Get Into The Ecu....

[sixfan]

OK...

I've spent a lot of time reading about the various options for modding my T. I will one day take the leap, but I'm keeping it as is for the time being as I think there must be a better way...

I set up a skyline with Haltech efi and I liked the control this gave me over the engine. The systems I've read about so far seem to be focused on bending the signals or fooling the management computer. Fine by me, but wouldn't it be better to get into the code? re-write from the ground up?

People who understand these things better than me (And there are heaps and heaps...) will surely tell me if Im wrong here, but If Ford can modify the software version, there must be a way for us to as well....

Would it be possible for us to Pool our resources and work on this? Perhaps all throw in some dollars and hire someone to develop a crack for the ECU? Who knows.. perhaps there's people who could do it as members of this webpage?

I think it would be a readily marketable item! Let the engine use the bigger exaust / airfilter / injectors that have been fitted, without the torque limiting.

so what do you think?

is this possible or am I

[bkofoed]

Not nuts, but ambitious!

Yes, it's always possible. But Ford made some choices to make it HARD!

First off, the processor is a new generation device- the Motorola "Black Oak" specifically deisnged for use as an ECU. (I.e. supports many signal in/outs and optimizations for reading various types of sensors are streamlined in the instruction set).

That said, in the good old days, ECU's were reasonably simple microcontrollers (68HC05 for example) with external Eprom for Code and data maps. That's nice because if you know the Processor, and pop the Eprom, you can read the entire software and data maps, and simulate the whole thing on your PC.

A bit of trial and error, and you can work out which signal is which, such as TPS, Crank, MAF or equiv etc. Do a search on the web and you'll find any number of VN commo Rom's. In engineering we call this 'white box' as in you know what is inside.

Now, the MPC 555 Black Oak is a different beast- it has on-chip 448k Flash Ram. It would not doubt be configured to boot from this Flash, and guess what- with no external data lines we can't read it or take it off the board.

The only way therefore to access the internal memory it is to convince the ECU that you are a Ford Tech with your Diags module connected.

Assume Ford are serious about security- there will be a lengthy and involved handshake on connection so that the ECU can't easily be tricked. And to make it harder, I would make the ECU flash write-only. (as in only say the verison info is available to a legitimate diags module, and it never sends you the whole internal data).

That way should someone capture the handshake with a logic analyzer, they still can't see what's in there. (Black-box, and Ford win).

If I was on the design team that's what I'd do anyways.

More complicated data could be put on external Roms, but as the internal Rom only needs to hold a checksum (and check it on boot), no one can edit anything without the ECU knowing.

FYI I studied Computer Sys Eng so apologies if there's a lot of new terminology here...

BK

PS: The latest EVO Ecu is not cracked either, and looks pretty safe....

[Cobra]

if Ford don't want us to know the workings of the ECU then they have it

only because when they want to they can flash a dead end or a loop-d-loop into the ecu which will require the whole thing to be re-done :lol:

they have no intentions of letting go of the editor ... so we must strive for for reliable signal benders

[bloan]

Do they use these same ECU's in the states I.e. Mustang, Lightening, Crown Vic., Explorer etc., etc.?

If so, is anybody over there working on cracking them?

[Venom XR6]

I think Jaguar's were the first to use the Black Oak ECU, not sure if any US Ford's do though. If you want total control of the engines workings wouldn't it just be easier to replace the standard ECU with a Motec or even run it in tandem with the stock ECU so that it can control things such as ignition timing and fueling and let the standard ECU contol other things such as the auto, air con, thermo fans etc.

[NT TURBO]

From what I've heard the EPA in America is trying to standardise ecu's so they can be reflashed anywhere (eg servo's) to prevent the manufactures having a monoply over the cost of reflash. (Yes out of warranty they can charge a fortune for an ECU upgrade flash)

[bkofoed]

Remeber it's in Ford's interest to make it hard- if it was easy, you'd get those oops-something-blew-at-18-psi-better-reflash-to-standard and go back for warranty people.

For those of you that aren't aware of what's going on in the red team, LS1 Edit is rampant- with some people even posting their modified Rom maps on the net.

A custom LS1 Edit for your commo V8 (or derivative) with dyno session is $1k plus anyway....

Later

BK

[GOLDIE]

I think Jaguar's were the first to use the Black Oak ECU, not sure if any US Ford's do though. If you want total control of the engines workings wouldn't it just be easier to replace the standard ECU with a Motec or even run it in tandem with the stock ECU so that it can control things such as ignition timing and fueling and let the standard ECU contol other things such as the auto, air con, thermo fans etc.

I beleive motec do have a system that also controls drive by wire throottle like the ba has.As for running motec a long side of the factory computor this what is being done now with unichip,chiptorque ect.

I beleive one the code will be cracked until than what we have is ok.

IAN

[aaronmihe]

You'll probably find that there's a minor changelogging subroutine in the ECU as well. And the ability to extract data.

I know the units in certain euro cars when linked to the in-dealership laptops can do a byte by byte comparsion against the in-car ECU to what it shoudl be. If they detect something abnormal it is merrily sent all the way to europe via the same internet link that delivers updates to the laptop. In other words you'd be sprung big time. It also stores whent eh last write operatiosn where made in a FIFO buffer that isn't able to be flashed, AND whenever a car gets flashed it's logged back at HQ, ie they'll see if you're playing silly buggers pretty quick.

This process happens every time the car is at a dealership - the laptop gets plugged in and all this happens as part of the 'system checks'....

Oh yes manufacturers are wising up - and seeing as they have to cover warranty on the car, and are slowly being forced in meeting emissions rules long after that warranty expires well it's no wonder they're looking at every avenue to lock tuners out...

[Falchoon]

There was a guy at Fordforums, Pete (XR9UTE) who was very cluey on all this sort of stuff and had cracked codes for pre AU cars (maybe AU as well), maybe look him up and see if he's had a play yet.