NefMoto

So lets hear it. I was under the impression that these would possibly prevent reading via obd, or at the very least scramble the data. I suppose I could be wrong, but the files I've pulled appear to be fine. One MTM, one VAST.

A picture of the specific board I'm referring to is below.

(http://i46.tinypic.com/3ub15.jpg)

Neither has the chip receptacle like the one shown, rather the standard 29f800bb eprom is soldered directly to the encryption board.

Obviously I won't know for sure until I do it, but can you overwrite these? I wouldn't think so, but I also wouldn't have thought they could be read and make any sort of sense.

those usually swap address and data lines around a bit, so obviously the write algorithms will fail.

generally, you can read them out via boot mode just fine, because the ecu sees what it needs to see: the unscrambled data.

but why bother? its a waste of time dorking around with other people's protection schemes.

those are the most useless forms of "protection" there is.

I have one of the exact same board chips in an s3 Ecu I bought.

When I read in boot mode it was all ok but reading the chip directly it was Scrambled and im sure it was Edian swapped so sure data lines are changed.  I reflashed the chip back to stock put it back in the Ecu and it ran fine . So now I don't know. To be honest I didn't bother looking into it any further and its currently in the kids toy cupboard! So might have to dig it out and look again.

Just to clarify, I have NO desire to copy someone elses tunes. At this point I'm confident I can do better than a cookie cutter OTS tune anyway. I'm just a curious person by nature, and wanted to increase my understanding of the hardware.

Both times I've read them over OBD, bootmode wasn't required. All the maps I looked at look normal, and a quick comparison of the pulled files and their stock counterparts revealed changes to the typical maps. I figured I must be missing something, and given the wealth of knowledge on this board I decided to take advantage  ;D

Last question-WHY DOES THE UNDERSIDE LOOK LIKE THIS? At first glance I figured it must be a failed IC, but the boards on the EVC site have similar crap on them?

Note: I snagged the pic off of AZ.

(http://i48.tinypic.com/6rrq76.jpg)

its a scrambler board. what do you think does the de/scrambling? magic? lol.
i guess you mean the epoxy. its goo to keep you from pulling that off the board as well i assume.

LOL-I don't mean the IC, I mean the goo that appears to be leaking from the IC.

Although magic would be cool  :P

If its a scrambler board, but can be read from obd and remain useable what's the point? According to ddilinger he read the chip normally and viewed the maps without any issue! Seems a bit odd

So let me get this straight-even with a working encryption board reading via bootmode won't result in scrambled data? What good are these boards then? They only scramble when reading via OBD (when working properly)?

From my limited testing yes that's the base of it! I guess they hope anyone trying to read over obd will be put off when they see it scrambled, in my case all seemed a bit half hearted as you can easily remove the chip and read or boot mode. More a deterant that a security feature. I guess back in the day ie 1999 when the Ecu was in use it was pretty good, along with the 6 maps changed to make it a stage 1..

If your at all interested I'll get some pictures up of the board/chip etc.. And try and dig out the map.. but I'm sure you have better things to do ;-)

I'd like to see it when you dig it out. Did you replace the eprom and leave the board out?

I bought it as a unit to use with the emulator, just not got round to fitting the header yet.

These aren't normally used in anything "flashable", as you said you can read it just fine!  But in cars which require a physical chip change, it encrypts it as it won't allow you to do a sequential read in a programmer.  The ecu reads from the chip are realtively random, so it's ok.  When you sequential read after a set limit, it gives you garbage :)  Some people have written random read programs to gather the data, but as previously stated, effort is best put into perfecting your own tunes :)

I also realise there are different types of protection board, but the ones I have encountered worked that way.

-Gavin

Incorrect. The only thing it checks for is chip select pin being toggled between reads, which a programmer does not do.
The ECU can full well read stuff sequentially too.

heres how this works: read encryption board through bootmode. data comes out decrypted because the data you read in bootmode is the same exact data the cpu sees. there is no other choice but for it to be decrypted. desolder encryption board. resolder only flash back to ecu. flash in bootmode to recover. then you can reflash however youd like if you need.
thats why i said they are useless.
and if you read my other m3/5 read in bootmode thread, youll understand exactly what im saying in that thread.  ;)

So I re-read the files out with bootmode, and compared the bins with the OBD read files. They are identical.

guess that proves my useless statement even more then. lol.

Here's the one I had on the Ecu.. Anyone want it?

It's an evc like the one on the original post

I bought a 32HN ecu from a local dealer to clone mine and test my files here. I opened it today and looks like this. Can I bench read it via obd with nefmoto software?

(http://i61.tinypic.com/2jceb00.jpg)
(http://i62.tinypic.com/1zzjcxv.jpg)
(http://i60.tinypic.com/259jvdd.jpg)
(http://i60.tinypic.com/2upybrm.jpg)

Do you guys know what type the 20pin ic is?

Anyone please help me?

No. Desolder it and remove the riser, solder it back, bootmode it.

GAL16V8 - programmable logic device (PLD)

What you have there doesnt seems to be a scrambler but a 1 to 1 adaptor for the normal flash. For example if you have used the OLS300 on a ecu you can convert it back to normal function without any soldering. Some Tuners modify their customers ecus this way to use a emulator on it without having an own "Emulator Ecu" for this purpose. Another possible appearance of those is this:

Thanks a lot for the response. I'll try to bench read it when my cables and power supply arrive and tell you what happened

Agreed, actually, but note that some of these have the write enable pin clipped.

Thanks for that info.

Old thread but I can verify my Hbox MTM stage 1 with encryption board is completely transparent. File pulled by OBD and bootmode are 100% identical. I have flashed the MTM to ther ECUs with 0 issue. Looks like MTM was wasting their time with these boards :)
 I have not however tried flashing over the top of the MTM file. Sounds like write may be disabled.

I also have pulled several files both over obd and boot. No probbs at all.
Did not write any either

These boards are a relic from the early 2000's when OBD and boot flashing was not yet widely available.
Back then people desoldered the chips in every ECU.

This is why these boards were in place, so you could not read the chip in a programmer.

Once OBD and boot was open they became obsolete.

This kind was no problem to bootflash with diff flash. IIRC it was from ABT. I bootflashed it with my own as a spare.