Pages: [1]
Author Topic: getting my hands on bin files (repository?)  (Read 6890 times)
eightfold_prime
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 6


« on: September 15, 2020, 10:35:52 AM »

Hi

I want to get started with car tuning by reverse engineering CAN files so I can get more acquainted with figuring out bin files while learning about how engines are connected. My goal now is to figure out the lookup tables by the bin files.

But firstly. . how does someone who wants to do what I do get their hands on bin files?!

I've been searching online for quite awhile and it seems like most stock bin files are generally posted on forums like this instead of a particular repository (unless one wants to pay 7.50 euro for one . . which sounds ridiculous for me atm)

If there's anyone who has started out like I do or has information on this, it would be great help to me if I could understand how exactly does one get OEM bin files.
Do I simply just go to the car forum I desire (ie Ford) and request for a OEM stock tune file like I've seen in many posts?

I have also read the car hacker manual (a few times in certain chapters relevant to my quest).

It would be awesome if one of you hackers could enlighten me on the framework with regards to acquisition and working on bin files.

thanks!
« Last Edit: September 15, 2020, 11:10:38 AM by eightfold_prime » Logged
d3irb
Full Member
***

Karma: +131/-1
Offline Offline

Posts: 186


« Reply #1 on: September 15, 2020, 11:14:42 AM »

You mention Ford. This process is going to be different manufacturer to manufacturer. There's no central repository of ECU files on the Internet because the files are technically the copyrighted material of the vehicle manufacturer and are worth money to many folks. This is a bad combination because there's both legal risk and a massive market for sucking up all your bandwidth as soon as you offer them for free, and if you could get money for them anyway... you see where this is going.

Since this is mostly an ME7 and VW AG centric forum, I will explain VW AG's process. For VW AG cars, flash data is easiest to acquire from dealer update files. These dealer update files are shipped to dealers as a DVD set called the "Flashdaten" which can be found online in torrents and the like.

They're in a nonstandard encrypted ZIP format called FRF, which for modern ECUs contains a standardized XML container format called ODX and for older ECUs contained the firmware payload directly.

The payloads inside an FRF or ODX differ ECU to ECU. So you need a collection of tools to go from an FRF to a BIN. First you need an FRF extractor which can convert the encrypted ZIP into the XML container (ODX). This one works: https://github.com/trick77/frfdumper . Now you have an ODX. For an older ECU, the FLASH-MEMORY nodes in this XML file will contain the BIN content verbatim. For a newer ECU, it contains reflash data which is encrypted in the form the ECU expects, so a dump directly from the ECU hardware or leaked data is necessary to extract the encryption keys from the ECU hardware and decrypt the payload. I did this for Simos18 ECUs here: http://nefariousmotorsports.com/forum/index.php?topic=6583.msg123050#msg123050 but the process will differ for each ECU.

In short: The update mechanisms by which the files are distributed to dealers are manufacturer specific. You will have the best luck asking on a tuning forum specific to the vehicle you are looking for, but be aware that most tuning forums don't like people looking for handouts (if you explain what you are trying to do that isn't "charge someone money to badly tune their car", people will be more helpful), and most "general" automotive / car forums are clueless and incompetent when it comes to this stuff.
Logged
jamespinger
Jr. Member
**

Karma: +1/-0
Offline Offline

Posts: 35


« Reply #2 on: September 16, 2020, 01:39:59 PM »

@d3irb I tried pm'ing you for some Simos info.  This post is super helpful! My sent items is empty so I'm not sure if there's a post limit for PM's.... Calling you out in public instead.

Sent from my Pixel 4 XL using Tapatalk

Logged
eightfold_prime
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 6


« Reply #3 on: September 22, 2020, 12:56:10 PM »

You mention Ford. This process is going to be different manufacturer to manufacturer. There's no central repository of ECU files on the Internet because the files are technically the copyrighted material of the vehicle manufacturer and are worth money to many folks. This is a bad combination because there's both legal risk and a massive market for sucking up all your bandwidth as soon as you offer them for free, and if you could get money for them anyway... you see where this is going.

