Locked out of my ECU
Jan 8, 2007, 11:55 AM
#16
Evolved Member
It's not that hard to get the xml out for your own HEX, you just need look for a big map, say the high octain fuel. If you compear it to a known map it becomes not to bad a job.
MB
Jan 8, 2007, 04:14 PM
#18
Evolving Member
Thread Starter
iTrader: (6)
Join Date: Feb 2004
Location: Maryland
Posts: 442
Likes: 0
Received 0 Likes
on
0 Posts
Do you mean you a writing an app that will automaticaly read the hex then output an xml so we can edit it in ECUflash? That would be cool.
It's not that hard to get the xml out for your own HEX, you just need look for a big map, say the high octain fuel. If you compear it to a known map it becomes not to bad a job.
MB
It's not that hard to get the xml out for your own HEX, you just need look for a big map, say the high octain fuel. If you compear it to a known map it becomes not to bad a job.
MB
It was pretty easy to unscramble the map once I started looking at the hex.
As long as you know what you're looking for it's a simple matter unscrambling it.
Jan 8, 2007, 07:19 PM
#19
Kapolani has a point, most of the maps have "markers" that indicate whether their 2d or 3d maps, and they almost always occured in the same order. So as long as the order doesnt change, you can easily translate it.
There are two types of methods for making maps difficult to read, the first is the basic Lock which the Unlocker allows you to read. There is also an Obfuscation that some tuners are starting to use, which I can undestand why they feel its necessary to protect their work, it also makes it difficult for the rightful owner to manipulate, and that is what I have a strong disagreement with.
Basically, most maps have their rom version embedded into their data. Some tuners have decided to alter the value so there is no matching Definition for it, or worse, an improper match which can lead to even bigger problems if their altered. Its easy to find and fix, but you have to know where your looking. The rom series is located in several locations, and the version number (the last one or two bytes) is all they usually change to obfuscate it.
I actually was in the process of writing a tool that found all the maps, unfortunately I have had some personal issues that have prevented me from doing much with it, and then I started working on unilogger. Anyway, the problem I found was there are 1d values, that do not have any unique identifiers, partially because many of the values are embedded within actual rom code, and if you alter it improperly, it will actually break the rom. Those are more difficult to isolate.
The good news is most of the bytes around the data is pretty static if its imbedded in rom code, and I have been trying to use that to isolate those values. However I haven't gotten far enough to produce anything worth releasing.
I actually have gotten quite a few "Scrambled maps" from tuners who have asked for assistance, and have deciphered every one of them, so its pretty easy to do if you want to take the time. Unfortunately don't send them to me, I won't have the time to get to them in a reasonable amount of time, but if your tuner has one thats especially difficult, have them contact me.
Even when I begin doing some dyno tuning for hire, I will never lock or obfuscate a rom, nor will I discourage someone from examining the maps and asking questions or discussing them online.
There are two types of methods for making maps difficult to read, the first is the basic Lock which the Unlocker allows you to read. There is also an Obfuscation that some tuners are starting to use, which I can undestand why they feel its necessary to protect their work, it also makes it difficult for the rightful owner to manipulate, and that is what I have a strong disagreement with.
Basically, most maps have their rom version embedded into their data. Some tuners have decided to alter the value so there is no matching Definition for it, or worse, an improper match which can lead to even bigger problems if their altered. Its easy to find and fix, but you have to know where your looking. The rom series is located in several locations, and the version number (the last one or two bytes) is all they usually change to obfuscate it.
I actually was in the process of writing a tool that found all the maps, unfortunately I have had some personal issues that have prevented me from doing much with it, and then I started working on unilogger. Anyway, the problem I found was there are 1d values, that do not have any unique identifiers, partially because many of the values are embedded within actual rom code, and if you alter it improperly, it will actually break the rom. Those are more difficult to isolate.
The good news is most of the bytes around the data is pretty static if its imbedded in rom code, and I have been trying to use that to isolate those values. However I haven't gotten far enough to produce anything worth releasing.
I actually have gotten quite a few "Scrambled maps" from tuners who have asked for assistance, and have deciphered every one of them, so its pretty easy to do if you want to take the time. Unfortunately don't send them to me, I won't have the time to get to them in a reasonable amount of time, but if your tuner has one thats especially difficult, have them contact me.
Even when I begin doing some dyno tuning for hire, I will never lock or obfuscate a rom, nor will I discourage someone from examining the maps and asking questions or discussing them online.
Last edited by MalibuJack; Jan 8, 2007 at 07:22 PM.
Jan 8, 2007, 08:03 PM
#20
Newbie
Join Date: Oct 2005
Location: Connecticut
Posts: 87
Likes: 0
Received 0 Likes
on
0 Posts
TTP-Engineering had my ECU unlocked for free and hence earned my reflash business for his help. I did not give my business to them as a condition of un-fubarring my ECU so they would have done it regardless at no charge. It was the least I could do for their help.
for people like them and MalibuJack for not trying to make $$$ off of members that have been screwed by obfuscation attempts.
