J2534 Pass-Thru — ECU Reference Guide

Feather M4 CAN Express • GM Powertrain Controllers • CAN / BAM / JTAG

Verified — JTAG IDCODE, cited in tool config, board photo, or multiple independent sources confirm MCU

Partial — Strong evidence (BDM protocol, memory map) but not physically confirmed

Insufficient — No MCU identification yet; flash size / algo only

ECU	MCU	Core	Flash	CAN Protocol	Algo	BAM	JTAG	Kernel	Status
E92	MPC5674F	e200z7	4 MB	GMLanMPC5XXX	2B:0x201 / 5B:0x92	✓	✓	✓	Verified
E80	MPC5676R	e200z7	6 MB	GMLanGen6	5B:0x28	✓	✓	—	Verified
E82	MPC5676R	e200z7	6 MB+	GMLanGen5	5B:0x81	—	—	—	Verified
E84	MPC5676R	e200z7	6 MB	GMLanGen5	5B:0x85	—	—	—	Verified
E83	MPC5565	e200z6	2 MB	GMLanMPC5XXX	5B:0xB2 / 2B:0xDE	—	✓	—	Verified
E78	MPC5566	e200z6	3 MB	HS-CAN / BAM	—	✓	✓	—	Verified
E39/E39A	MPC5566	e200z6	3 MB	GMLanMPC5XXX	5B:0xB2 / 2B:0xDC	✓	—	—	Verified
T87A	SPC564A80	e200z4	4 MB	GMLanMPC5XXX	5B:0x87 / 2B:0x87	✓	✓	—	Verified
T87	SPC564A80	e200z4	4 MB	GMLanMPC5XX	2B:0x57	✓	—	—	Verified
T93	Unknown	Unknown	4 MB+	HS-CAN + CAN FD?	2B:0x5D	?	—	—	Partial
E38	MPC561	MPC500	2 MB ext	GMLanMPC5XX	2B:0x92	—	BDM	—	Verified
E67	MPC565	MPC500	2 MB ext	GMLanMPC5XX	2B:0x89	—	BDM	—	Verified
E69	MPC55xx?	—	2 MB	—	—	—	BDM	—	Partial
E90	MPC5676R?	—	8 MB	GMLanGen6	5B:0x28	—	—	—	Partial
T43	MPC55xx?	—	2 MB	GMLanMPC5XX	2B:0x84	—	—	—	Partial
E40	MC68376	CPU32 (68K)	1 MB ext	GMLanMPC5XX	2B:0x68	—	BDM	—	Partial
T42	MC683xx?	CPU32	1 MB	GMLanMPC5XX	2B:0x73	MVP	—	—	Unknown

Verified ECUs

E92 ECM MPC5674F

MCU / Core

MCUMPC5674F

Coree200z7 (Book E)

DatasheetMPC5674F Reference Manual (NXP)

Memory

Flash4 MB (0x00000000-0x003FFFFF)

FMC00xC3F88000

FMC10xC3F8C000

SRAM256 KB @ 0x40000000

Shadow0x00FFC000 (16 KB)

Programming Interfaces (Early vs. Late variant)

Method	Variant	Protocol	Kernel	Algo
HS-CAN	Early (pre-2017)	GMLanMPC5XXX	E92Kernel.dat	2-byte algo 513
HS-CAN	Late / E92A (2017+)	GMLanMPC5XXX	E92Kernel.dat	5-byte algo 146 (AES-128)
BAM	Both	MPC5XXXBam	MPC5674BAM.dat	—
JTAG	Both	e200z7, IR=5	—	—

Variant Detection (v1.5.0)

Firmware command E92ID classifies an attached E92 as Early or Late from two signals: the OEM part-number cluster (a fixed list of 14 Early PNs and 8 Late PNs maintained in firmware) and VIN position 10 (model year). AUTH uses the result to route 5-byte seeds to algo 146 on Late, and refuses $27 02 on UNKNOWN to protect the MEC counter from a wrong-algo attempt. VINWRITE on E92 short-circuits with cal-reflash guidance — VIN lives in calibration on this family, not as a writable DID.

