Page 1 of 1

Locked and scrambled Evo VIII Rom

PostPosted: Fri Oct 27, 2006 9:28 am
by SpecOps
Hello all -

My friend was custom tuned.

He wanted me to take a look at his maps.

I'm using EcuFlash and tried to download his map. At first I wasn't able to do it, but then found a little program called ecu unlocker.

I downloaded his map. But, now when I look at it it looks like jibberish.

I'm assuming the tuner probably wrote something to the ecu that makes EcuFlash possibly think it's a different version of rom (not sure) and when EcuFlash tries to interpret it - it doesn't make sense and displays garbled values.

I've been looking at the file with a hex reader on my development system at work.

I'm assuming that EcuFlash reads a sector of memory and then reacts upon that and displays the values on the GUI when initiated. Unfortunately I can't seem to find the correct hex value.

has anyone run into this problem and been able to bypass it?

PostPosted: Fri Oct 27, 2006 12:10 pm
by Freon
Your best bet is to get tuned using Openecu in the first place and swap the Ecutek ECU or sell the Cobb AP.

PostPosted: Sat Oct 28, 2006 7:27 am
by SpecOps
Freon wrote:Your best bet is to get tuned using Openecu in the first place and swap the Ecutek ECU or sell the Cobb AP.


We are tuned using EcuFlash.

I've solved the problem.

It was actually quite simple. I'm not going to divulge the secret on how the tuner scrambled the map - I'm sure he does it so that the average Joe doesn't just pull the map and give it to his friends.

What the tuner failed to realize is that I'm an embedded systems software developer....

:D

PostPosted: Sat Oct 28, 2006 10:05 am
by Cabal
Did he just change the rom version to something that wasn't immediately recognized by the XML files, or something more complex?

PostPosted: Mon Oct 30, 2006 8:46 am
by MalibuJack
All that is being done is the 4 bytes for the internal ECU ID have been altered. If you have your original Rom, you can get the original bytes and put them back in with a hex editor

And this is correct, it was probably an attempt to prevent casual inspection/alteration of the roms

I've had quite a few people ask about this and figured it out a few weeks ago but decided not to talk about it until the complaints became more prevalent.

There is the possibility that the altered values were inadvertant, but it was clever..