Jump to content
LegacyGT.com

Clone your immobilizer chip to a replacement ECM/ECU


Recommended Posts

  • 4 months later...

Thanks again for Infosecdad for posting this.

 

Looks to be a success (though haven't tried the flashed ECU in the car yet).

 

I hate effin' Python and even more so this Cmake garbage. Even though the default python on my Mac (running Mojave) is 2.7, and despite passing the parameters with paths to 2.7 Infosecdad posted, it was insisting on /Library/Frameworks/Python.framework/Versions/3.3 which led to SWIG linking errors. I just temporarily renamed that directory and Cmake found a 2.7 path that worked.

 

Also, had to increase the delay to 1.5 seconds. I was getting bad writes where some bytes differed, even with 900 ms delay.

Edited by unclemat
Link to comment
Share on other sites

  • 1 month later...

I am trying to set up on linux and getting:

 

root@debian:/home/l/Downloads/Adafruit_Python_GPIO-master# python eeprom-read.py

2021-02-19 00:22:34,060 [MainThread ] [DEBUG] Disabling FTDI driver.

2021-02-19 00:22:34,060 [MainThread ] [DEBUG] Detected Linux

2021-02-19 00:22:34,141 [MainThread ] [DEBUG] Called ftdi_usb_open and got response 0.

2021-02-19 00:22:34,142 [MainThread ] [DEBUG] Called ftdi_usb_reset and got response 0.

2021-02-19 00:22:34,142 [MainThread ] [DEBUG] Called ftdi_read_data_set_chunksize and got response 0.

2021-02-19 00:22:34,142 [MainThread ] [DEBUG] Called ftdi_write_data_set_chunksize and got response 0.

2021-02-19 00:22:34,143 [MainThread ] [DEBUG] Called ftdi_usb_purge_buffers and got response 0.

2021-02-19 00:22:34,143 [MainThread ] [DEBUG] Called ftdi_set_bitmode and got response 0.

2021-02-19 00:22:34,144 [MainThread ] [DEBUG] Called ftdi_set_bitmode and got response 0.

2021-02-19 00:22:34,177 [MainThread ] [DEBUG] Setting clockspeed with divisor value 66

2021-02-19 00:22:34,177 [MainThread ] [DEBUG] SPI write with command 11.

2021-02-19 00:22:34,178 [MainThread ] [DEBUG] SPI read with command 20.

2021-02-19 00:22:34,203 [Dummy-1 ] [DEBUG] Enabling FTDI driver.

2021-02-19 00:22:34,203 [Dummy-1 ] [DEBUG] Detected Linux

 

The output is not correct; nonhex. I know i am using it and got everything installed, but i really can't work around in linux unless the instructions are step-by-step, as i suspect the usb device is not able to be claimed in the lines.

 

I also tried two flavors of windows 8.1 and 10--both 64-bit--but both did not set up correctly; both with a "win32 error" upon doing:

import ftdi1

 

I can try to install a windows 32-bit and try again, but this would be like the third day attempting this straight. Then I will try to find a mac, and I have never used a mac.

Edited by darthqwo
Link to comment
Share on other sites

i got it set up on a virtual machine with the adafruit board passed-thru with both 32-bit windows and ubuntu--which the deprecated guide uses--but it turns out it was unnecessary. more importantly, it works with 64-bit windows, and it is important to use the x86 python 2.7 installer instead of x86-64 python 2.7 installer, as the deprecated adafruit guide states very briefly; this demonstrates that the deprecated guide is more of a hack of the portable python 2.7 32-bit install files than an application in python (at least for windows), but whatever. more importantly, i found that my original debian linux set-up actually worked from the beginning since the output is the same as a working configuration.

 

but we are still missing a step that was not really mentioned, which would have saved a whole week of frustration for me if i had known to uncoat the pcb; namely, it is necessary to unocat the chip contacts from the protective transparent coating that is on the pcb since this can prevent a proper read.

 

but thanks so much infosec for the thread in the first place

Edited by darthqwo
Link to comment
Share on other sites

Awesome, glad to hear you got it figured out.

