EEPROM Modification to Enable ADB Access, Disables Authorized Secure ADB Client requirment.

Using a dump tool/software, extract the firmware from the indentified IC. Using any Hex editor, flip the following. Then write back to IC, tripple check your work.

For example using minipro on macOS with an XGecu Programmer

minipro -p "M24C64" -r dump.bin
minipro -p "M24C64" -w modified.bin
minipro -p "M24C64" -r verify.bin

===============================================

• Byte 0x440: 0x5A (framing byte)

• Byte 0x441: 0x00 ← Security flag = ENABLED

• Byte 0x442: 0x5A (framing byte)

• Byte 0xa80: 0x5A (framing byte)

• Byte 0xa81: 0x00 ← Security flag = ENABLED

• Byte 0xa82: 0x5A (framing byte)

===============================================

• Byte 0x440: 0x5A (framing byte)

• Byte 0x441: 0xFF ← Security flag = DISABLED

• Byte 0x442: 0x5A (framing byte)

• Byte 0xa80: 0x5A (framing byte)

• Byte 0xa81: 0xFF ← Security flag = DISABLED

• Byte 0xa82: 0x5A (framing byte)

OTA Updates will rewrite the IC and lock ADB again. Either update to the latest OS and try it, or do it on existing version and do not update further.

Unless someone knows how to flip this via DPS.

I’ll keep poking and checking what else can be toggled on or off.

Should be mostly correct... I think

VIP_Renesas_EEPROM_Map.xlsx

A calibration file can flip the EEPROM flag (Seed Bypass Indicator) that enables adb (ICUSB) access to non gm secure clients. But you'll need to pass authentication on the ECU before it writes the security flag if you're using DPS I would guess. The radio calibration file ID:7 85783460 contains some EEPROM values that get rewritten. It resets 0x0440, 0x0A80 and 0x0B40

Also in some builds of GM AAOS Build Y177, the VIP_APP firmware file was set to force the kernel into permissive mode for selinux. Unfortunately, update Y181 fixed the VIP firmware bug.

0xb67d0 in the VIP Firmware was set to always return 0. Which looks like it passed onto Android as a boot parameter to allow permissive.

(unless it was an internal quick workaround that made it into a Techline available update)

I don't have access to older A11 calibration for the gminfo3.7 radio to compare and see if this is a recent GM fix or if it's always been this way.

I do not think it's always been this way since recall updating the calibration with SPS while I had the eeprom mod and never lost adb access. The rest of the calibration file appears to be audio tuning stuff.

A11_calibration.zip