Flash Passwords

Password 0A1A11111

Password 1B2B22222

Password 2C3C33333

Special Regions

Skip 10x1FF80 (0x80 bytes)

Skip 20x2FF80 (0x80 bytes)

Key offset0x10154 (0x11 bytes)

Read: clean-room kernel reads full 4 MB in 440 s (~9 KB/s), checksum 0x233F8347 (3× match), clean $11 01 reset exit. Auth: Late E92A bench-verified 2026-04-25 — algo 146 unlocks via firmware (seed=8785EEC106 → key=08B3B3656D, ECU returned $67 02). Early bench-verified 2026-04-25 — algo 513 unlocks on a 2016 unit ($27 01/03 returns 2-byte seed, 660B aliased across both levels).

Verification Evidence

Cited in USBJTAG config (TECUE92BAM.xml, TECUE92CAN.xml, TECUE92JTAG.xml) as MPC5674F
JTAG confirmed via e200z7 debug interface
Dual FMC register addresses match MPC5674F datasheet
Clean-room kernel successfully reads 4 MB flash
v1.5.0: Late E92A unlock proven with firmware-built algo 146 against a 2020 bench unit; Early unlock proven with algo 513 against a 2016 bench unit

E80 ECM MPC5676R

MCU / Core

MCUMPC5676R

Coree200z7 (Book E)

DatasheetMPC5676R Reference Manual (NXP)

Memory

Flash6 MB (0x00000000-0x005FFFFF)

FMCDual modules

SRAM@ 0x40000000

Shadow0x00FFC000 (16 KB)

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanGen6	E80Kernel.dat	5-byte 0x28
BAM	MPC5XXXBam	MPC5676BAM.dat	—
JTAG	e200z7, IR=5	—	—

Flash Passwords

Password 0A1A11111

Password 1B2B22222

Password 2C3C33333

Notes

Shares kernel with E90 (E80Kernel.dat). Gen6 platform ECM.

No Kernel or live testing yet

Verification Evidence

Cited in USBJTAG config (TECUE80BAM.xml, TECUE80JTAG.xml) as MPC5676R
6 MB flash and dual FMC match MPC5676R datasheet

E82 ECM MPC5676R

MCU / Core

MCUMPC5676R

Coree200z7 (Book E)

DatasheetMPC5676R Reference Manual (NXP)

Memory

Flash6 MB+

Flash PWA1A11111 / B2B22222 / C3C33333

Memory Regions

Region	Start	End	Size	Notes
EEPROM	0x00000000	0x0001FFFF	128 KB	—
Boot	0x00020000	0x0003FFFF	128 KB	Protected
Flash	0x00040000	0x05C3FFFF	~5.75 MB	—

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanGen5	E82Kernel.dat	5-byte 0x81

No Kernel or live testing yet

Verification Evidence

Noted in USBJTAG config (TECUE82CAN.xml) as MPC5676R
Flash passwords match MPC5676R family pattern

E84 ECM MPC5676R

MCU / Core

MCUMPC5676R

Coree200z7 (Book E)

DatasheetMPC5676R Reference Manual (NXP)

Memory

Flash6 MB

Shadow0x00FFC000 (16 KB)

Flash PWA1A11111 / B2B22222 / C3C33333

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanGen5	E84Kernel.dat	5-byte 0x85

No Kernel or live testing yet

Verification Evidence

Noted in USBJTAG config (TECUE84CAN.xml) as MPC5676R
Flash passwords and shadow address match MPC5676R family

E83 ECM MPC5565

MCU / Core

MCUMPC5565

Coree200z6

DatasheetMPC5565 Reference Manual (NXP)

Memory

Flash2 MB (0x00000000-0x001FFFFF)

