Clone your immobilizer chip to a replacement ECM/ECU

[Infosecdad]

This is a DIY write up for cloning the "special immobilizer code" to a replacement ECU/ECM if you need to replace it. I've been able to get this to work for my '05 LGT.

 

You can also desolder the chip and move it over physically or go to a dealer and have them do it for you. I'm ok at soldering, but didn't have the right equipment for the surface mount chip. The dealers around me where $150-$400 and hours away. Since, my background is in software development and information security, I decided to take this route.

 

TL:DR

You need to have a working driver and then python module installed (at least for this variant).

This can be a challenge in both Windows and MacOS.

 

I started here. Many props to Ryan Geyer over at the Outback forums. He figured a good bit of this out. Excellent work sir!

 

https://www.subaruoutback.org/forums/109-gen-3-2005-2009/501753-immobilizer-reverse-engineering-2005-obxt-probably-other-year-models.html

 

Ryan's code for read/write the EEPROM is in GH here:

https://github.com/rgeyer/ft232h/tree/master/93l56-16bit

 

My experience required me to use other resources as well.

You experience will probably vary from mine as well since there are so many variables involved. I was using a 2013 MacBookPro on Mojave (10.14.5) with the included Python 2.7. What machine and OS you are using will make a difference as will the python version.

 

Software:

 

FTDI Drivers:

https://www.ftdichip.com/Drivers/D2XX.htm

 

 

Hardware:

 

Adafruit FT232H

https://www.amazon.com/Adafruit-FT232H-Breakout-General-Purpose/dp/B00XW2MD30/

 

Test Clip for 8-pin IC

https://www.amazon.com/gp/product/B07BRSVRXV/

(There are several to pick from, I just chose this one.)

 

Jumper Wires

https://www.amazon.com/gp/product/B07GJG25DJ/

(You need six of them, I just got these because I plan to do other projects)

 

 

You can see the microUSB cable to the adafruit board.

Make sure you have a real data cable, some items (battery packs, etc) ship with one that is only power and doesn't have wiring for data transfer.

There are six jumper wires from the adafruit board to the IC Test Clip.

How exactly to connect them is in Ryan's post.

You can see the location of the chip on the board in the corner.

 

Adafruit documentation:

https://learn.adafruit.com/adafruit-ft232h-breakout

(Base instructions for MacOS, Win, and Linux)

 

 

It wasn't enough for me, I also needed a few other things.

 

I started following the steps from:

https://learn.adafruit.com/adafruit-ft232h-breakout/mac-osx-setup

 

But the ftdi library wouldn't actually build and install the python module.

So the "import ftdi1" would fail.

 

After much research, I found that I had to disable some of MacOS internal protections to get it installed.

 

Shutdown your Mac
Hold down CMD+R and boot
In the recover mode, open the terminal
Type: "csrutil disable"
Then select restart from the menu
(When you are all done, you need to come back and rerun that command with "enable" instead.)

 

Also, FTDI includes information on how to disable the less than helpful default Apple driver that gets in the way:

https://www.ftdichip.com/Support/Documents/AppNotes/AN_134_FTDI_Drivers_Installation_Guide_for_MAC_OSX.pdf

 

Once that was disabled, I had to manually build and install the FTDI drivers:

https://github.com/adafruit/Adafruit_Python_GPIO/issues/87

 

The kicker to getting it to work for me, was the info in this post:

https://forums.adafruit.com/viewtopic.php?f=19&t=112535#p603865

 

My version of this is below.

I updated to get version 1.4 instead of 1.2

and updated to point to the python libraries on my machine.

 

wget http://www.intra2net.com/en/developer/libftdi/download/libftdi1-1.4.tar.bz2
tar xvf libftdi1-1.4.tar.bz2
cd libftdi1-1.4
mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX="/usr/" -DPYTHON_INCLUDE_DIR="/System/Library/Frameworks/Python.framework/Versions/2.7/include/python2.7/" -DPYTHON_LIBRARIES="/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/" ../
make
sudo make install

 

 

I used https://ridiculousfish.com/hexfiend/ to read the hex from the binary file output from the read/write files.

 

The sequence I used was:

1. Plug in USB cable to connect adafruit board to computer

2. Carefully align test clip on chip

3. Run the read_eeprom python script

4. Open results in hexfiend.

5. If you could read your VIN three times in it, then you got a good read.

6. Save that file.

7. Connect the test clip to the replacement ECM/ECU

8. Attempt to read.

9. If your read was all 0's or F's, try again.

10. Once you get a clean read, save that binary file as it was the VIN for the previous car.

11. I had to update the write code from GH to sleep longer to ensure a write.

time.sleep(0.100)

was the default, but it wasn't long enough, I found

time.sleep(0.500)

was 90% successful, but that

time.sleep(0.700)

worked perfectly.

12. Run the write_eeprom python script specifying your extracted binary file.

13. Read the same chip you just wrote to ensure that it matches the binary file you tried to write.

14. Once they match, unhook the test clip and plug it into your car and try it.

 

If I'm missing something, just let me know and I'll try to update this post.

 

Good Luck!

[Guest]

Cool!

[l88m22vette]

Nice work

[skaithao]

I'm trying to do the same thing your doing but I'm getting a hex dump file full of FF values. Did you get actual responses from your check commands? I'm running Windows 10.

 

Sent from my VS996 using Tapatalk

[moral hazard]

This is awesome work!

