hey guys if you've got one of these 2007
to 2010 delphi radios
it's got these middle buttons with the
lines on them for the channel selects
and it's got this big round button here
in the middle to turn it on and off and
do the volume and it has the word
locked up here in the left-hand corner
then stay tuned i'm going to show you
two different ways you can unlock this
radio
all right guys so this is the series
radio we're going to be looking at
today this is the one that came out
after the rds series radio
starting in 2005 or so this particular
one is pretty beat up with some peeling
on
paint on the buttons but we're here to
show you how to unlock it we'll show it
first
how to unlock it with a tech 2 and then
we'll show how to
open it up and access and reprogram the
actual eeprom on the circuit board
the only connector we're going to need
to use is the x1 connector
and i'll show you that too so first i'll
give you a real quick uh
shot of removing it from the vehicle
just so you can see if you need to know
how to actually pull one of these at the
salvage yard
let me show you that and then we'll get
started when you're at the salvage yard
and you're gonna pull one of these
radios
you're gonna need to pull this piece of
trim off and this piece of trim off so
that you can get this trim
around the radio so what i'd start doing
is pulling the piece that's on the
bottom off
like that and that'll allow you to be
able to come underneath
to get this piece it's just going to be
held in by these kind of same kind of
clips they're just super strong
they're going to sound like they're
breaking but they're not right they're
just these metal
wire type clips and similarly on this
side
we got the same kind of design
just got to get this guy
might come up from the top there you go
and again it's just these really strong
type metal clips in fact in these two
the clips came off right so
be wary for that you can pull them out
with a pair of pliers though but
this is a salvage yard vehicle so we're
not too concerned we're going to get
this piece of trim off here
same kind of thing
all right and then there's a
little connector here for the airbag but
you don't necessarily have to disconnect
that
what we're after here are these four
bolts that are seven millimeter
i'm going to take these off and then
we'll come back i'll show you how to
disconnect it
all right guys got the last one of these
seven millimeter bolts here
as soon as we get this last bolt out
then we'll be able to pull the radio out
and disconnect the harness
these bolts are kind of long
unfortunately
takes a bit to get them out
but they will eventually come out all
right
with that last bolt out of the way the
radio just comes out like that
and the back you got an antenna
connection that you just
kind of pull out kind of twist it let it
go like that
and then let's see if we get a good view
of this
then you've got this uh wiring harness
guy
and it's got two little clips on top
that you squeeze in you gotta squeeze
one for this one and then one for this
one
and again right on top here right you
just push down here
and you push down here and that'll get
the radio out and now you're done
all right the first thing i'm going to
show you is uh the bench top harness
that i put together from
the service manual for the a car series
chevrolet cobalt
pontiac g5 right both of these vehicles
are covered in this particular service
manual
and i'll show you the the different
pages i exerted out of this
and highlighted for what you need to do
if you're interested in putting
something together like this
kind of zoom in here a little bit all
right so let's start off with the data
link connector
so that we have a way of plugging our
scan tool in our tech 2.
we're going to need the low speed gm lan
serial data line
pin one we're going to need both grounds
on pins four and
five both ground for the tech two as
well as signal ground
to the equipment the modules will be
communicating to
we're gonna need to have pin six gm
high speed gm land data positive and pin
14 high speed um gm land serial data
negative so
positive and negative on both those
lines and then finally pin 16
which will be battery positive voltage
so voltage grounds
plus and minus on the high speed gm lan
and then a single pin
on the low speed serial port and then
we'll also need for the radio um
connector
x1 we're going to need to just have
pin one battery positive voltage
right here and then we're gonna need to
have on this same connector pin eight
which is ground and pin nine which is
low speed
serial communication so just those three
lines we don't need anything
from connector x2 the next thing that
we're going to take
is from the body control module and
we're going to take from the body
control modules x1 connector
we're interested in pin 18 which is
where the low speed gm land serial data
comes in
we're going to need on that same bcm x1
connector we're going to need
pin 36 which is another low speed
connection only if you have option ue1
on your vehicle right so this one i
think you could probably
uh characterize as an optional
connection for this
procedure then we're going to want the
ground on pin 61.
