Skip to content
Install CameraLoops App

Browse CameraLoops via the app. Learn more.

www.CameraLoops.ru

Use the CameraLoops full-screen app on your home screen with push notifications, badges and more.

To install the CameraLoops app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install the CameraLoops app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Hacking the GM HMI 2.5 module.

I'm on a quest to hack the GM HMI 2.5 module to learn more about its functionality.

This article is a placeholder for future findings and experiments.

GM HMI 2.5 EMMC Chip Pinouts for dumping the HMI 2.5 Emmc Micro Chip

For dumping the contents of the HMI 2.5 module's EMMC chip, which stores the Sat-Nav maps, calibration files and other operating files.

 

To be continued 

IMG_5021 (3).jpeg



User Feedback

Recommended Comments

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

If someone want to try... Calibrations for HMI 2.5 84099718/84028485 from Buick Encore 2019.

I dont know if are compatibles with europeans HMIs 2.5 and others HMI numbers.

7af17e9d0c6f951587a06f14c1b25555x.jpg

 

has an announce on google. you can search it using the vin. KL4CJCSM9KB891239

 

 

a few days ago, tested anothers cals from Chevy, Cadillac in a hmi 2.0 and works...

IMG_20220913_195529.jpg

 

HMI 84099718.zip

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

well, works in a 234 15900 hmi 2.5.

 

Now i cant go back to Opel theme. LOL via sps, software not available for this hmi

IMG_20221016_000401.jpg

IMG_20221016_000340.jpg

pupu14 Community Regular

+pupu14

+Contributor

GM Car Hacking Expert

  • Contributor

Yeah, same error for me for SPS2.. I guess it does not like seeing "incorrect" CALs than it was expecting.

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

someone has archieved the uboot mode in the hmi 2.5? im trying but...

 

TBB-gd41017e #1

TBB-gd41017e #1

TBB-gd41017e #1

TBB-gd41017e #1

TBB-gd41017e #1
# INFO SW=GMG3G_LINUX_15.1A044 GMG3_AUTOSAR_15.0C06.12 
mDNSResponder: mDNSResponder (Engineering Build) (Jun  8 2015 17:59:40) starting
mDNSResponder: mDNS allowed interface: cplay
mDNSResponder: mDNS disallowed interfaces: none(disabled)
mDNSResponder:   6: Listening for incoming Unix Domain Socket client requests
mDNSResponder: mDNS_AddDNSServer: Lock not held! mDNS_busy (0) mDNS_reentrancy (0)
mDNSResponder: mDNS_AddDNSServer: Lock not held! mDNS_busy (0) mDNS_reentrancy (0)
mDNSResponder: mDNSPlatformSourceAddrForDest: connect 1.1.1.1 failed errno 101 (Network is unreachable)
Creating zram swap with 300 MBytes
khd: Looking up config value for key 'key_store'
khd: Key store path: /var/opt/bosch/dynamic/keyman/key_store.

khd: Looking up config value for key 'listen_socket'
khd: Server listen path: /var/run/khd/listen.

khd: Reading disc store file
khd: Number of keys on disc: 1
Created zram swap with 300 MBytes
# INFO HIT NOT Enable/Available

 

the system boots normaly

Robi_X Collaborator

+Robi_X

+Contributor

GM Car Hacking Expert

  • Contributor

I was also not able to get in U-Boot, i just changed the settings in the Partition like HMI_Guy has described.

But I didn't get it SSH to work because the ASIX AX88179 driver is not installed and not able to installed.

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

still working.

IMG_20221031_212107.thumb.jpg.3e5694eb2c24f134aadbc7c20f9cce62.jpg

 

 

IMG_20221031_212112.thumb.jpg.745e1f9f76a5dcae9c5c9efeeee2ed04.jpg

IMG_20221031_212117.thumb.jpg.f8a04a0cf4ee5e16286b044445553ac2.jpg

 

ZZZ Enthusiast

+ZZZ

+Contributor
  • Contributor

Is it possible to connect using serial console to Instrument cluster UHS?

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor
34 minutes ago, ZZZ said:

Is it possible to connect using serial console to Instrument cluster UHS?

i dont think so possible. the HMI is a linux system based and have the console serial port. but the UHS.. i dont know. 

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor
On 7/29/2022 at 1:33 PM, Troy said:


interesting stuff. Do you know what that install and recorder icon is used for? 

