•  
    Page 1 of 3 123 LastLast
    Results 1 to 10 of 29

    Thread: My Aveo ECU hacking journey has begun

    1. #1
      Aveo Whisperer 06T200's Avatar
      Join Date
      Aug 2014
      Location
      530
      Posts
      618
      Thanks
      55
      Thanked 86 Times in 74 Posts

      My Aveo ECU hacking journey has begun

      I was finally able to unlock an Aveo ECM using a very crude brute force script. Uses the same seed/key arrangement as any other GM/Delphi module. Anyway, when I find something useful like lookup tables or interesting DIDs I will be sure to share. Once I nail down the memory address registers I should be able to pull some calibration data out of it, and possibly even grab the operating module, but I am no guru when it comes to hex/assembly code.

      They say pics or it didn't happen....


      Name:  MR140KEY.jpg
Views: 1676
Size:  110.6 KB

      That just happened...

      Tip: If your seed is 204E - The key is going to be 8B96. This is from an 05 module.

      Name:  WP_20160620_12_49_05_Pro.jpg
Views: 1677
Size:  209.7 KB
      FYI


      Last edited by 06T200; 07-14-2016 at 10:45 PM.

    2. The Following 4 Users Say Thank You to 06T200 For This Useful Post:

      AndrewButler05 (07-17-2016),Daox (08-09-2016),DavidB (07-19-2016),Orange_Crush (08-11-2016)

    3. #2
      Aveo Whisperer 06T200's Avatar
      Join Date
      Aug 2014
      Location
      530
      Posts
      618
      Thanks
      55
      Thanked 86 Times in 74 Posts
      ps: if anything in this thread sounds like greek geek speak, just click on to the next thread, this is going to get really BORING for the casual driver! I am posting this info for the hard core Aveo guru's, and you know who you are! If anyone would like to play along at home, don't hesitate to chime in, I will share any code/data R&D I have on the subject.

    4. The Following User Says Thank You to 06T200 For This Useful Post:

      AndrewButler05 (07-17-2016)

    5. #3
      What do you mean there's no turbo? northguest47's Avatar
      Join Date
      Feb 2011
      Location
      Brampton, ON
      Posts
      364
      Thanks
      15
      Thanked 26 Times in 23 Posts
      subscribed. not a hard core guru though, but i speak geek a bit. don't know anything about car computers. looks like you know a lot about object oriented language. it would be awesome to open source something like this, and provide a free gui and compiler with the car imho

    6. #4
      Aveo Whisperer 06T200's Avatar
      Join Date
      Aug 2014
      Location
      530
      Posts
      618
      Thanks
      55
      Thanked 86 Times in 74 Posts
      Well im just one guy with some time on the side of my day job as a programmer, one day I hope more will dive in to decode this stuff.

      Here is a short snippet if you want to pull the VIN and hold it in a variable.

      # Scripted version ======Get VIN ============
      $ecuPort.open()
      $ecuPort.writeline("0902" + [char]13) # Vin request
      start-sleep -m 200
      $input = $port.ReadExisting() # -split(" ")
      $vin = $input.split(" ")[6,10,11,12,13,17,18,19,20,24,25,26,27,31,32,33,34] |
      ForEach-Object { [Convert]::ToInt32($_,16) } |
      ForEach-Object { [Convert]::ToChar($_) } |
      ForEach-Object { $_ }
      $vin -join ""

    7. #5
      Aveo Whisperer 06T200's Avatar
      Join Date
      Aug 2014
      Location
      530
      Posts
      618
      Thanks
      55
      Thanked 86 Times in 74 Posts
      Here is the script with the brute force cracker routine for anyone wanting to play.

      Just remove the .txt on the end to edit with powershell. Will need to point it to your interface port. Tested using ST1110 'clone' chip.
      Enjoy
      Attached Files Attached Files

    8. The Following User Says Thank You to 06T200 For This Useful Post:

      AndrewButler05 (07-18-2016)

    9. #6
      What's wrong with my car?
      Join Date
      Jun 2015
      Location
      California
      Posts
      4
      Thanks
      1
      Thanked 1 Time in 1 Post
      What interface are you using to communicate with the ecu?