here's a couple more optionals on 62
under
battery positive voltage if you do not
have option
lnf these options you know are back in
the trunk of your vehicle
on the driver's side rear when you lift
up the carpet you'll be able to see
a little sticker with all these three
letter codes pin 64 is the associated
ground if you do not have
option lnf if you do have it like in the
vehicle i'm simulating here then you
know there's nothing here to take
and then on um connector x2
of the body control module we want to
have the positive and
the two positives for high speed gm land
serial data so there's
there's redundancy here and that on the
same circuit
there are two distinct lines with two
different colors serving the same
circuit so we'll take both of those
just uh because we don't know which one
may be used by the tech 2 in its
communication
in the path to the bcm similarly we have
these two pins
here which is pins 19 and 20
and those are the negatives for the high
speed serial data
and then we have pin 28
down here i'm sorry 38 38 which is our
low speed serial data and that is all we
need here nothing else from
x2 and we don't need anything here
on this section from x3 on this page but
we do need something on the next page
from connector x3 so on connector x3
we're going to take the b3 cavity for
battery positive voltage to the body
control module
and then b5 accessory voltage accessory
voltage is critical
for the radio because this is where the
power for the radio is going to come
from
uh cavity d1 is another battery positive
voltage cavity d4 is another
battery positive voltage now you know if
you did the leg work and trace down the
circuit diagram
all these different circuit numbers you
may find that you don't need all these
but in my case i just it's just faster
just to wire them all up
for what i'm trying to do ignition
voltages
on cavity d7 d10 and
a couple more so d10 and d12 are a
couple more battery positive
voltage connections and then you're on
body control module
x4 same kind of thing you see right
we're grabbing battery positive voltages
oh this is another one that's associated
with a particular option on the vehicle
uq3
so you may or may not have that c1
is a battery positive voltage all the
way around c8 is another accessory
voltage
d1 is another battery voltage d4 is an
ignition three voltage so
one of the voltage lines when the key is
in the
ignition run position even if the engine
is not started
and then on this other page of x4 we
have here d10
is another battery positive voltage e6
is another ignition voltage
12 is a ground f1 is another battery
positive
four is ignition one five is ignition
six is ignition and nine is ignition
and that is it that gets you all the
wiring
so this out a little bit and you get
this right so this
is um a body control module
for these a body cars from 2005
to 2010 chevrolet cobalts pontiac g5s
find it on the passenger side on the
lower
front side of the center console but on
the passenger side
access and this is where your fuses and
relays
are on the interior on those vehicles
and we end up bringing all this
stuff we talked about out to where we
have
all of the positives battery positive
voltages here
we've got all of the ignitions here
we've got a switch to simulate
turning the key into the run position
that makes
contact between those ignitions and the
battery positive voltages
we've got our connector for the radio
with our positive our low speed
and our two high speeds uh connections
as well as our ground
we've got our diagnostic or data link
connector for the scan tool
similarly with high and low speed serial
connections as well as grounds and power
and we've got all of those low speed
greens
connected up we've got our high speed
tans and browns
connected up and then we've got our
accessory voltage
connected up and and brought into uh
battery positive so that all we got to
do is
hook up our our bench power supply
and and show this thing in operation so
that's what i'm going to do now if i
just kind of pull the radio over here
and i bring into view here i'm going to
hook up
a positive line from a 12 volt bench
power supply
and then i'm going to bring over a
ground line from that same
bench power supply put that over here
so now we've got ground we've got power
come over here we're going to hook up
the radio into the x1 connector and what
i've done is i've clipped
off these latches just to make it easy
to
unplug and and plug in the radios as you
go around right so you don't have to
deal with having to do the squeeze and
get the latch to let go
and now if i just kind of rotate this
guy around
because we're going to be interested in
looking at the radio itself
rather than the body control module we
need the body control module because we
got to have some way
of communicating with the vehicle's
modules and in this case with the radio
and with all that set up
if i turn on the bench power supply
you can kind of hear the radio cd motor
whirring there
and i turn our little um
ignition switch excuse me ignition
switch simulator and i come down here
and i hit the power
our radio is working right so we can
tune the channels
we can come over here and change the
bands
of course i don't have any speakers or
antenna hooked up to it but you guys get
the idea
all that stuff is working can turn it
off it's all fine
if i turn this power supply off and i
come and grab
a radio that is not associated or
learned with the vin of this particular
body control module and i plug that
radio
in
and what we expect to see if we do the
same exact thing
power it on get our ignition into the on
position
we can bring this guy up into view he's
locked
and that's exactly what we would expect
right because the body control module
is the one that's doing the handshake
with the radio
and making the determination of whether
this guy is
going to be allowed to be used or not or
whether he's locked so let's go through
with the tech 2 scan tool how to unlock
that all right guys the setup i've got
is i've got
the dlc connector hooked up with the
cable that we use for the tech 2
and for this particular type of
generation the tech 2's candy module
which is to give it a translation
interface to the higher speed
communication than the early
90s type vehicles had we're going to go
ahead and power on the tech
and then while it's getting fired up
here we're going to set this camera
back up here in front of the radio
and then i'm just going to walk you guys
through how you do this with the tech 2.
