but would be for off-road application/tuning. Only a matter of time before they all (even aftermarket) land on the same page via the standards, and I see a few open source rtos/EMS systems now ported to the tricore architecture.

Who knows, but this is the sum of the experiment. I see the movement to open source engine management, so im just using what I have available to help explore that area. I know the OEM’s don’t always follow the standards, but so far everything seems to line up on these first gen boxes anyway.

I don’t think I would be sharp enough to be able to gut out all of the ‘bounds checking’ and 'security' code in the stock ecu sw, so the ‘trend’ seems to be looking at porting open source software onto the various ECM chips/mcu’s. And since we have a very well designed and quite popular 'TriCore Aurix' platform (mainly in Bosch/Motec boxes) why not explore?

To summarize the concept, use open source engine management - on existing MCU/EMS box, and just turn on/off what you need in the software. Mapping tables, lut's etc. is a different art IMO and is done manually on a dyno cell/rollers by trial and error. This stuff is just computer 101 box programming stuff, then running something well known and proven in what was a stock 'regulated' box, repurposed for custom/off road/racing duty, not engine, or car specific.

ooops!! Sorry to write a book, but I have been busy... - I may be over simplifying the EMS aspect of the dsp - but far as I know it is just timed interrupts that respond to the sensors, so it is simple logic, that is lightning fast in practice. In theory it is complicated, but all the logic is in EMS libraries that are pretty open now. Time will tell! It's only a side project, I may hit a wall at any second and shelve the whole thing lol

In case anyone wants to dive in deep to the Infineon TriCore chip.

http://www.infineon.com/dgdl/TC1_3_A...12be86204c0111

These chips are most well known to be found in Audi/VW Bosch Motec ECU's from the late 90's to current models. Our box is made by Delphi in Korea, by what look like to be former Hitachi/Robert Bosch employee's. I still need to confirm that the 04/05 uses the same platform.

One of the more stable OS's ported to TriCore chips.

https://en.wikipedia.org/wiki/ERIKA_Enterprise

http://www.evidence.eu.com/download/...rprise_1_6.pdf

More info,

Media blurb about Delphi/Infineon collaboration...
Infineon Technologies Announces Design Win; Delphi Automotive Systems Selects Award-Winning 32-bit Automotive Controller ICs - Infineon Technologies

" Delphi, a world leader in mobile electronics, transportation components and systems technology, selected the Infineon TC1775 engine management controller for a new system design"

TC1775 Datasheet
https://www.dropbox.com/s/iuvfepwbxr..._0502.pdf?dl=0

TC1775 User's Manual
https://www.dropbox.com/s/au6sgdgojj...anual.pdf?dl=0

More info on the TC1775

Ignition Algorithm/app notes document
https://www.dropbox.com/s/19gnj1n98l...23610.pdf?dl=0

Injection Algorithm/app notes docuement
https://www.dropbox.com/s/squt87oj9h...23710.pdf?dl=0

Link to the IAN (interactive application notes) and example source code for the above ignition and injection algorithms as implemented in the TC1775
http://www.infineon.com/dgdl/TC1775_...1344b7a5cf02e8

Interesting stuff

Pretty cool stuff! I did some Assembly programing back in my college years.

Quote:

---

Originally Posted by 06T200

FYI - For those of us with the first gen Aveo's, this info should apply, with the exception of the 04/05 MY I have yet to confirm they use the same platform:

So the chip in the lower left with 'AM29bl....' is our flash memory, according to the datasheet for it this is the 8MB chip. The larger chip with 'TriCore' is the main MCU/CPU - and is quite a capable little chip for an econo-box. This is TOP shelf stuff in the EMS world! The 'Delphi' chip with a 466 on it is most likely the memory management/watchdog chip. (only speculation at this point on the Delphi chip) The others are just voltage regulators/filters, some DC motor driver(s), injector drivers, and other ancillary stuff we need.

FWIW: there are open source tools, and an RTOS 'OS' available that has been ported to the tricore 32-bit. see www.hightec-rt.com for the scoop. The GCC tool-chain is Eclipse ready and slaps right in. So make note, the entire chain of tools is available in the open source flavors to individuals for learning or reworking your own rig.

