CM2200A Cummins Questions

[Chavez91]

Was Cruising through things and noticed that there was a patch for the RSA Security for the CM2200A. Got one sitting here(2011), haven't even tried hooking it up to the V2 yet, but whats the process for reading out the truck? Can we read out the stock file like normal? and then apply the RSA bootloader patch, then flash over the stock/modified tunes that we read off the truck? or do we need to find some other method (like the LML or getting a dealer reflash) for acquiring another stock file that can be flashed in after the RSA patch?

If I can get a read out without the rsa patch, then ill run outside and grab a read off the truck and mail it in, seeing that there isn't calibration support as of yet. Just curious. Haven't really dug into it yet as Ive been busy with the LMLs.

[WyoFreeride]

The patch is for the 601 boot block. It fixes the anti tuning boot loader.

[Chavez91]

I was just reading the "Cummins 6.7L Bootloader RSA Patch User Guide" is all. Don't really know a whole lot about em ATM.

" Supported Vehicles
This guide documents the patching process for:
1. Cummins CM2100A (2007-2010) ECM’s
2. Cummins CM2200A (2010-2012) ECM's (tuning support presently not available) "

That is what I was basing my assumptions off of.

[WyoFreeride]

Sorry. You are right. Too late, brain fart. 2100 is what I meant. 2200 you can't read or tune yet.
I hope the fact that its in the manual means its close. I almost fell out of my chair when i read that the first time.

Also, v8 scan will detect a 2011 but can't scan anything yet and no pids are available

[GMPX]

Was Cruising through things and noticed that there was a patch for the RSA Security for the CM2200A. Got one sitting here(2011), haven't even tried hooking it up to the V2 yet, but whats the process for reading out the truck? Can we read out the stock file like normal?
We can't get reading working via OBD-II yet :bawl:

But the Bootloader patch has been developed and tested working here on the CM2200 (so yes we can flash them too), I guess you can see that the CM2200 is in the pipeline given we can get around the anti-tuning stuff.
Before anyone asks on the 2013+ CM2350B, no luck there, the Bully Dog box seems to be a good solution and probably the only option.

[Chavez91]

Ahh... Alright! Sounds good! Hopefully you get it soon! :tongue:

Good work! On the RSA!

[catman3126]

I talked to someone at Ennis this fall at their booth and he said they used the Bully dog to unlock the ecm and then used something else to tune and in some way delete a 13'+ cummins. he said the only way available was to ship the ECM to them, they tune it for 1500.00 and ship it back overnight.

[GMPX]

They (Bully Dog) came up with something better than that, they used to have people send the ECM in but now they have a module that programs via a different CAN port (not via the OBD-II plug) where I guess the anti-tuning checks are not applied, nothing like leaving the door accidentally wide open Cummins. Hats off to Bully Dog on that one, keeps the aftermarket alive.

[Chavez91]

Yeah. They have a $50 module that you can use with the gt tuner that plugs into a plug in the engine bay that is integrated into the flash process. It's a one time use tho. Once you use it and unlock the ecm. It's unlocked. You don't need to use the special box ever again for that truck.

[catman3126]

So then what can we use to do the tuning? Or would it be another bully dog tuner?

[catman3126]

Yeah. They have a $50 module that you can use with the gt tuner that plugs into a plug in the engine bay that is integrated into the flash process. It's a one time use tho. Once you use it and unlock the ecm. It's unlocked. You don't need to use the special box ever again for that truck.

Oh right on I see.

[catman3126]

Yeah. They have a $50 module that you can use with the gt tuner that plugs into a plug in the engine bay that is integrated into the flash process. It's a one time use tho. Once you use it and unlock the ecm. It's unlocked. You don't need to use the special box ever again for that truck.

Oh right on I see.

[Chavez91]

I'm not sure if efi will support it being it can't be done directly from the obdII port. I also don't know what can/will be done with tuning after its been unlocked with BullyDog as far as efi goes..... Bully Dog is gonna just be your best bet for the time being.

[catman3126]

Yeah I'm not to worried about it I'm working on LML's now. but I like to keep up on information.

[GMPX]

I'm not sure if efi will support it being it can't be done directly from the obdII port.
It can be tuned via the OBD-II port once the BD box has done its thing.
So for a shop situation to offer custom tuning using EFILive the 2013+ ECM would first need to be unlocked via the BD device, then after that one off process you are right to tune via normal means. Of course Cummins have been plugging these security holes since the 2008 ECM first introduced the RSA signatures, it might be in the next gen ECM or a CM2350 update they will see the error of their ways and close the door BD use on the 2013+ too. But for now we have a life line.

