Ah I see, you have the ability to change the radio key? is that right?
Its weird it reads the hex backwards for the pin code..
eg. 1111 in hex is 0457... and what is displayed in the log is 5704.
Wonder if the same occurs with the VY.. will try sending that when I pop a headunit into the car this arvo.
What is the Mechanical key exactly.. something important?
GM Technical Document Discussion
GM ALDL Logging and Scanning
Forum rules
To gain access to the Invite Only forum you must be invited by a member of that forum. That member will PM the mods or admins (NOT you) saying that they nominate you for access. THEY will be responsible for your actions. If you don't post and just leech info, you will BOTH be removed. Dont send a PM to the moderators or admins asking for access, you really dont want to see the result. If you submit information, you may simply be invited
To gain access to the Invite Only forum you must be invited by a member of that forum. That member will PM the mods or admins (NOT you) saying that they nominate you for access. THEY will be responsible for your actions. If you don't post and just leech info, you will BOTH be removed. Dont send a PM to the moderators or admins asking for access, you really dont want to see the result. If you submit information, you may simply be invited
by Biggsy » Wed Jun 13, 2012 3:14 pm
Mechanical key number is what you give a locksmith to get a key cut if you dont have a sample to copy.
It does let me change the radio PIN but its in the BCM menu not audio system.
Am having trouble logging it though, the BCM drops communication as it writes to itself
Couple things to try in a VX:
F2, 65, 4, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, A3, BRAKE LAMP illuminate
F2, 65, 4, 2, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, A1, SEATBELT LAMP illuminate
F2, 65, 4, 4, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9D, LOW FUEL LAMP illuminate
Tried and works,
Itching to play with my VY when I get home!
More to come......
Dave.
It does let me change the radio PIN but its in the BCM menu not audio system.
Am having trouble logging it though, the BCM drops communication as it writes to itself
Couple things to try in a VX:
F2, 65, 4, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, A3, BRAKE LAMP illuminate
F2, 65, 4, 2, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, A1, SEATBELT LAMP illuminate
F2, 65, 4, 4, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9D, LOW FUEL LAMP illuminate
Tried and works,
Itching to play with my VY when I get home!
More to come......
Dave.
I've come to realize that everything electronic runs on smoke, you let too much of it out and the electronics stop working!
-
Biggsy - Starting Ignition
- Posts: 33
- Joined: Mon Jun 04, 2012 10:37 pm
- Location: Adelaide
- Has thanked: 0 time
- Been thanked: 0 time
by TazzI » Wed Jun 13, 2012 7:46 pm
Gave a go at sending the pin command.. This is what I get.
Tx'd Frame = F1, 57, 1, 4, B3,
Rx'd Frame = F1, 58, D, 2, 33, 75,
.. No idea whats going on there.. 0D02 = 3330... doesnt seem right.
Tx'd Frame = F1, 57, 1, 4, B3,
Rx'd Frame = F1, 58, D, 2, 33, 75,
.. No idea whats going on there.. 0D02 = 3330... doesnt seem right.
by Biggsy » Wed Jun 13, 2012 10:47 pm
Try some of these, they are for a VY Commodore:
BCM FAULT CODE RETRIEVAL
Tx'd Frame = F1, 57, 1, 2, B5,
Rx'd Frame = F1, 69, 1, 2, 0, 0, 0, 4, 1, 28, 16, 3, 8, 12, 26, 28, 15, 1, FF, 14, 5, FF, C8,
BCM FAULT CODE HISTORY 18 26 2 7 25
BCM FAULT CODE CURRENT = NONE
THE FOLLOWING ARE FUNCTION TESTS:
Tx'd Frame = F1, 66, 4, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, A3,
TURN INTERIOR LIGHT ON
Tx'd Frame = F1, 66, 4, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, A3,
TURN INDICATORS ON (NOT FLASHING)
Tx'd Frame = F1, 66, 4, 0, 0, 40, 0, 0, 0, 0, 0, 40, 0, 0, 0, 0, 0, 0, 0, 25,
TURN A/C LED ON
Tx'd Frame = F1, 66, 4, 0, 0, 4, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 9D,
TURN LOW SPEED FAN ON
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, A2,
CENTRAL LOCKING LOCK
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, A1,
CENTRAL LOCKING DEADLOCK
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, A4,
CENTRAL LOCKING UNLOCK DRIVER
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, A3,
CENTRAL LOCKING UNLOCK ALL