FMCSingle @ 0xC3F88000

SRAM@ 0x40000000

Shadow0x00FFFC00 (1 KB)

Flash PWA1A11111 / B2B22222 / C3C33333

Memory Regions

Region	Start	End	Size
Boot	0x00000000	0x0001FFFF	128 KB
Firmware	0x00020000	0x001FFFFF	1.875 MB

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanMPC5XXX	E83kernel.dat	5-byte 0xB2 / 2-byte 0xDE
JTAG	e200z6, IR=5	—	—

No Kernel or live testing yet

Verification Evidence

Cited in USBJTAG config (TECUE83CAN.xml, TECUE83JTAG.xml) as MPC5565
Single FMC, 2 MB flash, 1 KB shadow all match MPC5565 datasheet

E78 ECM MPC5566

MCU / Core

MCUMPC5566

Coree200z6

DatasheetMPC5566 Reference Manual (NXP)

Memory

Flash3 MB (0x00000000-0x002FFFFF)

FMCSingle

Shadow0x00FFFC00 (1 KB)

Flash PWA1A11111 / B2B22222 / C3C33333

Special Regions

Skip 10x3F80 (0x80 bytes)

Skip 20x1FF80 (0x80 bytes)

Programming Interfaces

Method	Protocol	Kernel	Algo
BAM	MPC5XXXBam	MPC5566BAM.dat	—
HS-CAN	—	—	—
JTAG	e200z6, IR=5	—	—

No Kernel or live testing yet

Verification Evidence

Cited in USBJTAG config (TECUE78BAM.xml, TECUE78JTAG.xml) as MPC5566
3 MB flash, single FMC, 1 KB shadow match MPC5566 datasheet

E39 / E39A ECM MPC5566

MCU / Core

MCUMPC5566

Coree200z6

DatasheetMPC5566 Reference Manual (NXP)

Memory

Flash3 MB

Shadow0x00FFFC00 (1 KB)

Flash PWA1A11111 / B2B22222 / C3C33333

Programming Interfaces

Method	Protocol	Kernel	Algo
BAM	MPC5XXXBam	MPC5566BAM.dat	—
HS-CAN (E39A)	GMLanMPC5XXX	E39Akernel.dat	5-byte 0xB2 / 2-byte 0xDC

No Kernel or live testing yet

Verification Evidence

Cited in USBJTAG config (TECUE39BAM.xml, TECUE39ACAN.xml) as MPC5566
Shares BAM kernel with E78 (MPC5566BAM.dat)

T87A TCM SPC564A80 (MPC5644A equiv.)

MCU / Core

MCUSPC564A80 (ST Qorivva)

EquivalentMPC5644A (Freescale)

Coree200z4 (VLE)

JTAG IDCODE0x2AE02041

DatasheetSPC564Axx Reference Manual RM0029 (ST)

Memory

Flash4 MB

FMC00xC3F88000

FMC10xC3F8C000

SRAM192 KB @ 0x40000000

Shadow0x00FFC000 (16 KB)

Flash PWA1A11111 / B2B22222 / C3C33333

Flash Memory Map

Region	Start	End	Size	Notes
Boot	0x000000	0x01FFFF	128 KB	Protected
BootBlock	0x020000	0x03FFFF	128 KB	Key @ 0x28710
Flash1	0x040000	0x07FFFF	256 KB	—
Trans	0x080000	0x17FFFF	1 MB	Key @ 0x80010
OS	0x180000	0x2FFFFF	1.5 MB	—
Empty	0x300000	0x3FFFFF	1 MB	Unused

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanMPC5XXX	T87kernel.dat	5-byte 0x87 / 2-byte 0x87
BAM	MPC5XXXBoot	—	—
JTAG	e200z4, IR=5	—	PW: A72483DBE61FC095

Read: BAMREAD 4 MB in 447 s (9.2 KB/s) · HS-CAN read 32 KB/s with extracted commercial kernel. Write: BAMWRITE 23 sectors in 380 s · v1.4.5: CALWRITE + FULLWRITE proven on HS-CAN through Flashy without bricking. Unlock: 5-patch dual-unlock recipe applied to stock OS via tools/t87a_patch.py — see the T87A Unlock Recipe for the patch map and CRC/Wordsum recalculation. Cross-OS safety: HSWRITE compares source-bin OS PN at flash offset 0x014638 against live TCM OSID via Mode 9 PID 4 before any kernel load — aborts with banner on mismatch (prevents the cross-OS boot-anchor brick).