Since this is mostly an ME7 and VW AG centric forum, I will explain VW AG's process. For VW AG cars, flash data is easiest to acquire from dealer update files. These dealer update files are shipped to dealers as a DVD set called the "Flashdaten" which can be found online in torrents and the like.

They're in a nonstandard encrypted ZIP format called FRF, which for modern ECUs contains a standardized XML container format called ODX and for older ECUs contained the firmware payload directly.

The payloads inside an FRF or ODX differ ECU to ECU. So you need a collection of tools to go from an FRF to a BIN. First you need an FRF extractor which can convert the encrypted ZIP into the XML container (ODX). This one works: https://github.com/trick77/frfdumper . Now you have an ODX. For an older ECU, the FLASH-MEMORY nodes in this XML file will contain the BIN content verbatim. For a newer ECU, it contains reflash data which is encrypted in the form the ECU expects, so a dump directly from the ECU hardware or leaked data is necessary to extract the encryption keys from the ECU hardware and decrypt the payload. I did this for Simos18 ECUs here: http://nefariousmotorsports.com/forum/index.php?topic=6583.msg123050#msg123050 but the process will differ for each ECU.

In short: The update mechanisms by which the files are distributed to dealers are manufacturer specific. You will have the best luck asking on a tuning forum specific to the vehicle you are looking for, but be aware that most tuning forums don't like people looking for handouts (if you explain what you are trying to do that isn't "charge someone money to badly tune their car", people will be more helpful), and most "general" automotive / car forums are clueless and incompetent when it comes to this stuff.

thanks for updating me on the etiquette of car tuning. I don't really see why such things should be secretive: not everyone wants or will learn tuning and by keeping things secretive, it only increases the (ridiculous) cost or profits certain people in the market. Even if I were to "profit" from this, it's only on a small scale as you would need a team going to package things up.  Furthermore, i'm pretty sure most commercial tuners would prefer to use commercial tools like HPtuners etc.

I also found out that there are numerous software updates to a ECU hardware. . which begs the question what's the difference and why the multiple software updates.

I would gladly help someone tweak some values given the hardware number and bin to save his old car from breaking down or sputtering toxic gas just cuz the outputs can't keep up with the parts.
Logged
d3irb
Full Member
***

Karma: +131/-1
Offline Offline

Posts: 186


« Reply #4 on: September 22, 2020, 02:53:40 PM »

thanks for updating me on the etiquette of car tuning. I don't really see why such things should be secretive: not everyone wants or will learn tuning and by keeping things secretive, it only increases the (ridiculous) cost or profits certain people in the market. Even if I were to "profit" from this, it's only on a small scale as you would need a team going to package things up.  Furthermore, i'm pretty sure most commercial tuners would prefer to use commercial tools like HPtuners etc.

I also found out that there are numerous software updates to a ECU hardware. . which begs the question what's the difference and why the multiple software updates.

I would gladly help someone tweak some values given the hardware number and bin to save his old car from breaking down or sputtering toxic gas just cuz the outputs can't keep up with the parts.

I mean... that's what lets those people maintain their ridiculous costs, and they're often the ones on these forums. NefMoto was definitely started on the same premise - that information should be shared more freely. Unfortunately with new and more complex ECUs, they are enough work that it  takes a highly skilled person a lot of free time to figure out, so hobbyists freely sharing are less common and the information is mostly retained commercially and stays entombed until it has lost value. The other factor here is that again, most of this scene is still based off of manufacturer-internal documents / "IP," especially early on, so there is a hierarchy of people with access to these documents and they need to travel down the chain.

The smart  / high-end commercial folks actually really wouldn't rather use something like HPTuners - because by the time tuning gets "down" to that commodity platform level, tuners are not differentiated anymore. Take for example MPI activation / cross-flashing on Simos18 / MQB VW/Audi. If I bought/discovered/stole the ability to do this and the shop up the street did not, I don't want to share that with anyone, I'm minting cash. By the time we both can buy that off the shelf from HPTuners it's game over, we can both buy the same thing and I have to actually tune rather than maintaining an artificial moat around my business. At the very beginning of a given ECU generation it's even more fierce - if I'm the first to build a signature bypass exploit for an ECU, I can sell the software at whatever price I want to the first few idiot/whale customers who are willing to pay whatever it takes to have the faster car.