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 4, 9F,
POP BOOT LOCK
Tx'd Frame = F1, 66, 4, 0, 0, 80, 0, 0, 0, 0, 0, 80, 0, 0, 0, 0, 0, 0, 0, A5,
OPERATE FRONT WIPERS
Tx'd Frame = F1, 66, 4, 0, 8, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 95,
DRIVERS WINDOW DOWN
Tx'd Frame = F1, 66, 4, 0, 4, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 9D,
PASSANGER WINDOW DOWN
Tx'd Frame = F1, 66, 4, 0, 40, 0, 0, 0, 0, 0, 40, 0, 0, 0, 0, 0, 0, 0, 0, 25,
POWER WINDOW RELAY
Tx'd Frame = F1, 66, 4, 0, 0, 10, 0, 0, 0, 0, 0, 10, 0, 0, 0, 0, 0, 0, 0, 85,
HORN
Tx'd Frame = F1, 66, 4, 0, 2, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, A1,
ILLUMINATION RELAY
BCM FAULT CODE RETRIEVAL
Tx'd Frame = F1, 57, 1, 2, B5,
Rx'd Frame = F1, 69, 1, 2, 0, 0, 0, 4, 1, 28, 16, 3, 8, 12, 26, 28, 15, 1, FF, 14, 5, FF, C8,
BCM FAULT CODE HISTORY 18 26 2 7 25
BCM FAULT CODE CURRENT = NONE
THE FOLLOWING ARE FUNCTION TESTS:
Tx'd Frame = F1, 66, 4, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, A3,
TURN INTERIOR LIGHT ON
Tx'd Frame = F1, 66, 4, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, A3,
TURN INDICATORS ON (NOT FLASHING)
Tx'd Frame = F1, 66, 4, 0, 0, 40, 0, 0, 0, 0, 0, 40, 0, 0, 0, 0, 0, 0, 0, 25,
TURN A/C LED ON
Tx'd Frame = F1, 66, 4, 0, 0, 4, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 9D,
TURN LOW SPEED FAN ON
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, A2,
CENTRAL LOCKING LOCK
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 3, A1,
CENTRAL LOCKING DEADLOCK
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, A4,
CENTRAL LOCKING UNLOCK DRIVER
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, A3,
CENTRAL LOCKING UNLOCK ALL
Tx'd Frame = F1, 66, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 4, 9F,
POP BOOT LOCK
Tx'd Frame = F1, 66, 4, 0, 0, 80, 0, 0, 0, 0, 0, 80, 0, 0, 0, 0, 0, 0, 0, A5,
OPERATE FRONT WIPERS
Tx'd Frame = F1, 66, 4, 0, 8, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 95,
DRIVERS WINDOW DOWN
Tx'd Frame = F1, 66, 4, 0, 4, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 9D,
PASSANGER WINDOW DOWN
Tx'd Frame = F1, 66, 4, 0, 40, 0, 0, 0, 0, 0, 40, 0, 0, 0, 0, 0, 0, 0, 0, 25,
POWER WINDOW RELAY
Tx'd Frame = F1, 66, 4, 0, 0, 10, 0, 0, 0, 0, 0, 10, 0, 0, 0, 0, 0, 0, 0, 85,
HORN
Tx'd Frame = F1, 66, 4, 0, 2, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, A1,
ILLUMINATION RELAY
I've come to realize that everything electronic runs on smoke, you let too much of it out and the electronics stop working!
-
Biggsy - Starting Ignition
- Posts: 33
- Joined: Mon Jun 04, 2012 10:37 pm
- Location: Adelaide
- Has thanked: 0 time
- Been thanked: 0 time
by gruntly69 » Thu Jun 14, 2012 7:58 am
NICE Work guys, looks like all my work is out dated!
I'll still have a look if anything is needed but you guys seem way more advanced than I!
Jezza, I have the old Snap-On MT2500, I do have a newer solus pro but it's on US software so I need to see if I can flash newer Aust program to it's chip!
EDIT: Nice Work Zero stayed on last page, but for some reason it said on the bottom was only at page 5 of 6, but was actually on the 6th page!
I'll still have a look if anything is needed but you guys seem way more advanced than I!
Jezza, I have the old Snap-On MT2500, I do have a newer solus pro but it's on US software so I need to see if I can flash newer Aust program to it's chip!
EDIT: Nice Work Zero stayed on last page, but for some reason it said on the bottom was only at page 5 of 6, but was actually on the 6th page!
by TazzI » Thu Jun 14, 2012 2:34 pm
wow Biggsy!
I didn't think the car sent that many commands!.. Im keen on getting the windows going up by pressing the key unlock twice!
Will try them all when I get home, will post results, the last radio I had in had a pass code of 5155 or something along those lines so see if the radios pin goes to the bcm and saves
I didn't think the car sent that many commands!.. Im keen on getting the windows going up by pressing the key unlock twice!
Will try them all when I get home, will post results, the last radio I had in had a pass code of 5155 or something along those lines so see if the radios pin goes to the bcm and saves
by Biggsy » Thu Jun 14, 2012 5:22 pm
The scantool sends the commands so u can do tests. I'm not even half way through yet, and this is just VY!