Verified OS Versions

OS Version	Mode	Status	Notes
24293216	BAM	Verified	Read + write (2026-04-22)
24286985	HS-CAN	Verified	5-patch unlock (HPT lock check at 0x034A70 + bypass patches)
other 836-family OSes	HS-CAN / BAM	Untested	Same patch map expected; cross-OS gate will refuse mismatched bins

Verification Evidence

JTAG IDCODE: 0x2AE02041 (physically confirmed)
onCE JTAG ID: 0x07C2601D
MCU ID register: 5640 Version 2.0
MCR C3F88000: 0x05408600 (Code Flash Module 0)
MCR C3F8C000: 0x05010600 (Code Flash Module 1)
BAMREAD / BAMWRITE verified against JTAG readback
v1.4.5: Flashy CALWRITE + FULLWRITE bench-verified on HS-CAN; $6C per-module size-field encoding fix landed (M0 LMSR 0x011000 / M1 LMSR 0x021000 / HSR 0x031000)

T87 TCM SPC564A80 (same as T87A)

MCU / Core

MCUSPC564A80 (ST Qorivva)

Coree200z4 (VLE)

RelationshipSame hardware as T87A, no signed cals, no secure boot

DatasheetSPC564Axx Reference Manual RM0029 (ST)

Memory

Flash4 MB

FMC00xC3F88000 (MCR 0x05408600)

FMC10xC3F8C000 (MCR 0x05010600)

Shadow0x00FFC000 (16 KB)

Flash PWA1A11111 / B2B22222 / C3C33333

Programming Interfaces

Method	Protocol	Kernel	Algo
BAM	MPC5XXXBoot	T87kernel.dat	2-byte 0x57 (algo 87)
HS-CAN	GMLanMPC5XX	T87kernel.dat	2-byte 0x57

Transmissions

8L90E, 8L45, Allison LCT1000 6-speed

Vehicles (2014–2016)

2015-2016 Silverado/Sierra, 2015 Corvette C7, 2016 Camaro SS, 2015-2017 Escalade, 2015-2016 Tahoe/Suburban/Yukon.

T87 vs T87A

Same SPC564A80 MCU. T87 has no encryption, no signed calibrations, no secure boot — kernels load into RAM and execute freely. T87A added signed/encrypted cals + 5-byte seed-key + secure bootloader that rejects RAM execution.

CALWRITE: 512KB, 25.6s, 20.1 KB/s | FULLWRITE: 3.5MB, 177.7s, 20.2 KB/s

Verification Evidence

CPUData register values byte-for-byte identical to JTAG-confirmed T87A (MCR 0x05408600 / 0x05010600)
Same kernel (T87kernel.dat), same BAM protocol (MPC5XXXBoot), same flash layout
MagicMotorsport Flex tool confirms SPC564A for T87/T87A family

E38 ECM Motorola MPC561

MCU / Core

MCUMotorola MPC561

CoreMPC500 (embedded PowerPC, 32-bit)

Speed40-66 MHz

External FlashAMD AM29BDD160GB (2 MB burst)

Slave CPUMC9S12C32 (Drive-By-Wire)

DatasheetMPC561 Reference Manual (NXP)

Memory

Int Flash1 MB (unused by GM)

Ext Flash2 MB (AM29BDD160GB)

SRAM32 KB

Analog Ch32 (2× QADC64)

CAN3× TouCAN (NOT FlexCAN)

