NefMoto

would like to hear what you guys do, if anything, about protecting your tune.

encryption boards, epoxy on the board, ect.
the scrambler boards are useless as the data can just be dumped in bootmode.
epoxy on the board i feel is useless to a point. its still pretty easy to defeat.

(http://i795.photobucket.com/albums/yy231/k0mpresd/78821A1E-B28E-46DC-9418-230918C8FDD7-1160-0000005BDA6D2C49.jpg)

so, is it even worth it to try to protect your work?

I've ask about immo functions so i could at least ask for vin and hard code that so tune compares my hard coded vin against immo chip vin. then if missmatch force limp mode.

not that secure

exactly. pointless. dump eeprom, immo off, protection broken.
i guess really there should be 2 points to discuss here. protection against cloning vs protection against just getting a read.

There have been a few instances that I tried to dump contents through the same scrambler board/chip and each time received a slightly different file, then trying again non-boot using Nef and getting another file.. I thought these scrambler/encryption boards could recognize boot mode then send bad data?

i got bad data in the bootloader part one time. just patched the bootloader with one from the same file # and it was fine. i just considered it a fluke. only time ive had a problem reading them.

Can you explain this?

0>ffff in hex.

I think there is no protection on the bench, if there is a pro tuner. :'(
I prefer to lock the OBD for "small" tuners... :)

How is that done?

Disable the upload service...
But that won't save it from anyone who is serious about reading it.

What I do on older ECU's, is I add an additional checksum algorithm and modify some values in the ECU (for example MAF calibration), to calculate this checksum and then use an offset for every value. I don't store the checksum anywhere, only the offset.
And if anyone modifies my file, the MAF will stop working. If they even manage to strip all my ASM logic from the file, then the MAF will still not work because the actual calibration is "wrong" and needs the offset.

I do this for a couple of maps... so people don't touch my base tunes. As for copy protection - you are never going to achieve this.
But I think some clever things can be done to prevent someone taking your tune, making a couple changes to it and passing it as their own.

yes, nothing has ever stopped me from getting a read. this is the main reason i was wondering what other people's methods were.
really i feel like things are just more of a deterrent than an actual protection.

i really feel like the best method would be the epoxy on the board, top and bottom since bootpin is on flash, cpu, and ram. most people are too scared to heat it to remove it. and some sort of software run-around like prj describes + lock file to the eeprom.
at least then you have to break down 3 doors and at the most you would be able to clone the file and never modify anything.

I prefer to just do good enough custom tunes that they don't copy over well.  And I change weird obscure stuff that i can reference and know when people do copy.

hello.............
its hard to me explain my method in english...........
in this moment i use a combination of a glue and sodium bicarbonate, that convert in a few seconds in a rock.......

in second way, in this moment im talking with a programmer that offer me in a solution. first step is encript some maps, this force to cloner to use "complete file".if use it..... then a few minutes/hours. the car stop, and erase flash eprom and eeprom..........
what do yo think?


jpi512

nice thoughts!

physical (glue) protection agains boot mode or BDM means you are only able to write by OBD?

there won't be a 100% secure way, I think, unless you want to be able to re-write.

I like the Idea by prj but wouldn't it be easier to change some hardware that belongs to the software calibration. easiest way would be like a resistor between ECU and a sensor (e.g. MAP/MAF) and change the according maps.
That would confuse 99% of tuning related people and copy paste will not work, and you know that probably even less than 1% really know what they can read.

Same applies to very custom tunes.

The only things unique are the EEPROM and FLASH. If you copy both over your software will not know that it is running on another car.
It is always possible to copy.

I also am STRONGLY against pouring CRAP into another persons ECU.
This is just ridiculous. It's not your ECU, and if your customer wants it tuned later, then they probably have to buy a new ECU.
If I was your client and you did this, I would probably sue you... especially if it was one of the newer more expensive ECU's.

