Update:
Read dump from BCM - it is 1Mb, and is completely different from what I've read from it's EEPROM.
Dump from IPC - couldn't read so far, it accepts 4 byte addresses, but I was unable to choose proper memorySize so far.

Returns $31, RequestOutOfRange for sizes between 0 and 41302, that's already out of normal limits, so chances are low.

Dump from TCM - found correct parameters, but as it really big, had no time to download it yet.

 

No new ideas.. will be asking for files here and preparing to read full ECM dump from BSL mode.

9 hours ago, TunnerXP said:

hi dear i have some simtec 76.1 dump please check these maybe you can find something what you need..

Cruze simtec76.1.zipOnly +Contributor Members can download attachment files. CLICK HERE TO DONATE

Thank you, will try to collect as much info as possible (requested files, fingers crossed) and then will buy access to download all.

Update:
IPC dump - unable to download because my search for correct memorySize parameter was not successful. Scanned full range from 0x0000 to 0xFFFF
TCM dump - still in progress
ECM, most interesting part. So I started comparing different dumps, wrote small python script for quick identification of ECM dump. Seems like it was obfuscated. Here is what I've found:

My best guess:

Software Id: CAO95BD2 -> CAO95B00 or CAO95B20 - obfuscated?
ECU ROM Id: J6IBDsA6 -> J6IB00A6 (6 - 1.6, A - automatic, 6 - speed)  - obfuscated too, also switched places with calibrations
Calibrations Id: ... completely lost? gibberish: 10123893

 

Here is what I have in dump:

3D1E:4 - Base Model Number ($CC): - same in other dumps
  Hex: 03 4F EA 8A
  Int: 55569034
  ASCII: .O..

10172:C - Software date: - it's not programming date
  Hex: 31 37 2E 30 32 2E 32 30 30 39 20 20
  Int: 211379171378
  ASCII: 17.02.2009

E0000:8 - Hardware ID?: - here should be calibrations Id, be we have obfustaced ECU ROM ID
  Hex: 4A 36 49 42 44 73 41 36
  Int: 318738350660
  ASCII: J6IBDsA6

E0040:C - Software ID: - obfuscated?
  Hex: 43 41 4F 39 35 42 44 32 2E 44 41 54
  Int: 288858519861
  ASCII: CAO95BD2.DAT

E0054:C - ECU ROM ID: - here should be something like 'J6IBDsA6' above, but we have some number
  Hex: 31 30 31 32 33 38 39 33 20 20 20 20
  Int: 211261927987
  ASCII: 10123893

E006D:4 - Software Id ($C2): - here should be calibrations Id, but we have some gibberish?
  Hex: 00 8B C0 21
  Int: 9158689
  ASCII: ...!

E0071:0xD - Calibrations: - here should be calibrations Id, but we have some gibberish
  Hex: 20 20 31 32 33 34 35 36 37 38 20 41 42
  Int: 137979048499
  ASCII:   12345678 AB

E007E:0x6 - System Name or Engine Type ($97):
  Hex: 41 31 36 58 45 52
  Int: 279998519365
  ASCII: A16XER

 

Interesting that when googling for CAO95BD2 I've found only one mentioning of it on another website, where one person was searching for it without much success. And if it's really obfuscated - that's the reason.

Update:
I'm still here and kicking)

Purchased one paid tool to download flash dump in bench mode without opening the ECM. But it showed error during download.
Investigated logs - seems like it is able to download only 0x3C0 or so and then transmission stopped by ECM itself.
Investigated how it is done, implemented it in my python scripts (learning, adjusting and optimizing them along the way) - still 0x3C0.

Using this 'window' I was able to read protected EEPROM area and see that there is untouched software ID. But I was curious why transmission interrupted.

So recently I started reading Infineon documentation and trying to understand what's going on at the lowest level.

Still in progress...

 

Also, still no luck with calibration files for my VIN(s)...

Update:

Was trying to download dump from TCM, but each time after short timeout download was stopped. After some unsuccessful experimentation with $3E Tester Present where I got no responses from the module I figured out that re-unlock with key/seed works perfectly. Will need to try this approach with ECM, still get interruptions there.

Interesting finding - seems TCM uses https://github.com/tinyos/tinyos-main as a real-time OS.

Answering questions - no, there is no DID to read PIN from BCM. But it's really easy to read it from EEPROM.

New year new update:
EBCM - fully fixed to match my car - VIN, PIN, calibrations (changed 15' disc/disc, low mu to 16' disc/disc, low mu)

Update: not so easy. Seems like this calibration string gets reset after cycling power. Need to get back to the investigations.