For some background: Operating Systems - Infineon Technologies

---

I am a technician, trying to replace an ecu on 2008 Aveo, the old ecu has mark on it as KN, MT34 and this car is manual transmission.

i got a used ecu from the junk yard place it on the car, performed online sps to it, now got tech2 perform 2 key relearn function, cycle the key 3 times after the 10 minutes count down reached, but I got failed programming message on the tech2,

but it when I check the key diagnosis, I have key status ID 1 learned in the immobilizer, I checked the second key and it was also learned but the ECU is in UNLEARN status... pls how can I learn this ecu so that the status can appear learned ...

i have performer 30 minutes relearned but did not still work, the ecu is still in the UNlearned status,

11 minutes on and then 10 seconds off, 3 times but ecu won't go into learn status in the immobilizer.. I need idea how to go about this... or is there a chip to transfer from the damaged ecu to the used one I got..

rememver the damage ecu starts alright with the ecu being in Learned status but the throttle side is not functional, as you press the pedal but the junk yard one has the throttle working as you press the pedal you see the to reading

Quote:

---

Originally Posted by 06T200

More info on the TC1775

Ignition Algorithm/app notes document
https://www.dropbox.com/s/19gnj1n98l...23610.pdf?dl=0

Injection Algorithm/app notes docuement
https://www.dropbox.com/s/squt87oj9h...23710.pdf?dl=0

Link to the IAN (interactive application notes) and example source code for the above ignition and injection algorithms as implemented in the TC1775
http://www.infineon.com/dgdl/TC1775_...1344b7a5cf02e8

---

Anything new on this project?

I don't have much wisdom to help, I am assuming you made sure you have 13+ volts at the ECM during the relearn?

Quote:

---

Originally Posted by Jim2029

Anything new on this project?

---

No. Infineon/Delphi stonewalled any effort to obtain technical data. I gave up on hiring an engineer due to lack of interest. Project is shelved for now.

Update: Project had a setback a few months ago due to some bizarre bad luck.

For years I always left my car unlocked at home as we live off the beaten path, some apparent kids cleaned out my car one night back in April, took the change in the ashtray and my ultraguage, my OBD telematics logger, and the laptop I was using for logging data with a graphing app. We found the ashtray just a few yards from the driveway, but nothing else. Blew my mind since aside from the laptop nothing was really flashy (my cobbled boxes and cables tucked in the glovebox) but they grabbed everything cables and all. I have much of my notes, just lost some info I can gather again. and some tools I was still using!

Since the initial vision for my project hit some frustrating barriers ( intellectual property crap) I kind of scrapped the OE rework, and am currently researching piggyback options. Hopefully will spring into a new Aveo project. Looks promising , well makes sense in theory and Jack from Dastek/Unichip seems confident I can figure out the sub mapping differential tables for timing curve and a power enrichment curve to play with. All new to me, but about the only low buck option to have the drivability I am after, and not drop $2,000 into aftermarket/stand alone EMS. If all pans out with the wiring nightmare of a piggyback, I may have a good foundation to add a small hairdryer under the hood of my LS. One of these days!

hi mate i have this ECU too i would see u can help step by step able unlock read the Used & old ECU to change VIN and get security pin codes thanks

www.hightec-rt.com looking good this software

Sorry, I don't have much to add that would simplify the process to that level. Are you an EE? If you work in the EE field and have the interest, you may want to track down Robert Kearney, he is the lead engineer that worked for Delphi/GMDAT during the creation of the PCM design and development for the engine management in most Aveo's (at least in the states). He was very helpful to me, and shared many key information to help discover the logic platform. Today he still works for Infineon, and he is very sharp.

FWIW: I do recall specifically he was able to confirm the CPU architecture for the MR140 modules are based on the Motorolla 68000, and the later (06-08+) MT34 is based on the Tricore TC1775 as I have shared the tech info above. I will leave it at that, for now. Good luck on your project!

Hi! Do you have soft for download and upload ECU firmware?

I’m wondering if this is useful when it comes to adding a turbo, if you are able to adjust the air and fuel map in a way to tune it, or if I would still have to go with a piggy back or standalone

I was thinking of wanting to turbo my etec2 in my 08 aveo5. Can't find any piggy back systems.

Quote:

---

Originally Posted by GR1087

I was thinking of wanting to turbo my etec2 in my 08 aveo5. Can't find any piggy back systems.

---

Sorry for the slow response. But you might want to look into the FuelTech FT450 standalone for your needs. I personally don't have much experience with Aveo tuning any longer, but this should be a good starting point to aim toward, as that system is rather agile.

HTH
06T200

If you are going to turbo that engine, you could probably find an AEM Fuel ignition controller that would suit your needs.

The AEM FIC 4 would do it, it woul allow you to control timing advance and fuel, which is basically all you need.