so the whole procedure here is built
into the tech 2. you don't need any
extra special software here
so if i come into the tech 2 and i build
the vehicle
diagnostics this came out of a 2009
passenger car chevrolet it's an a body
style
we're going to go into the body section
and you're going to hear the candy
module over here in the background
clicking doing its kind of thing
you have this light flashing that's
normal for this guy
it's going to tell you that the onstar
vcam is not responding we don't have one
on this setup you might not even have
one your vehicle that's going to be
normal if that's the case
now this is not a barn burner on
communications right we're going from
this really
slower type of communication that the
tech 2 does to the newer kind of
vehicles
and so there is a delay in going through
one of these candy modules so we're
going to come down in the body section
and we're going to come down to the
radio
and then we're going to come all the way
down to module setup so this is a bit
different than earlier years like 2003
2004 maybe maybe even you know
earlier than 2003 so this is what it
started to look like for these vehicles
it's going to go into module setup
then relearn just watch the locked over
there on the radio so i'm going to come
in
it's going to communicate ask me do i
want to clear the theft information
now what you got here on the bottom i'll
make sure this is showing through here
you got a little button here of course
you got to hit your soft button on your
tech 2 to begin clearing
cycle the ignition so this is why it's
very important to have this kind of
switch that we did so we're going to
come up here and
cycle the ignition we're going to turn
it off
i'm going to turn it back on and it is
now cleared so now if we come over here
and we turn the radio on
we've got a cd we can go to our band
information
change bands am fm whatever we want to
do everything's
good to go so if you have a tech 2
or if you have you don't have a tech 2
and you have an
mdi or another j2534 type scan tool
with acdelco tds and a tech to win
simulator you can also do what i just
did but what if you don't have any of
these scan tools
well let's go do the next method i'm
going to open this guy up i'm going to
show you how to edit the eprom directly
all right guys this particular radio
that we're going to take apart here
is a delphi and it's a gm
258 34576
this is a radio from a 2009 cobalt
it's got the auxiliary input and again
it's got this uh you know kind of
distinctive design
with the selection buttons and the power
on button in the middle so
this uh is going to be a radio that you
know the design may vary from year to
year
so that's why i'm calling that out to
get the uh disassembly going we're going
to take the front faceplate off
and to do that we're going to remove
these two bolts on either side
of that faceplate this is four bolts
total
and i'm going to be taking these off
with a
3 16 english although you probably could
get away with a
four and a half millimeter if you had a
fractional one like that
but i don't so i'm just going to use
3 16 here
take this both of them off either side
that one got kind of stuck on me
and then after we take these two guys
off we're going to
release these clips that we see at the
top and the bottom
there are two on the top and two on the
bottom
and then this face plate kind of press
fits
into a uh it's got a male
end on it that press fits onto a female
end it's on the circuit board
all right so to get these clips off
what i'm going to do is i'm going to use
a small metal
spatula type tool to get under here so
that we don't
damage this clip get it off of its
tab and then once i've got it off its
tab i'm just going to wedge
like one of these guitar pick type of
spudger tools in there
you can use a putty knife if you've got
it
accomplish the same thing i think
all right so at that point i've got
these two tabs disengaged
i can flip this guy over
on the top part do the same thing
got that one off
and that got one that went off so then
you get that point
it just comes right off and here's the
male connector i was referring to
and then here's the female connector on
the circuit board
all right so with the face plate off and
out of the way
the next thing we've got is a few more
of these bolts we've got one
on either side right here
there's one right here in the middle of
this heat sink
it's associated with just one side of
the radio
and then there's going to be on this
particular model
four in the back one here
one here uh one here and one here
and when we get these four out we'll be
able to
lift off and remove
this top cover
the goal of this exercise is not to drop
any screws
on the floor or they'll probably
disappear
all right got this guy and then we got
one more
and then we'll be able to do the top
cover removal
and reveal the circuit board inside the
unit
okay all right so with all those
fasteners removed
just kind of lift up on this guy and at
the top
area it's curved in so
lift up and out and you can see you got
these curved tabs that are retaining it
