E38 Secondary Bootloader

This is to discuss and understand what the CAN Bus messages are and how to decode them.
Post Reply
Admin
Site Admin
Posts: 11
Joined: Sat Aug 10, 2019 7:24 pm

E38 Secondary Bootloader

Post by Admin » Mon Aug 12, 2019 4:50 pm

This is the secondary bootloader that needs to be pushed into the PCM prior to reading and writing the PCM
Attachments
E38_Secondary_Bootloader.zip
(1.57 KiB) Downloaded 149 times

Gen4_tech
Posts: 5
Joined: Sat Aug 10, 2019 10:45 pm

Re: E38 Secondary Bootloader

Post by Gen4_tech » Mon Aug 12, 2019 5:00 pm

This is awesome reading material, hoping to fix my bricked E38 sitting here on the bench, lol..

Not a particular need, just want to be able to say I unbricked it.. lol..

Great work and thanks!!!!

Gen4_tech
Posts: 5
Joined: Sat Aug 10, 2019 10:45 pm

Re: E38 Secondary Bootloader

Post by Gen4_tech » Fri Aug 16, 2019 12:10 pm

Gotta give you a shout out for these uploads!!! I was able to fix my bricked E38 ecu with some reading and a lot of stress, lol..

read along for those who are curious..

My E38 was in a recovery of sorts, I had tried writing an incompatible OS(yes I now know better).. gm sps could see the ecu bit failed with a 74 negative response code and failed programming every time..

logging the programming session and comparing it against a good sps session showed what was failing..

My download bootloader request was failing with a code 22, figured out was a security issue(thanks to the documents here!!), my ecu was always unlocked.. When sending it a 2701 seed request it always came back with an unlocked status, then it wrote the 34 bootloader request but failed so sps gave up..

I tried copying this section of code with some real shitty code and used an elm327 and found out if I sent a 2702 0000(any key worked) AFTER the 2701 even though it was already unlocked the next 34 bootloader request got the correct response, woohoo!!!

For actual reprogramming I simply set up a terminal program with an elm327 and a Y cable and an MDI using sps programming to inject the 2702 0000 command when I saw the 2701 command.. I had tried to time it perfectly but gave up and just started tapping/sending the command about every half second when it started changing programming mode.. I know it's dirty as hell but it worked!!!

Looking forward to how this site develops, definitely owe some thanks already!!!

Post Reply