T87A 5-Patch Dual Unlock Recipe

Enables both USBJTAG HS-CAN kernel execute and HP Tuners unlock recognition on T87A TCM modules (SPC564A80).

The 5 Patches

Flash Memory Map

0x000000 - 0x007FFF  Boot Sector (32KB)    DO NOT ERASE - MCU reset vector
0x008000 - 0x01FFFF  NVM / Adaptation      DO NOT ERASE - VIN, seed keys, PNs
0x020000 - 0x03FFFF  Boot Block (128KB)    USBJTAG patches 1+2 live here
                                            HS-CAN kernel auto-protects this region
0x040000 - 0x07FFFF  OS Code (256KB)       HPT patches 3+4+5 live here
0x080000 - 0x17FFFF  Calibration (1MB)     Safe to read/write
0x180000 - 0x3FFFFF  OS Code (2.5MB)       Safe to read/write

How It Works

USBJTAG Kernel Signature Bypass (Patches 1+2)

The stock bootloader at 0x020000 calls a signature validation function before executing any uploaded kernel. The function returns a pass/fail result. USBJTAG's patch replaces the function CALL with a direct write of "1" (valid) to the result flag location, skipping the validation entirely.

Stock code:
  0x02B39C:  4B FF FD 11    bl   sig_validate    ; call signature checker
  0x02B3A0:  48 00 01 C4    b    next_step       ; continue (result in flag)

USBJTAG patch:
  0x02B39C:  39 60 00 01    li   r11, 1          ; r11 = "valid"
  0x02B3A0:  99 6C DB 23    stb  r11, -0x24DD(r12) ; write flag = valid

HPT Unlock Recognition (Patches 3+4+5)

HP Tuners checks three branch instructions in the OS code to determine if the module is "unlocked". Stock code uses conditional branches (bne) that enforce lock checks. HPT patches convert these to unconditional branches (b) or NOPs, bypassing the lock validation.

Verified OS Versions

Status at a glance — patches confirmed applied; bench verification varies by OS.

Patched Examples — Ready-to-Flash Library

Rebuilt 2026-04-22 from vendor baselines using tools/t87a_patch.py. One file per OS version, full 4 MB flash, all 5 patches applied, Boot Block CS1/CS2 recalculated and verified. Prior BAM-only sidecars were retired — BAM write now handles the 0x020000 offset in firmware, so a single full-flash image covers BAM, HS-CAN, and JTAG flows.

Download: T87A-Patched-Library-v1.zip — attached to the latest Flashy release.

OS Block PN Decode

All five per-file fields read from each patched bin as 4-byte big-endian integers. The 0x014638 block holds four related GM part numbers that vary per OS; 0x080010 is a calibration-region marker (ASCII prefix "2288") that stays near-constant across files.

Generated 2026-04-22 by tools/t87a_patch.py --verify (Cal ID + CRC32 reported inline).

Application Methods

Method 1: JTAG (Full Flash)

1. Apply all 5 patches to a full 4MB flash file
2. JTAG flash the entire file
3. Result: Complete dual unlock in one step

Method 2: USBJTAG BAM + Feather HS-CAN (Two-Step)

1. USBJTAG BAM: Write full flash file with USBJTAG patches (sets up boot block at 0x020000)
2. Feather HS-CAN: Write HPT-patched stock OS (kernel protects 0x020000-0x03FFFF)
3. Result: USBJTAG boot block preserved + HPT-unlocked OS

Method 3: Feather BAM Only

1. Prepare BAM format file (strip first 128KB from full flash)
2. BAMWRITE via Feather (writes 0x020000+ only, boot sector at 0x000000 untouched)
3. Result: OS region updated, boot sector preserved

Cross-OS Write Compatibility — which paths are safe?

Not every write path supports swapping to a different OS version. Boot block has OS-specific anchors (signature hashes, OS PN, region CRCs) — if you write a new OS without also matching the boot block, the TCM refuses to boot. This was verified on the bench 2026-04-22.

Hardware Reference

USBJTAG Kernel

Checksum Recalculation

After applying patches, Boot Block checksums MUST be recalculated. Without valid checksums, the bootloader silently rejects the patched code.

Order matters: CS1 must be written first, then CS2 recalculated (CS2 range includes CS1 location).

Patch Tool

# Apply patches + recalculate checksums:
python tools/t87a_patch.py input.bin [output.bin]

# Verify existing file:
python tools/t87a_patch.py --verify file.bin

# Batch patch all bins in a directory:
python tools/t87a_patch.py --batch directory/

Notes

• HPT may only require P3 (0x034A70) for unlock detection — P1/P2 included for safety, needs further testing
• USBJTAG tool recalculates checksums automatically when it patches — our tool matches its output exactly
• Boot sector (0x000000-0x007FFF) is identical across ALL T87A bins — never needs patching
• All 5 patches + 2 checksums = 17 bytes changed total in the boot block (0x020000-0x03FFFF)

Flashy Project — Updated 2026-04-22