Flashy — J2534 Pass-Thru

Tool Instructions — v1.4.0 first public release

Check the Flashy Wiki for the latest instructions, capture workflows, VIN-write recipes, and current MENU options. Algorithms and clean-room kernels are being added quickly — the wiki tracks the live state. This page documents what shipped in this release (v1.4.0).

What This Release Does

Flashy is a J2534-style Pass-Thru tool for diagnostics, reversing, and programming automotive ECUs. It bridges your PC to the vehicle CAN bus (OBD-II or bench harness) using an Adafruit Feather M4 CAN Express paired with an AdaLogger FeatherWing.

v1.4.0 is the first public release. The shipped firmware includes only the clean-room MIT-licensed read kernel for the GM E92 ECM. Other modules (E38, E67, T87, T87A, T93, T42) are recognized for diagnostics — VIN read, VIN write, OSID read, CAN bus capture — but flash read/write requires kernels this build does not include. See the wiki for how to add your own.

Works out of the box

  • E92 ECM full flash read (clean-room kernel, ~7 min)
  • VIN scan across the bus — finds all responding modules
  • VIN read & write on E38, E67, E92, T87, T87A, T93, T42
  • 30-second CAN bus capture to a SavvyCAN-format CSV
  • Auto-detect Feather USB COM port

Available with user-supplied kernels

  • Full / calibration read on E38, E67, T87, T87A
  • Full / calibration write on E38, T87, T87A
  • BAM mode read/write on T87A (boot-assist recovery)

See CONTRIBUTING.md for the build-your-own kernel workflow.

What's in the Release Zip

FileWhat it does
firmware.uf2 Feather M4 firmware. Drag onto the FEATHBOOT drive to flash.
Flashy_Menu.bat Top-level interactive picker — the recommended starting point.
Flash_Firmware.bat Auto-detects the FEATHBOOT drive and copies firmware.uf2 to it.
Detect_Port.bat / .exe Lists Adafruit Feather USB COM ports and auto-detects which one is yours.
VIN_Scan.bat / .exe Scans the CAN bus, prints VIN + module responses for every node found.
VIN_Update.bat / .exe Writes a new 17-character VIN to a chosen module. Prompts you to pick the module first (E38 / E67 / E92 / T87 / T87A / T93 / T42) so the right CAN IDs and seed-key algo are used.
Capture_CAN_Bus.bat / capture_bus.exe 30-second CAN bus capture, saved to your Desktop as capture-YYYYMMDD-HHMMSS.csv. Useful for studying any CAN-capable tool's session, or capturing a kernel another tool uploads so you can disassemble it.
reads/ & writes/ Local-only working folders. Both contain a README explaining their use. Anything you drop here stays on your PC — never tracked in git, never uploaded.
Read-Write-Instructions.html This page. Offline copy of the latest release docs.

Connecting Flashy

  1. Assemble the hardware. Stack the AdaLogger on top of the Feather M4 CAN. Cut the onboard 120Ω CAN terminator before stacking — once the wing is on, the jumper is unreachable. Full step-by-step on the Hardware Assembly wiki page.
  2. Flash the firmware. Plug the Feather into your PC. Double-click the RESET button on the Feather — a USB drive named FEATHBOOT appears. Run Flash_Firmware.bat (it auto-finds FEATHBOOT and copies firmware.uf2 over) or drag firmware.uf2 onto the drive yourself.
  3. Connect to the vehicle. Wire the Feather's CAN screw terminals to OBD-II pins 6 (CAN-H) and 14 (CAN-L), with GND on pin 4 or 5. Don't tie the OBD-II +12V (pin 16) — Flashy is USB-powered.
  4. Open a serial terminal at 115200 baud on the Feather's COM port. The firmware prints a banner and tries to auto-detect the bus baud (500 kbps primary, 250 kbps fallback). Type MENU for the interactive picker, or HELP for the full command list.

