My Aveo ECU hacking journey has begun

[06T200]

I was finally able to unlock an Aveo ECM using a very crude brute force script. Uses the same seed/key arrangement as any other GM/Delphi module. Anyway, when I find something useful like lookup tables or interesting DIDs I will be sure to share. Once I nail down the memory address registers I should be able to pull some calibration data out of it, and possibly even grab the operating module, but I am no guru when it comes to hex/assembly code.

They say pics or it didn't happen....




That just happened...

Tip: If your seed is 204E - The key is going to be 8B96. This is from an 05 module.


FYI

[06T200]

ps: if anything in this thread sounds like greek geek speak, just click on to the next thread, this is going to get really BORING for the casual driver! I am posting this info for the hard core Aveo guru's, and you know who you are! If anyone would like to play along at home, don't hesitate to chime in, I will share any code/data R&D I have on the subject.

[northguest47]

subscribed. not a hard core guru though, but i speak geek a bit. don't know anything about car computers. looks like you know a lot about object oriented language. it would be awesome to open source something like this, and provide a free gui and compiler with the car imho

[06T200]

Well im just one guy with some time on the side of my day job as a programmer, one day I hope more will dive in to decode this stuff.

Here is a short snippet if you want to pull the VIN and hold it in a variable.

# Scripted version ======Get VIN ============
$ecuPort.open()
$ecuPort.writeline("0902" + [char]13) # Vin request
start-sleep -m 200
$input = $port.ReadExisting() # -split(" ")
$vin = $input.split(" ")[6,10,11,12,13,17,18,19,20,24,25,26,27,31,32,33,34] |
ForEach-Object { [Convert]::ToInt32($_,16) } |
ForEach-Object { [Convert]::ToChar($_) } |
ForEach-Object { $_ }
$vin -join ""

[06T200]

Here is the script with the brute force cracker routine for anyone wanting to play.

Just remove the .txt on the end to edit with powershell. Will need to point it to your interface port. Tested using ST1110 'clone' chip.
Enjoy

[d_5150_misfit]

What interface are you using to communicate with the ecu?

[06T200]

Just the garden variety $4-$10 cheapo OBD scanner, this has a 'vgate' logo. That worked the best, I have a wired interface as well, but it would reset every 30 seconds or so, so I stuck the Bluetooth one on and it has run with no issues. Any 'ELM compatible' interface should do the trick.

[d_5150_misfit]

I have an 08 aveo myself, up until I saw your post I figured simpler methods of engine modifications were non existant. If needed I can acquire data from the ecu currently in use in my vehicle. Id like to see this taken further.

[06T200]

A peek inside of an MT34 ECU for amusement..

It's a Hitachi board with some high end chips, notice the Hitachi logo in the lower right corner.


This particular unit was given to me as a 'broken' unit, it has nothing on the serial port, but I do see reference voltage on the reference pins, but no data on C31. With any luck I can reflash it to use it again.

Close up of J5


Very nice quality work!

[06T200]

FYI - For those of us with the first gen Aveo's, this info should apply, with the exception of the 04/05 MY I have yet to confirm they use the same platform:

So the chip in the lower left with 'AM29bl....' is our flash memory, according to the datasheet for it this is the 8MB chip. The larger chip with 'TriCore' is the main MCU/CPU - and is quite a capable little chip for an econo-box. This is TOP shelf stuff in the EMS world! The 'Delphi' chip with a 466 on it is most likely the memory management/watchdog chip. (only speculation at this point on the Delphi chip) The others are just voltage regulators/filters, some DC motor driver(s), injector drivers, and other ancillary stuff we need.

FWIW: there are open source tools, and an RTOS 'OS' available that has been ported to the tricore 32-bit. see www.hightec-rt.com for the scoop. The GCC tool-chain is Eclipse ready and slaps right in. So make note, the entire chain of tools is available in the open source flavors to individuals for learning or reworking your own rig.

For some background: Operating Systems - Infineon Technologies