defeating CVNs and flash counters

[DSteck]

Let me preface this with a blurb about my stance... I think it's absolute crap that people try to revert their car back to stock to get an engine or transmission warrantied. In no way do I condone reflashing to stock to try and assist with a warranty claim, and I am 100% fine with paying out of pocket for something that fails that might even remotely be tied to modifications I have done to my vehicles.

That said... there's been a lot of hub-bub about the 2010 Camaros and the flash counter that is on them. A certain handheld tuning company claims their equipment doesn't impact the CVNs at all.

I quote:
"Our flash process does not touch the CVNs in any way."

I find this to be extremely hard to believe, and attribute it to ignorance of what's actually happening. I have to assume they are confusing segment IDs with CVNs, seeing as how CVNs are a GENERATED value and not a programmed value. That said, I realize that it's possible to tweak unimportant parts of a file to get the checksum to match a desired CVN, but the effort required to do that would be absolutely insane. In other words, I'm calling complete shenanigans on this company's tune dodging the CVN check (unless reflashed to stock).



Now, beyond that, they claim that if a person flashes their car, then flashes it back to stock, it will completely defeat GM's aftermarket calibration detection, including the flash counter. To me, this sounds like blowing smoke up the public's ass. Is defeating the flash counter even feasible? I'm not asking HP Tuners to impliment the ability to do this. I understand the concern with being tied to warranty fraud, and think it's absolute BS that people try to cheat the system. I'm just trying to get some information from a company that isn't trying to dupe people into believing something that there's no proof of.

The current leg to stand on is "well, nobody's had a problem with warranty with our equipment, so it must be fine!". Nevermind the fact that nobody's brought a blown engine back to the dealer after reflashing their stock tune back in.

[Bill@HPTuners]

Not sure about the flash counter but there have been several companies that have mucked with the CVN changes, those that are still offering a stealth tune ultimately will ruin the industry as the CVN's are used for emissions testing in at least cali which means the EPA will have a hand in it which if you know anything about the EPA really doesn't like the aftermarket industry at all and is constantly looking for ways to shut it down completely so thats not the cape you want to be tugging on if you want to keep your buisness running.

-Bill

[rnjmur]

My understanding of the flash counter and CVNs is that some cars differ in the way they handle them. As far as the flash counter goes, some vehicles simply keep track of the flashes via the ECM. In these cases a "Write Entire" with the stock tune will fix the CVN as well as erasing any flash count. Some vehicles (including the new Camaro) store the flash count on the BCM. In these cases the flash count can be read to see how many times the flash process has been done.

As far as "fudging" the CVN on "stealth tunes", there are also two ways this is done. One company makes their stealth tunes by "forcing" a CVN that does not match the actual checksum of the file. Basically they are removing the ability of the computer to detect any errors in the ECM by forcing that specific CVN. The other company, I am guessing, uses the way you were talking about; they change "unnecessary info" in order to make the CVN match. This sounds like it would be hard to do, but if you wrote a computer program that could tell you what you had to change in order to make the CVN match a specific code, then it would actually be fairly easy to make the necessary adjustments.

[DSteck]

Some vehicles (including the new Camaro) store the flash count on the BCM. In these cases the flash count can be read to see how many times the flash process has been done.

This is what I have the hardest time believing is easy to defeat.

[Nick 2K2 SS]

Over on the Modern Camaro forum a member took his car to the dealership and asked them to specifically look to see if they could tell it had been flashed and here's what he learned from his experience.

http://www.moderncamaro.com/forum/sh...13&postcount=8

Just thought I would pass this on.

[rnjmur]

Over on the Modern Camaro forum a member took his car to the dealership and asked them to specifically look to see if they could tell it had been flashed and here's what he learned from his experience.

http://www.moderncamaro.com/forum/sh...13&postcount=8

Just thought I would pass this on.

That is good to know. I thought that they were implementing the BCM keeping track of flash counts, but I guess the Camaro is still not tracking them. I am sure that you will see flash counters in seperate modules or flash counters that are stored on seperate NVRAM chips soon enough.

[Montecarlodrag]

I know nothing about the new VCM's, but I know for sure all flash procedures are done through the CPU (proccessor). Tuning software works this way, thats why if a write entire is interrupted the VCM can be bricked, (no code remains to get control of CPU to flash again). Unless you pull the flash chip from the board and program it with a universal programmer, the CPU always controls the data written to the flash chip.

If they really intended to register all flashes, there are many CPU's with integrated EEPROM and proper code to handle a flash counter and checksums. You can change the flash memory all you want, write anything you want to it, but the CPU will know it, comparing the contents of the flash with the contents of its own eeprom.

Of course, that CPU's are almost impossible to crack, all are BGA and no info is available about them, so you can't change the internal memory's contents.

I have seen applications of those CPU's where you can change all data in the flash and the device will keep the serial number and all sensitive data. You can even swap flash chips to 2 similar devices and they keep their identity.
As a matter of fact, the data stored in the flash memory is used only to Boot and run the OS, nothing more.

As I said, I know nothing about the 2010 Camaro's VCM and its security, but GM can do it if they want.
Maybe it has some degree of flash registry, but it is weak and can be defeated. Maybe it has no flash counter at all, who knows.