ECU seems to be locked, and tools to unlock it?

[mrjj]

I think this is a very interesting project. Ecutek is rumored to change the key seed algorithm. You should be able to figure the algorithm out by either disassemling the Ecutek software/driver (DESKey locked, so quite hard) or by sniffing the USB or OBD2 traffic when first writing a locked Ecutek map.
Re-create the map using the dumped/sniffed data and disassemble it in IDA. The key seed should be in there.
Please keep me posted on your progress. I have experience from cracking other similar DRM systems.

[Chickeneatman]

Originally Posted by churchx

Well, if you have backgrounds in IT, probably have heard about EULAs, which, believe me or not, supposed to be binding legal contracts, even if reading was quick pgdowns to scroll and enter to dismiss. I'm more then sure that one buying tune, even if was too lazy for that, was informed by shop, what exactly he buys, with what features/possibilities, what he can or cannot do and what exactly tuning shop selling tune must provide and what is upto their goodwill to provide.

"I bought this copy of photoshop, paid for it". "It must be opensourced, so i with my coding skills can modify even more and sell as product renamed to uberpaint, at 1/4th the price of PS, or even release it for free!!" Well, Adobe may have different view on that, and might have different things what's in their best business interests, no matter what customer may wish or expect/request them from their product. And you cannot fault them for not quietly doing anything what you may which/request, all you can do is vote with your valet to get their product or not.

As for unlocking possibility, i'm pretty sure that even if there had been a way for someone via eg. some unofficial vendor alternative encryption key set to hack around/unlock locked tune, then it's in interests of ecutek as vendor and tuning shops choosing/using it exactly for there to not be publicly known such possibility. Locking/encryption feature might be not the only one/main one, tuning shops stick to ecutek as tuning solution, but it is used feature due existence of which many shops may have chosen this platform aswell. So i doubt that even if someone knew how to unofficially crack locked ecutek tunes, that he would share such nfo, be it from ecutek themselves, be it from some tuning shop or be it some hacker that found some weakness/vulnerability and found ways around .. waiting to be hit with legal action, once publishes that nfo in open public. Be it due DMCA or whatever else alike.

I'd be interested to know how any sort of EULA affects us as we are not the people who originally had this car tuned. I highly doubt anyone can sue us if we manage to crack it. Providing an unlocking tool is NOT illegal. It doesn't break any rules/laws. Now if I went around sharing the tune, that could be. However that is not my goal or intention.

Thanks for your reply, but can we please try to keep this on topic?

[CSG Mike]

Originally Posted by Chickeneatman

Alright guys I understand. I misspoke. I want to unlock the tune. It is my opinion that when a tune is paid for, that it should be unlocked. I don't believe in locking hardware.

I thought I had made it clear that my intention is to read the ECU, but clearly I did not say enough that I do not want to overwrite the current tune. I want to modify the current tune.

Thanks

You purchased a locked tune from Delicious, and/or the previous owner purchased a locked tune from delicious.

Unlocked tunes are available for purchase, but will cost you deep 6 figures, and a host of legal documents.

Reverse engineering a tune is not difficult for anyone knowledgeable, but anyone with that knowledge wouldn't bother reverse engineering a tune; they'd rather tune it themselves.

[JohnJuan]

Originally Posted by Chickeneatman

...Her car works, we just have some small things we want to change. If we can figure it out, I would like to provide the tools to unlock ECUs to the masses. I find it ridiculous that someone can pay for a tune, and then they aren't allowed to touch it after that. ...

Call me skeptical, but Delicious has tuned dozens to hundreds of these cars. It's safe to say that they're pretty good at it. What exactly are you looking to improve?

[redhalo]

Originally Posted by Chickeneatman

I highly doubt anyone can sue us if we manage to crack it. Providing an unlocking tool is NOT illegal. It doesn't break any rules/laws.

Actually, what you are proposing is illegal and sueable. https://en.wikipedia.org/wiki/Digita..._Copyright_Act

[mrjj]

Originally Posted by redhalo

Actually, what you are proposing is illegal and sueable. https://en.wikipedia.org/wiki/Digita..._Copyright_Act

Did you read the exceptions?
"Computer programs that are contained in and control the functioning of a motorized land vehicle such as a personal automobile,"


Also, there's no DMCA where I live :-)

[churchx]

Yet. There will be. EU is happy to also becoming similar state. Matter of time.

