Changelog

• Added Universal CLEARDTC — 3-pass cross-vendor clear: Mode $04 broadcast on functional 0x7DF, then physical UDS $10 03 + $14 FF FF FF per responder, then a GMLAN $28/$A2/$A5 broadcast wake-up + $14 with $20 returnToNormal cleanup. Bench-verified non-destructive across repeated runs.
• Added SCAN FULL — per-module Mode 9 dump: VIN, ECU Name (PID 0A), all CAL IDs (PID 04), all CVNs (PID 06), GM $1A B4 cal-info string. Default SCAN / SCAN FAST remains the quick presence + VIN walk.
• Added tools/obd2/ — vendor-neutral host wrappers for CLEARDTC and SCAN FULL with parsed output (including --json) and an NRC reference table.
• Added tools/set_rtc_local.py — sets the Feather’s PCF8523 RTC from the host’s current local time. Auto-detects the Feather by USB VID and exits the boot menu first.
• Changed OSID now walks every GM diagnostic slot like SCAN and prints the primary OSID per responder (was: only the active ECM).
• Changed PING accepts NRC as proof of life (matches SCAN’s logic) and prints the destination IDs so you can see which module is being pinged.
• Changed GM diagnostic slot labels broadened — 0x7E3 “ABS” → “ABS/FPCM”, 0x7E1 “ECM2” → “ECM2/FSCM”, 0x7E6 “RCDLR” → “ECU6”. Vendor assignment varies; SCAN FULL’s ECU Name field is the authoritative identifier.
• Fixed RTC boot banner stopped reporting “time not set” on every boot when the time was actually valid — the PCF8523 initialized() and lostPower() flags were being misinterpreted; now we trust now().year() plausibility.
• Fixed tools/flashy_diag.py decoded firmware output as ASCII; em-dashes from the firmware were rendering as …. Now decodes UTF-8.

• Added Interactive menu auto-launches at boot — module-aware op picker, inline VIN/file prompts, raw-command escape on option 6.
• Added E92 variant detection (E92ID) and AUTH gate — routes 5-byte seeds to algo 146 on late E92, refuses $27 02 on unknown variants to protect the MEC counter.
• Added Kernel registry — drop kernel.bin + meta.json under Cernels/private/<id>/, picked up at build. New KLIST / KUSE commands.
• Added Runtime parameter overrides (SET / PARAMS) and three new dev tools (flashy_diag, socketcan_sniff, vinwrite_debug).
• Fixed Serial backspace handling, VINWRITE fallback to UDS $2E F190, longer filename support in cmd_kernel_read, clearer SD mkdir warnings.

Added First bench-verified Flashy CAL & Full Write on T87A without bricking. Root cause of earlier brick attempts identified as an incorrect $6C size-field encoding. Per-module encoding mined from NT-Link reference capture, applied to Flashy, validated end-to-end.

T87A write fixes

• $6C size-field per-module encoding — Flashy was hardcoded to 0x011000 for all addresses; correct values are 0x011000 (M0 LMSR, addr < 0x080000), 0x021000 (M1 LMSR, 0x080000–0x0FFFFF), 0x031000 (HSR, addr ≥ 0x100000). Fix in extkern_write_block.
• Cross-OS safety gate — HSWRITE now reads source bin OS PN at flash offset 0x014638 and compares against live TCM OSID via Mode 9 PID 4 before any kernel load or flash touch. Mismatch → aborts with a clear banner, TCM untouched. Prevents the cross-OS boot-anchor brick mechanism.
• HSWRITE auto-bring-up — no longer requires a prior HSREAD/CALREAD to load the kernel. Mirrors CALWRITE's internal session flow.
• POWER-CYCLE banner added to HSWRITE completion (matches CALWRITE). Makes post-write recovery step explicit.
• No KEXIT after write — captured bench evidence shows post-write kernel state is unstable for the MCU-reset path. Writes now print the power-cycle banner instead of attempting KEXIT.