in the front
and then the next obstruction in your
way will be the cd player
that's held on by one bolt here
and then in the front there are two
bolts here
and here so i'd recommend you take the
back one off first because it's going to
be held on by this little bracket
to a certain extent and then
keeping it laying in this direction
remove the two in the front
when you get ready to remove the second
one just kind of want to hold off a
little bit because
you don't want to have this thing drop
on the board so reach inside
kind of secure the drive with your hand
as you remove the last screw
and once you do that you can pick up on
it
and it'll be connected to the board
with a ribbon cable we see like this
this side of the ribbon cable is going
to be white
if we turn it around look at the other
side
hopefully guys you can see that it's
kind of important for the reassembly
this side is blue now this is just a
just presses in here so you can just
remove it main thing is to remember that
the blue
end is going to be facing the passenger
side
so you know if we look at the front of
the radio driver's side
is over here passenger sides over here
we want this blue one facing towards the
passenger side so you can remove the cd
player assembly out of the way at this
point
we've got the board inside the radio
here
and i'm going to actually use this
orientation here
so the particular chip we're after
all right guys just had to uh get a
better bearing on what i'm going to be
showing you
zoom in a little bit here and i wanted
to grab a flashlight to
kind of light up this board so that we
can uh
see what all we've got here so on this
particular board there are a
number of chips that look like they
might be the ones
that we're interested in that look like
they might be an eprom i'm going to
kind of point these out to you this guy
back here
is not the one we're interested in this
is a op-amp
this guy here is not the one we're
interested in this is a
power switch and this guy
over here is not the one that we're
interested in either
that's a that's a mosfet there's another
power switch over here
it turns out that of all of these
devices there's one
two three four five
in this eight pin soic type package but
it's actually this guy back here
is the one that we're interested in
see if i can get that into a clear view
here
right so this guy right here
is the actual eprompt ship that we're
interested in
and we'll zoom on him and get a little
bit better picture of him here in a
minute
now while i'm in here and looking at all
these trying to figure out which one is
the eeprom
you know sometimes this happens that you
find out there's some other problems and
i actually noticed this guy over here
i know if you guys can see but you
notice we only see we see the four pins
over here
we only see three pins over here this
pin up here is not missing
it's just very badly corroded so while
we're in here we're going to have to do
some little bit of a repair work too so
let me show you those two and show you
the markings on the eeprom so you'll be
able to identify it yourself very easily
all right guys here's a view under the
microscope apologize it's upside down
but that's
how i have to get fit in the microscope
area with this board still being in the
casing but you can see there's this
delphi house number
now reading it upside down it's zero
nine four zero
zero four six four and this is the
actual eprom we can see down here on the
bottom
that it's got a microchip logo on it so
this turns out to be a delphi
house brand of a 24c08eprom
now if we swing around i want to show
you that
one that we were mentioning that has
some damage on it that we're going to
have to go work on here
while we're in this area you can see
this guy
this is one of these power devices power
switch devices
and you can see what the problem is with
this guy is that pin one is just
badly corroded there's a lot of
something focused on this a little
better
there's a lot of um carbon
to be copper oxide that you can see
built up around these pins
maybe we can uh improve the lighting
here just a little bit so you can see
that detail
and so you can see so this is pretty
badly damaged so what i'm going to have
to do is clean up this oxidation
and reflow the solder on these three
pins while i'm in here
just to make sure we don't have any
problems with the radio after we unlock
it
just a lucky catch but you know whenever
i open these up i tend to
inspect everything in here if i see
anything else like that all right let's
move this over to the bench where we can
start working on the programming
all right guys here we've got the test
clip set up on that eeprom
there's a couple of ways you can do this
um you know once you
unlock the radio using the scan tool the
tech 2
you you you know you need to get it back
in a locked state to show this step so
you can either
load a previous eprom image and and
bring it back to where it was before you
ran the scan tool or just grab a second
radio
so i'm just showing a second radio i
have handy just to speed things up for
