1994 - 1999 GM Delco THEFTLOCK Radio LOC How to Unlock Code using Arduino & TMS370 (Chevy & GMC)

In this video I'm going to show you how the original Delco Electronics Theftlock worked so that a GM radio from the 1994 - 1999 era that show LOC or INOP on the display can be unlocked using the code stored inside its memory. We will learn how to obtain the unlock code for these Theftlock radios off its TMS370 PLCC chip using a sketch and shield for an Arduino Pro Mini. For a time GM disconnected the phone number for the dealer radio unlock code service 1-800-537-5140 that you called with the dealer code 106010 and your scrambled backup code for decoding. It may go away forever, so here's how the Theftlock unlock codes are stored.

The first generation of these Delco radios ran from 1994 - 1999 and used a communications bus that was proprietary to GM known as the Entertainment and Comfort bus, or E&C bus for short. There are no commercial tools for decoding the E&C bus protocol, though at one time Delco collaborated with CSI Electronics to produce the SAINT gateway E&C decoder. Today, the most economical tool is an Arduino. Delco changed to a different circuit board design in 2000 - 2002 that did not use the same TMS370 chip, so while those radios still use Theftlock technology this videos Arduino approach is not applicable to them.

I will go over radio disassembly and how to desolder & remove the Texas Instruments TMS370 microcontroller from the circuit board, extract its memory contents using a UPA-USB programmer with the TMS370 PLCC-68 adapter, and then how to analyze that memory dump contents. Finally I will show how to use the knowledge gained from analyzing the TMS370 memory dump, coupled with the Tech2 radio diagnostics, to reverse engineer how the Tech2 communicates with the radio and obtain both the user and master unlock codes over the E&C bus using an Arduino Pro Mini setup. And how to wire it up on a work bench!

TI TMS370C056 datasheet: https://media.digikey.com/pdf/Data%20...

The eBay and Amazon search links below are paid links, for which I may be compensated and earn a commission, if you choose to buy the parts and tools shown in this video thru them:

ChipQuik SMD1: https://ebay.us/mDb0IX or https://amzn.to/36HxooV

If you're looking to buy a GM Tech2 scan tool: https://ebay.us/jOvabX

USB UPA programmer to read a TMS370: https://ebay.us/LkMjRp or https://amzn.to/3oa6dKM

If you're interested in the tablet oscilloscope: https://ebay.us/LoGgeJ and https://amzn.to/3pAhCTJ

5V/16Mhz Arduino Pro Mini for the shield & sketch used: https://ebay.us/xWsnIu and https://amzn.to/2Yoru7c

And you'll need an FTDI serial adapter for the Arduino Pro Mini to program the sketch: https://ebay.us/BwBfu6 and https://amzn.to/3jaSVep

Data decoding examples (must be 16-bit so trailing 0s are appended if discarded by E&C)
1 10 101001 00100110 001001 1
1 10 101001 10100110 00101101 0 These two are LSB 0010110100100100, or 0x9396

1 10 101001 00000100 10 0
1 10 101001 10000100 10 1 These two are LSB 1000000010000000, or 0x0257

1 10 101001 10101100 011010 1
1 10 101001 01101100 100101 1 These two are LSB 1001010001101000, or 0x1629

1 10 101001 10101100 100010 0
1 10 101001 01101100 100010 0 These two are LSB 1000100010001000, or 0x1111

GM E&C Bus Technical Information
Arduino shield open hardware design: https://oshpark.com/shared_projects/L...
E&C bus background and theory: https://stuartschmitt.com/e_and_c_bus/
Arduino Sketch Github repo: https://github.com/svschmitt/EC-PCB/
GM PIC4696E phone number disconnected: https://static.nhtsa.gov/odi/tsbs/201...

And if I've saved you some $$ here, consider some coins for the coffee tip-jar! https://ko-fi.com/drshock

1994 1995 1996 1997 1998 1999

Chapters
0:00 - Problem overview
4:30 - Radio disassembly
7:05 - TMS370 chip removal
17:01 - Reading the TMS370 chip contents
21:00 - TMS370 architecture
23:01 - Radio bench setup
23:54 - Gathering data with Tech2
27:59 - TMS370 data encoding schemes
31:39 - TMS270 memory dump analysis
34:18 - Customer unlock code location
34:52 - Money shot
37:00 - Unlock code verification
38:22 - Analyzing the E&C bus
45:11 - Snooping the Tech2 E&C bus messages
51:14 - Combining all we've learned

#drshock #chevytrucks #arduinoprojects

Disclaimer: DrShock, the alias for the human content creator for this YouTube channel, is not responsible for any damages, injuries, losses, or liabilities associated with any repairs, upgrades, or maintenance performed on yours, or any other, vehicle whatsoever. No warranty, express or implied, is made as to the accuracy or completeness of any information provided within this channel. Viewing and using the “as-is" information of this channel is totally at your own risk. Always wear personal protection equipment and follow appropriate vehicle manufacturer service manual guidelines with original manufacturer parts only when performing any repairs, upgrades, or maintenance upon any vehicle.