 

Good to learn about the coating, I didn't have any on the three ECUs I had tested with; I'll see if I can update the original post to mention making sure you have clean, direct contact with the traces.

 

With Python 2.7 deprecated, and 32bit support fading; at some point we aren't going to be able to use this method and another one will need to be developed.

Link to comment
Share on other sites

We have copies of them, it's more that it's getting harder to actually run 32bit programs. It'll be sometime yet, but Apple no longer supports 32bit and at some point Microsoft won't either. It's not that they will be 100% gone, it'll just be reduced to a pretty small set of people that understand (and have archived) enough to be able run it all.
Link to comment
Share on other sites

I can read from 2008 legacy, but the output is some ascii or utf format; i think it is the same issue as

 

I’m having a similar issue with my 09. It appears my ecu has a different model eeprom with a different storage capacity. I’m still working through the code and confirming, but I’m guessing the code needs to assign a different address sequence for the different chip. Can you get a clear pic of the eeprom model? Mine is an S93C86. The code was written for a BR93L56. The 56 is a 2Kbit capacity and the 86 is a 16Kbit capacity.

 

I can also read from a 2013 forester ecu, but i cannot write successfully to it. The chips on both are labeled S93C86 with IC402 label to the side. When i write my 2008 legacy binary to it, then read it again, it is the same as before. (for reference i have not written to the legacy and have no reason to)

 

If we can change some of these values, it is worth a try, but im not the one to ask:

 

import bb93l56

 

EEPROM_SIZE_IN_BYTES = 256

NUMBER_OF_ADDRESSES = 128

SIZE_OF_REGISTER_IN_BYTES = 2

 

Edited by darthqwo
Link to comment
Share on other sites

  • 8 months later...
  • 1 year later...

I know this is an old thread, but I figured I'd post what worked for me since it took me like 2 weeks to figure this out. I could never get Ryan Geyer's method to work for my 2012 Forester because it's for an older chipset. The bin files would never show the VIN on them. My car has a 93c86 chip labelled "IC402" on the board. I guess this chip stores more data than the ones mentioned in the guides, which were used in earlier years. 

I followed this video and it ended up working out for me. I just successfully cloned my ECM to a donor and the car started right up. I bought a CH341A USB MinProgrammer (Black Edition) from Amazon, and the same 8pin clip mentioned on OP. The software is in the YouTube description. I had to do the read and writes with 16bit selected, because 8 bit didn't produce the VINs. For 16 bit configuration, wire 6 on the eeprom clip has to go to terminal 8 on the CH341A. 

Good luck and I hope someone out there finds this helpful!

https://www.youtube.com/watch?v=hPKckby54uA

 

Edited by GreenJumpsuit
  • Like 1
  • Thanks 1
Link to comment
Share on other sites

  • 9 months later...

I'm having a lot of trouble sourcing an FT232H outside of the US, only could get a CH341A. This is for my '05 LGT. Is it possible to use pin connections that are analogue on this board, or do I absolutely need the FT232H?
 

Link to comment
Share on other sites

On 3/28/2024 at 10:18 PM, elomo64 said:

I'm having a lot of trouble sourcing an FT232H outside of the US, only could get a CH341A. This is for my '05 LGT. Is it possible to use pin connections that are analogue on this board, or do I absolutely need the FT232H?
 

Looks like the person two posts before you got it working with the CH341A, so it should be feasible.

Link to comment
Share on other sites

18 hours ago, Infosecdad said:

Looks like the person two posts before you got it working with the CH341A, so it should be feasible.

Yup was reading their posts but since it was for a newer model, it looks to not be a 1:1 thing. I'm gonna have to do some reading because I have pretty much 0 experience with these programmable modules.

  • Like 1
Link to comment
Share on other sites

Got my hands on the FT232H but getting the ftdi drivers to work has been so far impossible, I've tried both on my Windows and Mac machines. The Blinka drivers worked instantly, but the eeprom script would need to be rewritten to use those I guess.

