Ford Focus ST Forum banner

1 - 20 of 43 Posts

·
The Site Founder
Joined
·
3,422 Posts
Discussion Starter #1
Tuning Protection / Anti-Tune explained..

[h=1]Tuning Protection / Anti-Tune explained..[/h]On Bosch EDC17 and MED17 ECUs

We've had many people asking why we need to open the ECU's of the later cars brought to us, and what is this "tuning protection" many companies are talking about. Here's a brief explanation of it. "Tuning Protection" for the Infineon TriCore TC-series processors (Bosch MED17/EDC17) On the CR TDI and 1.8/2.0 Turbo Petrol engines with the latest Bosch ECU generation (MED17 for the petrols, EDC17 for the diesels, I'll just refer them to MEDC17 from now on...), Bosch has implemented some new security measures to protect against aftermarket reprogramming of the engine control unit calibration data. Bosch originally started to use various checksums in the late 80's to verify the data integrity of the engine control unit memory content. Originally this was just a simple additive checksum, where you count the sum of all bytes in the file, and store the value in one place. Later on, it was also used to protect the data from unauthorised modifications (thats us...). For example, ME7.5 ECU (1.8 Turbo) contains about 70 different checksum blocks, and the result values are filtered through various functions to have a secure method of verifying data integrity. At around the same time, Bosch started using access control on the outside ECU reprogramming (that is what we call the OBD flashing nowadays). It's usually a normal challenge-response scheme with a seed-key algorithm. Of course, the chiptuning industry kept on and solved these functions to have methods of correcting the checksums, and to have OBD programming capability of these ECUs. About 7-8 years ago, Bosch started using RSA signatures to control the ECU contents. Early on, just a 256bit RSA, then 512bit RSA, and nowadays, on these new ECUs, its a hash from a 1024Bit RSA signature. Something thats virtually un-crackable with traditional brute force methods. Since these keys are yet to be solved, tuners have had to find other ways of programming the ECUs. When the MEDC17 ECU family was released, a backdoor was found in the programming algorithm. Originally this hash was checked only after certain conditions were met. If they are not met, it was not checked. So the programming method made sure that was the case every time they programmed the ECU. This "Tuning Protection", as it is commonly called, just means that this backdoor has been sealed, and the ECU always checks the hash validity after every OBD programming attempt. If this is not valid, it sets a flag in the memory that prevents the car from starting. Our tools can detect this function just by reading the ECU via OBD. Many others, including some big brand names, have problems with cars not starting after writing. That is why, for now, on these protected ECU's, we need to open the ECU to use a processor function built in the TC17xx-series processors, which allows us to boot and reset the ECU at any given moment from pins on the motherboard. This way the ECU does not detect it as being an OBD programming attempt, and skips the hash validity check. At this time, there are no tuning companies who can bypass this security check and if an ECU has "Tuning Protection" then it will need to be programmed by taking the ECU out and opening it. Some call it "bench flash", some say they "install a probe", but this is how it is done by ALL tuners who are offering remaps on "protected" MEDC17 ECUs.
I am pretty sure the Focus ST uses that ECU. But I've seen stand-alone chips used in BMW's. Neat stuff.

Discuss..
 

·
Premium Member
Joined
·
1,368 Posts
An ECU tune for a GTI costs £499 which, off the top of my head, equals around 800 bucks USD. That's insane... HP tuners is around 500 bucks, and that lets you tune the ECU whenever you want! I guess it could be the Euro thing, though... Everything's more expensive for European cars (then again, the Focus was designed in Cologne...)
 

·
Registered
Joined
·
549 Posts
APR Stage1 GTI tune is often on sale for $599, includes 4 types of tunes (91octane, 93, valet etc) and if dyno charts are to be believed, gives the MKVI GTI 300 ft lbs of torque(93octane). I've seen video of APR Stage1 GTI running with some fast cars.
 

·
The Site Founder
Joined
·
3,422 Posts
Discussion Starter #5
Well the topic is this so called unbreakable ecu. I thought I was reading around and they have this ecu cracked already. Could be a rumor.

HP tune might take awhile ... At one time I was seriously thinking about a BMW 135i for my next purchase. Naturally I checked out tune options. One of them was stage 1,2, & 3. Which was a ecu bypass I guess.
 

·
Registered
Joined
·
358 Posts
Well the topic is this so called unbreakable ecu. I thought I was reading around and they have this ecu cracked already. Could be a rumor.

HP tune might take awhile ... At one time I was seriously thinking about a BMW 135i for my next purchase. Naturally I checked out tune options. One of them was stage 1,2, & 3. Which was a ecu bypass I guess.
don´t burn your money on a 135i!
 

·
The Site Founder
Joined
·
3,422 Posts
Discussion Starter #8
I don't care what encryption you have. It is breakable. It all takes is patience.
 

·
Registered
Joined
·
25 Posts
There is only one car I know of that tuners gave up on and its the Gen 2 cts. GM has used 5 different ecus in that one car. Tuners said screw it cuz they would have to break all of them and tune for all of them. The market just wasn't there. And why in the world would anyone want to block us out? They know when we tune and can void the warranty when they see it so what's the difference?
 

·
Registered
Joined
·
549 Posts
and those are flashed using the aforementioned method, right?
Current 2012 GTI with the Bosch stuff is a bench flash only for now. Cannot be done through OBD port. I've seen rumors of something being worked on, but nothing confirmed anywhere that I can see. My bet is that if you want an ST tune, your ECU has to come out.
 

·
Director of Web Relations
Joined
·
4,009 Posts
When it does happen, group buy!
 
  • Like
Reactions: JdubST13

·
Director of Web Relations
Joined
·
4,009 Posts
Get cracking!
 
  • Like
Reactions: Chad

·
Registered
Joined
·
45 Posts
Hopefully they have more luck than the 2011+ Hemi's. The Dodge boys haven't been successful at cracking that encryption and it's been almost 2 years.
 

·
Registered
Joined
·
693 Posts
my brother is an IT guy and said that its encryption is pretty indepth. i cant recall how many bits it is but its many. in due time........ GROUP BUY as soon as its available.
 

·
Registered
Joined
·
440 Posts
Dear Ford,

Please leave the ECU in a spot that is easy to access. Not saying i will remove it but i would like to know where it is at all times and in the event my car stays in a sketchy area and the % of my car getting stolen increases; i can carry it in my murse with my aftermarket deck face.

Thank you,

Hacker
 

·
Registered
Joined
·
547 Posts
Dear Ford,

Please leave the ECU in a spot that is easy to access. Not saying i will remove it but i would like to know where it is at all times and in the event my car stays in a sketchy area and the % of my car getting stolen increases; i can carry it in my murse with my aftermarket deck face.

Thank you,

Hacker
driver side wheel well
 
1 - 20 of 43 Posts
Top