DebugBDM (not JTAG)

Flash Memory Map (External)

Region	Start	End	Size	Notes
Boot	0x000000	0x00FFFF	64 KB	Key @ 0xC1CC
SystemOS	0x010000	0x1FFFFF	~1.94 MB	—

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanMPC5XX	E38kernel.dat	2-byte 0x92 (algo 402)
BDM	BDMPPC, MPC55X	—	—

Vehicles

2006+ Corvette (LS2/LS3/LS7), Camaro SS (LS3/L99), CTS (3.6L), G8 GT (L76/LS3), Silverado/Sierra (Gen IV V8), Trailblazer, SSR, most Gen IV GM V8 vehicles.

Key Difference vs E67

MPC561 = 32 KB SRAM, 32 analog channels. E67 (MPC565) = 80 KB SRAM, 40 analog channels. Both use external 2 MB burst flash.

READ: 3/3 on SD card, working via U-Link kernel | VIN ...7561 checksum 0xBC224A2

Verification Evidence

BitBox / Chiptuningshop commercial tool declares: "E38 — MCU: Motorola MPC561, Flash: AM29BDD160GB"
IO Terminal product page lists E38 with AM29BDD160GB flash
EFILive forum Gen IV ECM types: "E38: 1 x MPC561 CPU, 1 x MC9S12 CPU, 2Mb Burst Flash"
rusefi wiki confirms MPC561 for E38
USBJTAG BDM SubProtocol "MPC55X" (USBJTAG label for MPC5xx BDM, not MPC5500 series)

E67 ECM Motorola MPC565

MCU / Core

MCUMotorola MPC565

CoreMPC500 (embedded PowerPC, 32-bit)

Speed40-66 MHz

External FlashSpansion S29CD016 (2 MB burst)

Slave CPUMC9S12C32 (Drive-By-Wire / ETC)

DatasheetMPC565 Reference Manual (NXP)

Memory

Int Flash1 MB (unused by GM)

Ext Flash2 MB (S29CD016)

SRAM80 KB (@ 0x003F8000-0x0040BFFF)

Analog Ch40 (2× QADC)

CAN3× TouCAN (NOT FlexCAN)

DebugBDM (not JTAG)

Kernel Load Address — MYSTERY SOLVED

EFILive's kernel at 0x003FC400 falls squarely within MPC565 internal SRAM (0x003F8000–0x0040BFFF). This was previously flagged as "not in MPC5565 SRAM" — correct, because the E67 is NOT MPC5565. The MPC5xx (MPC500 core) has SRAM at an entirely different address than MPC55xx (e200 core, SRAM @ 0x40000000).

Flash Memory Map (External)

Region	Start	End	Size	Notes
Boot	0x000000	0x00FFFF	64 KB	Key @ 0xC0B8
SystemOS	0x010000	0x1FFFFF	~1.94 MB	—

E67A variant: all addresses offset by +0x400000 (different external flash mapping)

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanMPC5XX	E67kernel.dat	2-byte 0x89 (algo 393)
BDM	BDMPPC, MPC55X	—	—
Slave	GMLanSlave	E67slave.dat	2-byte 0x89

Vehicles

2006-2008 CTS-V (LS2), Hummer H3 (LH8 5.3L), Impala SS / Monte Carlo / GP GXP / LaCrosse Super (LS4 FWD), Trailblazer/Envoy/Rainier/Saab 9-7X (LS2 5.3/6.0L). 2009+ Corvette ZR1 (LS9), CTS-V (LSA), Camaro ZL1 (LSA), Colorado/Canyon (5.3L). All GM supercharged vehicles until Gen V LT4 transition (~2015-2017).

Impact on Clean-Room Kernel

The E67 Kernel needs a completely different approach than the E92 Kernel. MPC565 uses MPC500 core (original Book E predecessor), TouCAN (not FlexCAN), and a different peripheral register map. The NXP powerpc-eabivle-gcc may work with appropriate -mcpu flags, but the CAN driver and startup code must be rewritten from the MPC565 Reference Manual.