I wonder if the same process can be used when replacing the cluster ?

[Infosecdad]

I'm trying to do the same thing your doing but I'm getting a hex dump file full of FF values. Did you get actual responses from your check commands? I'm running Windows 10.

 

Sent from my VS996 using Tapatalk

 

Usually when I got nothing but FFFFFF... I needed to try again and/or reseat the clamp. When it's on right and the drivers are correct, then you should get the response back you are expecting.

[Infosecdad]

This is awesome work!

I wonder if the same process can be used when replacing the cluster ?

 

Thanks!

In theory, assuming it has a similar chip to perform that function.

If I have time I could look at the OBXT cluster I have and see if I can find it.

[Ducki3]

Hey everyone! I realize this thread is a couple months old now but I'm trying to locate the EEPROM on my 2009 Legacy 3.0R ecu. There is some type of coating on the board that makes it really hard to read the IC's. There is about 8, 8 pin IC's all the same size. My ECU doesn't send signal to injector 6 anymore and I'm trying to replace it with a used one.

[Infosecdad]

Post a picture and we can help you try to identify the chip.

[Ducki3]

Thanks! Pics attached.

[Ducki3]

https://ibb.co/9HQFBDD

https://ibb.co/Db6SpVJ

[Infosecdad]

It's in a different location, but the number and size match. I would say try the clamp on IC405 (circled in red) and see if you can read off the VIN off it. If so, pretty sure that's the one.

 

[Ducki3]

It might be a while before I can verify, but thank you for your help! Much appreciated!

[Ducki3]

Thank you infosecdad! That was indeed the correct IC. I desoldered my chip off of my ECU and was able to move it to a donor ECU and it fired right up. I appreciate the help very much!

[awfulwaffle]

Here's a bundle that should set up anyone looking to do this on Windows 10 (and probably other versions, haven't confirmed though).

 

Bundle has a local copy of the relevant Adafruit instructions, downloads of all necessary files, a README with instructions that I would have found helpful, and some photos to demonstrate proper wiring of the breakout board to the EEPROM clamp, which I found wasn't too clear in the other sources.

 

https://drive.google.com/open?id=1DZxvv5FUnjUgV7cYU11DznTPoaNziBPa

 

Edit: Just realized I never specified, so might as well - HxD is a good free hex editor that you can use to check the binaries in Windows: https://mh-nexus.de/en/hxd/

Edited February 8, 2020 by awfulwaffle

[theflystyle]

wish i knew this before replacing my ECU!! Great work

[imprezkid]

I believe i am in a position of needing a new ECU as well. Couple of questions:

 

1. I assume that i would need to uninstall my accessport before doing this?

2. Anyone with the know how/tools willing to do this for others? I don't know my way around well enough i don't believe to be messing with my ECU? Compensation of course.

[awfulwaffle]

I believe i am in a position of needing a new ECU as well. Couple of questions:

 

1. I assume that i would need to uninstall my accessport before doing this?

2. Anyone with the know how/tools willing to do this for others? I don't know my way around well enough i don't believe to be messing with my ECU? Compensation of course.

 

Not sure on the Accessport question, but I assume so. If you feel like mailing both your new and old ECU to me, I'll clone the immobilizer for you. All my stuff's still set up.

[weenz0r]

Hello, I've been following along and I've got everything installed but when I run eeprom-read.py I am getting "ftdi_usb failed with error -4: usb_open() failed" any ideas? I'm pretty much stuck I have triple checked the driver installation and when I plug the FT232H in my computer sees it and I can see it in the device manager. Also the green light is on. I have no idea how to move forward with this.

 

Thank you!

weenz0r

[Infosecdad]

Hello, I've been following along and I've got everything installed but when I run eeprom-read.py I am getting "ftdi_usb failed with error -4: usb_open() failed" any ideas? I'm pretty much stuck I have triple checked the driver installation and when I plug the FT232H in my computer sees it and I can see it in the device manager. Also the green light is on. I have no idea how to move forward with this.

 

Thank you!

weenz0r

 

(Assuming you are on Windows)

 

If I remember right, I used zadig (utility) to change the usbdriver to "libusbk" and that fixed it for me. I think it's per USB port, so you also need to make sure you are plugged into the one that you are changing the driver on.

 

Hopefully that helps.

[weenz0r]

Ah yes I'm on windows 10 and I did change the drivers over per the instructions I'm using the same port I have always used but still getting that usd open failed.

[weenz0r]

So I did the whole install on my other laptop and it worked without an issue. I just started up the car on the JDM ECU. Thanks for all the info here guys

[Infosecdad]

Awesome, glad to hear it.

 

USB drivers can be really finicky at times, I went through two Windows VMs and a MacBook before I got it to run the way it was supposed to.

 

Also glad to hear that it can be done on JDM ECUs like this as well.

[weenz0r]

I swapped to an EJ20X/Y since the stock EJ255 was burning a massive amount of oil. I really wanted to use the quad AVCS and Twinscroll turbo so now I can run the car on the JDM ECU and drive the exhaust AVCS then switch to my stock ECU for Inspection since the JDM ECU won't show as supported at the inspection station. I actually documented the whole thing in a thread on another site. I'll copy that thread here and link to it.

[weenz0r]

here you go context might be weird in places I posted this thread on a forum that is just used by like 5 friends. figured I'd share with the LGT community though.

 

https://legacygt.com/forums/showthread.php/legacy-gt-ej20x-y-swap-282026.html