LS1GTO Forums banner

1 - 20 of 133 Posts

·
Registered
Joined
·
91 Posts
Discussion Starter #1
I’ve seen a few threads where people have been in need of a replacement BCM and have had a hard time getting one. I know there is a good used supply, but without the security codes, they are not very useful. With that in mind, I decided to come up with a way that anyone would be able to replace their BCM with a used unit all by themselves, and came up with the following:





This can read and write to the BCM, meaning it can clone a BCM, and also give you the BCM security code. It will also clone PIMs as well. It connects to the BCM or PIM with the programming clip and gets power through a mini USB connector.

You select the action you want(BCM or PIM, read or write) with the “MODE” button and then push “ENTER”. It does a verification test with every read/write and will notify you of any issues. I also designed it to only allow the “write” function after a successful “read” was done and the data was in the on-board memory. The only real trick is to make sure the clip is oriented correctly and making proper contact. The programming clip has a red stripe that indicates the number 1 pin. The following pictures show the BCM EEPROM and how the programming clip should be oriented:



BCM orientation:



PIM orientation:



It's not perfect and doesn't give any PIM info. For now, it simply copies the PIM data and writes it back. If anyone knows at what memory location in the PIM any security codes or important info are stored, I can have it displayed on the LCD.

I know of at least 4 BCM part numbers, and I am not sure how many different PIMs there are, so if you buy used, make sure they match your stock peices.

I have received a lot of help from the GTO community over the years and many of you have contributed to the GTO’s electronics knowledge that allowed me to build this. I’m hoping this will help some of you out as well.

My plan is to loan it out to anyone that needs it. If there is a high demand, then maybe I’ll figure out a better way to get this out to the community. It’s already going out to a member for its first test. I’ll update this thread when it is available again.

I'd also be interested in any suggestions or comments.
 

·
May I quote you on that?
Joined
·
22,046 Posts
Nice work.
 

·
Pontiac Fanboy
Joined
·
1,182 Posts
Subscribed for (hopefully no) future reference.

Thanks for the effort, care to post a write-up or keeping it close to the chest for now?
 

·
Unleaded Regular Member
Joined
·
1,903 Posts
Amazing. Awesome work.
 

·
Registered
Joined
·
315 Posts
Did you build that tool yourself!? It looks professionally built.

My plan is to loan it out to anyone that needs it. If there is a high demand, then maybe I’ll figure out a better way to get this out to the community. It’s already going out to a member for its first test. I’ll update this thread when it is available again.
Could always post a DIY build thread for everything. Might be a slightly long post but then anyone could try and build one if they have the skills.
 

·
Cyclone Gray Moneypit
Joined
·
1,989 Posts
Wow, great contribution! I'd love to see a DIY/BOM with software to flash if that wouldn't be too much to ask :) thanks for your work!

sub'd

IB4 Tazzi

:wall:
 

·
Registered
Joined
·
91 Posts
Discussion Starter #7
I wrote the code and designed/built the hardware myself. It basically consists of a PIC, an LCD, a couple of buttons and some resistors/caps.
I don't sharing more details and can get a more detailed write-up going as soon as I have some time and have made sure it's been tried out by a few people and bug free. I don't code or design circuits for a living, so I'm hoping I got most of the issues out of it.
In the meantime, I can answer any questions.
 

·
Registered
Joined
·
84 Posts
I wrote the code and designed/built the hardware myself. It basically consists of a PIC, an LCD, a couple of buttons and some resistors/caps.
I don't sharing more details and can get a more detailed write-up going as soon as I have some time and have made sure it's been tried out by a few people and bug free. I don't code or design circuits for a living, so I'm hoping I got most of the issues out of it.
In the meantime, I can answer any questions.
Great Work!. Professional looking piece of equipment!.
I have a couple BCM's on bench that I tinker around with, ones working fine but the other was corrupt by trying to read the eeprom. I got it from another member that attempted to read the bcm's eeprom, although some reason ended up wiping info. We figured it was something to do with it being a 93S46 eeprom.. maybe had a security enabled wipe for unauthorized access or something along those lines. Guessing you havent had that problem!?
Been attempting to fix every since.

As for the PIM, from the dumps seen, the VIN is saved backwards, found at loc 0x5C to 0x4C.
And think the security code/link is the last 4 bytes so 7C to 7F.
Both of the above are stored in plain text. I would assume that the last 4 bytes should match up with bcm & pcm.. maybe? haha.

IB4 Tazzi

:wall:
Lol.
 

·
Registered
Joined
·
1,144 Posts
Very nice work. It'd be interesting to get a read of an unprogrammed bcm/pim which the helms says you can relink without the tech 2
Probably unlikely since GM can't seem to get them...
 

·
Registered
Joined
·
91 Posts
Discussion Starter #10
Great Work!. Professional looking piece of equipment!.
I have a couple BCM's on bench that I tinker around with, ones working fine but the other was corrupt by trying to read the eeprom. I got it from another member that attempted to read the bcm's eeprom, although some reason ended up wiping info. We figured it was something to do with it being a 93S46 eeprom.. maybe had a security enabled wipe for unauthorized access or something along those lines. Guessing you havent had that problem!?
Been attempting to fix every since.

As for the PIM, from the dumps seen, the VIN is saved backwards, found at loc 0x5C to 0x4C.
And think the security code/link is the last 4 bytes so 7C to 7F.
Both of the above are stored in plain text. I would assume that the last 4 bytes should match up with bcm & pcm.. maybe? haha.


