Chevy Bolt EV Forum banner

1 - 12 of 12 Posts

·
Registered
Joined
·
19 Posts
Discussion Starter #1
Anyone have the ECU pinout for the Chevy Bolt EV?
Want to start a potential "project" with the Bolt EV ECU and looking for any existing pinout knowledge ;-)

Thanks!
 

·
Registered
Joined
·
230 Posts
Anyone have the ECU pinout for the Chevy Bolt EV?
Want to start a potential "project" with the Bolt EV ECU and looking for any existing pinout knowledge ;-)

Thanks!
I'll try and dig up my service manual, although these days, the system is so distributed I'm not even sure if there is a "master" ECU any more? I'll have to check tonight. Side note, there's a source of (probably not the most legit in terms of copyright) PDF service manuals on eBay for $25. They appear to be a PDF rip of GM's subscription service manual. So far only available for 2017-2019 - 2020s have at least some noticeable wiring changes (secondary diagnostic connector is missing, and also another thread indicated the radio unit itself has different connectors) compared to older vehicles.

What sort of idea do you have in mind? I'm slowly progressing towards an OnStar replacement, but that requires access to the "isolated" GMLAN buses, which means splicing wires on the "dirty" side of the SDGM or building a breakout/adapter harness that plugs into the SDGM, the OnStar module itself, the radio, or maybe the DIC controller.
 

·
Registered
Joined
·
19 Posts
Discussion Starter #3
Mostly just fact-finding at the moment.
I've been keeping my eye out for the main ECU (there does seem to be a "main unit" 24293043, and then a bunch of subsystems on the canbus network).
Been scouting eBay to try and get one, and get it running out of a vehicle to probe around on.... the going rate of $120 though is a bit too rich for me at the moment.

I also have a potential OnStar replacement in the works. Tired of the GM run-around on OnStar.
Initially going with a Asus Tinkerboard (just what I had laying around, ESP32 would be better a less overboard) + hologram.io Cellular connection.
Hooking up to the OBD2 port via a low profile extender and a "cheapo USB to OBD2" adapter.

I'd like to base everything on a cheap BLE OBD2 adapter + a USB Bluetooth dongle, but they are way too insecure to "leave plugged in".

I have a VXDiag which offers GMLAN access.. but with the encryption i'm not sure it'll be worth much.
 

·
Registered
Joined
·
230 Posts
Mostly just fact-finding at the moment.
I've been keeping my eye out for the main ECU (there does seem to be a "main unit" 24293043, and then a bunch of subsystems on the canbus network).
Been scouting eBay to try and get one, and get it running out of a vehicle to probe around on.... the going rate of $120 though is a bit too rich for me at the moment.

I also have a potential OnStar replacement in the works. Tired of the GM run-around on OnStar.
Initially going with a Asus Tinkerboard (just what I had laying around, ESP32 would be better a less overboard) + hologram.io Cellular connection.
Hooking up to the OBD2 port via a low profile extender and a "cheapo USB to OBD2" adapter.

I'd like to base everything on a cheap BLE OBD2 adapter + a USB Bluetooth dongle, but they are way too insecure to "leave plugged in".

I have a VXDiag which offers GMLAN access.. but with the encryption i'm not sure it'll be worth much.
What encryption? Sequence numbers are NOT encryption. Firewalls that ensure that a message originates on the correct bus are NOT encryption. Simply not understanding what the meaning of fields is NOT encryption. I've looked at messages on the bus, and have yet to see anything that even hints at any encryption (at least not during normal operation, flashing firmware is likely a whole other ballgame, since almost surely GM is enforcing code signature verification. They definitely are enforcing certificate validation for their SSL update requests.)

I keep seeing people say "encryption" without providing a single example anywhere of data or messages that are actually encrypted.

As far as replacing onStart, you will not succeed if your goal is to use the OBD connector on the vehicle. While it's on the "clean/privileged" side of the SDGM, in addition to making sure "privileged" messages don't originate from the "unprivileged" (infotainment/telematics isolated bus), it turns out the SDGM ensures that messages that normally originate from the "dirty/isolated" buses actually DID originate there.

Which means that messages that should originate on the "dirty" bus like an onStar wakeup or unlock message will be ignored if they are injected from the "clean" buses wired to the OBD port. At least on a 2020 - I verified this with a Macchina P1. I can cause all devices to wake up, but issuing a precondition or unlock command on the "clean" buses gets ignored. It's definitely the correctt command, since the SDGM will relay it between buses and you can see it in captures - it just gets ignored if it originates on the wrong side. Replacing onStar will require splicing into wiring on the "dirty" side of the SDGM, or whipping up a breakout/passthrough cable for one of the connectors to the SDGM, the OnStar module, the radio, or maybe the DIC.
 

·
Registered
Joined
·
19 Posts
Discussion Starter #5 (Edited)
What encryption? Sequence numbers are NOT encryption.