Need someone that can make a program that can be customised to send each of these commands by clicking on an icon. Some sort of customizable GUI.
Dave.
Need someone that can make a program that can be customised to send each of these commands by clicking on an icon. Some sort of customizable GUI.
Dave.
I've come to realize that everything electronic runs on smoke, you let too much of it out and the electronics stop working!
-
Biggsy - Starting Ignition
- Posts: 33
- Joined: Mon Jun 04, 2012 10:37 pm
- Location: Adelaide
- Has thanked: 0 time
- Been thanked: 0 time
by TazzI » Thu Jun 14, 2012 6:55 pm
Logged what happens when you go into the "general" of the program.. goes nuts when you hit read.
This is what is sent when clicking general (disabling eeprom):
Then when you click read you get....
Then clicking write goes spastic!.. may take some time figuring each code out here, uses the 11mode in the general.. from memory 11 is the "security" mode. When writing to the cluster in the "general" tab, it uses mode 21.. it request data first then sends the new data.
This is what is sent when clicking general (disabling eeprom):
- Code: Select all
Request: 14/06/2012 4:44:14 PM.01464 (+10.3584 seconds)
F2 57 11 00 A6 òW..¦
Answer: 14/06/2012 4:44:14 PM.01464 (+0.0000 seconds)
F2 57 11 00 A6 F2 58 11 9B C0 4A òW..¦òX.ÀJ
Request: 14/06/2012 4:44:14 PM.03064 (+0.0000 seconds)
F2 59 11 01 FD EB BB òY..ýë»
Answer: 14/06/2012 4:44:14 PM.04664 (+0.0156 seconds)
F2 59 11 01 FD EB BB F2 58 11 FD EB BD òY..ýë»òX.ýë½
Request: 14/06/2012 4:44:14 PM.06164 (+0.0000 seconds)
F1 56 09 B0 ñV.°
Answer: 14/06/2012 4:44:14 PM.07764 (+0.0156 seconds)
F1 56 09 B0 ñV.°
Then when you click read you get....
- Code: Select all
Request: 14/06/2012 4:44:16 PM.71464 (+2.6374 seconds)
F2 58 22 00 01 93 òX"..
Answer: 14/06/2012 4:44:16 PM.71464 (+0.0000 seconds)
F2 58 22 00 01 93 F2 5B 22 00 00 01 18 6A 0E òX"..ò["....j.
Request: 14/06/2012 4:44:16 PM.77764 (+0.0468 seconds)
F2 58 22 00 02 92 òX"..
Answer: 14/06/2012 4:44:16 PM.77764 (+0.0000 seconds)
F2 58 22 00 02 92 F2 5B 22 00 00 02 01 2C 62 òX"..ò["....,b
Request: 14/06/2012 4:44:16 PM.83964 (+0.0468 seconds)
F2 58 22 00 60 34 òX".`4
Answer: 14/06/2012 4:44:16 PM.83964 (+0.0000 seconds)
F2 58 22 00 60 34 F2 5D 22 00 00 60 00 00 F3 80 òX".`4ò]"..`..ó
BC ¼
Request: 14/06/2012 4:44:17 PM.90164 (+0.0468 seconds)
F2 58 22 00 4D 47 òX".MG
Answer: 14/06/2012 4:44:17 PM.90164 (+0.0000 seconds)
F2 58 22 00 4D 47 F2 5A 22 00 00 4D 00 45 òX".MGòZ"..M.E
Request: 14/06/2012 4:44:17 PM.96464 (+0.0468 seconds)
F2 58 22 00 4E 46 òX".NF
Answer: 14/06/2012 4:44:17 PM.96464 (+0.0000 seconds)
F2 58 22 00 4E 46 F2 5A 22 00 00 4E FF 45 òX".NFòZ"..NÿE
Request: 14/06/2012 4:44:17 PM.02664 (+0.0468 seconds)
F2 58 22 00 4F 45 òX".OE
Answer: 14/06/2012 4:44:17 PM.02664 (+0.0000 seconds)
F2 58 22 00 4F 45 F2 5A 22 00 00 4F 3C 07 òX".OEòZ"..O<.
