Finally cracked the m5 loop.

It is some loop that expire if there is no activity on the bus. When that happen the pcm is crasher and reset.
Before that happen memory from 6000-600b3 is cleared. I suppose that is the target ram for uploading code.

When in mode5 only mode5 and mode6 messages can be sent.

Mode 5 will just reply with AA and keep the bus alive.
Mode6 is to upload and execute some code.

It needs to be in a format like this

06 XX XX [YYYYYYYYYYYYYY] chks

xxxx= data where the upload will be stored and executed.

YYYY= upload code. No need to specify length, it is taken automatically, also there is no checksum verification, so if the message is corrupt the pcm will likely crash.

For now a snigle upload can be worked fairly easy. A multi message upload will need some tweaking as the execute needs to return to m5 loop.{i think EE upload apporach will work without issue- just some tweaking of the addresses].

Now someone needs to write some code to program the eerpom with custom data. i am sure gm have something on t1 but where to get is beyond me.