Saturday, December 4, 2010

So you want to hack your ECU. Where do you start?

I've been reverse engineering automotive engine control units (ECUs) since 2001.  Recently, an acquaintance encouraged me to write a blog about it.  At first, I wasn't sure if anyone would really be interested about the internal details of ECUs, but then I thought, why not.  So if you're reading this, I assume you are the curious type, are interested in cars and electronics, and aren't afraid to use a soldering iron.  I plan to write about how I got into ECU hacking, the basics of how to do it, such as what tools you need, and some of what I've learned along the way.  So let's start from the beginning.

I wasn't always interested in cars.  In fact, growing up I never really thought of them as anything more than a form of transportation until one singular experience changed everything for me - playing Gran Turismo.  I know, it sounds kind of silly, and it is, but that's really the reason why I got excited about cars, and why, in 2001, I bought a used Honda 1991 CRX Si (which had seen better days), bought a used Jackson Racing supercharger, which I installed myself to save money, and, finally, decided to crack open the CRX's ECU to see if I could hack it myself, because the only other option at the time was to pay someone else about $1000 to do it.  So, what started out mainly as an attempt to go fast cheaply has turned into a long-term hobby, and since that time, I have had almost as much fun working on my cars and hacking their ECUs as I've had driving them.

In 2001, the conventional wisdom was that Honda ECUs couldn't be hacked, except by the few commercial outfits that were charging an arm and a leg for their services.  But hey, if they could do it, why couldn't I?  I decided to open up my ECU and see.  What I found was a pleasant surprise:  My CRX's ECU was powered by an 8051 microcontroller and used a standard 28-pin EPROM.  It'd be hard to come up with a more common combination of parts.  There were plenty of 8051 code disassemblers that could be downloaded for free, as well as datasheets.  I was fortunate enough to have access to an EPROM programmer, so all I had to was desolder the EPROM, read it and disassemble it.  If you're interested, you can read more about it here:  http://forum.pgmfi.org/viewtopic.php?f=2&t=7&start=0

Since the CRX, I've owned a supercharged '93 Civic Si, a supercharged '94 Integra GS-R and now a 2001 Mazda Miata, and I've hacked the ECU in each one.  I've also gone from having no kids to 4, so I don't have as much free time to devote to this as I used to, but I will try to post regularly about what you need to do to hack your own ECU, from the ground up, including what hardware and software tools you'll need and where to find them.  Stay tuned.

27 comments:

  1. I have recently desired to learn more about this subject and this is exactly what I'm looking for! I look forward to read the rest of your entries.

    ReplyDelete
    Replies
    1. Sorry for not replying. I hope you're still learning.

      Delete
  2. Have you done any work on GM ECM's?

    ReplyDelete
    Replies
    1. This comment has been removed by the author.

      Delete
  3. No, sorry, I stick with makes I actually own. I believe there's a pretty active community of GM ECU hackers, though.

    ReplyDelete
    Replies
    1. Sir, I'm really interested in this field, can you help me with this?
      My email ID is keerthi@vvcecs.in

      Delete
  4. I have a 2010 Honda accord edu and there is no tuner for this car, but many parts, cams, 2012 civic si turbo manifold, etc that are very compatible. I don't want to buy a different edu from the civic si and then get a tuner, any ideas how I could hack my ecu?

    ReplyDelete
    Replies
    1. Really? There's no ECU hacking development on 2010 Accord ECUs? I haven't kept up with Honda ECU hacking, but your best bet is to check websites that are dedicated to Hondas and ask there. With a lot of newer ECUs, I believe you can reflash them without even removing the chip, so that might make things easier, but in terms of hacking it yourself, good luck. If someone hasn't already dumped it and analyzed the ROM, you'll have a lot of work to do!

      Delete
  5. how do the larger companies create universal ecu management systems and how do they differ from companies like unichip, access port, and open flash tablet? How do to they get around the legal issues and licensing to distribute these ecu reflash products?

