Pages: [1] 2 3
Author Topic: Chipped ecus, EVC key encryption boards and reading/writing  (Read 23843 times)
ddillenger
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« on: January 22, 2013, 11:50:03 PM »

So lets hear it. I was under the impression that these would possibly prevent reading via obd, or at the very least scramble the data. I suppose I could be wrong, but the files I've pulled appear to be fine. One MTM, one VAST.

A picture of the specific board I'm referring to is below.



Neither has the chip receptacle like the one shown, rather the standard 29f800bb eprom is soldered directly to the encryption board.

Obviously I won't know for sure until I do it, but can you overwrite these? I wouldn't think so, but I also wouldn't have thought they could be read and make any sort of sense.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
nyet
Administrator
Hero Member
*****

Karma: +607/-168
Offline Offline

Posts: 12268


WWW
« Reply #1 on: January 22, 2013, 11:55:51 PM »

those usually swap address and data lines around a bit, so obviously the write algorithms will fail.

generally, you can read them out via boot mode just fine, because the ecu sees what it needs to see: the unscrambled data.

but why bother? its a waste of time dorking around with other people's protection schemes.
Logged

ME7.1 tuning guide
ECUx Plot
ME7Sum checksum
Trim heatmap tool

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
k0mpresd
Hero Member
*****

Karma: +146/-54
Offline Offline

Posts: 1655


« Reply #2 on: January 22, 2013, 11:59:45 PM »

those are the most useless forms of "protection" there is.
Logged
littco
Hero Member
*****

Karma: +52/-7
Offline Offline

Posts: 903


« Reply #3 on: January 23, 2013, 12:00:22 AM »

I have one of the exact same board chips in an s3 Ecu I bought.

When I read in boot mode it was all ok but reading the chip directly it was Scrambled and im sure it was Edian swapped so sure data lines are changed.  I reflashed the chip back to stock put it back in the Ecu and it ran fine . So now I don't know. To be honest I didn't bother looking into it any further and its currently in the kids toy cupboard! So might have to dig it out and look again.
« Last Edit: January 23, 2013, 12:04:02 AM by littco » Logged
ddillenger
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #4 on: January 23, 2013, 12:14:09 AM »

Just to clarify, I have NO desire to copy someone elses tunes. At this point I'm confident I can do better than a cookie cutter OTS tune anyway. I'm just a curious person by nature, and wanted to increase my understanding of the hardware.

Both times I've read them over OBD, bootmode wasn't required. All the maps I looked at look normal, and a quick comparison of the pulled files and their stock counterparts revealed changes to the typical maps. I figured I must be missing something, and given the wealth of knowledge on this board I decided to take advantage  Grin

Last question-WHY DOES THE UNDERSIDE LOOK LIKE THIS? At first glance I figured it must be a failed IC, but the boards on the EVC site have similar crap on them?

Note: I snagged the pic off of AZ.

« Last Edit: January 23, 2013, 12:15:49 AM by ddillenger » Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
k0mpresd
Hero Member
*****

Karma: +146/-54
Offline Offline

Posts: 1655


« Reply #5 on: January 23, 2013, 12:16:22 AM »

its a scrambler board. what do you think does the de/scrambling? magic? lol.
i guess you mean the epoxy. its goo to keep you from pulling that off the board as well i assume.
Logged
ddillenger
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #6 on: January 23, 2013, 12:18:38 AM »

LOL-I don't mean the IC, I mean the goo that appears to be leaking from the IC.

Although magic would be cool  Tongue
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
littco
Hero Member
*****

Karma: +52/-7
Offline Offline

Posts: 903


« Reply #7 on: January 23, 2013, 12:53:42 AM »

its a scrambler board. what do you think does the de/scrambling? magic? lol.
i guess you mean the epoxy. its goo to keep you from pulling that off the board as well i assume.

If its a scrambler board, but can be read from obd and remain useable what's the point? According to ddilinger he read the chip normally and viewed the maps without any issue! Seems a bit odd
Logged
ddillenger
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #8 on: January 23, 2013, 01:09:32 AM »

So let me get this straight-even with a working encryption board reading via bootmode won't result in scrambled data? What good are these boards then? They only scramble when reading via OBD (when working properly)?
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
littco
Hero Member
*****

Karma: +52/-7
Offline Offline

Posts: 903


« Reply #9 on: January 23, 2013, 01:28:18 AM »

So let me get this straight-even with a working encryption board reading via bootmode won't result in scrambled data? What good are these boards then? They only scramble when reading via OBD (when working properly)?

From my limited testing yes that's the base of it! I guess they hope anyone trying to read over obd will be put off when they see it scrambled, in my case all seemed a bit half hearted as you can easily remove the chip and read or boot mode. More a deterant that a security feature. I guess back in the day ie 1999 when the Ecu was in use it was pretty good, along with the 6 maps changed to make it a stage 1..
« Last Edit: January 23, 2013, 01:33:42 AM by littco » Logged
littco
Hero Member
*****

Karma: +52/-7
Offline Offline

Posts: 903


« Reply #10 on: January 23, 2013, 01:36:03 AM »

If your at all interested I'll get some pictures up of the board/chip etc.. And try and dig out the map.. but I'm sure you have better things to do ;-)
Logged
ddillenger
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #11 on: January 23, 2013, 01:38:00 AM »

I'd like to see it when you dig it out. Did you replace the eprom and leave the board out?
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
littco
Hero Member
*****

Karma: +52/-7
Offline Offline

Posts: 903


« Reply #12 on: January 23, 2013, 01:51:33 AM »

I bought it as a unit to use with the emulator, just not got round to fitting the header yet.
Logged
Sprockets
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3


« Reply #13 on: January 23, 2013, 03:03:42 AM »

These aren't normally used in anything "flashable", as you said you can read it just fine!  But in cars which require a physical chip change, it encrypts it as it won't allow you to do a sequential read in a programmer.  The ecu reads from the chip are realtively random, so it's ok.  When you sequential read after a set limit, it gives you garbage Smiley  Some people have written random read programs to gather the data, but as previously stated, effort is best put into perfecting your own tunes Smiley

I also realise there are different types of protection board, but the ones I have encountered worked that way.

-Gavin
Logged
prj
Hero Member
*****

Karma: +1072/-480
Offline Offline

Posts: 6035


« Reply #14 on: January 23, 2013, 09:59:33 AM »

These aren't normally used in anything "flashable", as you said you can read it just fine!  But in cars which require a physical chip change, it encrypts it as it won't allow you to do a sequential read in a programmer.  The ecu reads from the chip are realtively random, so it's ok.  When you sequential read after a set limit, it gives you garbage Smiley
Incorrect. The only thing it checks for is chip select pin being toggled between reads, which a programmer does not do.
The ECU can full well read stuff sequentially too.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
Pages: [1] 2 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.022 seconds with 18 queries. (Pretty URLs adds 0s, 0q)