Per-OS patch recipe (tools/t87a_patch.py)

• Safety gate in apply_patches() — aborts if any patch offset's "old" bytes don't match expected. Prevents silent corruption of bins where compiler output places checks at different addresses. Proven on OS 24286985 (checks at 0x034730 / 0x034794 / 0x034B90, not 0x034648 / 0x0346AC / 0x034A70).
• Per-OS offset table — OS_PATCHES dict keyed by OS PN lets each OS have its own patch addresses. Default table matches OS 24288836; OS 24286985 entry registered with correct shifted offsets.
• Regenerated 24286985 bin — T87A_OS-24286985_Unlock_Patched_v2.bin built with correct offsets, bench-verified full-flow (Flashy CALREAD + HSWRITE + power-cycle + boot).

FLASHY protocol branding

• Kernel ACK rebranded — Private kernel binary patched so the 0x7EA acknowledgment frame bytes spell "FLASHY " (46 4C 41 53 48 59 20) instead of the legacy "USBJTAG" bytes. Flashy-project ownership visible on the wire.
• Flashy byte checks accept either signature (FLA or USB prefix) — drop-in compat with existing tool ecosystems.
• 0x101 broadcast pad stamping (FLSHY / JACKD / IN!!!) was already present; documented and indexed.

UX

• Auto-menu at boot — Flashy now enters the interactive menu immediately. RAW command mode still available via menu item 6.
• File path prompts in CAL Write & Full Write menu items — type the source path inline, no need to set g_sd_filename separately.
• Bin filenames reorganized to <MODULE>_<VIN>_<OSID>_<OP>_<timestamp>.bin — groups by ECU in file explorer.
• Log labels updated: "Rollin Smoke T87A kernel" → "FLASHY T87A kernel".

Documentation

• T87A-Unlock-Recipe.html gains a Cross-OS Write Compatibility matrix explaining which write paths support OS swaps vs. same-OS-only (BAM / JTAG safe for cross-OS; HS Full Write same-OS only).

Footprint: Flash ~31% / RAM ~49.5%. Bench hours this release: ~14. Bricks along the way: 3 (each led to a fix).

Added Hands-free T87A Rollin Smoke kernel exit. After HSREAD / CALREAD, the firmware now sends a 16 MB $A0 kill stream that causes the MCU to reset itself and cold-boot the OS within ~2 minutes. No power cycle required. Mined from a bench capture showing the kernel's final payload is a PowerPC blr (4E 80 00 20) — the kernel's own return-from-main triggers the MCU reset path.

T87A improvements

• AUTOKEXIT on by default — every HS-CAN read cleans up the kernel automatically. AUTOKEXIT off defers cleanup until MENU → 9 Reset.
• Standalone KEXIT command — run the kernel-exit sequence manually after any read session.
• Smart Reset menu button — on T87A, MENU item 9 (Reset) automatically routes through the kernel-exit kill stream instead of the UDS $11 01 that the resident kernel silently ignores.
• Reordered T87A menu — grouped by speed path (High Speed vs. Bench Tool) with consistent naming:
  Cal Read / Full Read / Cal Write / Full Write [High Speed], BAM Read / BAM Write [Bench Tool].
• CAL Read over Rollin Smoke kernel — 1 MB cal region dump in ~30 s over HS-CAN, auto-names to /Read/CALREAD_<OSID>_<timestamp>.bin.

OSID & file naming

• Changed OSID now reports the 8-digit decimal OS Part Number (e.g. 24288836) via OBD-II Mode 9 PID 4 ($09 04), matching the naming convention used in .bin files. Falls back to GM $1A B4 alphanumeric cal ID for modules that don't answer Mode 9.
• All reads now land in /Read/ on the SD card with consistent <OP>_<VIN>_<OSID>_<timestamp>.bin naming — HSREAD, CALREAD, BAMREAD, and E92 FULLREAD.
• BAMREAD auto-reads the OS PN from flash offset 0x014638 after the dump completes and renames the file to embed it.

SD browser (serial terminal)

• SDLIST [path] — lists files and subdirectories (fixed prior root-only limitation). Defaults to /.
• SDTREE [path] — recursive listing, 3-level depth cap.
• SDSTAT — card total / used / free MB plus root-entry counts.
• SDPEEK upgraded to xxd-style output: OFFSET: hex hex hex |ASCII| rows.

Documentation

• T87A-Unlock-Recipe.html rebuilt with an 11-OS Patched Examples library — one full 4 MB image per OS version with CS1/CS2 checksums and file CRC32s. BAM-only sidecars retired (firmware now handles the 0x020000 offset internally).