FULLREAD: 2 MB, 96s, 21.3 KB/s, zero errors, checksums match (0x8E29C2)

Verification Evidence

BitBox / Chiptuningshop declares: "E67 — MCU: Motorola MPC565, Flash: S29CD016, 2.0 MB"
IO Terminal lists E67 with S29CD016 flash memory
EFILive forum Gen IV types: "E67: 1 x MPC565 CPU, 1 x MC9S12 CPU, 2Mb Burst Flash"
rusefi wiki: "E67 uses an MPC565"
Kernel load address 0x003FC400 confirmed within MPC565 SRAM (0x003F8000–0x0040BFFF) — matches perfectly

Partially Known ECUs

E69 ECM MPC55xx (assumed)

MCU / Core

MCULikely MPC55xx family

BDM SubProtoMPC55X

Memory

Flash2 MB

EEPROM1 KB @ 0x80000000

No Kernel or live testing yet

Verification Evidence

BDM SubProtocol "MPC55X" identifies family
No MCU cited in USBJTAG config
EEPROM at 0x80000000 is unusual and may help narrow MCU variant

E90 ECM MPC5676R-class (assumed)

MCU / Core

MCUUnknown (possibly MPC5676R-class)

NoteShares kernel with E80 (E80Kernel.dat)

Memory

Flash8 MB starting @ 0x00800000

NoteUnusual base offset 0x00800000!

FMC00xC3F88000

FMC10xC3F8C000

Flash PWA1A11111 / B2B22222 / C3C33333

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanGen6	E80Kernel.dat	5-byte 0x28

No Kernel or live testing yet

Verification Evidence

Shares kernel and algo with E80 (MPC5676R), suggesting same family
Dual FMC register addresses match MPC567x pattern
8 MB flash with 0x00800000 offset is unusual — may be banked or different silicon
No MCU cited in USBJTAG config

T43 TCM MPC55xx (assumed)

MCU / Core

MCUUnknown MPC55xx

Memory

Flash2 MB

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanMPC5XX	T43Kernel.dat	2-byte 0x84

No Kernel or live testing yet

Verification Evidence

GMLanMPC5XX protocol implies MPC55xx family
2 MB flash consistent with MPC5565 but not confirmed
No BDM SubProtocol, <CPU> tag, or JTAG data available

T93 TCM Unknown MCU — NOT same board as T87A

MCU / Core

MCUUNKNOWN — physically different PCB from T87A

OBDSTAR claimSPC5888 (unverified — not in ST product catalog)

USBJTAG claimTCUT93GMBoot.xml shares CPUData with T87A, but board inspection contradicts

CAN FD?HPT unlock starts at 500 kbps then switches to higher speed — likely CAN FD

Label (bench unit)

GM PN24047110

Service #24046678

MfgBosch, Made in USA

Serial1320101000000X

Known Programming Interfaces

Method	Protocol	Notes
HS-CAN	500 kbps initial	HPT starts here, then switches speed (CAN FD?)
BAM	UNKNOWN	USBJTAG config exists but board differs from T87A — BAM unverified
JTAG	—	No JTAG port visible on PCB, chips unlabeled

Transmissions

8L45, 8L90, 10L80, 10L90, Allison 10L1000 (HD diesel)

Vehicles (2019–2026+)

2019+ Silverado/Sierra 1500, 2020+ Tahoe/Suburban/Yukon/Escalade, 2020+ Camaro SS/ZL1, Corvette C8, CT5-V/CT4-V Blackwing, Escalade-V. Global A + Global B platforms.

Physical Inspection — Board Differs from T87A

Visual inspection of bench unit shows the T93 PCB and processor look nothing like the T87A. Chips are unlabeled, no JTAG port found. The USBJTAG config shares CPUData register values with T87A, but this may reflect a config template reuse rather than actual silicon identity. OBDSTAR DC706 lists the T93 MCU as "SPC5888" which is not a known ST part number. Do not assume T87A BAM protocol works on T93 without verification.

