Hacking a 20 Year Old Subaru

While cars are slowing becoming completely computer-controlled, road vehicles have been relying on computers since the 1970’s. The first automotive use of computers was in engine control units (ECUs) which came along as fuel injection systems started to replace carburetors.

[P1kachu]’s 1997 Subaru Impreza STi, like most cars of this vintage, uses an ECU and provides a diagnostic connector for external communications. [P1kachu]’s Subaru hacking project includes building a diagnostic interface device, dumping the ECU’s firmware, and reverse engineering the binary to understand and disable the speed limiter. If this looks familiar, it’s because we just covered the infotainment hacks in this car on Saturday. But he added information about the communications protocols is definitely worth another look.

This era of Subaru uses a non-standard diagnostics protocol called SSM1, which is essentially a 5 volt TTL serial line running at 1953 bits per second. The custom interface consists of a Teensy and a 3.3V to 5V level shifter. Once connected, commands can be sent directly to the ECU. Fortunately, the protocol has been quite well documented in the past. By issuing the “Read data from ECU address” command repeatedly, the full firmware can be dumped.

[P1kachu] goes on to locate the various engine tuning maps and discover the inner workings of the speed limiter. With cars getting more computerized, it’s nice to see folks are still able to tune their rides, even if it means using Teensys instead of wrenches.

45 thoughts on “Hacking a 20 Year Old Subaru

  1. 1953 bits per second

    Let me guess. That’s a 512us bit period, coming from a UART (in x16 mode) with a baud rate clock of 1MHz / 32. Or perhaps a UART (in x64 mode) with a baud rate clock of 1MHz / 8.

  2. In my family we are on our 11th Subaru since 1983. I can say there are several good reasons to have a Subaru. I can also categorically state that there are no good reasons to have a 20 year old Subaru.

      1. My Forester STi is going to be 19 in three months. And it’s a pretty great car, the japanese guy that had it before me took proper care of it, virtually no rust at all and the usual suspect spots are all sealed.

        It does get me from A to B aswell, but in a very enjoyable manner. Most kids with their Golf GTIs and whatnot don’t expect such a big wagon to suddenly go that fast.

    1. What’s a bad reason to have one? I have two subarus each of which is 20 years old or older (1995 legacy and a 1999 legacy outback), and I can’t think of a single reason to get rid of them. The main point of failure is a faulty head gasket and both have had that changed recently. The older one is approaching 350k and everyone who drives it loves it and wants one of their own, and I’d take the 99 anywhere without hesitation.

      1. Concur wholeheartedly. I have five Subarus and they’re all 2001 or older. I use the 99 to drive everyday back and forth to work in snow and ice and it’s a 75 Mi round trip. For years I used the 96 or 97. All of them still run supremely and I wouldn’t trade them for anything! Put a head gasket on them and they will drive forever…

      1. You make it sound like we only use one at a time. Bad assumption. We get 10-12 years out of them, at which point their maintenance costs are more than replacement costs, so off they go to pasture. Usually everything starts to go at once at around 10 years: timing belt and head gaskets are usually the tipping point, but the body, suspension, brakes, and exhaust and fuel system all need work, and the air conditioning is generally beyond repair by then too. There was a time I’d fix all that, but I lost enthusiasm on about the 5th one, and I’ve better things to do with my life now.

        1. By timing belt, you’re saying you only drive a car to either 100, or 200,000kms?

          There’s certainly exceptions to 10-12yrs being the life of a vehicle.. my car being one of them. with well over 200,000kms. Friend has a Saab with 300+kms on the clock. Everything works well, including the air conditioning although there have been odds and ends that needed doing (door lock actuator, window motor, ignition module)

          The trick to having a vehicle that goes further is to carefully choose what model you’re buying, and to buy one that has been well looked after it seems.

  3. … though I perked up when I saw he defeated the electronic governor. I’ve bounced off that hard limit several times in my ’08 Impreza, and it is literally jarring. Almost tooth-rattlingly ferocious. Dangerously disconcerting to have instant and complete power loss at speed like that.

    1. Vehicle speed limiter or engine speed limiter? Because if you hit the vehicle speed limiter on the street, you’re a dangerous asshole. And if you hit it on the track, you just should be doing research on your vehicle before trying to find its limits. If you mean the engine speed limiter, that’s protecting then engine and it cuts out hard so you don’t ruin your engine by over-revving it. A race car might turn the fuel and\or spark back on sooner so the cut doesn’t feel as hard, but an Impreza is not a racecar so it errs on the side of self-protection.

      1. likely vehicle speed, it’s 112mph as I recall, and it’s a hard limit like headbutting the windscreen sort of thing, and if it happens mid corner it’ll really upset the car. the sti can hit that speed very quickly, and is perfectly safe much faster. I have no trouble or problem with folk going that fast (or faster) so long as the roads empty and they are in control.

