2018 6.7 C&C Tuning Issues

[Mitco39]

Hey guys,

I have a customer trying to flash his 2018 5500 Cummins. He grabbed the details via the OBD section of scan and tune and we did our thing and sent him a file for his ECM. However when trying to license the controller it would come back as no ignition ($549) but you can still pull the details from the ECM so it is seeing it. Not sure if this is because the ECM is returning 2018 details and the tune tool does not know how to handle it?

I never had issues with the 2017 doing the same thing last year.

Any ideas?

[GMPX]

Hi Mitch,

In these cases the only way we can see what might be going on is to get the trace files. If EFILive thinks the ignition is switched off then it sounds like the ECM doesn't respond to certain messages we send out (a trace will show that).

[Road]

2018 have the same controller? I heard they were introducing a new dual core processor in 2018.

[GMPX]

Well, that I don't know (it is possible something is coming) however we have the 2018 Tech Auth files are they are still CM2350B. ID, Checksums etc is all done just not mapping.

[Road]

Well, that I don't know (it is possible something is coming) however we have the 2018 Tech Auth files are they are still CM2350B. ID, Checksums etc is all done just not mapping.
Good to know we are able to support them. Thanks

[Mitco39]

Ill get a trace from the customer. In the mean time can you tell me if this OS is supported for read write?

CalID: 31321831AD
OS: 31180100
Data Software: 05150521AC
Boot: 0000000AA
Cal Verification: $58151937


Thanks

Mitch

[GMPX]

Mitch, that OS is supported for checksum corrections and flashing, but I have not mapped it yet. If you are doing your own thing then I would have thought you'd be ready to roll (we'll see what the trace says as to why it won't license).
The 2018 layouts were only added in late August so make sure you update to probably RC3 as a safe bet.
https://forum.efilive.com/showthread.php?27992-Sep-2017-Release-Candidate-3

[Mitco39]

Mitch, that OS is supported for checksum corrections and flashing, but I have not mapped it yet. If you are doing your own thing then I would have thought you'd be ready to roll (we'll see what the trace says as to why it won't license).
The 2018 layouts were only added in late August so make sure you update to probably RC3 as a safe bet.
https://forum.efilive.com/showthread.php?27992-Sep-2017-Release-Candidate-3

Yeah doing my own thing it just wont let it license to flash. Ill send traces tomorrow.

Thanks!

Mitch

[Mitco39]

This is what my customer found (who also works for chrysler).

Looks like the 2018s might only be bench flashable?

===========

Chrysler added a security gateway module this is the Description
NOTE: The Security Gateway (SGW) Module is located behind the radio (Refer to 08 - Electrical/8A - Audio and Video/RADIO/Removal) .

The SGW module is a Cyber Security hardware device to stop unwanted access and threats to the Controller Area Networks (CAN’s) for the vehicle. The gateway does not contain any drivers, and therefore does not directly operate or control any vehicle components.
The complexity of in‐vehicle networking has led to the development of a variety of bus standards and protocols that are specific to their application domains. The SGW module serves as the information bridge between these communication domains and the diagnostic scantool. Serving also as the vehicle’s central interface for diagnostics and OEM flashing, hardware security features prevent unauthorized network access.
and operation
The Security Gateway (SGW) module is located in the Controller Area Network (CAN) architecture between the Data Link Connector (DLC), Radio Receiver Module (RRM) and Star Connector for Powernet. The main function is to gate messages from one bus to another. It provides security against certain types of attacks and threats from the service tool or RRM bus to the vehicle. The module gates messages within the CAN-C bus, or the CAN-CH bus. The module contains up to eight dual wire CAN channels that comply with CAN-FD (the module does NOT support partial networking functionality). The module is a frame gateway, it does not provide signal gateway functionality. With the gating there are several criteria that must be met, that is to say the message must be on the allowed list from the source bus. The SGW module prevents threats to the bus systems through the DLC. A secure connection must be present to allow authentication between the SGW module and the diagnostic scantool. The SGW module will then allow the radio to turn ON via the system data bus.

[comnrailpwr]

Interesting. I wonder if the DLC under the hood bypasses this module. That may be the future of non bench flashing.

[SASDakota]

Until they remove the plug again like they did in 06-07.

[GMPX]

Oh no, this gateway sounds pretty bad (I've heard GM are going to be rolling out something similar soon).
Our Tech Authority expired recently, best renew it and check this out. From what I can tell the ECM itself is still 'normal' and it must just be this module causing the problem so yes a bench flash might work.

[GMPX]

From Tech Authority...

The Security Gateway (SGW) module is located in the Controller Area Network (CAN) architecture between the Data Link Connector (DLC), Radio Receiver Module (RRM) and Star Connector for Powernet.
The main function is to gate messages from one bus to another. It provides security against certain types of attacks and threats from the service tool or RRM bus to the vehicle.
The module gates messages within the CAN-C bus, or the CAN-CH bus. The module contains up to eight dual wire CAN channels that comply with CAN-FD (the module does NOT support partial networking functionality).
The module is a frame gateway, it does not provide signal gateway functionality. With the gating there are several criteria that must be met, that is to say the message must be on the allowed list from the source bus.
The SGW module prevents threats to the bus systems through the DLC. A secure connection must be present to allow authentication between the SGW module and the diagnostic scantool.