Currently stuck at trying to compile the drivers, I just get:

clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[2]: *** [python/_ftdi1.so] Error 1
make[1]: *** [python/CMakeFiles/_ftdi1.dir/all] Error 2
make: *** [all] Error 2

 

Link to comment
Share on other sites

Nvm, finally got it working on windows! But the dump bin file is just "ÿÿÿÿÿÿÿÿÿ"...

Is it possible I have the pin connectors wrong?

 

2024-04-01 19:28:04,744 [MainThread  ] [DEBUG]  Called ftdi_usb_open and got response 0.
2024-04-01 19:28:04,746 [MainThread  ] [DEBUG]  Called ftdi_usb_reset and got response 0.
2024-04-01 19:28:04,746 [MainThread  ] [DEBUG]  Called ftdi_read_data_set_chunksize and got response 0.
2024-04-01 19:28:04,747 [MainThread  ] [DEBUG]  Called ftdi_write_data_set_chunksize and got response 0.
2024-04-01 19:28:04,752 [MainThread  ] [DEBUG]  Called ftdi_usb_purge_buffers and got response 0.
2024-04-01 19:28:04,753 [MainThread  ] [DEBUG]  Called ftdi_set_bitmode and got response 0.
2024-04-01 19:28:04,756 [MainThread  ] [DEBUG]  Called ftdi_set_bitmode and got response 0.
2024-04-01 19:28:04,788 [MainThread  ] [DEBUG]  Setting clockspeed with divisor value 66
2024-04-01 19:28:04,788 [MainThread  ] [DEBUG]  SPI write with command 11.
2024-04-01 19:28:04,789 [MainThread  ] [DEBUG]  SPI read with command 20.

 

Edited by elomo64
Link to comment
Share on other sites

Yeah I suspect it might be the clamp, I've tried several times and it seems to be seated correctly, but I still get the ÿ's.

I'm so close... I think I might be missing to uncoat the threads on the chip on the ECM! Will try that...

Link to comment
Share on other sites

Have you tested to see if the clamp is maybe 180 degrees off?  Maybe it just needs to be flipped.

Or you might need to slow it down a little more, things are even faster than when I first did it.

Sorry, hard to troubleshoot from over here... 😛

Link to comment
Share on other sites

Yeah, if I do the 180º I instead get this:

 

2024-04-01 19:27:45,855 [MainThread  ] [DEBUG]  Called ftdi_usb_open and got response 0.
2024-04-01 19:27:45,858 [MainThread  ] [DEBUG]  Called ftdi_usb_reset and got response 0.
2024-04-01 19:27:45,858 [MainThread  ] [DEBUG]  Called ftdi_read_data_set_chunksize and got response 0.
2024-04-01 19:27:45,858 [MainThread  ] [DEBUG]  Called ftdi_write_data_set_chunksize and got response 0.
2024-04-01 19:27:45,862 [MainThread  ] [DEBUG]  Called ftdi_usb_purge_buffers and got response 0.
2024-04-01 19:27:45,865 [MainThread  ] [DEBUG]  Called ftdi_set_bitmode and got response 0.
2024-04-01 19:27:45,867 [MainThread  ] [DEBUG]  Called ftdi_set_bitmode and got response 0.
Traceback (most recent call last):
  File "eeprom-read.py", line 17, in <module>
    ft232h = FT232H.FT232H()
  File "C:\Python27_x64\Adafruit_GPIO\FT232H.py", line 165, in __init__
    self._mpsse_sync()
  File "C:\Python27_x64\Adafruit_GPIO\FT232H.py", line 252, in _mpsse_sync
    data = self._poll_read(2)
  File "C:\Python27_x64\Adafruit_GPIO\FT232H.py", line 232, in _poll_read
    raise RuntimeError('Timeout while polling ftdi_read_data for {0} bytes!'.format(expected))
RuntimeError: Timeout while polling ftdi_read_data for 2 bytes!

This seems like it means the pins are not in the correct position I assume?

BTW you helping me with this is something I appreciate immensely, seriously thank you!

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

Terms of Use