[steve99]

Originally Posted by Chickeneatman

I understand they have no obligations, and I have no interest in paying someone else to tune my car, when I am fully capable. I would just like to have the original tune in case something does get screwed up in the process. I also don't want to pay for even more tuning supplies when I already have an OFT and a Tactrix cable. I do appreciate the response, but the bigger point here is to open up the ECU and use the open source tools. I have spent enough money at this point and just want to use the tools I have and the knowledge available.

It is unlikely that I will be successful in unlocking the ECU. That being said, I am willing to try. Nothing would ever get done if everyone ran away when success was "unlikely"

My goal, once we have this figured out is to share what we have learned and make it available to anyone here that wants to tune their own cars. The Tactrix is a very powerful tool; it just has a very steep learning curve.

Given enough time and effort most stuff can be cracked but here is a much simpler way if you just want to have a failsafe backup tune.


Buy a spare ecu on ebay or one from Auto recyclers. AFAIK all the ecu are same auto manual any year. Ive swapped or assised in at least 10 or more swaps.


You will likely need a flash tool like tactrix or even ecutek will work to be able to flash in a compatable ecu calibration to your spare ecu unless you get one from same year model and country.


Anyway all you need to do is aquire the spare ecu program it up using whaever flash tool your using . Best to avoid oft for this as it doesnt like changing calid, i can get around it but its a pain in the arse. Its just far easier to use ecutek or tactrix or brzedit.


Remove your current ecu with ecutek tune.


Then swap in your spare ( they are usually less than $100 usa) program up your spare ecu with a compatable calid for your car then tune on spare ecu. If you want at any time you can swap back to your original ecu jist takes 30 minutes each time to sync ecu to security in car. Jist slide your spare ecu in next to current one and swap the 4 plugs over if you want as well saves time.


No cracking needed and your not going to upset anyone and you can achieve what you need to do



Ecu swap proceedure here.
http://www.ft86club.com/forums/showthread.php?t=102810




Tell me your current ecu tune calibration id like ZA1JB01C or whatever it is and ill sort a tactrix compatable rom and definition for you. Or even jist the year of car and transmission type will do

[redhalo]

Originally Posted by mrjj

Did you read the exceptions?
"Computer programs that are contained in and control the functioning of a motorized land vehicle such as a personal automobile,"

These exemptions are only for circumventing in a non-infringing use case, such as replacing the OEM ecu code with your own. The use as proposed is infringing, he wants to make a derivative copy of someone else's work. If this was a legit desire towards an open source ecu and learning, he would have just started from scratch.

I'm not going to stop someone from tinkering, but it should be known that this is theft being discussed.

[Tcoat]

Originally Posted by Chickeneatman

I'd be interested to know how any sort of EULA affects us as we are not the people who originally had this car tuned. I highly doubt anyone can sue us if we manage to crack it. Providing an unlocking tool is NOT illegal. It doesn't break any rules/laws. Now if I went around sharing the tune, that could be. However that is not my goal or intention.

Thanks for your reply, but can we please try to keep this on topic?

The legality of what you are asking IS on topic.
In one breath you state that somebody that paid for a tune should have access to it and in another you insist it is OK since you are not the one that paid for it. Well which is it? It would appear that your motives are not what you claim them to be. The tune is proprietary whether you are the one that had it done or not. You want to change it then just pay the fees to Delicious and be done with it.


Let's see what they have to say. @DeliciousTuning

[steve99]

Originally Posted by mrjj

Did you read the exceptions?
"Computer programs that are contained in and control the functioning of a motorized land vehicle such as a personal automobile,"


Also, there's no DMCA where I live :-)

Originally Posted by redhalo

These exemptions are only for circumventing in a non-infringing use case, such as replacing the OEM ecu code with your own. The use as proposed is infringing, he wants to make a derivative copy of someone else's work. If this was a legit desire towards an open source ecu and learning, he would have just started from scratch.

