Update:
Read dump from BCM - it is 1Mb, and is completely different from what I've read from it's EEPROM.
Dump from IPC - couldn't read so far, it accepts 4 byte addresses, but I was unable to choose proper memorySize so far.

Returns $31, RequestOutOfRange for sizes between 0 and 41302, that's already out of normal limits, so chances are low.

Dump from TCM - found correct parameters, but as it really big, had no time to download it yet.

 

No new ideas.. will be asking for files here and preparing to read full ECM dump from BSL mode.

9 hours ago, TunnerXP said:

hi dear i have some simtec 76.1 dump please check these maybe you can find something what you need..

Cruze simtec76.1.zipOnly +Contributor Members can download attachment files. CLICK HERE TO DONATE

Thank you, will try to collect as much info as possible (requested files, fingers crossed) and then will buy access to download all.

Update:
IPC dump - unable to download because my search for correct memorySize parameter was not successful. Scanned full range from 0x0000 to 0xFFFF
TCM dump - still in progress
ECM, most interesting part. So I started comparing different dumps, wrote small python script for quick identification of ECM dump. Seems like it was obfuscated. Here is what I've found:

My best guess:

Software Id: CAO95BD2 -> CAO95B00 or CAO95B20 - obfuscated?
ECU ROM Id: J6IBDsA6 -> J6IB00A6 (6 - 1.6, A - automatic, 6 - speed)  - obfuscated too, also switched places with calibrations
Calibrations Id: ... completely lost? gibberish: 10123893

 

Here is what I have in dump:

3D1E:4 - Base Model Number ($CC): - same in other dumps
  Hex: 03 4F EA 8A
  Int: 55569034
  ASCII: .O..

10172:C - Software date: - it's not programming date
  Hex: 31 37 2E 30 32 2E 32 30 30 39 20 20
  Int: 211379171378
  ASCII: 17.02.2009

E0000:8 - Hardware ID?: - here should be calibrations Id, be we have obfustaced ECU ROM ID
  Hex: 4A 36 49 42 44 73 41 36
  Int: 318738350660
  ASCII: J6IBDsA6

E0040:C - Software ID: - obfuscated?
  Hex: 43 41 4F 39 35 42 44 32 2E 44 41 54
  Int: 288858519861
  ASCII: CAO95BD2.DAT

E0054:C - ECU ROM ID: - here should be something like 'J6IBDsA6' above, but we have some number
  Hex: 31 30 31 32 33 38 39 33 20 20 20 20
  Int: 211261927987
  ASCII: 10123893

E006D:4 - Software Id ($C2): - here should be calibrations Id, but we have some gibberish?
  Hex: 00 8B C0 21
  Int: 9158689
  ASCII: ...!

E0071:0xD - Calibrations: - here should be calibrations Id, but we have some gibberish
  Hex: 20 20 31 32 33 34 35 36 37 38 20 41 42
  Int: 137979048499
  ASCII:   12345678 AB

E007E:0x6 - System Name or Engine Type ($97):
  Hex: 41 31 36 58 45 52
  Int: 279998519365
  ASCII: A16XER

 

Interesting that when googling for CAO95BD2 I've found only one mentioning of it on another website, where one person was searching for it without much success. And if it's really obfuscated - that's the reason.

Update:
I'm still here and kicking)

Purchased one paid tool to download flash dump in bench mode without opening the ECM. But it showed error during download.
Investigated logs - seems like it is able to download only 0x3C0 or so and then transmission stopped by ECM itself.
Investigated how it is done, implemented it in my python scripts (learning, adjusting and optimizing them along the way) - still 0x3C0.

Using this 'window' I was able to read protected EEPROM area and see that there is untouched software ID. But I was curious why transmission interrupted.

So recently I started reading Infineon documentation and trying to understand what's going on at the lowest level.

Still in progress...

 

Also, still no luck with calibration files for my VIN(s)...

Update:

Was trying to download dump from TCM, but each time after short timeout download was stopped. After some unsuccessful experimentation with $3E Tester Present where I got no responses from the module I figured out that re-unlock with key/seed works perfectly. Will need to try this approach with ECM, still get interruptions there.

Interesting finding - seems TCM uses https://github.com/tinyos/tinyos-main as a real-time OS.

Answering questions - no, there is no DID to read PIN from BCM. But it's really easy to read it from EEPROM.

New year new update:
EBCM - fully fixed to match my car - VIN, PIN, calibrations (changed 15' disc/disc, low mu to 16' disc/disc, low mu)

Update: not so easy. Seems like this calibration string gets reset after cycling power. Need to get back to the investigations.

+understanding of EBCM EEPROM map and how bin patches can be written and applied to the module, in case other (more safe) ways does not work.

Now seems like time to increase complexity level: IPC, BCM, ECU

EBCM, car: same behavior, no luck

EBCM, bench: tried all possible ways, added wait\delay for 15 mins., no luck. Observed behavior: "standard/normal" programming does not change anything, but module responds with success return code. Can use custom utility script that uploads custom binary payload to change EEPROM. After power cycling value stays same (new one). But when requesting DID $2E - old value returned, and EEPROM also changes to the old value.

In the OS, there are 2 areas that resemble EEPROM address ranges. One covers whole EEPROM, other (located nearby) - part of it. And this part covers DID $2E. Possibly this values backed up in flash somewhere, and overwritten when something does not match.. some CRC?