    ReplyDelete
    Replies
    1. Universal ECU management systems - I don't know too much about them but I assume they build ECUs from the ground up (hardware/firmware) to work with many sensor and actuator types. They're not just replacing your ECU's program - they replace the entire ECU.

      On the other hand, companies that just hack an ECU's program (probably 99.9% of the time) are just modifying a few bytes here and there to get the desired changes. I doubt that they are rewriting the code from scratch, and they are definitely not replacing the hardware.

      As for legal issues, you'll have to ask them. I got into Honda hacking many years ago but never monetized the info I learned because I wasn't confident that doing so would be strictly legal (although the reason I got into it was BECAUSE there were companies charging outrageous prices for modified chips at the time).

      Delete
  6. Do you do Vi-Pec ecu's skyline r32 need to remove the password but keep the map

    ReplyDelete
    Replies
    1. You have an R32? I envy you. But sorry, no, I know nothing about Vi-Pec.

      Delete
  7. Have an rx8 and was trying to adjust my idle rpm I have obd auto doctor but from my understanding this app only monitors. How do I make adjustments?

    ReplyDelete
    Replies
    1. Sorry, I don't know. I'm pretty sure there is ECU mod support for RX8's though, isn't there?

      Delete
  8. I want to program ECM EFPROM of Harley Davidson in order to get the VIN number and the odometer;
    Also I need to use VIN number and odometer from another bike to cover data on this bike
    Who can help me to do this? I can pay for it. (I prefer to program it without to open the shell of ECM)
    This ECM is operated by Freescale MC9S12XEP768MVL (5M48H) and CAN-BUS protocol. This ECM is from DELPHI
    These are two different ECMs of Harley Davidson, but the MCU that they are using the same, which is Freescale MC9S12XEP768MVL (5M48H)

    Thanks,

    Here is my email: john72298@gmail.com

    ReplyDelete
    Replies
    1. I'm pretty sure there are standard OBD-II codes to get VIN and odometer, but in terms of programming VIN and odometer into another bike - well, that sounds kind of illegal. In any case, I don't know how to do it. If you are interested in poking around your bike yourself, look for any EEPROMs; that's where I'd look.

      Delete
  9. Looking for some mazda ECM hacks glad to see you did one for the miata I look forward to reading how and what I will require thank you in advace

    ReplyDelete
  10. Nice idea.'m wanting to hack into my VW Golf 1.6 FSi (engine code BAG).Im searching now for a spare ECU.DO you have any expertise in this?Thank you

    ReplyDelete
    Replies
    1. No, but I think there's a lot of activity on VWs. I have a VW too - maybe that's next for me!

      Delete
  11. Contact me, I want to help.

    https://www.linkedin.com/in/mfyoung

    ReplyDelete
  12. Where could I get some info regarding remapping or software/firmware updates on a 2010 Volvo XC60? Have problems with Climate control.. some says an update fix this problem while others says need to replace Climate Control Module.. but getting a Climate control from wreckers wouldn't solve this problem as each modules are programmed/locked for each cars .. so if I get one it needs to be programmed.. could you give some info.. my email: blessxavi@gmail.com Thanks

    ReplyDelete
    Replies
    1. Sorry, I don't know. Modern cars have more and more ECMs and your problem is pretty specific to one that I have no experience with. I hope you can find a solution.

      Delete
  13. I'm looking for automotive controls helps on a Self-Driving car project where we're using as myRide's prototyping vehicle a Fiat 500e. It would be awesome Jonathan to chat with you.
    Eric (617) 800-4877

    ReplyDelete
    Replies
    1. Don't know if you are still interested, but I'll try calling.

      Delete
  14. Mate looking forward to seeing more at the moment im trying to figure all this out with a very uncommon ecu for a 4jx1 turbo diesel so far as i know now real kits or people have done it

    ReplyDelete
    Replies
    1. Well, then you can be the first! Good luck!

      Delete