Request: 14/06/2012 4:44:17 PM.08964 (+0.0468 seconds)
F2 58 22 00 DB B9 òX".Û¹
Answer: 14/06/2012 4:44:17 PM.10464 (+0.0156 seconds)
F2 58 22 00 DB B9 F2 5A 22 00 00 DB 00 B7 òX".Û¹òZ"..Û.·
Request: 14/06/2012 4:44:17 PM.15164 (+0.0312 seconds)
F2 58 22 00 E3 B1 òX".ã±
Answer: 14/06/2012 4:44:17 PM.16764 (+0.0156 seconds)
F2 58 22 00 E3 B1 F2 5A 22 00 00 E3 22 8D òX".ã±òZ"..ã"
Request: 14/06/2012 4:44:17 PM.21364 (+0.0312 seconds)
F2 58 22 00 E4 B0 òX".ä°
Answer: 14/06/2012 4:44:17 PM.21364 (+0.0000 seconds)
F2 58 22 00 E4 B0 F2 5A 22 00 00 E4 51 5D òX".ä°òZ"..äQ]
Request: 14/06/2012 4:44:17 PM.27664 (+0.0312 seconds)
F2 58 22 00 50 44 òX".PD
Answer: 14/06/2012 4:44:17 PM.27664 (+0.0000 seconds)
F2 58 22 00 50 44 F2 5A 22 00 00 50 00 42 òX".PDòZ"..P.B
Request: 14/06/2012 4:44:17 PM.33864 (+0.0468 seconds)
F2 58 22 00 54 40 òX".T@
Answer: 14/06/2012 4:44:17 PM.33864 (+0.0000 seconds)
F2 58 22 00 54 40 F2 5A 22 00 00 54 00 3E òX".T@òZ"..T.>
Request: 14/06/2012 4:44:17 PM.40164 (+0.0468 seconds)
F2 58 22 00 7F 15 òX"..
Answer: 14/06/2012 4:44:17 PM.40164 (+0.0000 seconds)
F2 58 22 00 7F 15 F2 5A 22 00 00 7F 01 12 òX"..òZ"....
Request: 14/06/2012 4:44:17 PM.46364 (+0.0468 seconds)
F2 58 22 00 66 2E òX".f.
Answer: 14/06/2012 4:44:17 PM.46364 (+0.0000 seconds)
F2 58 22 00 66 2E F2 5A 22 00 00 66 00 2C òX".f.òZ"..f.,
Request: 14/06/2012 4:44:17 PM.52564 (+0.0468 seconds)
F2 58 22 00 CD C7 òX".ÍÇ
Answer: 14/06/2012 4:44:17 PM.52564 (+0.0000 seconds)
F2 58 22 00 CD C7 F2 5B 22 00 00 CD 00 00 C4 òX".ÍÇò["..Í..Ä
Request: 14/06/2012 4:44:17 PM.58864 (+0.0468 seconds)
F2 58 22 00 7E 16 òX".~.
Answer: 14/06/2012 4:44:17 PM.58864 (+0.0000 seconds)
F2 58 22 00 7E 16 F2 5A 22 00 00 7E 00 14 òX".~.òZ"..~..
Request: 14/06/2012 4:44:17 PM.65064 (+0.0468 seconds)
F2 58 22 00 7A 1A òX".z.
Answer: 14/06/2012 4:44:17 PM.65064 (+0.0000 seconds)
F2 58 22 00 7A 1A F2 5A 22 00 00 7A 01 17 òX".z.òZ"..z..
Request: 14/06/2012 4:44:17 PM.71364 (+0.0468 seconds)
F2 58 22 00 F6 9E òX".ö
Answer: 14/06/2012 4:44:17 PM.72864 (+0.0156 seconds)
F2 58 22 00 F6 9E F2 5A 22 00 00 F6 2B 71 òX".öòZ"..ö+q
Request: 14/06/2012 4:44:17 PM.77564 (+0.0312 seconds)
F1 56 09 B0 ñV.°
Answer: 14/06/2012 4:44:17 PM.79164 (+0.0156 seconds)
F1 56 09 B0 ñV.°
Then clicking write goes spastic!.. may take some time figuring each code out here, uses the 11mode in the general.. from memory 11 is the "security" mode. When writing to the cluster in the "general" tab, it uses mode 21.. it request data first then sends the new data.
by jezzab » Thu Jun 14, 2012 7:23 pm
I would suggest getting some GM white papers or SAE docs on the ALDL protocol as it will help with nderstanding the responses and status codes
Daily Ute - 2009 Holden VE SSV Ute Single Turbo (IQ, E3 Cluster, EDI) - 586rwhp
Drag Ute - 2002 Holden VU SS Twin Turbo - 1010rwhp [SOLD]
All VE/VF Module reprogramming. Remote programming with flash box
http://www.facebook.com/jsbperformance
Drag Ute - 2002 Holden VU SS Twin Turbo - 1010rwhp [SOLD]
All VE/VF Module reprogramming. Remote programming with flash box
http://www.facebook.com/jsbperformance
by gruntly69 » Fri Jun 15, 2012 7:55 am
Biggsy, how do you get the sent commands so cleanly without having to sift through all the other data? I could try & send commands direct from my scan tool without the car connected but i'm 99% sure it picks up it's not detected!