Cannot read flash from Evo9 (UK FQ)

[AutoXer]

Thanks.

Are the keys coded to the ECU or the ECU coded to the keys?

I mean, if I get another ECU and get the imobiliser sorted on the second ECU, can I then just swap between the two or will the 're-code' need to be done each time the ECU is swapped?

The keys are coded to the immobilizer. The ECU is also coded to the immobilizer. However, the two codes are independent of each other. You need to have the immobilizer code for the ECU.

I believe I'm in the same boat as you. I have a second ECU, but I can't get the immobilizer code off of my existing ECU. It's driving me nuts!

Al(Dynoflash), said that he can get the code off my working ECU, but he'd charge me for it. I'm waiting to see if a free fix emerges. I can't believe you and I are the only ones in this situation.

[S54fan]

For some reason the JDM GSR ECU I bought starts my car (UK FQ340). You can see the ROM image I already posted. I don't know why it works. I thought the immobiliser-ECU was a two way thing.

[SilverBack]

Thanks.

Are the keys coded to the ECU or the ECU coded to the keys?

I mean, if I get another ECU and get the imobiliser sorted on the second ECU, can I then just swap between the two or will the 're-code' need to be done each time the ECU is swapped?

The keys are coded to the immobilizer. The ECU is also coded to the immobilizer. However, the two codes are independent of each other. You need to have the immobilizer code for the ECU.

I believe I'm in the same boat as you. I have a second ECU, but I can't get the immobilizer code off of my existing ECU. It's driving me nuts!

Al(Dynoflash), said that he can get the code off my working ECU, but he'd charge me for it. I'm waiting to see if a free fix emerges. I can't believe you and I are the only ones in this situation.

Thanks.

I've kind of stalled not wanting to spend much more money on this little project right now. Driving me bananas too!

So it is poss. to just swap ECU’s if you get the second sorted ...?

I have to say that if I had a second ECU, I’d be down to my local Mits dealer with the ECU, a crisp £20 note and a big - convincing - smile!

Not that I’m glad to hear of somebody else’s misery, but I was starting to feel a little alone… like I’m missing something obvious.

[AutoXer]

I have to say that if I had a second ECU, I’d be down to my local Mits dealer with the ECU, a crisp £20 note and a big - convincing - smile!

My dealer wanted $80 and wasn't sure that the techs knew what they were doing.

[AutoXer]

For some reason the JDM GSR ECU I bought starts my car (UK FQ340). You can see the ROM image I already posted. I don't know why it works. I thought the immobiliser-ECU was a two way thing.

Interesting... Maybe they only use a certain number of codes. If they used all the possible codes, your chances of hitting the right one would be 1-in-65536. However, if they limited the number of codes that they used, your chances of "getting lucky" would be greatly increased.

I may be going a little off-topic here, but bear with me. Is there any reason that someone would not want to post their immobilizer code? I can't think of any good reasons. It won't make their car any easier to steal, unless they remove their ECU everynight and store it under their pillow. There's a reason why I ask... I think we should start a list of codes to see if there are only a certain number of codes used. I'll post the code from my 2nd ECU when I get home this evening.

[S54fan]

Maybe some ECUs are not immobilised, such as my GSR one?

[AutoXer]

Maybe some ECUs are not immobilised, such as my GSR one?

Though I was actually told using FFFF will allow the ECU to bypass the immobilizer, but I'm not so sure about that and haven't had an opportunity to try it

Hmmm.... anyone tried FFFF?

[SilverBack]

Maybe some ECUs are not immobilised, such as my GSR one?

Hmm... I've heard car crime is virtually zero in Japan so maybe...

[SilverBack]

I have to say that if I had a second ECU, I’d be down to my local Mits dealer with the ECU, a crisp £20 note and a big - convincing - smile!

My dealer wanted $80 and wasn't sure that the techs knew what they were doing.

I'm thinking it's may be the only way forward for me now without knowing for sure why the FQ ECU won't init.

Just need a Mitsi insider...

[cboles]

It probably has a different init sequence. I could figure out what it is if I had the ECU to fool around with...

[SilverBack]

It probably has a different init sequence. I could figure out what it is if I had the ECU to fool around with...

Can I attempt different inits for you? Is it practical?

[cboles]

My preferred method is to connect internally via the AUD port and examine / takeover the boot code in RAM, which would not be practical for you. On a bench programming setup, you could let it run for a few days with a special program to try all 65536 combinations of init codes. That would only work if it was simply an init code difference in the boot protocol (it probably is) and not a different protocol altogether.

[SilverBack]

My preferred method is to connect internally via the AUD port and examine / takeover the boot code in RAM, which would not be practical for you. On a bench programming setup, you could let it run for a few days with a special program to try all 65536 combinations of init codes. That would only work if it was simply an init code difference in the boot protocol (it probably is) and not a different protocol altogether.

I'm limited by my single ECU at present and the IX is my main car. I can't really be without for extended periods of time...

Right then... ECU hunting. I'll let you know if I come across an FQ ECU.

Thanks for the reply Colby.

[YP]

Hmmm.... anyone tried FFFF?

I tried it on non turbo MMC CARISMA 03MY. No chance. Diagnostic tool reports about P1610 (Immo connection). I think in evo will be the same result because immo code in the same addresses (3ffce-3ffcf)

[AutoXer]

On a bench programming setup, you could let it run for a few days with a special program to try all 65536 combinations of init codes.

Looking at the log when I connect, it looks like it sends a byte(0x01), then gets a response, then sends another byte(0x00), then gets another response. If this is the case, couldn't you just brute force the first byte until you get a response. Then using the found first byte, brute force the second byte.

255 combos on the first + 255 combos on the second = 512 total tries possible

Maybe I'm over simplifying it.?