Tech2 by HK — J2534 clean-room replacement

This project is an independent 32-bit implementation of the public SAE J2534-04.04 DLL interface used by the GM Tech2 pass-through adapter. It does not contain code from the legacy GM DLL.

Current state:

• all 14 legacy export names and ordinals are present;
• the public J2534 ABI, parameter validation, state management and error reporting are implemented;
• the GM registry configuration and Win32 COM-port setup are implemented;
• the verified Tech2 open/close, CAN/ISO15765 channel and raw-CAN message commands are isolated in the transport layer;
• an offline test mode exercises the DLL without hardware;
• raw 11-bit CAN transmit/receive, selective pass filters and a dedicated native serial receive worker with a 512-frame queue are implemented;
• the single-wire body-bus path uses raw CAN at 33.333 kbit/s and the captured SET_CONFIG(J1962_PINS, 0x0100) sequence to route CANdi to OBD pin 1;
• extended IDs and native ISO15765 message transfer remain incomplete pending dedicated hardware traces.

The physical open/close handshake, PassThruConnect/PassThruDisconnect for CAN and ISO15765 at 500 kbit/s, and raw-CAN filter/read/write operations have been verified against a real Tech2, CANdi and Trionic 8 ECU on COM5. The clean-room replacement read both the diagnostic address and the multi-frame VIN; its complete 329-byte VIN-test TX stream was byte-identical to the legacy DLL. The 33.333-kbit/s timing, pin-1 switch and selective body-bus filter sequence were also captured byte-for-byte from the legacy DLL. See docs/protocol_notes.md for the byte-level observations.

TrionicCANFlasher's T8 path is covered by physical upload and read regressions. A complete 1 MiB FLASH read was MD5-verified with the clean-room DLL. Its trace contained more than 100,000 consecutive CAN frames; sporadic missing CANdi transmit statuses were recovered by re-enabling the configured channel and resubmitting the exact read request. Version 0.5.26 moves serial reception into a native worker so CANdi statuses and ECU frames continue to be drained while the managed application is paused. A complete 42-block RAM-loader upload plus tail and entry-point invocation was physically verified, as was a 100-step FLASH-read regression with 1,764 consecutive frames and no recovery. A real serially lost consecutive frame still requires the application's safe whole- block retry because its seven payload bytes cannot be reconstructed. The default high serial rate remains 115200 baud; 230400 baud is experimental and was not stable with the tested CH340 adapter. Version 0.5.27 also avoids a blocking CH340 output-drain operation between T8 TransferData frames; a captured 5.7-second driver stall had otherwise made the ECU leave its programming session halfway through the RAM-loader upload.

Build

From a PowerShell prompt in this directory:

.\build.ps1

The script uses an installed or project-local portable Zig toolchain and emits:

• build\Tech2_by_HK.dll
• build\Tech2_32.dll (compatibility alias for fixed legacy filenames)
• build\smoke_test.exe
• build\hardware_probe.exe
• build\trionic8_read_probe.exe
• build\trionic8_block_probe.exe
• build\Tech2Config.exe (graphical COM-port selector)
• build\Tech2_32_trace.dll (diagnostic forwarding proxy)

If Zig is not already installed, the build script downloads the official portable Zig 0.15.2 archive into the ignored .tools directory and verifies its published SHA-256 hash before extraction.

Run the offline ABI test with:

.\build\smoke_test.exe .\build\Tech2_by_HK.dll

Separate J2534 registration

The legacy GM - Tech2 registry entry does not advertise the CAN capability, so applications such as TrionicCANFlasher omit it from their generic J2534 adapter list. After building, an elevated PowerShell can register the clean-room DLL as a separate device without modifying the GM entry:

.\register_cleanroom.ps1 -Port 5

At runtime the DLL reads the Tech2 by HK entry first, accepts the former Tech2 Clean-Room entry as a migration fallback, and finally falls back to the legacy GM - Tech2 entry. A serial port supplied through J2534 PassThruOpen (COM4, 4, or \\.\COM4) takes precedence over both registry and environment configuration; this lets applications use their own GUI port selector. When an application such as TrionicCANFlasher passes no name and the registered port is no longer present, the DLL can also use exactly one physically present USB or FTDI serial adapter. This covers USB CDC, CH34x, CP210x, Prolific and FTDI devices without tying the implementation to one chipset. With multiple matching adapters it reports the ambiguity and never chooses one at random. An explicit GUI/PassThruOpen port or TECH2J2534_PORT always wins.

For applications such as TrionicCANFlasher that call PassThruOpen(NULL), run build\Tech2Config.exe. It lists all currently present Windows serial ports, stores the selected port in the 32-bit Tech2 by HK J2534 registration, and can verify the exact CANFlasher-style Open/Version/Close path. The program requests elevation because the standard J2534 registration is machine-wide. On first start it migrates the former Tech2 Clean-Room registration to Tech2 by HK while preserving its COM-port and other settings. Close any other diagnostic application before using its connection test.

If Device Manager has already changed a port's PortName but Windows has not yet recreated its \\.\COMx DOS link, the DLL opens that exact selected port through the standard PnP COM-port device interface. Port changes therefore do not require unplugging and reconnecting the USB adapter.

Remove only this additional entry with:

.\register_cleanroom.ps1 -Remove

Diagnostic environment variables

• TECH2J2534_TEST_MODE=1 skips the physical COM port and enables deterministic offline API tests. Never use this setting with diagnostic software.
• TECH2J2534_PORT=<number> overrides the registry COM-port number.
• TECH2J2534_BAUD_LOW=<number> and TECH2J2534_BAUD_HIGH=<number> override the registry baud rates.

Safety

Initial hardware tests should be performed with the Tech2 on a bench setup, without an ECU programming operation and without a moving vehicle.

Capturing the legacy serial protocol

Tech2_32_trace.dll is a temporary diagnostic proxy, not part of the clean-room replacement. It forwards all J2534 calls to the legacy DLL and records the legacy DLL's COM-port traffic. In an isolated test directory:

1. copy the legacy DLL to Tech2_32_original.dll;
2. copy Tech2_32_trace.dll to Tech2_32.dll;
3. point a test J2534 registration at that directory;
4. optionally set TECH2J2534_TRACE_FILE to choose the log path;
5. run only a short, non-programming diagnostic session.

The default trace path is C:\Users\Public\Documents\Tech2J2534_serial.log. The proxy logs COM-port open/close events, baud changes and raw TX/RX bytes. Do not overwrite the installed legacy DLL; use a separate directory and registry entry.

For the first physical test, follow HARDWARE_TEST_DE.md. The included hardware_probe.exe loads a DLL by explicit path, so the initial open/close capture does not require changing the installed J2534 registry entry.

For the legacy trace proxy, TECH2J2534_PORT is applied by a process-local registry-query hook. This lets the old GM DLL use (for example) COM5 without changing the installed Port registry value. The convenience command is:

.\run_open_close_trace.ps1 -Port 5

License

Copyright (C) 2026 Hirschmann & Koxha GbR

This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

The full license text is in LICENSE.md.

The SAE J2534-04.04 interface described in include/j2534_v0404.h is a public specification; this repository contains an independent implementation of it and no code from the legacy GM DLL.