the video
so one thing i want to show you besides
the connection of the test clip
is this little barcode label up in the
top area here
we're going to get this flashlight out
of the way and i'm going to see if we
can zoom in on this
any further probably not might have to
hold it up
and what you want to look at here is
there's a there's a number on this
little label
if we can get it focused
you can see that label there that starts
with b520
that's the serial number of the
motherboard now i'm going to show you
why that's important here in just a
minute when we
look at what's on inside the eeprom the
other piece of data
that i'm going to show you is the top of
the radio cover
that came off this radio just kind of
pull this guy out a little bit
and the top of the radio cover we're
interested in taking a look at the
serial number of the radio
you see this number down here at the
bottom of this barcode that starts with
an 89wdb number
this is the serial number of the radio
itself so you know you've got the part
number of the radio
from delphi you've got the part number
of the radio from gm which is what you
usually are looking at when you're
trying to match up the radio
and again what i'm showing here is
particular to this delphi
made 4576 radio if you've got a
radio that looks like this but came out
of a panasonic
then you're going to probably have a
different experience and we just knocked
our little test clip off over here
just going to go reconnect him and that
was what i was trying to basically
highlight is when you have a test clip
you can have a situation where some
radios will let you do this kind of in
circuit reading
and some will not and you can see this
guy's crooked and
you know test clips in general are just
kind of finicky to begin with but
i get that in some cases it can be
faster than
you know removing the chip and
desoldering it all right let's take a
look at the screen
on the eeprom reader and by the way the
the type of
programmer i'm using here is just a very
inexpensive
simple one of these ch341a type
black edition programmers and i'll put a
link up in the
top right of the video because this is
one i've modified to do 5 volt
work for automotive all right so let's
just take a look at the screen
itself and then we'll take a close up
of what we see there all right so here
we are
hopefully this is uh yeah that looks
like it's readable for you guys so
here's a read
that we had from this ship to begin with
i'm just going to clear it out here
and show us re-reading that live just to
show the test clip is in the right
position
as you scroll down what you pull in from
this eprom
you see a couple of things i wanted to
draw your attention to so here you see
this 89 wdb
number so that's the serial number of
the radio
you know a lot of times people say hey
how come you can't just put a blank
eprom on here well you know all this
information
is is needed by the radio right so
there's um a bunch of
of obfuscated information in here
certainly channel presets and stuff like
that but there's also stuff the firmware
wants to know so there's the radio
serial number and you come all the way
down near here the bottom
and there's two other numbers there are
actually three other numbers
here's our 89 wdb number again which is
the um
you know the serial number we we read
off the radio earlier and again just for
reference right that's this guy down
here right so this
920 430 number
that we see uh right here 9 24 30 is the
last few digits of that serial number
and then we see this b520
830 number well that was the serial
number of the circuit board
that we saw earlier the vin is actually
located right here this is the donor
cars vin
the last six digits of it 286 187
this digit here is a checksum on that
vin
and this digit here is always a v you
can think of it like v
for vin on these particular series
radios
now fortunately this checksum is only
used by the scan tool
in my experience so you don't have to
worry about recalculating that i have no
idea what the algorithm is
for recalculating that if you used to
work at delphi and you know what that is
feel free to leave a comment below but
all we really need to do to change
this from a lot to an unlocked state is
to change
these six digits here now before i do
that like a best practice
is let's save this image that we've read
from this eprom
because if anything goes wrong we want
to get back
to where we were
we can just call it whatever we want and
kind of save it down here
and then if something goes wrong or we
make a mistake or we did the wrong
number and
whatever what have you and we want to
get back that way we can just read that
file in
and and re-flash that eprom to exactly
where we started
so i'm gonna go um dig up the vin
for this because i lost where i wrote it
down and we'll come back but i'll plug
that vent in here and that's how we'll
go show it unlocked
all right guys sorry about that i
misplaced that and i
finally found it it's uh the vin we want
to put in here and all you gotta do is
write this over
it's two four six