[RADustin]

so efi can do the 2013+ trucks? awesome.

[GMPX]

Not yet, we can flash them but they are not mapped yet.

[catman3126]

Whoa this would be big of Efi was first to release tuning for 13+ but I'm guessing this isn't something we will see soon?

[Chavez91]

Haha. I meant unlocking it can't be done from the obdII port. My bad.

Would be pretty cool to have the tuning for them.... but a pain in the ass to have to buy the whole BullyDog tuner setup just to be able to unlock the ecm. But you gotta pay to play....

[catman3126]

I don't think you have to buy the tuner just the unlocker device? Right?

[Chavez91]

Nope. It requires the GT tuner. the box is just additional hardware needed. The device by itself doesn't do anything.

[catman3126]

Ok I see

[GMPX]

Whoa this would be big of Efi was first to release tuning for 13+
Not sure we'd be the first, didn't H&S have 2013+ tuning done too?


but I'm guessing this isn't something we will see soon?
Definitely not going to commit anything in writing at this stage.


Haha. I meant unlocking it can't be done from the obdII port. My bad.
It can't be done, simply impossible unless you get Cummins to sign the digital signature for you (never would they!)


but a pain in the ass to have to buy the whole BullyDog tuner setup just to be able to unlock the ecm. But you gotta pay to play....
It is a pain but think of it like this, a new RAM is around $55K right, an extra few hundred bucks here and there to tune it isn't much in the scheme of things. Remember BD was the first to unlock these but it required you to send the ECM in to them and cost around $1,200 from memory, so already with the new arrangement they have you are in front.

[catman3126]

Ive never seen anything for 13's from H@S. I think it would ahve come out on the down low by now if they did.

[GMPX]

Oh ok, must have been 10 - 12 then, I wasn't sure if they had done it before the issues they got caught up in.

[catman3126]

Yep. torque tech is close to tuning the 13's too i understand.

[GMPX]

No disrespect to them, but Who?

[Chavez91]

I think he means torquetech.ca?? Just did a quick Google search.. never hear of then either...

[catman3126]

LOL yeah thats who I mean I've used a couple and they work good. not near the features of an H@S but does the job.

[RADustin]

I'm sure unlocking could be done though the obd port. right after you figure out the RSA string.

time frame wise I think that'll be right after Jesus's second coming.


BD unit seems to backdoor the RSA and switch it off without actually figuring it out. Be nice to know what it is actually doing and if same is possible on LML dmax.

[WyoFreeride]

Hardway performance has 13+ tuning options, not sure how he's doing it but its a combination of h&s and bully dog I think

[WyoFreeride]

http://www.cumminsforum.com/forum/2013-general-discussion/1323033-2013-tuning.html

Doesn't show anything on their web store at the moment but the category is still there

http://hardwayperformance.com/custom-tuning/13-14-6-7-cummins.html

[catman3126]

Yep I talked to them down at ennis and they said its 1500.00 lol. uses the BD tuner to unlock and then he said something about set the VGT at 50% which didn't make sense to me about how that would have anything to do with a delete.

[Chavez91]

Probably "rumble". Also seems to be something to do to verify that the tune flashes correctly. Sometimes when it doesn't it will still have 90% vane pos after flash even tho you demand 40-50.... it CAN be an indicator that the delete tune didn't take properly.... but take what I have to say with a grain of salt. Lol

[GMPX]

I'm sure unlocking could be done though the obd port. right after you figure out the RSA string.
time frame wise I think that'll be right after Jesus's second coming.
RSA Digital signatures are pretty much uncrackable in this day and age, you can't figure it out, many math geniuses have tried and failed, it is not even worth considering, they occasionally find exploits but not solid solutions. Nobody doing Cummins has figured the RSA signatures, they can only be bypassed via some slightly open back doors.


BD unit seems to backdoor the RSA and switch it off without actually figuring it out. Be nice to know what it is actually doing and if same is possible on LML dmax.
That is exactly how it is done, switching it off is tricky too as the flag is not meant to be accessible on a production ECM. I could explain how it is done as we do it on the CM2100 and CM2200, but then this isn't MHH right! so I won't :sly:
LML, there is probably no need to kill the RSA on it unless you want to modify the OS, in which case you are probably clinically insane to want to do that.