That last sentence sounds like it might be a problem for 2018's going forward trying to program on the vehicle :bawl:

[comnrailpwr]

Oh boy. Do you ever think to yourself: man, my life was so much easier 5 years ago?

[GMPX]

About 10 times a day that thought crosses my mind, always another wave coming to sink you down again.

I'm not sure how we could ever get around this TBH, it would appear that the SGW is smart enough that it will let scantools get logging data, DTC's etc but it is going to block what they consider threats (like, reflashing messages). Of course unless you are Dodge and know the negotiations to get through. Anyone want to ship a brand new Ram to NZ for a year while we work on it :rolleyes:
Maybe there is a market for bypass connectors to the SGW (5 paper clips would probably work).

[SASDakota]

I forsee J1939 flashing becoming a thing, no?

[comnrailpwr]

I agree. OBD port flashing is on its way out unfortunately.

[GMPX]

Well as annoying as that might be it is at least a solution and still better than what some tuners have to deal with (search on late model Mercedes V8 tuning).
For workshops a CM2350B bench harness would also do the trick (I assume), the OS's aren't encrypted or anything nasty like that.

[BigCE]

For workshops a CM2350B bench harness would also do the trick (I assume), the OS's aren't encrypted or anything nasty like that.

I don't have a bench harness currently, I wonder if you take the 18' computer and put it in a 13-17 truck if that would allow you to flash it?

Any reason I shouldn't try this? I have the means to try this next week.

[GMPX]

I can't say for sure on that, sounds like a reasonable idea though. Not sure how the rest of the truck with go with a 2018 program in the ECM though.

[BigCE]

Yea I don't know. I probably won't even try to start it if it does work, because I imagine the security will go nuts.

I'll give it a go and report back.

[BigCE]

Update: I can Licence the computer but when I flash it it is failing right at the end of the flash. Error $0340 Download not accepted. Trying to flash a stock file.

21621

[GMPX]

Yeah, unless the digital signatures have been disabled (using a BullyDog, Fleece etc) you will only be able to flash stock files.
As the $0340 error code description says:

For Cummins controllers: Controller contains security to prevent modified tunes being programmed.

Cheers,
Ross

[BigCE]

Yes I know I am trying to flash an older Stock file so the BD can talk to it.

[BigCE]

Do you have any 2018 stock files that I an try so if this doesn't work I can at least go back to stock. I have 10-17 files only

[GMPX]

Do you know what was in it originally? 32370831AD etc
Yes I do have 2018 files.

[BigCE]

do you know what was in it originally? 32370831ad etc
yes i do have 2018 files.

31321831ad

[BigCE]

I've tried 15' 16' and 17' files all with no luck, they get right to the end and fail, as if you were flashing a modified file, but these are all bone stock. I am on the latest software and firmware.

[GMPX]

Close enough to get you going again....

[GMPX]

I've tried 15' 16' and 17' files all with no luck, they get right to the end and fail, as if you were flashing a modified file, but these are all bone stock. I am on the latest software and firmware.
Ah I see why, they've changed the signing key for the 2018's, only stock 2018 files will work on 2018's.

[BigCE]

"Script finished successfully" Yay now to figure out how to unlock this computer without a BD.

I cant open that file maybe I need a 7.5 update, is it a Asin file this is a 4500 C&C truck.

[GMPX]

They are not mapped yet, I only posted it so you could recover the ECM.

[GMPX]

I cant open that file maybe I need a 7.5 update, is it a Asin file this is a 4500 C&C truck.

You said it had
31321831AD
I posted...
31321831AC.ctz

My file was for the correct vehicle based on what you said, just one release earlier than what was in it.

[BigCE]

You said it had
31321831AD
I posted...
31321831AC.ctz

My file was for the correct vehicle based on what you said, just one release earlier than what was in it.

Thanks again for all the help. At least if we have to give up, the truck will still work.

Currently trying to figure out another way to "unlock" the computer, if anyone knows what software/tool can be used please pm me.

[2007 5.9]

Anything new on this Ross? Got a 2018 3500, are we able to flash a 13-17 file in to get the edge or bullydog to unlock?

[BigCE]

They will only take a 2018 file, until you unlock the RSA security. So the BD and Edge won't work.

[GMPX]

Contact Fleece Performance, they have unlocked a 2018 ECM (not using BD etc).
Cummins changed the digital signatures on the 2018 ECM too so the earlier tunes will not flash in even if they are stock, must be 2018+

Even when the 2018 ECM is unlocked the problem still exists of the Security Gateway module on the vehicle, bench programming once the ECM is unlocked is the only option at this stage.