Using the Tools (Easy Path)

Run Flashy_Menu.bat or click Start Menu → Flashy → Flashy after installing. You'll see:

  ==========================================
    Flashy J2534 Pass-Thru
  ==========================================

    1) Detect Feather port
    2) VIN scan (find all modules on bus)
    3) VIN update (write VIN to a module)
    4) Capture CAN bus (30 sec to CSV)
    5) Flash firmware

    H) Open Read/Write Instructions
    Q) Quit

Pick a number, the tool runs in its own console, then you return to the menu. The COM port is auto-detected on every run — no need to remember it.

Working Example: Read an E92 ECM

The E92 ECM (MPC5674F) is the only module with a working clean-room kernel in this release. Use it as your end-to-end test:

  1. Connect Flashy to a 2014+ GM vehicle with an E92 ECM (most C7 Corvette, Camaro 6th-gen, etc.). Or a bench-powered E92 with proper 12 V + ignition + ground wiring.
  2. Open a serial terminal to the Feather (115200 baud).
  3. Type MENU → 3) Connect to ECU → E92 ECM. The firmware sets the right CAN IDs and seed-key algo for you.
  4. From the E92 menu, pick 1) Full Read. The full sequence runs automatically:
    • Reads VIN + OSID
    • SecurityAccess (computes the right seed-key)
    • Uploads the clean-room read kernel into ECU RAM at 0x40001000
    • Streams 4 MB flash via UDS $23 ReadMemoryByAddress to the SD card
    • Resets the ECU cleanly with $11 01
  5. The result lands on the SD card as <OSID>-<YYMMDD>-<HHMMSS>.bin. Pull the card and copy it to your PC, or watch progress in the serial terminal.

Expected timing: ~7 minutes for the full 4 MB at ~9 KB/s, zero errors on a stable bus.

What About E38 / E67 / T87 / T87A / T93 / T42?

These modules are recognized and partially supported in this release:

If you have a CAN capture of a flash session from a tool you own, you can extract that kernel into a private header and rebuild firmware with it locally. The CONTRIBUTING.md walks through the workflow.

The wiki tracks live progress on adding more clean-room kernels and algorithms. Check the wiki and the changelog for new module support as it lands.

Capturing a CAN Session

Run Capture CAN Bus from the menu (or Capture_CAN_Bus.bat directly). The default is a 30-second capture written to your Desktop as capture-YYYYMMDD-HHMMSS.csv.

The CSV is in SavvyCAN format. Open it directly in SavvyCAN to filter, decode, and analyze. Useful for:

Press Ctrl+C during a capture to stop early. Default longer captures up to 600 seconds via capture_bus.exe --duration 600000.

NeoPixel LED Status

Dim blueIdle — waiting for commands
Solid greenConnected & authenticated to a module
Cyan flashingReading flash
Orange flashingWriting flash
Red flashingErasing flash
MagentaWaiting for module reset (BAM mode entry)
YellowSecurityAccess in progress
Solid redError — check serial output
Bright green strobeSuccess celebration

Troubleshooting

SymptomWhat to try
"No Feather found" from detect_port.exe Check the USB cable (data, not charge-only), check Device Manager for the COM port, close any serial terminal that has it open.
Boot says "no bus (use INIT or AUTOINIT)" The CAN bus isn't reachable. Confirm vehicle ignition is on (key in RUN), wiring is solid, and that the onboard 120Ω jumper is cut for vehicle use.
Module: T87 shown when you didn't pick anything Updated in this release — default is now None. If you still see T87 you may be running an older firmware. Re-run Flash_Firmware.bat.
"No kernel/algo embedded for <module>" Expected for non-E92 modules in this public build. See the wiki / CONTRIBUTING for the build-your-own kernel workflow.
VIN write fails with NRC 0x35 (invalidKey) Wrong module picked — the seed-key algo doesn't match. Re-run VIN_Update.bat and pick the correct module from the prompt.
Window closes before I can read the output Use the .bat launchers (they pause). If you double-click an .exe directly it now also pauses with "Press Enter to close this window..." — updated in v1.4.0.