[Chavez91]

LML, there is probably no need to kill the RSA on it unless you want to modify the OS, in which case you are probably clinically insane to want to do that.

Lol!!! Get me my straight jacket! [emoji23]

[Cummins610]

Since we're talking about the abyss does anyone know what variant of ECM the VM Ecodiesel is based off of? Seems those that have bypassed the 13+ ECM have done the same with the ecodiesel already...

[vortecfcar]

The ecodiesel is an edc17c79. I haven't seen a patch yet on the ECM. The ecodiesel tuning requires splitting the case still at this point.

[RADustin]

RSA Digital signatures are pretty much uncrackable in this day and age, you can't figure it out, many math geniuses have tried and failed, it is not even worth considering, they occasionally find exploits but not solid solutions. Nobody doing Cummins has figured the RSA signatures, they can only be bypassed via some slightly open back doors.


That is exactly how it is done, switching it off is tricky too as the flag is not meant to be accessible on a production ECM. I could explain how it is done as we do it on the CM2100 and CM2200, but then this isn't MHH right! so I won't :sly:
LML, there is probably no need to kill the RSA on it unless you want to modify the OS, in which case you are probably clinically insane to want to do that.
DSP hope is a hard dream to shatter.




Lol!!! Get me my straight jacket! [emoji23]
no lie. lol.

[GMPX]

Since we're talking about the abyss does anyone know what variant of ECM the VM Ecodiesel is based off of? Seems those that have bypassed the 13+ ECM have done the same with the ecodiesel already...


The ecodiesel is an edc17c79. I haven't seen a patch yet on the ECM. The ecodiesel tuning requires splitting the case still at this point.
What Nick said, there is no option on those apart from opening the case to patch out the security. That ECM contains the latest anti-tuning updates from Bosch.


DSP hope is a hard dream to shatter.
Let me go on record by saying that I will never write DSP for the LML, the Tri-Core CPU is just awful, I don't mind a challenge but the thought of doing such a thing is too much for this ageing man to deal with.

[catman3126]

In all honestly I'm glad it will be nice to not putting switches in and as fast as these cal flash we can change tunes in a minute. I use two of my dsp5 settings anymore and tow with exhaust brake and Hot.

[RADustin]

Let me go on record by saying that I will never write DSP for the LML, the Tri-Core CPU is just awful, I don't mind a challenge but the thought of doing such a thing is too much for this ageing man to deal with.

well you have two semi-idiots eager to help should you change your mind. I understand your stance on the issue though.

[Chavez91]

well you have two semi-idiots eager to help should you change your mind. I understand your stance on the issue though.
I'm pretty sure I can almost quote those Infinion manuals in my sleep [emoji28]

[GMPX]

well you have two semi-idiots eager to help should you change your mind. I understand your stance on the issue though.
Please appreciate that we've walked all these roads before with every ECM we've touched in the last 10 years, I know what technical battles to choose vs waste of time/life and Tri-Core ECM assembler isn't one of them, especially how Bosch code is written. Understanding CPU op-codes is one thing (the easy part) inserting custom code without upsetting subroutine timings, RAM variables, Register values that need to be preserved etc, etc is the hard part and as I said about Bosch code, the way it all finally turns out once they compile the code makes that task really tricky. It was a struggle on the Bosch PowerPC CPU's and I know that CPU inside out.

[Chavez91]

We are beyond appreciative of everything you do and have done. Don't mistake us in that..... but yeah we understand your stance on it. :)

[GMPX]

I don't want to come across as a know it all because I don't know it all :Eyecrazy:, just giving you some words of wisdom on my Bosch experiences.

[Chavez91]

By far, all this is definitely one of my favorite hobbies being its a combination of my two favorite things, electronics and engines..... The hardest part up to now has been finding any information at all on where to start on all this. Or finding the "Old guy" that's willing to pass on the knowledge cause I know being "Self-taught" on all this is only going to get me so far. But its fun none the less. But the hints, help, and just any little bits of information that you throw our way is appreciated. This aint MHH, but sometimes that small nudge in the right direction is all you need to figure it out yourself.... seems to be working so far. :music_whistling_1:

So I do gotta thank you for everything you do with your product. Is definitely inspiring. :)