Bench unit available (PN 24047110) — HS-CAN testing next, BAM status unknown

Verification Evidence

USBJTAG config (TCUT93GMBoot.xml) shares CPUData with T87A — but board physically differs
PCB inspection: processor and board layout do NOT match T87A
Chips unlabeled, no visible JTAG port
HPT unlock tool uses HS-CAN then switches to high-speed mode (possibly CAN FD)
Existing capture CSVs end when speed switch occurs — CAN FD data not captured
Bench unit label photographed: GM 24047110, Bosch, SERV# 24046678

E40 ECM Motorola MC68376 (CPU32 / 68K family)

MCU / Core

MCUMotorola MC68376

CoreCPU32 (Motorola 68000 family, NOT PowerPC)

Architecture68K (completely different from MPC5xx PowerPC)

External FlashAMD AM29BL802CB (1 MB burst)

NoteDual MC683xx CPUs per EFILive

DatasheetMC68336/376 User Manual (NXP)

Memory

Ext Flash1 MB (AM29BL802CB)

SRAM@ 0xFFFF0000 (internal, configurable)

SIM regs0xFFF6xx (matches MC68376 UM)

TPU regs0xFFFAxx (matches MC68376 UM)

DebugBDM (68K-style, distinct from PowerPC BDM)

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanMPC5XX	E40Kernel.dat	2-byte 0x68 (algo 104)
BDM	68K BDM (NOT BDMPPC)	—	—
Slave	GMLan68K	—	—

Vehicles (2005-2006 only, transitional Gen III/IV)

2005 Corvette C6 (LS2 6.0L), 2005-2006 Pontiac GTO (LS2), 2005-2006 SSR (LS2), 2006 Trailblazer SS (LS2), 2005-2006 Envoy/Trailblazer/Rainier/Saab 9-7X (LH6/LQ9 5.3/6.0L).

No Kernel or live testing yet

Verification Evidence

PCMHacking forum (t=6416): E40 identified as MC68376 with AM29BL802CB flash
EFILive forum Gen IV types: "E40: 2 x MC683xx CPU's, 1Mb Burst Flash"
USBJTAG register addresses (0xFFF6xx SIM, 0xFFFAxx TPU) match MC68376 User Manual exactly
BDM protocol is "BDM" (68K-style), NOT "BDMPPC" — confirms non-PowerPC
Not yet confirmed with board photo or JTAG IDCODE

MCU / Core

MCUMC683xx / CPU32 (68K)

NoteKernel load address 0xFF9000 places execution in the SRAM region typical of MC683xx-family parts; 1 MB internal flash matches the MC68377 variant. MC68376 (used by E40) is the next closest candidate. Exact MCU still pending physical confirmation (board photo or BDM IDCODE).

Memory

Flash1 MB

Kernel load0xFF9000 (SRAM)

Programming Interfaces

Method	Protocol	Kernel	Algo
HS-CAN	GMLanMPC5XX	T42Kernel.dat (clean-room MVP)	2-byte algo 371 (0x73)

v1.5.0 MVP: Auth + kernel upload + post-boot ping ($1A 55 → $5A 55 F L A S H) bench-verified on HS-CAN. Kernel uploads via $34 RequestDownload + $36 TransferData (1012 B payload, no $37; bootloader auto-jumps). Five test variants A–E (T42READ A … T42READ E) provide rapid bench iteration of session/heartbeat/probe variations. Flash-read loop is the next milestone.

Verification Evidence

Kernel boot + ping confirmed on bench — the auth/upload pipeline is correct.
Kernel load address (0xFF9000) and 1 MB flash size align with MC68377; MCU still unconfirmed without a board photo or BDM IDCODE.
2-byte algo 371 (0x73) and GMLanMPC5XX protocol match published config data.