I've been doing some research, and the Recorder button is for, as the name suggests, to record video from the K157 module. K157 is the 360 vision module (RPO UVH) and all the cameras in the car are connected to this module. Front, sides and rear. Example vin: W0VZT6GF1J1168520 In the TIS, there is detailed information about the Recorder function

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

Hi, someone knows if the SHOP app in the hmi 2.5 still working in USA vehicles?

 

image.png.d676341d5a0a0be0ae3ae231aa1cee4b.png

 

In EU vehiches the shop goes to
vehicle.api.eur.onstar.com:443 > this host is dead

in USA veiches:
vehicle.api.gm.com:443

 

Andreia Pereira Lemes Rising Star

Andreia Pereira Lemes

Member
On 28/09/2021 at 15:46, Miragui said:

 

O EMMC usa MBR e tem um total de 6 partições. 3 partições primárias e 1 partição estendida com 3 partições, todas formatadas em EXT4.

Content Partition 1.jpg

Content Partition 2.jpg

Content Partition 3.jpg

Content Partition 4.jpg

Content Partition 5.jpg

Content Partition 6.jpg

Partition 1.jpg

Partition 2.jpg

Hello, good times everyone.

 

I'm in the process of finding out about the HMI module. I already know the SD solder points, I have a backup SD with the software in version SW.15.2B033. The issue is that same version is not accepted in other frames.

 

Being Linux files their reading by me is vague.
I believe I'm close to being able to adapt the sd in place of the memory without much difficulty. 
Can you give any tips, is it possible to use the same files in another HMI, is your data only in memory?
Sorry about my English.

MODULOS HMI.jpeg

SD.jpeg

Andreia Pereira Lemes Rising Star

Andreia Pereira Lemes

Member
I found a link where there are open source code for several versions. I downloaded some, but I don't know their application. Could someone take a look?

 

favicon.ico Bosch Open Source Software

OSS.BOSCH-CM.COM

 

pupu14 Community Regular

+pupu14

+Contributor

GM Car Hacking Expert

  • Contributor

Yes, it's a known link.
But these files are just Open-source system firmware (kernel, drivers, runtimes etc.).
GM receive that base image from Bosch, and build their HMI system on top of that.

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

if you have access to SPS, you can perform a usb download the HMI firmware. around 2,7Gb.

Andreia Pereira Lemes Rising Star

Andreia Pereira Lemes

Member
26 minutes ago, Arbe_gtc said:

se você tiver acesso ao SPS, poderá realizar um download usb do firmware da IHM. cerca de 2,7Gb.

Sorry, but what would SPS be?
Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor
5 minutes ago, Andreia Pereira Lemes said:
Sorry, but what would SPS be?

techline connect

Miragui Top Member

+Miragui

+Contributor
  • Contributor
On 3/13/2023 at 5:11 PM, Andreia Pereira Lemes said:

Hello, good times everyone.

 

I'm in the process of finding out about the HMI module. I already know the SD solder points, I have a backup SD with the software in version SW.15.2B033. The issue is that same version is not accepted in other frames.

 

Being Linux files their reading by me is vague.
I believe I'm close to being able to adapt the sd in place of the memory without much difficulty. 
Can you give any tips, is it possible to use the same files in another HMI, is your data only in memory?
Sorry about my English.

MODULOS HMI.jpeg

SD.jpeg

Nice work on adapting the SD adapter.

Changing only the data from the EMMC is not going to work. All the system checksums are in the EMMC, but it checks against the NOR GL512. So you have to change the data from both. Calibration data is stored in the NOR. My advice is change the data in both the EMMC and NOR. 

Andreia Pereira Lemes Rising Star

Andreia Pereira Lemes

Member
13 hours ago, Miragui said:

Bom trabalho na adaptação do adaptador SD.

Alterar apenas os dados do EMMC não vai funcionar. Todas as somas de verificação do sistema estão no EMMC, mas são verificadas no NOR GL512. Então você tem que mudar os dados de ambos. Os dados de calibração são armazenados no NOR. Meu conselho é alterar os dados tanto no EMMC quanto no NOR. 

Thank you for your guidance, but I don't know how to proceed. 
Could you give more details?
mmbrothers Rising Star

+mmbrothers

+Contributor
  • Contributor

Dump emmc data from the new hmi product, and then raise the screen. However, a reboot occurs after 1 minute and 22 seconds.

