flashed a bin with the seed key set to FFFF

[bobcratchet555]

flashed a bin from the 2002 files - 2002 Chevrolet Express Van Automatic L31 5.7L 4L60e 2wd (12212156) Lean Cruise.bin - accidentally did clone instead of os, parameters, and boot.

This file has the seed key set to FFFF which is obviously not valid. Also, the broadcast code seems to be invalid as well (in PcmBinBuild it shows up as question marks)

Any easy way to recover this without opening the ECU?
I am open to letting it sit on my desk and brute force for a week if need be.

I have tried setting the seed to FFFF in PcmHammer but it doesnt work (and it shouldnt because thats not valid).

It seems to me that the seed key is calculable in a predictable manner from the broadcast code, no? If the broadcast code is 0000 can that ever have a valid seed key? Or, will i be forced to open the ECU to fix it?

[kur4o]

Post the bin you flashed.

[bobcratchet555]

Post the bin you flashed.

posted.

this is similar to the bin in the 2002 bin files thread titled "2002 Chevrolet Express Van Automatic L31 5.7L 4L60e 2wd (12212156) Lean Cruise.bin" . it just has the spart and VE tables set up for swapping to an LT1. http://www.gearhead-efi.com/Fuel-Injection/attachment.php?attachmentid=5043&d=1376235082

[kur4o]

Eeprom_data Seed: FFFF, Bin Key 944D [OK]

Bin looks legit. Did you try reading/writing to pcm.

[bobcratchet555]

Eeprom_data Seed: FFFF, Bin Key 944D [OK]

Bin looks legit. Did you try reading/writing to pcm.

pcmhammer allowed me to write this bin to the PCM.

after writing it, it will no longer read or write

[kur4o]

What error it gives, sounds like a bug that interpret seed FFFF as pcm is unlocked instead of sending a new key.

Can you use custom key 944d

[bobcratchet555]

[08:17:05:963] Device Successfully Initialized and Ready
[08:17:09:110] VIN: 1GBFG15R121000000
[08:17:09:146] OS ID: 12212156
[08:17:09:153] Hardware Type: P01_P59
[08:17:09:182] Calibration ID: 4294967295
[08:17:09:207] Hardware ID: 9386530
[08:17:09:285] Serial Number: 1EB1VZ5E1227
[08:17:09:306] Broad Cast Code:
[08:17:09:329] MEC: 0
[08:17:37:107] Will save to C:\Users\JGerber\Desktop\not_backed_up\tuning_myla ppy\my_mystery_bins\dummy_003.bin
[08:17:38:664] Querying operating system of current PCM.
[08:17:38:690] OSID: 12212156
[08:17:38:762] The PCM didn't accept the unlock key value
[08:17:40:268] Unable to process unlock response.
[08:17:40:273] Unlock was not successful.

debug log

[08:17:38:664] Querying operating system of current PCM.
[08:17:38:678] XPro: 20 01 00 DE
[08:17:38:679] TX: 6C 10 F0 3C 0A
[08:17:38:690] OSID: 12212156
[08:17:38:694] Suppressing VPW chatter.
[08:17:38:704] XPro: 20 01 00 DE
[08:17:38:704] TX: 6C FE F0 28 00
[08:17:38:706] Sending 'test device present' notification.
[08:17:38:716] XPro: 20 01 00 DE
[08:17:38:717] TX: 8C FE F0 3F
[08:17:38:718] Ignoring chatter: 6C F0 10 68 00
[08:17:38:721] Sending seed request.
[08:17:38:728] XPro: 20 01 00 DE
[08:17:38:728] TX: 6C 10 F0 27 01
[08:17:38:738] Parsing seed value.
[08:17:38:744] Sending unlock request (FFFF, FFFF)
[08:17:38:752] XPro: 20 01 00 DE
[08:17:38:753] TX: 6C 10 F0 27 02 FF FF
[08:17:38:762] The PCM didn't accept the unlock key value
[08:17:39:265] Timeout.. no data present A
[08:17:39:266] No response to unlock request. Attempt #2
[08:17:39:766] Timeout.. no data present A
[08:17:39:766] No response to unlock request. Attempt #3
[08:17:40:267] Timeout.. no data present A
[08:17:40:268] No response to unlock request. Attempt #4
[08:17:40:268] Unable to process unlock response.
[08:17:40:273] Unlock was not successful.

PCMHammer 21

[bobcratchet555]

using the user defined key of 0x944d worked for reading. When i tried to write, there were a bunch of timeouts, and PCMHammer froze. This bricked the ECU further. Guess it is getting opened up.

EDIT:

I think what happened is that at least one of the sectors got erased. After restarting PCMHammer and power cycling the ECU, the "Read properties" option failed with unexpected response. After that, i attempted a "write full flash" with a known good bin. PCMHammer successfully entered recovery mode and was able to write the full flash to the ECU.

After that the ECU appears to be fully functional and responds to all of the usual PCMHammer shenanigans. So, thank you kindly for the help!!

I would recommend caution with the particular bin in question as it does not seem to play nice with PCMHammer for whatever reason. Additionally, PCMBinBuilder does not like it. For example, if you try to change the eeprom data such as the VIN, you get:

* Eeprom_data *
Seed FFFF
Bin Key 944D [OK]
Hardware 9386530
Serial 1EB1VZ5E1227
Id 3154131286
Id2 4294967295
Broadcast ????
VIN 1GBFG15R121000000
Filling empty area
[OK]
Validating segments
[OK]
Setting VIN to: 1GCHK29UX2E696969
[OK]
Applying patches
[OK]
Calculating checksums
OS checksum: 0761 [OK]
EngineCal checksum: 5B78 [OK]
EngineDiag checksum: 4F5F [OK]
TransCal checksum: D377 [OK]
TransDiag checksum: B45D [OK]
Fuel checksum: B568 [OK]
System checksum: 79E3 [OK]
Speedo checksum: 609E [OK]
Calculating Eeprom key
Seed: FFFF
Bin Key: 944D [OK]
Validating data
Error:
Error: Eeprom_data Broadcast code missing!

so, something tells me that there is an issue with that particular bin, although i couldn't say exactly what it is.

Thanks for all the help and use caution!!