2017 Duramax

[GMC-2002-Dmax]

Guys, there is no encryption on these ECM's, lets get the terminology correct.
There is a password on the 'back door' as it was put (and sorry, it is 64 bit, not 128), but either way you ain't getting in unless you know it. This is the password that protects the ECM from being opened up and the flash dumped out using JTAG tools (Google PowerPC censorship password).
The flash segments again are not encrypted in any way, they just have a SHA-256 signature included that nobody other than GM can calculate with their private key that must be sent and validated during the OBD-II flash.
So yes doors are closed and the keys broken off in the lock, nothing to see here folks please move on to your nearest Dodge or FORD dealership.

2017 FORD is in need of a locksmith as well it seems.

[DURAtotheMAX]

Its one ECM, I am not sure there is any difference other than the harness and the code, I am waiting to get one, even if its just for testing on my 2012 LML.

I highly HIGHLY doubt it will work in a factory truck. Im sure its strictly for standalone applications.

Which would still be nice...because as of right now, its impossible to make an LML run in standalone without keeping the BCM, TDM, and original ignition key. So this aftermarket ECU would give engine swap guys a nice alternative to a complex standalone harness that has additional wiring for the BCM etc.

[GMPX]

2017 FORD is in need of a locksmith as well it seems.

Oh dear.
I don't think it is in any of this generation EDC17 ECM's but I had read last year about the new Bosch ECM's that were coming out that did have on the fly decryption meaning everything stored in the ECM is gobbledygook unless you know the private decryption Key (there's that private key thing again). That is even one step beyond what we are dealing with today.
Out of interest, read page 6 of the pdf in the link below, this explains exactly what GM have implemented in the E41.
http://www.nxp.com/assets/documents/...SECURITYWP.pdf

I highly HIGHLY doubt it will work in a factory truck. Im sure its strictly for standalone applications.

Which would still be nice...because as of right now, its impossible to make an LML run in standalone without keeping the BCM, TDM, and original ignition key. So this aftermarket ECU would give engine swap guys a nice alternative to a complex standalone harness that has additional wiring for the BCM etc.

I would say it'll be like many of GM's late model gas ECM's where there is no specific theft disable calibration, we have to patch the OS in those to make them run standalone. Unfortunately (here we go again) the LML OS sections are protected with a digital signature.

[GMC-2002-Dmax]

Reading that made my head hurt !!

[DURAtotheMAX]

I wonder if there are any vulnerabilities via the secondary CAN controller.

[GMPX]

I wonder if there are any vulnerabilities via the secondary CAN controller.

I can't see how that would be possible, once the ECM is put in to programming mode it would not be listening to any other modules on the bus.

[sn00py]

Oh dear.
I don't think it is in any of this generation EDC17 ECM's but I had read last year about the new Bosch ECM's that were coming out that did have on the fly decryption meaning everything stored in the ECM is gobbledygook unless you know the private decryption Key (there's that private key thing again). That is even one step beyond what we are dealing with today.

That's probably less about keeping the aftermarket out (I mean, the signatures is enough, right?) and more about keeping researchers from discovering diesel defeat devices. ;-)

[LB72004]

Very unlikely. The researchers didn't need to examine the VW code to see something was wrong. Also a court order can force GM to reveal the emmision strategy/code if the epa/carb had enough to show something was not right.

[sn00py]

Very unlikely. The researchers didn't need to examine the VW code to see something was wrong. Also a court order can force GM to reveal the emmision strategy/code if the epa/carb had enough to show something was not right.

One can't deny that researchers could have (maybe not quite so easily) reversed engineered the ECU code to find the defeat device code, right? If the code is encrypted, however, reverse engineering is a much less feasible (likely impossible, as Ross said) option.

[GMPX]

If the code is encrypted, however, reverse engineering is a much less feasible (likely impossible, as Ross said) option.

The code is not encrypted so they aren't trying to hide anything, it's just digitally signed to stop people modifying it.