 

Is it a problem to transform emmc data?

Carlos Candido Rising Star

Carlos Candido

Member

hello everybody,
First post on this forum, thanks for allowing.

I develop automotive solutions, and this time HMI2.5.
objective is to restore or change identity data in the workbench.

I can change VIN via OBD2.
I want to do this to replace a damaged GM HMI with another purchased from a crashed vehicle or with a total loss.

  That I've already managed to do, I can access the EMMC, but it asks for a password (which I would like to know).
My question here today:
1: what is the passwor, if it is in the Serial, model, or other location.
2: about the GL512 if it can be modified on the bench.
3: to change ID from one vehicle to another need to change in EMMC and GL512.
4: how to connect the HMI on the workbench, what and which modules are needed.

image.png.7dd7f334e68308bad4f7e6d1c4e2f960.png

 

it is very likely that others have these same questions, think about it,
I work with HMI in the Americas.
thanks,
Carlos.

 

 

 

Valery Gusev Explorer

Valery Gusev

Member

Please help me. Requires DUMP HMI 2.5 navi and NOR s29gl512s. I can't read my EMMC. The microchip is unreadable. I want to replace the EMMC and restore my HMI.

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor
On 3/24/2023 at 8:21 AM, mmbrothers said:

Dump emmc data from the new hmi product, and then raise the screen. However, a reboot occurs after 1 minute and 22 seconds.

 

Is it a problem to transform emmc data?

in a HMI 2.0 I have the same problem with non opel calibrations. it reboots randomly. but with opel calibrations it works normally.

xGhost Explorer

+xGhost

+Contributor
  • Contributor

Hi guys.
Which setup do I need to run HMI with screen on the bench? I have HMI 2.5, escalade lcd and radio module. What do I need to do to turn on the screen?
Battery voltage applied to all modules, MOST looped, LIN5 and LIN10 connected to display module, communication enable pulled up to supply voltage, but screen still dark.

Thank you in advance.

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor
On 9/2/2023 at 6:37 PM, xGhost said:

Hi guys.
Which setup do I need to run HMI with screen on the bench? I have HMI 2.5, escalade lcd and radio module. What do I need to do to turn on the screen?
Battery voltage applied to all modules, MOST looped, LIN5 and LIN10 connected to display module, communication enable pulled up to supply voltage, but screen still dark.

Thank you in advance.

Radio (EU Silverbox or US Densoten) HMI, speedometer (UDD or UHS) and close the most bus betwen all units in ring. need to connect the blue cable from HMI to Display (LVDS video signal) and most control from radio to all units in the most bus

xGhost Explorer

+xGhost

+Contributor
  • Contributor
On 9/3/2023 at 10:04 PM, Arbe_gtc said:

Radio (EU Silverbox or US Densoten) HMI, speedometer (UDD or UHS) and close the most bus betwen all units in ring. need to connect the blue cable from HMI to Display (LVDS video signal) and most control from radio to all units in the most bus

IPC? For what? Need I connect BCM?

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Add a comment...

All Articles

Popular Members

  1. hassan77h
    +hassan77h
    27
  2. Troy
    Troy
    22
  3. uglyoldbastard
    +uglyoldbastard
    13
  4. regloops
    +regloops
    8
  5. GM-Enthusiast
    +GM-Enthusiast
    7

New Members

  1. David Fontenot
    David Fontenot
      Member
    Joined
  2. SSAUTOZ
    SSAUTOZ
      Member
    Joined
  3. valdemarford
    valdemarford
      Member
    Joined
  4. Course faycal khalil
    Troll-Course faycal khalil
      Troll-Troll
    Joined
  5. Troll stevie nick
    Troll-Troll stevie nick
      Troll-Troll
    Joined
  6. Troll Parkerchevy
    Troll-Troll Parkerchevy
      Troll-Troll
    Joined
  7. Hayk Vardanyan
    Hayk Vardanyan
      Member
    Joined
  8. tunedbycasco
    tunedbycasco
      Member
    Joined
  9. freehugs
    freehugs
      Member
    Joined
  10. ceberon
    ceberon
      Member
    Joined

CameraLoops™
Powered by Art
All Trademarks appearing on this website are the property of their respective owners.

Account

Navigation

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.