When you buy a tune you sign a document allowing the tuner to do whatever modifications they want to achieve what they promised and that includes disclaimers of all sorts. APR has such document which I signed years ago when I purchased my stage 1 tune.

You are still pouring crap into an ECU.
Look, this is not an encryption board, or anything like this.
If the ECU has to be bootmoded in the future or if you want to get your car tuned by someone, it can't be done safely without risking damage to the ECU.

One thing is to solder on an encryption board and change data - modifications that can be reversed by anyone who knows how to solder.
The other is dumping a giant turd into the ECU.

I'm personally not a fan of someone (a client) having their hardware physically ruined with epoxy/etc without the client having very explicit knowledge of it and approving it.

As far as encryption goes, it seems decently effective, I mean just look at how many APR tunes people have looked at over here ha.

I'd say either encrypt, disable OBD reading, and/or cookies in the tune as an signature.  prj's way sounds effective too.

I understand that.

CWSCTMDE?

The german way. Just cut the circuit  ::)

I find this unacceptable...at least if the client is not informed.....  ???

Buthering the ECU like this  >:(

If anyone ever did this to one of my ECU's I would throw it through their shop or car window.

The idea of destroying an ECU to prevent someone copying a file is just crazy.

heres how unitro....well, nevermind, does it. noobs.

(http://i795.photobucket.com/albums/yy231/k0mpresd/IMG_7118.jpg)

(http://i795.photobucket.com/albums/yy231/k0mpresd/IMG_7119.jpg)

(http://i795.photobucket.com/albums/yy231/k0mpresd/IMG_7120.jpg)

Agreed. This is stupid. LOL @ tuners who think their shit doesn't stink. Sorry, nothing you are doing is special, get over it.

Yeah, they do that to their "BT" tunes... Best part is their tunes aren't even worth stealing/using they're so bad.

right, but thats not a bt tune. just a regular stg2 hpfp file.
its hard to tell, but most of the bdm pads themselves were scratched off the board. so i soldered to the trace and to the few pads that were left.

Ah, that explains the missing epoxy then... their 1.8T and VR6 BT tunes used have the ECU/flash doused in epoxy

I think the best protection is custom code + script panel. A lot of headache, but I think this is the way how APR, Revo etc protect their files. And if somebody can decrypt it, it means he is not noob and can make a good tuned file by himself.

How do the Electronic keys work? the EVC ones? the raised eprom with a small square chip underneath which has some form of resin on one end

http://nefariousmotorsports.com/forum/index.php?action=printpage;topic=3102.0

Good read, answerd my question

The way I do it is to check a password stored in the EEPROM against a password stored and hidden in the flash using a custom routine. Most of the cars I tune (Volvo) erase the password in the EEPROM if it does not match what is stored in the paired module on the car. That way, even with an immo delete performed and the previous EEPROM copied into a new car, the passcodes do not match since one is correct and one is blank and the custom routine prevents start. For a car that doesn't perform the password erase, I would try looking at the immo check routine and code a routine to check the code against the immo directly, instead of checking what is stored in EEPROM. Either way, the bottom line is, even with all of this, the routines can still be disabled the same way they were added. The point of this is to stop people from mindlessly copying tune files from one vehicle to another. If someone is good enough to hack and disable these security routines, odds are they wouldn't need to be mindlessly copying files, IMO.

I think the biggest problem that tuned file can be compared with ori file. And its easy to find custom code, cause it doesnt look like maps. So swapping tuned maps is the way to crack this protection.

True, that is why I obscure my code with randomly generated bytes and also move the important maps into a mess of stuff. Again, any good tuner can probably get through it, but then again, any good tuner probably isn't copying.

What for? It can still be copied as is, from ECU to ECU.

All you are doing is preventing somebody from modifying your tune. And anybody capable of modifying your tune probably is smart enough to do it from scratch...

Unless all they want to do is, say, disable EGT or something. Or maybe disable LTFTs for logging purposes.

Why would you want to prevent that?

Look what i found.. pro work

(http://i57.tinypic.com/ejxyrn.jpg)