    10. #7
      Aveo Whisperer 06T200's Avatar
      Join Date
      Aug 2014
      Location
      530
      Posts
      618
      Thanks
      55
      Thanked 86 Times in 74 Posts
      Just the garden variety $4-$10 cheapo OBD scanner, this has a 'vgate' logo. That worked the best, I have a wired interface as well, but it would reset every 30 seconds or so, so I stuck the Bluetooth one on and it has run with no issues. Any 'ELM compatible' interface should do the trick.

      Name:  71FuQgCcNVL._SL400_.jpg
Views: 1473
Size:  19.9 KB

    11. The Following 3 Users Say Thank You to 06T200 For This Useful Post:

      AndrewButler05 (07-21-2016),d_5150_misfit (07-22-2016),MeekMark (07-27-2016)

    12. #8
      What's wrong with my car?
      Join Date
      Jun 2015
      Location
      California
      Posts
      4
      Thanks
      1
      Thanked 1 Time in 1 Post
      I have an 08 aveo myself, up until I saw your post I figured simpler methods of engine modifications were non existant. If needed I can acquire data from the ecu currently in use in my vehicle. Id like to see this taken further.

    13. The Following User Says Thank You to d_5150_misfit For This Useful Post:

      AndrewButler05 (07-22-2016)

    14. #9
      Aveo Whisperer 06T200's Avatar
      Join Date
      Aug 2014
      Location
      530
      Posts
      618
      Thanks
      55
      Thanked 86 Times in 74 Posts
      A peek inside of an MT34 ECU for amusement..

      It's a Hitachi board with some high end chips, notice the Hitachi logo in the lower right corner.
      Name:  small-MT34_ECU.jpg
Views: 1954
Size:  212.0 KB

      This particular unit was given to me as a 'broken' unit, it has nothing on the serial port, but I do see reference voltage on the reference pins, but no data on C31. With any luck I can reflash it to use it again.

      Close up of J5
      Name:  J5-MT34_small.jpg
Views: 1695
Size:  182.9 KB

      Very nice quality work!

    15. The Following User Says Thank You to 06T200 For This Useful Post:

      AndrewButler05 (07-25-2016)

    16. #10
      Aveo Whisperer 06T200's Avatar
      Join Date
      Aug 2014
      Location
      530
      Posts
      618
      Thanks
      55
      Thanked 86 Times in 74 Posts
      FYI - For those of us with the first gen Aveo's, this info should apply, with the exception of the 04/05 MY I have yet to confirm they use the same platform:

      So the chip in the lower left with 'AM29bl....' is our flash memory, according to the datasheet for it this is the 8MB chip. The larger chip with 'TriCore' is the main MCU/CPU - and is quite a capable little chip for an econo-box. This is TOP shelf stuff in the EMS world! The 'Delphi' chip with a 466 on it is most likely the memory management/watchdog chip. (only speculation at this point on the Delphi chip) The others are just voltage regulators/filters, some DC motor driver(s), injector drivers, and other ancillary stuff we need.

      FWIW: there are open source tools, and an RTOS 'OS' available that has been ported to the tricore 32-bit. see www.hightec-rt.com for the scoop. The GCC tool-chain is Eclipse ready and slaps right in. So make note, the entire chain of tools is available in the open source flavors to individuals for learning or reworking your own rig.

      For some background: Operating Systems - Infineon Technologies





    17. The Following User Says Thank You to 06T200 For This Useful Post:

      AndrewButler05 (07-26-2016)

    Page 1 of 3 123 LastLast

    Similar Threads

    1. New FREE book on hacking your car
      By 06T200 in forum Open Forum
      Replies: 1
      Last Post: 06-23-2016, 02:13 AM
    2. Six Year Journey With My Aveo5
      By honey/BEE in forum Introductions
      Replies: 2
      Last Post: 04-25-2015, 10:13 PM
    3. Sidewinder's Fuel Economy Almost 3-Year Journey
      By Sidewinder in forum Fuel Economy
      Replies: 2
      Last Post: 01-10-2013, 02:19 AM

    Posting Permissions

    • You may not post new threads
    • You may not post replies
    • You may not post attachments
    • You may not edit your posts
    •