Jan 8, 2007, 09:39 PM
#21
Evolved Member
MB
Jan 8, 2007, 10:24 PM
#22
Account Disabled
iTrader: (91)
Join Date: Sep 2003
Location: 2003 Evo VIII - Silver
Posts: 16,850
Likes: 0
Received 0 Likes
on
0 Posts
Any of my customers who has a locked ecu or an obfiscated ecu or any other problem with it does not have to pay anyone $50 to do anything with it
I am here to provide customer service to paying customers and anyone who contacts me will be given tech support and assistance.
I lock all ecus I flash to prevent mitsubshi dealers from flashing update flashes on my customers cars in for oil changes and other service calls. After several years I grew tired of continually re-installing customers previous maps every week. With Malabu Jack's fabuolus unlocker anyone with a tactrix cable can open any evo ecu.
Anyone who is my customer - please let me know if you have any issues - problems or questions - its all free tech support for you.
Those who are not my customers - anyone who has a rom loaded in their ecu that is giving them trouble can easily copy the imobilizer code onto a stock rom - which I will provide free of charge to anyone who requests one and that should get you going in your self tuning journeys.
I do not follow these forums regularly so please if you wish to contact me use PM or email as I will prob not read any response here.
I am here to provide customer service to paying customers and anyone who contacts me will be given tech support and assistance.
I lock all ecus I flash to prevent mitsubshi dealers from flashing update flashes on my customers cars in for oil changes and other service calls. After several years I grew tired of continually re-installing customers previous maps every week. With Malabu Jack's fabuolus unlocker anyone with a tactrix cable can open any evo ecu.
Anyone who is my customer - please let me know if you have any issues - problems or questions - its all free tech support for you.
Those who are not my customers - anyone who has a rom loaded in their ecu that is giving them trouble can easily copy the imobilizer code onto a stock rom - which I will provide free of charge to anyone who requests one and that should get you going in your self tuning journeys.
I do not follow these forums regularly so please if you wish to contact me use PM or email as I will prob not read any response here.
Jan 9, 2007, 05:50 AM
#23
Locking the ECU for a car that is still under warranty makes perfect sense, as I've seen quite a few cars go in and get Rom updates as part of their regular service. I also had one guy tell me that when Mitsubishi COULDN'T update the ECU, that they though there was something wrong and replaced it, so you need to have a very good line of communication with your dealer if your still using them for service so your absolutely sure they don't attempt to do it without your knowledge.
FWIW, Dynoflash DOES NOT obfuscate roms, occasionally a user will have a rom that he does not have a definition for, and thats easily fixed by using the updated definition pack that is being maintained by a member on OpenECU's forums.
I am aware of one tuner who does obfuscate their maps. I am very very sympathetic to his reasons, but I disagree that this method is going to prevent maps from being distributed (which is the concern) I suggested to him, as I suggest to any Tuner, to embed the car's VIN or some unique identifying data within the rom's unused areas, so if you do find a map out in the wild that looks like one of your own, you can identify it. If the tuners are interested enough, I can put together a tool that can do a checksum and embed information into the roms so they can be identified easier, and then later read it back. This should discourage most unauthorized distribution, while still allowing users, tuners, etc, to work and review roms without the need for obfuscation.
FWIW, Dynoflash DOES NOT obfuscate roms, occasionally a user will have a rom that he does not have a definition for, and thats easily fixed by using the updated definition pack that is being maintained by a member on OpenECU's forums.
I am aware of one tuner who does obfuscate their maps. I am very very sympathetic to his reasons, but I disagree that this method is going to prevent maps from being distributed (which is the concern) I suggested to him, as I suggest to any Tuner, to embed the car's VIN or some unique identifying data within the rom's unused areas, so if you do find a map out in the wild that looks like one of your own, you can identify it. If the tuners are interested enough, I can put together a tool that can do a checksum and embed information into the roms so they can be identified easier, and then later read it back. This should discourage most unauthorized distribution, while still allowing users, tuners, etc, to work and review roms without the need for obfuscation.
May 29, 2010, 04:14 AM
#24
Newbie
Join Date: Nov 2008
Location: San Diego
Posts: 45
Likes: 0
Received 0 Likes
on
0 Posts
i have the same problem. i have a customer that has an evo 7 and i can download the rom from the ecu. but its i can edit anything. i downloaded the ecu unlocker from aktive matrix and its still not working. what else can be used. i am using windows vista and i also down loaded .net 1.1 as recommended by aktive matrix.
and still no luck.
any help will be greatly appreciated
and still no luck.
any help will be greatly appreciated