Yes all this is a pain but it is the way things are heading for everything, it's not 2007 anymore :bawl:

[SASDakota]

Maybe a flash harness is in order. leave the PCM mounted but have a long flash cable to plug in. Saves a bunch of time.

[GMPX]

Yeah, I was thinking the exact same thing. Sure it adds more expense for the owner but at least it is a solution, better than owning a L5P :bawl:
I'll send the guys at EFI Connection a message because they already do a bench harness for the CM2350B so a slight tweaking of it could work for doing it on the vehicle.
https://www.eficonnection.com/home/product/cummins-cm2350b-ecm-programming-harness

[30 RUM]

Yeah, I was thinking the exact same thing. Sure it adds more expense for the owner but at least it is a solution, better than owning a L5P :bawl:
I'll send the guys at EFI Connection a message because they already do a bench harness for the CM2350B so a slight tweaking of it could work for doing it on the vehicle.
https://www.eficonnection.com/home/product/cummins-cm2350b-ecm-programming-harnessWhat about adding the cm2350b to the HD v2 and flash trough the back bone on the j1939 buss? No messing with the ecm connections (pia to get to).

Sent from my SM-G900V using Tapatalk

[GMPX]

J1939 bus still has digital signature verification on a flash, it gets around the OBD-II port security gateway but not the main issue.

[Mitco39]

I see MM3 and Ezy have 2018 flashing support, has there been any further advancement with you guys?

Thanks so much

Mitch

[cindy@efilive]

Hey Mitch,

11 new OS's were added in the November public release. http://www.efilive.com/latest/cat/download-efilive/post/november-2017-public-release

https://uploads.tapatalk-cdn.com/20171213/fb875d653ceb09cd112a41df5ee6abb7.jpg

Cheers
Cindy


Sent from my iPad using Tapatalk

[30 RUM]

Cindy, will you guys be offering a solution to turn off RSA with the HD V2 via the J1939 port for the 2018 CM2350B? I assume the 2018 RSA can only be turned off that way, similar to the 2013-2017 correct?

Thanks

Sam

[GMPX]

I see MM3 and Ezy have 2018 flashing support, has there been any further advancement with you guys?
We won't be able to flash through the OBD-II port because of the gateway module (not sure if they can). CSP OS's are also completed for the 2018's.


Cindy, will you guys be offering a solution to turn off RSA with the HD V2 via the J1939 port for the 2018 CM2350B?
At this stage it is not in the pipleline, I know it makes sense to given the HD V2 is talking J1939 but it really isn't a simple task.
Keep your ears open though because there is a better solution coming that does not involve J1939 (it is not our project), I just know of it and apparently it works just as good.

FYI, the 2018 ECM is a CM2350F, it is slightly different which is why even stock tunes from 2013 - 2017 will not flash in to them.

[30 RUM]

Thanks for the reply,

Will the CM2350F take a CM2350B file after the RSA has been switched off then? Flashing Via bench harness.

[Mitco39]

At this stage it is not in the pipleline, I know it makes sense to given the HD V2 is talking J1939 but it really isn't a simple task.
Keep your ears open though because there is a better solution coming that does not involve J1939 (it is not our project), I just know of it and apparently it works just as good.


21706

:mrgreen:

[GMPX]

Thanks for the reply,

Will the CM2350F take a CM2350B file after the RSA has been switched off then? Flashing Via bench harness.

I would say so, we've been testing the CSP operation of the 2018 in a 'B' ECM, but I don't know if there is subtle hardware differences that on a vehicle might be an issue.

[SASDakota]

Fantastic news guys!

[MobileProg]

Fantastic news guys!

CM2350F, because "why not" change the private key you sign files with on CM2350B one year before you move to CM2450. Sigh. Really odd choice considering the key has been static from 13-17. Who knows.

[GMPX]

Yes I agree but I was thinking to myself maybe they did this on purpose because there is some subtle hardware change internally and they want to make sure the 'B' files could not be flashed in to the 'F' ECM.

[Road]

I would say so, we've been testing the CSP operation of the 2018 in a 'B' ECM, but I don't know if there is subtle hardware differences that on a vehicle might be an issue.

Every time I flash a 2018 file into my "B" ecm I get a $340 error. RSA has been removed. Anything special needed to flash a 2018 into the "B" ecm?

[GMPX]

Mike, there might actually be some hardware differences stopping it working too. I don't think they would have gone to the trouble of new digital signatures that would ensure stock files couldn't be interchanged for no reason.
If the $340 is happening at the end of the flash then that does indicate that whatever checks the ECM is performing at the end of the flash are failing and it is rejecting the file.

[Road]

Mike, there might actually be some hardware differences stopping it working too. I don't think they would have gone to the trouble of new digital signatures that would ensure stock files couldn't be interchanged for no reason.
If the $340 is happening at the end of the flash then that does indicate that whatever checks the ECM is performing at the end of the flash are failing and it is rejecting the file.

It is failing at the end of the flash. Back to the drawing board. Man they made a mess out of the 2018 xcal's.....