Lol.
The BCM has a 24C04 I2C EEPROM while the PIM uses a 93C46 Microwire EEPROM. The key FOB uses the 93S46, which is write protected.
The trick with the BCM EEPROM is that it has pin 2 tied to VCC, changing it's address to A4/A5. Some/most programmers don't allow you to change the address of the target EEPROM.

Thanks for the PIM info; I'll look into that security code location.
 

·
Registered
Joined
·
84 Posts
Very nice work. It'd be interesting to get a read of an unprogrammed bcm/pim which the helms says you can relink without the tech 2
Probably unlikely since GM can't seem to get them...
Maybe not the case Vending.. As we have seen in with the clusters, sending F2,57,0A,07,chksum (maybe it was 06?) does a "reset all" which reverts back to factory settings.. and clears alot of data that needs to be reset. Maybe the BCM has the same implementation? Havent tried that though!

The BCM has a 24C04 I2C EEPROM while the PIM uses a 93C46 Microwire EEPROM. The key FOB uses the 93S46, which is write protected.
The trick with the BCM EEPROM is that it has pin 2 tied to VCC, changing it's address to A4/A5. Some/most programmers don't allow you to change the address of the target EEPROM.

Thanks for the PIM info; I'll look into that security code location.
Ah must of got the 94s46 from the key, currently have that eeprom in the programmer *dough*
Ah... thats interesting with the programmer! Should try doing a read of a unlinked bcm, then again with the bcm linked.. Im guessing that a little security code is written to link the devices.. possibly the 4digit code seen in the PIM dump.
Ill open up the corrupt bcm and double check its the same 24C04.
 

·
Registered
Joined
·
1,375 Posts
looks great. I bet the same logic could be used to clone the cluster as well. I was unable to program my cluster in circuit with my programmer, but i wonder if it is due to the pin 2 to vcc as well....

Ryan
 

·
Premium Member
Joined
·
3,958 Posts
awesome.
 

·
Registered
Joined
·
91 Posts
Discussion Starter #16
As for the PIM, from the dumps seen, the VIN is saved backwards, found at loc 0x5C to 0x4C.
And think the security code/link is the last 4 bytes so 7C to 7F.
The PIM security code is in fact stored at these locations, and I have reprogrammed the cloner to display them as well.
Thanks again for the info.
 

·
Registered
Joined
·
38 Posts
First User Experience

Howdy Gents:

I'm the lucky first recipient of 06phantom's masterpiece. I have 2 BCMs and a PIM. One of the BCMs is the "GM Replacement" where the BCM Security Code is on a label on the housing.

IT WORKS! :hail:

It's pretty straight forward to use... plug the cable into the appropriate header (labeled BCM or PIM), clip-on to the EEPROM, provide power, select the "Mode," and push "Enter." 06phantom made it very simple and also built-in error messages/LED to indicate a problem. The only thing that I think will be a bit of a challenge going forward is getting the clip to stay on and making sure all 8 pins are in contact long enough to take a reading. I had to try several times before I was able to get a good read (this is where the error message/LED helps!). Don't get discouraged as it will work! :thumbs:

My hat's off to 06phantom for lending his expertise to solve a problem we're all going to have as our cars get older... meaning GM no longer has stock and the AU company that built them originally no longer maintains the workforce. So as GTOs die those BCMs will be valuable!

THANK YOU 06PHANTOM!!!
 

·
Registered
Joined
·
38 Posts
A Question on PIMs

I believe the four-digit PIM Code is the Immobilizer Code (IMMO). According to the GM Service Manual the only way a PIM can be reused is if it is reset (in the vehicle) first:

PIM Reset Procedure

The PIM reset procedure is only required when moving a known good PIM from one vehicle to another for the purpose of diagnosing the vehicle.

When a PIM has been installed into a vehicle, it is security linked to the BCM and the ECM. Once this linking has been performed, the PIM cannot be installed in any other vehicle unless the security linking between the BCM and the ECM has been reset. To reset the PIM refer to Service Programming System (SPS).​

The manual states that the "reset" needs to be done prior to removing the PIM from the vehicle. If this is true then a non-reset PIM is worthless for being installed in another vehicle and 06 phantom's tool can only be used to recover the IMMO Code in cases of a lost security card. I assume a legal owner with a VIN could, with some hassle, get it from GM as well.

Can anyone shed some light on this? If the PIM needs to be "erased/reset" is that something that 06phantom's tool could possible do?
 

·
Registered
Joined
·
84 Posts
The PIM security code is in fact stored at these locations, and I have reprogrammed the cloner to display them as well.
Thanks again for the info.
No worries, glad it helped. Phantom, anychance in the dumps of the modules did you find the same code in any of them? I thought it was the "linking" code.

I believe the four-digit PIM Code is the Immobilizer Code (IMMO).
Can anyone shed some light on this? If the PIM needs to be "erased/reset" is that something that 06phantom's tool could possible do?
I figured it was just a 4digit "security code" that links all three devices together?
I would have thought comparing a dump between the pim,pcm and bcm would turn up the same security code if from the same car. If thats the case, then the modules can be relinked by making sure the code is the same through them all. Simple read and write will o the trick.
 

·
Premium Member
Joined
·
3,958 Posts
when we used a tech2 to flash my car as an A4 after the M6 to 4L80 conversion, we somehow missed a step or something and didn't get things "linked up correctly" Now when I start the car the dic displays "service vehicle" with a wrench. We have checked the codes and found that the pim and abs are throwing the codes.

anyone know of a way to relink all?
 
1 - 20 of 133 Posts
Top