Pages: [1]
Author Topic: Yamaha YEC Flashing software | Hidden Key  (Read 2400 times)
Bower
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 1


« on: July 15, 2025, 03:45:25 AM »

Hi,
I am new to reverse engineering and have limited skills, but have located something interesting that I am not at a skill level currently to be able to progress further myself.
So I thought I might leave it here in case anyone wants to go down this particular rabbit hole.

Background:
In most superbike (1000cc) and supersport (600cc) series, the Yamaha R1 and R6 have their ECUs and wiring harnesses replaced with an OEM kit from Yamaha that allows for flashing via Yamaha YEC FI Matching Software.
This collection of parts is sold as the "GYTR Kit" and for the sake of this post, we are going to focus on the ECU alone (Part#B3L-8591A-A1) and for a 2024 Yamaha R1.
When these ecu's are supplied to customers they are supplied with a CD containing the flashing software with the serial number for the software on it.

The interesting part:
While waiting for someone to provide me the serial number so that I could assist them with remote tuning and insite into the current setup of their TC, engine brake, wheelie control etc I got impatient.
This lead to me decompiling the installer in an attempt to make a keygen.
Turns out a keygen was not needed because the serial number is hardcoded into the installer. HOWEVER, this is where things get interesting.
There are only two valid serial numbers for install of the software.
KIT = YMS2-1224-9694-3872
WORKS = YMS1-Z999-Z999-Z999
To date I do not know of anyone racing these bikes in my country that is using or even knows about the Works key. All ECU's I was able to find were supplied with the KIT key only.

When flashing using the YEC FI Matching Software V1.2.0, the information for the configuration is stored in a .ycz file. These can be viewed with a basic text editor and hold all of the parameters displayed in the flashing software to be loaded into the ecu.
If changes are made in the software, a new .ycz file can be saved or the original one can be written over. The currently stored values in the ECU can also be retrieved and saved.
When the WORKS key is used to install the software, the user then has the option to open .ycg files. For the life of me I can't reverse engineer the program enough to recreate a .ycg file from scratch and the contents and struture is different enough to the .ycz that it will not allow .ycz with it's file extension changed to be opened. (Note, I can vibe code at best. Have never written a program beyond very basic Python scripts and lack all of the skills needed to do this
Logged
_nameless
Hero Member
*****

Karma: +371/-3082
Offline Offline

Posts: 2964



« Reply #1 on: July 15, 2025, 10:08:22 AM »

Checksums? Using HPT I can have the same issues, when I repack the file if the checksums are not first updated beforehand.
Logged

If you are broke or expecting free handouts DO NOT message me. I'll probably put you on blast if you do.
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 2.324 seconds with 17 queries. (Pretty URLs adds 0.00099999999999989s, 0q)