Footprint: Flash 29.8% (151 KB / 508 KB), RAM 49.5%. +3.7 KB vs. v1.4.0.

Added First public release of Flashy — a clean-room, MIT-licensed J2534-style Pass-Thru tool. Built from public protocol documentation and reference manuals only. No commercial flash-tool source code, kernels, or proprietary IP referenced or included.

Hardware

• Target: Adafruit Feather M4 CAN Express (ATSAME51J19A, 120 MHz Cortex-M4F, built-in CAN peripheral + transceiver)
• Optional Adalogger FeatherWing (SD card + PCF8523 RTC) for on-device .bin storage and timestamped filenames
• Annotated wiring photos and bench-pinout reference for GM modules under docs/

Firmware features

• Auto-detect CAN at boot — sweeps 500k / 250k / 1M / 125k baud, no INIT required for normal operation
• Interactive menu — six top-level options (Help / Connect / Diag / ECU / Hacker / RAW), per-ECU operation menus, capability-gated commands
• UDS / ISO-TP / CAN driver stack — standard OBD-II services, multi-frame ISO-TP segmentation, interrupt-driven CAN RX with 4 KB ring buffer
• OBD-II diagnostics — Read DTC ($03 with human-readable decode like P0300 / U0100), Clear DTC ($04), VIN read/write, OSID, ECU reset
• SETCLOCK + RTC — PCF8523 wall clock, timestamped filenames (<OSID>-YYMMDD-HHMMSS.bin), session-counter fallback
• SCAN — multi-module bus probe, returns module type + VIN where available
• Bus Sniffer — live CAN frame display on serial, accept-all filter

Module support

• E38 ECM (MPC561) — full read, cal/full write, kernel upload, VIN read/write, diag
• E67 ECM (MPC565) — full read (verified, 21 KB/s), cal/full write, kernel upload, VIN read/write
• E92 ECM (MPC5674F, e200z7 Book E) — clean-room kernel verified: full 4 MB read in 7 min 20 s at 9 KB/s, three consecutive checksum matches (0x233F8347)
• T87 / T87A TCM (SPC564A80) — HS-CAN read/write, BAM-mode read/write (4 MB in 450 s, verified against JTAG readback)
• T93 TCM (SPC564A80) — HS-CAN diagnostics, BAM read in progress
• T42 TCM, E40 ECM — diagnostic-only at present

Clean-room kernels (Cernels)

• Cernels/e92_read/ — 1816-byte Book E read kernel for MPC5674F. Handles $01 PING, $1A readDataByIdentifier, $23 ReadMemoryByAddress (multi-frame ISO-TP TX with full FC/BS/STmin support), $11 01 ECUReset (SIU SRCR). Inherits bootloader stack, silently discards unrecognized frames. Built with the free NXP powerpc-eabivle-gcc toolchain.
• Cernels/t87a_read/ — VLE/Book E read kernel for SPC564A80, work-in-progress.
• MIT licensed. Written from Freescale / ST reference manuals and FlexCAN register definitions only. Embedded copyright signature in each binary.

Host tools (Python & .exe)

• capture_bus.py — raw CAN bus capture to SavvyCAN-format CSV
• vin_scan.py / vin_update.py — multi-module bus scan + VIN updater
• detect_port.py — Feather COM port auto-detect (USB VID match)
• seed_key_algo.py — GM 2-byte seed/key (1280-algo lookup)
• gm5byte/ — GM 5-byte seed/key (AES-128 + SHA-256)
• bin2header.py — .bin → C header for embedding kernels in firmware
• build_exe.py — PyInstaller build pipeline (portable dist/Flashy-Tool/ bundle, no Python required on target machine)

Documentation

• docs/ecu-reference.html — MCU specs, memory maps, and module verification status
• docs/Read-Write-Instructions.html — step-by-step usage guide
• docs/J2534-CANbus-Reference.html — protocol reference (UDS / ISO-TP / J2534)
• Starter wiki under wiki/, CONTRIBUTING.md, GitHub issue templates

Distribution

• Flashy-Tool.zip — portable bundle, double-click any .bat to launch
• Flashy-Tool-Setup-1.3.0.exe — Windows installer (Inno Setup)
• Pre-compiled firmware.uf2 bundled in both

License: MIT. Fork it, ship it, sell it — just keep the notice.