I think you are in (mostly) good company here with folks would like to help others out, that's why this forum exists. But such forums are few and far between.
Logged
eightfold_prime
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 6


« Reply #5 on: September 22, 2020, 11:25:55 PM »

I see. I won't know much about car tuning because i'm not in the scene (yet). So i won't know how competitive it is. But I guess since people want to optimize their cars or even outbattle each other, then they would have the ability to fork out more time/money/energy. But I've never thought of or heard of people going to workshop to tune their ride (normally people around me just shell out some Gs to get a muscle car or AMG that sorta thing)

but yea, i'm just requesting bin files to RE; maybe make my own obd scanner while at it.
Logged
ktm733
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 660



« Reply #6 on: December 17, 2020, 12:22:30 AM »

How have I never come across your posts? I’ve been on this forum for over six years or so ,and the information you post is just astonishing. Seriously! Not one person has posted even remotely close to the information you have posted. You even included links! How do you have so much knowledge in Bosch ecus? Your sentence structure is so easy to grasp. You must be a professor for some college?
Logged
ktm733
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 660



« Reply #7 on: December 17, 2020, 12:25:24 AM »

How have I never come across your posts? I’ve been on this forum for over six years or so ,and the information you post is just astonishing. Seriously! Not one person has posted even remotely close to the information you have posted. You even included links! How do you have so much knowledge in Bosch ecus? Your sentence structure is so easy to grasp. You must be a professor for some college?

d3irb
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12233


WWW
« Reply #8 on: December 17, 2020, 12:40:16 AM »

It really is a remarkable set of posts, isn't it?
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
ktm733
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 660



« Reply #9 on: December 31, 2020, 06:47:38 AM »

I mean, no one compares to you Nyet
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12233


WWW
« Reply #10 on: December 31, 2020, 12:43:32 PM »

I mean, no one compares to you Nyet

LOL no comparison, his posts are way more useful than any of mine.
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
navatar_
Newbie
*

Karma: +1/-1
Offline Offline

Posts: 18


« Reply #11 on: March 14, 2021, 02:40:01 AM »

You mention Ford. This process is going to be different manufacturer to manufacturer. There's no central repository of ECU files on the Internet because the files are technically the copyrighted material of the vehicle manufacturer and are worth money to many folks. This is a bad combination because there's both legal risk and a massive market for sucking up all your bandwidth as soon as you offer them for free, and if you could get money for them anyway... you see where this is going.

Since this is mostly an ME7 and VW AG centric forum, I will explain VW AG's process. For VW AG cars, flash data is easiest to acquire from dealer update files. These dealer update files are shipped to dealers as a DVD set called the "Flashdaten" which can be found online in torrents and the like.

They're in a nonstandard encrypted ZIP format called FRF, which for modern ECUs contains a standardized XML container format called ODX and for older ECUs contained the firmware payload directly.

The payloads inside an FRF or ODX differ ECU to ECU. So you need a collection of tools to go from an FRF to a BIN. First you need an FRF extractor which can convert the encrypted ZIP into the XML container (ODX). This one works: https://github.com/trick77/frfdumper . Now you have an ODX. For an older ECU, the FLASH-MEMORY nodes in this XML file will contain the BIN content verbatim. For a newer ECU, it contains reflash data which is encrypted in the form the ECU expects, so a dump directly from the ECU hardware or leaked data is necessary to extract the encryption keys from the ECU hardware and decrypt the payload. I did this for Simos18 ECUs here: http://nefariousmotorsports.com/forum/index.php?topic=6583.msg123050#msg123050 but the process will differ for each ECU.

In short: The update mechanisms by which the files are distributed to dealers are manufacturer specific. You will have the best luck asking on a tuning forum specific to the vehicle you are looking for, but be aware that most tuning forums don't like people looking for handouts (if you explain what you are trying to do that isn't "charge someone money to badly tune their car", people will be more helpful), and most "general" automotive / car forums are clueless and incompetent when it comes to this stuff.

Edit: links are dead
« Last Edit: July 17, 2021, 08:54:11 PM by navatar_ » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.067 seconds with 16 queries. (Pretty URLs adds 0s, 0q)