four four four now again
i don't have a way to calculate that
checksum but like i'm telling you you
don't have to worry about it now we're
going to come in here
and we're going to program the eprom
with this vin change
and then just to make sure that it took
i'm going to clear the buffer and read
it back
scroll down here we see that our new vin
is 246 444
all right so now what we're going to do
is we're going to
come back over to the bench now
and we're going to re-hook this radio
back up to our bcm
and we're going to verify that it's
unlocked
now to do that what i'd recommend you do
is go ahead and hook the face plate back
on
so you can obviously see some
interactivity
you can snap that on without having to
reassemble everything
just got to get it lined up just right
before it
snap back into position
and then i'm going to just off camera
here i'm just
getting our leads back into
view for our bcm
hook this back up to the back of the
radio
and then we'll power it up all right
i'm gonna move this guy over just a
little bit
all right so all we've got the same
setup we had before right we've still
got our
our switch here i'm gonna turn it and
leave it on right when we power it up
we've got a ground so we've got our
power we're going to go ahead
and power up this guy
and what we're going to find
we can maneuver this around
is our radio is not locked now just in
case you think it's kind of scammy
we're going to come back over here and
all i'm going to do is
plug the prompt programmer back in
and i'm going to load our saved file
and what i'm going to do now is i'm
going to program it back
to the locked state that we had before
and just to you know save
you know bouncing around with the camera
uh you know i'm not going to flip it
back and forth i'm just trying to find
where that file went
that we saved before
all right there it is guys jesus this
file it's like there's just so many
files here it took me
a moment to locate the one we wanted
here
and now we're going to write that file
i'm just checking to make sure that we
have the
same one we have now you notice i did
not even power this
off all i did was i loaded up the
old file and i rewrote it and i'm just
waiting a moment
and then if i wait long enough because
the bcm and the radio are always talking
you can see here that the radio is
locked again
right because it's going to periodically
check that kind of stuff you know our
test clip came back off again but
that shows you that you know it
periodically checks this so even without
powering anything off
just changing that is enough to rewrite
excuse me is enough to trigger the bcm
to say hey you know um
you got the wrong vin again man so uh
you need to lock yourself and that's
exactly what the radio
does in that situation so let me move
some of this stuff out of the way and
i'll tell you a few more attributes
about this and then we'll wrap it up
all right guys i decided to give you
another view of this so that you can see
it
kind of going live here right so we've
got the radio up
and she's locked i'm going to come over
here and i'm going to one more time what
i've done is i've reloaded the saved
image we did
just to kind of show it to you all live
here and then i'm going to rewrite this
vin
to 2 4 6
4 4 4 which is the one
that is for the correct bcm
and i'm going to write that to the eprom
and as soon as i write that to the eprom
you notice that
it picks it up right so if i was to
power this guy off
and power him back on
he stays unlocked however if i come over
here
and i pull up my old file
which has the vin number of
2 86187 and i write that instead
that doesn't take but a few seconds
before the bcm figures out
that's not the right guy and he locks it
so you know we can kind of come
repeat this kind of step over and over
again it's very solid and very reliable
now when you're doing it actually in the
vehicle
i would recommend that of course that
you do a key on
key off type sequence to make sure it
takes
but this definitely shows you that it
unlocks just fine
and you don't need to worry about that
checksum if you're doing it this way
now if you go back and run a scan tool
later it'll of course change that
checksum and put something in there and
that's okay
it won't be confused by any of this so a
later date
you do get a scan tool and you want to
rerun the vin relearn
that's fine so i hope this helps you out
on how to handle unlocking
these 2007 and up to around 2010
2007 to 2010 radios just remember like
the test clip situation
uh like i said uh this works on this
delphi model
it might not on a panasonic these test
clips are a pita anyway they pop off
they don't stay on there that well
i like a pogo pin adapter when i'm doing
this but i can't while i'm filming it
just desoldering it is usually the
easiest way and pop it into an adapter
that way
okay if you got questions just go ahead
and leave a comment below i'll try to
help you out
if you found this useful please take a
moment to hit that like button
helps this video get found by others
otherwise consider subscribing and
thanks for watching