I'm not going to stop someone from tinkering, but it should be known that this is theft being discussed.

Originally Posted by Tcoat

The legality of what you are asking IS on topic.
In one breath you state that somebody that paid for a tune should have access to it and in another you insist it is OK since you are not the one that paid for it. Well which is it? It would appear that your motives are not what you claim them to be. The tune is proprietary whether you are the one that had it done or not. You want to change it then just pay the fees to Delicious and be done with it.


Let's see what they have to say. @DeliciousTuning

Seems like it all a bit of a grey area . All tune systems and tuners basicly crack the stock ecu seed key locks then they read out stock ecu code, change it a bit then resell it to people as a tuned rom but its 95% or more the stock ecu code with some changes. Do all these people pay or get permission manufacturers ?? Probably not

[EAGLE5]

The DMCA is all about protecting copyrights. It's stupid, but that's what it's about.

Is a car's tune copyrightable? The ECUTEK code is, but the actual tune settings? Seems questionable, but IANAL.

[mrjj]

Originally Posted by steve99

Seems like it all a bit of a grey area . All tune systems and tuners basicly crack the stock ecu seed key locks then they read out stock ecu code, change it a bit then resell it to people as a tuned rom but its 95% or more the stock ecu code with some changes. Do all these people pay or get permission manufacturers ?? Probably not

This ^^


It would be bold (stupid) by Ecutek/DT to chase down someone who (for personal use) cracked their key seed and dumped/changed their rom.
Let's remember that Ecutek did crack the Denso/Subaru key seed algorithm, dumped the (copyrighted?) Denso/Subaru rom, changed it, and now making profit from it.
Ecutek can bark loudly about their copyright, but I see no risk in modifying my own car software - just like I crack my game console, 3d printer, mobile phone, etc.

[Chickeneatman]

I have been away for a week. I will try to address everything here.

Originally Posted by CSG Mike

You purchased a locked tune from Delicious, and/or the previous owner purchased a locked tune from delicious.

Unlocked tunes are available for purchase, but will cost you deep 6 figures, and a host of legal documents.

Reverse engineering a tune is not difficult for anyone knowledgeable, but anyone with that knowledge wouldn't bother reverse engineering a tune; they'd rather tune it themselves.

I have tuned a few cars. None have been a boosted BRZ/FRS. That is why I'd like a starting point/the tune currently on the car. Starting from scratch is possible, but not something I originally wanted to do. You are correct in saying that starting from scratch would be easier in the long run. However I really really want to figure out how to crack the seed. Seems like a fun project.

Originally Posted by JohnJuan

Call me skeptical, but Delicious has tuned dozens to hundreds of these cars. It's safe to say that they're pretty good at it. What exactly are you looking to improve?

The tune works. However there is a waste gate flutter, and we want to change out the boost controller, and possibly turbo. This is in no way a bash on Delicious Tuning. They have done a fine job. We just want to change some smaller things on the car.

Originally Posted by redhalo

Actually, what you are proposing is illegal and sueable. https://en.wikipedia.org/wiki/Digita..._Copyright_Act

Alright maybe if I go around spreading this potential tool it is, however mrjj is correct. Unlocking and modifying my ECU code is NOT illegal. This is all very much still an idea though. I haven't had much time yet to really dig into this.

Originally Posted by redhalo

These exemptions are only for circumventing in a non-infringing use case, such as replacing the OEM ecu code with your own. The use as proposed is infringing, he wants to make a derivative copy of someone else's work. If this was a legit desire towards an open source ecu and learning, he would have just started from scratch.

I'm not going to stop someone from tinkering, but it should be known that this is theft being discussed.

I am not understanding how I am stealing anything. I am not claiming the tune on the car as my own. I am simply planning on modifying the current tune. That is in no way theft.
Lets say I buy calculator program for my personal use. Unfortunately it doesn't have some functionality that I want. So I code it into the existing code. THAT IS NOT THEFT. That is essentially what I am trying to do here. I purchased a product, and used/modified it for myself. I am not providing this tune for anyone to have. I simply want to crack the seed, and modify the code.