Clone your immobilizer chip to a replacement ECM/ECU

[Infosecdad]

8 hours ago, elomo64 said:

I uh... might have forgotten to use Hexdump to read the files...

Progress, everything reads at ffff

Good catch, onward!

When I got all "f" it was the connection on the clamp, I would try a few ever so slightly different positions, it's not easy sometimes to get it just perfectly aligned to touch all the pins.

[elomo64]

Well I got it working, but the most frustrating thing is that it did not fix the issue I'm dealing with.

I've got a P0037 code, and I'm following the procedure in EN(H4SO)(diag)-83, which states that if pin no.2 of the B135 connector is less than 1V (Mine's reading at 0.06V), that I should replace the ECM.

Does this mean that this replacement ECM I got, is also a dud? I would like to imagine that whatever should be supplying the 1V might be shot and it should be something reparaible on the ECM board? I honestly thought I'd be done with this almost year-long ordeal.

[GreenJumpsuit]

1 hour ago, elomo64 said:

Well I got it working, but the most frustrating thing is that it did not fix the issue I'm dealing with.

I've got a P0037 code, and I'm following the procedure in EN(H4SO)(diag)-83, which states that if pin no.2 of the B135 connector is less than 1V (Mine's reading at 0.06V), that I should replace the ECM.

Does this mean that this replacement ECM I got, is also a dud? I would like to imagine that whatever should be supplying the 1V might be shot and it should be something reparaible on the ECM board? I honestly thought I'd be done with this almost year-long ordeal.

Did you maybe accidentally measure voltage instead of resistance? Pretty sure most of the diagnostic procedures involving B135 with a value of 1 are for resistance, not voltage. 

I highly doubt the donor ECM would be having a problem in the same exact circuit. There are 5 different o2 sensor codes relating to the heater circuits - P0030, 31, 32, 37, and 38. When I was having my issue, it would randomly throw 30 through 32, and it was fixed immediately after swapping the ECM. It's been running fine ever since. I don't think the donor ECM would show the same exact code out of the 5 possible codes. 

I would double check that you thoroughly checked everything in the diagnostic procedures for all 5 codes, and make sure all the wiring and connectors are in good shape. Have you also tried a new sensor? Was it OEM Denso? Good luck, with some patience and diligence, you'll get it!

[elomo64]

Yup, it's a brand new Denso, tests correctly for about 8 ohms of resistance (should be less than 30) at the heater circuit.

Here's the particular bit regarding the heater signal from the ECM, and so far it's the only element of all the checklist that fails to pass, so I still get the P0037.

I've read hundreds of posts regarding this, and some guy apparently had the P0037 code go away when he changed a faulty injector, though he never replied back when asked if the voltage reading ever went back up.

My car currently gets some misfires on cyl#1 at around 5K rpm, so I just might have an issue there. What's really annoying about all this is that the code showed up after I took my car for an engine rebuild, but the shop refuses to take ownership of the issue, claiming it was the cables fraying from exhaust heat and not them.

I'm also thinking that there might be an incorrectly grounded cable, which is causing the ECU to not give out the full 1V, especially since I found a disconnected ground when they delivered the car initially.

So fed up with that shitty shop.

[Algenaal]

 

I'm just gonna leave this here for information: I found this which tells that the jdm ecu doesn't have the VIN inside the eeprom. I guess I got a good reading on both all the time then.
I'll update this if it works when we finally got the engine hooked up .

-----------

Hey guys, amazing tutorial. I'm doing a copy of the immobilizer for a friend from a 2003 Legacy BL5 B4 GT ecu to an for the hz30 h6 engine. Doing a backup from the h6 works just fine, got a clean read with the vin 3 times in there. Now reading the eeprom from the original ej20 ecu, I get some confusing outcomes. The first 32 bytes getting read but after that, nothing gets read correctly but the FF at byte 0x66 to 0x6b. I checked the wiring like a 100 times, cleaned off the eeprom and double-checked if the h6 still gets read correctly. 
The ej20 ecu uses an L56R eeprom, the h6 a 93c56 chip. I use the zip for Windows, which got posted here too.
I also saw that the Capacitor C467 which connects 5v to GND right next to eeprom is missing - there was never any soldered onto, the board got quiet a lot of free solderpads. But such a Capacitor is mounted on the h6 ecu - Do they actually do a job like cleaning up some noice which can cause missreads?

I attached an image for reference. It seems like either something is wrong/missing in the code for the L56R (which should be compatible with the 93c56) someone messed with the immobilizer on the ej20 ecu or the eeprom itself is broken. The car ran perfectly on the ej20 ecu until we pulled the engine in December.Do you have any ideas? I also have an esp32 lying around here; maybe there's something more suitable library available for the L56R.

Thanks



h

Edited May 17 by Algenaal
Added more info