+understanding of EBCM EEPROM map and how bin patches can be written and applied to the module, in case other (more safe) ways does not work.

Now seems like time to increase complexity level: IPC, BCM, ECU

EBCM, car: same behavior, no luck

EBCM, bench: tried all possible ways, added wait\delay for 15 mins., no luck. Observed behavior: "standard/normal" programming does not change anything, but module responds with success return code. Can use custom utility script that uploads custom binary payload to change EEPROM. After power cycling value stays same (new one). But when requesting DID $2E - old value returned, and EEPROM also changes to the old value.

In the OS, there are 2 areas that resemble EEPROM address ranges. One covers whole EEPROM, other (located nearby) - part of it. And this part covers DID $2E. Possibly this values backed up in flash somewhere, and overwritten when something does not match.. some CRC?

Hi!

Were you able to finish the project and activate the cruise control?

On 8/27/2026 at 10:28 PM, Cleberson Santos said:

Hi!

Were you able to finish the project and activate the cruise control?

Hey, thanks for your interest in my investigations) And no, it is not finished yet, as I had series of challenges when decided to get back to the project this summer. One of the most serious one - my SSD died (probably overheated) where most work was stored, I managed to partially recover it with PC3000 but it was not cheap.
But even bigger issue is time. I will try to at least finish with IPC support soon, but no promises.

@geku I see.

I hope you manage to recover it; after all, that information is very useful for your project.

I’m also trying to activate cruise control on a GM Onix 1.0 (manual transmission, E83 ECU, and 52100479 BCM), but since the model was only released in the Brazilian market with an automatic transmission and a 1.4 engine, I’m running into difficulties getting the calibration done.

So, finally I managed to investigate and use IPC bin and setup files provided by community and it looks successful - $3B service used to write proper bitmap to appropriate DIDs. During experiments also changed fuel consumption values from km/l to l/100km so finally I don't need to recalculate values in my head.

In GDS2 I saw Cruise on/off change in BCM so initially thought that all I need to do - configure ECM properly. But seems like ECM does not receive those values from BCM yet, so:

Steering wheel -> BCM - works
BCM -> ECU - does not
ECU -> IPC - does not

Next step will be to fix BCM and in this thread earlier was mentioned that 2 bins need to be changed there, so it is not only configuration\DID changing. Will be investigating

@geku Awesome.

Can you get in touch with me?

@Crebs_s on Telegram.

Fresh update:
1. ECU now reacts on Cruise control buttons - matter of just configuration, no need to change BCM, but
2. Updated software on ECM, BCM, TCM so everything has latest security patches caibrations from GM, thanks to community help and especially @pupu14 for recent files!
3. No weird unrecognizable dumps from ECM anymore
4. All VINs, PINs looks aligned

Drove for 20 mins in the morning - no issues, but will be monitoring for some time. Also hopefully will be testing Cruise later today.
I think final touch will be to buy second key and do immo relearn and project can be considered finished.

So, as I changed electronic thermostat to the one from Opel (lower temperatures) some time ago, after reflashing stock GM ECM, I had to remove P0597 and use lower temperature ranges for fun on\off + checksum correction as usually.

All unrelated to my configuration DTCs are gone (like no communication with TPMS when I have no TPMS).

Issues left:

1. Automatic headlights stopped turning on automatically - that's probably because by VIN I had no T83, but in reality, I did. Rerequested BCM bins and setup for &T83.

2. Hood open - always now. I know there are 2 variants of hood ajar switch, two schematics. Probably new BCM calibrations use another variant. Will be able to fix it later with few resistors and small rewiring in the switch itself. But as a result, theft deterrent diode blinks quickly for a minute after locking the car.

3. The only DTC left - EEPROM error I had after changing VIN year ago. My guess is - related to the original Immo off. And now as I started reverting original GM binaries it needs to be fixed somehow. Most probably some area in BCM EEPROM is missing. Even though checksums look correct. Thankfully this EEPROM is easily accessible and I have a backup. So now doing Immo relearn became a necessity not an option.

I have EEPROM error in my bench BCM even after loading back original untouched EEPROM copy.

It also shows some weird error about too high supply voltage (showing 35V), although PSU can provide only up to 14V DC...
It may be unrelated and maybe some mosfet or IC voltage regulator did blew up on the circuit board - I just did not had time to investigate this further...

P.S. I will send you a bin with T83 option for BCM a bit later.