I've looked at messages on the bus, and have yet to see anything that even hints at any encryption (at least not during normal operation, fashing firmware is likely a whole other ballgame, since almost surely GM is enforcing code signature verification. They definitely are enforcing certificate validation for their SSL update requests.)
Extensive documentation on GMLAN isn't readily available (old articles like this one exist, but really don't dig into the canbus vs GMLAN). Haven't seen pretty much anything out there on the security gateway besides general forum chatter. That's likely where mis-information is coming from.

You should document it if you've been looking at it.

As far as replacing onStart, you will not succeed if your goal is to use the OBD connector on the vehicle.
My goal is broadcasting the easiest stuff like battery state of charge and other easily-obtainable canbus metrics. Never said I was trying to write to the bus to unlock doors or anything.
 

·
Registered
Joined
·
536 Posts
I also have a potential OnStar replacement in the works. Tired of the GM run-around on OnStar.
Initially going with a Asus Tinkerboard (just what I had laying around, ESP32 would be better a less overboard) + hologram.io Cellular connection.
As there is no OnStar available in Korea, 3rd party solution has filled in the void. There's a product called "ChevyTown MultiPack Connected" that provides much of the remote controlling of the car features over LTE connection. So not only is what you're trying to accomplish doable, it already exists in a certain form. I don't think the company that made it would share the technical details, though.
 

·
Registered
Joined
·
230 Posts
As there is no OnStar available in Korea, 3rd party solution has filled in the void. There's a product called "ChevyTown MultiPack Connected" that provides much of the remote controlling of the car features over LTE connection. So not only is what you're trying to accomplish doable, it already exists in a certain form. I don't think the company that made it would share the technical details, though.
The pictures in that link looks like a Volt, not a Bolt - and that predates the SDGM. (Supposedly the latest Volts may have an SDGM, but older ones don't.)

Plenty of info on doing this on the Volt - your trip down the rabbit hole to Wonderland starts here - https://www.reddit.com/r/volt/comments/ap17sc
The commands found by digging through that documentation are seen on the bus with a Bolt, but when sent from the OBD connector, the wakeup commands to get devices to start squawking on the bus work, but the actual OnStar commands (unlock, precondition, etc) are ignored. I'm 90% certain this is because they're on the wrong side of the SDGM. For the SDGM wiring - see your friendly service manual. There was a recent thread on OpenPilot and other Bolt hacking, someone posted there that you can find service manuals in PDF form on eBay for $25. These are probably less-than-legit copyright-wise as they appear to be PDF prints/rips of the subscription web-based service manual, and they aren't available for MY2020 Bolts yet, but at $25 - I was willing to risk it for 2017-2019.

It isn't impossible on the Bolt - I'm 95% certain that if you get on the correct side of the SDGM everything will work fine. But since neither of the "isolated/dirty" buses are wired to the OBD connector - it's a lot harder than just plugging into that connector.
 

·
Registered
Joined
·
536 Posts
The pictures in that link looks like a Volt, not a Bolt - and that predates the SDGM. (Supposedly the latest Volts may have an SDGM, but older ones don't.)
Just to clear things up, the post I linked is using Malibu as an example. There is a Bolt EV-specific version available but since the car isn't as popular there isn't a specific post about it. I know that some people in the Korean EV forum I go to have installed it in their Bolts. It apparently costs about US$130, by the way.
 

·
Registered
Joined
·
230 Posts
Just to clear things up, the post I linked is using Malibu as an example. There is a Bolt EV-specific version available but since the car isn't as popular there isn't a specific post about it. I know that some people in the Korean EV forum I go to have installed it in their Bolts. It apparently costs about US$130, by the way.
Ah. It looked like a dongle that plugged into an OBD plug for the vehicle shown.

Requiring installation would make sense for the Bolt - again, because the OBD port is firewalled from the buses you need to be on to replicate onStar functionality, so you need to splice into wiring behind the dash or install a passthrough/breakout cable between existing harnessing and an item behind the dash.
 

·
Registered
Joined
·
44 Posts
You just want the pin outs for P/N 24293043 aka "K20 Engine Control Module" that is in the engine compartment, mounted on top of the on board charging module? There are three connectors...

29698


29699
29700
 

·
Registered
Joined
·
19 Posts
Discussion Starter #11
Thanks scknogas :) Got it.
Do you mind asking what service manual you found this in? I signed up for the expensive "official" Chevy one and didn't find anything this awesomely detailed.

 

·
Registered
Joined
·
44 Posts
Thanks scknogas :) Got it.
Do you mind asking what service manual you found this in? I signed up for the expensive "official" Chevy one and didn't find anything this awesomely detailed.
Well, I won't say that there's a post about some on eBay.. :)
 
1 - 12 of 12 Posts
Top