ECU cracker
09-02-13, 12:53 AM
#18
Driver School Candidate
Join Date: May 2006
Location: N.I
Posts: 37
Likes: 0
Received 0 Likes
on
0 Posts
To bigcloud, is there anything to support this, or anything as far as the language it uses.
To bondango, on the forums they were talking of a bosch encrytion or maybe it was bosch design similar i'm assuming to the charger ecus. and 3 companies in japan supposedly have interfaces to the ecu to flash it and tune it to an extent. yes its denso and ecu says it but again bosch involvement.
To tgui, Jtag access has been neutered along with locking down the ecu if bad comands are sent, by who and neutered as in not implemented anymore, and I would buy a test ecu on the side not working on my own duh. Any knowledge on usb interfaces or what those lexus authorized to tune ecu (trd, sard, and i don't remember) usb hopefully.
To bondango, on the forums they were talking of a bosch encrytion or maybe it was bosch design similar i'm assuming to the charger ecus. and 3 companies in japan supposedly have interfaces to the ecu to flash it and tune it to an extent. yes its denso and ecu says it but again bosch involvement.
To tgui, Jtag access has been neutered along with locking down the ecu if bad comands are sent, by who and neutered as in not implemented anymore, and I would buy a test ecu on the side not working on my own duh. Any knowledge on usb interfaces or what those lexus authorized to tune ecu (trd, sard, and i don't remember) usb hopefully.
The 3 companys mentioned have a long standing business link with Denso japan and have always been given access to the Denso's own hardware / software regarding ECU calibtation.
Please kill this thread its embarrassing like the many before
the only 2 possible ways forward :-
1. JAPANESE MARKET ECU will it pair to an ISF, all electronics aren the same regarding engine control etc etc, its not like the good old days of map vs MAF and jap vs USDM differences. So if it pairs then the option is there for novel/Sard etc etc
2. Dealer level flash calibration file. This is basically the Data required which we need to manipulate. A dealer recalibration file contains any changes in maps/settings/ etc etc and is a Complete Refalsh file. We we would need someway finding a data scematic to make sense of the information in this file, and a way of changing it. I.e. we dont need to access the ECU as full calibration files are available via lexus download.
Last edited by bondango; 09-02-13 at 01:53 AM.
10-29-13, 10:40 PM
#21
Lexus Test Driver
I wouldnt hold you breath over it... I've tried and eventually ran out of air. LOL
With all jokes aside though, we have some really smart people on CL and brave ones who are willing to undergo this ECU cracking project. However I dont think any have been successful. Even big shops like D3PE have tried with little to no luck. There was also another company who kept stating they were waiting on cases for the thier "units" but that subject/thread died real quick and took everyone's hopes and dreams down with it. JDM ECUs have been cracked by SARD but nothing for the USDM market.
With all jokes aside though, we have some really smart people on CL and brave ones who are willing to undergo this ECU cracking project. However I dont think any have been successful. Even big shops like D3PE have tried with little to no luck. There was also another company who kept stating they were waiting on cases for the thier "units" but that subject/thread died real quick and took everyone's hopes and dreams down with it. JDM ECUs have been cracked by SARD but nothing for the USDM market.
10-30-13, 04:56 AM
#22
Tech Info Resource
iTrader: (2)
So a very good friend of mine spent his time at APR cracking ECUs while attending Auburn University and getting a degree in embedded systems. He spent 3 years trying to crack the Scion tC ECM. Here's what we know:
1. The processor and its instruction set are unique to Denso. No x86, RISC, or other well known machine code.
2. The only compilers for this ECM are controlled by Toyota.
3. The physical construction of the processor puts the code onboard the processor so there is no separate memory to attack.
4. There are no hardware interfaces on the processor to get it to cough up anything.
5. The processor memory is burned and the links used to program it are fusible links, so they are destroyed after it is programmed.
6. The flash memory holds ONLY calibration data in a proprietary format and the encryption does not have to follow any well known standards.
6. The tuning software is controlled by Toyota, and the only company known to possess this software outside Toyota is Lotus - this presents the only even slightly likely possibility one could obtain the necessary tools to recalibrate a Denso ECM, as it might be possible to pay someone at Lotus enough money to get the necessary tools (unlikely, but potentially possible).
If you can afford to etch down the processor to determine its architecture and instruction set you have a small hope of success. This is what I know from someone who made a living cracking Bosch ECMs like popcorn.
1. The processor and its instruction set are unique to Denso. No x86, RISC, or other well known machine code.
2. The only compilers for this ECM are controlled by Toyota.
3. The physical construction of the processor puts the code onboard the processor so there is no separate memory to attack.
4. There are no hardware interfaces on the processor to get it to cough up anything.
5. The processor memory is burned and the links used to program it are fusible links, so they are destroyed after it is programmed.
6. The flash memory holds ONLY calibration data in a proprietary format and the encryption does not have to follow any well known standards.
6. The tuning software is controlled by Toyota, and the only company known to possess this software outside Toyota is Lotus - this presents the only even slightly likely possibility one could obtain the necessary tools to recalibrate a Denso ECM, as it might be possible to pay someone at Lotus enough money to get the necessary tools (unlikely, but potentially possible).
If you can afford to etch down the processor to determine its architecture and instruction set you have a small hope of success. This is what I know from someone who made a living cracking Bosch ECMs like popcorn.
11-02-13, 09:26 PM
#26
Tech Info Resource
iTrader: (2)
Looks like the same CAN bus approach some other guys were saying they would release for the IS-F last June. They still haven't said anything public about that. 
08-20-14, 05:29 AM
#27
Driver School Candidate
Join Date: Aug 2014
Location: Slovakia
Posts: 3
Likes: 0
Received 0 Likes
on
0 Posts
Sorry for opening old thread. I discovered the way how to reprogramm the toyota denso ecu with changed software. I used it to remove the DPF from D4D engine. I have not experience with remapping and Im not able to recognize the map tables in the code. Also I dont know if is possible to recognize them but maybe somebody experienced with tuning of subaru ecus can check the toyota BIN and look for some similliarity.
08-20-14, 06:54 AM
#28
Driver
Join Date: Jan 2014
Location: Virginia
Posts: 168
Likes: 0
Received 0 Likes
on
0 Posts
If you can crack the ECU for a cheaper price than Novel, and add in adjustments for mods, there is quite a bit of money to be made. Even the Novel ECU can't adjust for mods. If that is done, that would be amazing. Good Luck 
08-20-14, 11:15 AM
#29
Driver School Candidate
Join Date: Aug 2014
Location: Slovakia
Posts: 3
Likes: 0
Received 0 Likes
on
0 Posts
I didnt found the way how to change the maps in ROM but I found the way how to burn in modified or different ROM into the ECU which is generally not possible. Im able to move up or down between firmware versions or burn the ROM from different car.
Im looking for some info or cooperation on discovering the toyota rom.
Im looking for some info or cooperation on discovering the toyota rom.
Last edited by error7889; 08-20-14 at 11:19 AM.
08-23-14, 11:11 AM
#30
Tech Info Resource
iTrader: (2)
I didnt found the way how to change the maps in ROM but I found the way how to burn in modified or different ROM into the ECU which is generally not possible. Im able to move up or down between firmware versions or burn the ROM from different car.
Im looking for some info or cooperation on discovering the toyota rom.
Im looking for some info or cooperation on discovering the toyota rom.