        1. You have no problem with people driving that fast on public roads?

          Of course it’s not a problem if the roads are empty and they are in control. The whole issue is that it’s hard to know for sure if the roads are empty, and it’s not like you *plan* to lose control. It’s reckless and dangerous, there’s no excusing it.

          1. Bro…calm your tits, it’s legal in some countries. I live in germany, i could hit the limiter a few times a day in a perfectly safe and sensible manner on those pretty straight sections of fast-travel roads we call Autobahn. Most people are already doing >80mph there anyways.

            And there’d still be some guy riding my ass, cause his Audi can go faster.

    2. Is it the same feeling as bouncing off the hard rev limiter? I’ve done that, but only when really trying to get out of the way at low speeds in first or second.. I didn’t think it was that disconcerting, just uncomfortable.

      1. Yup, but slower. It’ll cut fuel (and probably spark) when you reach the speed limit, make you involuntarily kiss the wheel, wait till you’re a few mph slower and then push you back into the seat if you haven’t let go off the throttle.

        1. Oh, i forgot: The fun thing about the Subaru limiters is that they’ll retard ignition slightly just before reaching limiter speed. Just enough to make you notice but not enough to make it go any slower. If you ignore that cue and push it to 188kph, it’ll cut fuel.

    3. I understand English pretty well, even though it isn’t my first language, but I don’t get what you mean. Either I’m naive or this is a cultural reference I missed out on. What is the business, and what is “shit ricer”?

      1. If I had to guess, I’d say “business” means the hobby of making after-market modifications to motor vehicles and that “ricer” is a racist slur based on a supposed correlation between ethnicity and those to make mainly cosmetic changes.

        1. Ricer is a racial slang term for cars of asian make vs locally made western ones and their implied beefed up manliness. The ”eat shit” needs a comma for comprehension. Our language is bad enough.

      2. Tuned or modified cars from oriental manufacturers are sometimes called ‘ricers’, with rice being a popular dish in those regions. The term is possibly referring to ‘racer’ too. The origins of the term seem to be derogatory, but it’s not always perceived to be a negative term. Some only apply the term to cars from oriental manufacturers with extensive cosmetic modifications, but little actual performance.

        In this case it sounds like Dave is into tuning non-oriental cars, and is trying to mark his territory. Somehow some people have it in their heads that people with the same hobby, but owning the wrong brand of car, are to be looked down upon and offended.

      3. ricer: either an Asian-made car, or the driver of one. To some, it refers to any car not made in the USA.
        Colloquial slur used by natives of North America, though mostly those in the USA. Stems from the older term “rice burner” which usually referred only Japanese motorcycles.

        As for what business “Dave” is in, I would suspect internet troll; more commonly becoming internet tough guy who likes pretending to defend racist American values so “those internet SJWs get triggered”. Or, “Dave” might be a USA car guy, who feels the need to put down those who bought a car made before he was born.

        It’s hard to tell.

        1. Amusingly, most US-market Subarus (and Hondas and Toyotas too!) have been built in the US for quite some time now, so the insult doesn’t really work, but whatever. Racists gonna be racist, I guess.

  4. When you start bouncing off the rev limiter it’s usually time to change up…. and clear the smoke… Another colloquial term down under for highly modified “big wing” cannon exhaust sporting rides, usually HR33 skylines, Silvia’s or 180SX with stupid low suspension, a huge sound system, a bunch of stickers and often damaged front bumper is ” full rice spec” and if shabby paint, bubbled aged window tint and no front bumper at all showing the non stock intercooler….. “drift pig”.

  5. Speed limiters are stock programming to not exceed the speed rating of the tires and suspension roll characteristics. Over speed stock tires and they will not stick to the pavement on curves at high speed. Body roll will increase with higher gravity forces on stock suspension which may lead into loss of control on curves at high speeds. Test all configurations at the track and don’t put other drivers at risk. Some mid 1990s stock chev Malibu could be reprogrammed with the calibration from a police interceptor package.

    1. We’re talking JDM cars here, those are pretty much all limited to 180kph for legal reasons. You could get the exact same car anywhere else in the world without said limiter.

  6. as cars get more and more ‘network based’ (lots of ethernet being designed into cars, now, replacing CAN and LIN) you can expect the firmware updates to be over the air (OTA) and encrypted/signed, so users won’t be able to even put a CAN query on the lines. I work in this field, so I can say this for a fact: the days of CAN and serial hacking are coming to an end, for all e-cars being designed now.

    I would prefer a safe interface for users to write apps to, but I don’t see the companies doing this. if anything, they are locking it all down, not opening it up.

    1. As much as I want to agree that a well-designed system should be used in vehicles, that is not a industry I expect to be able to figure out how to properly design networks or firmware.

      Automotive manufacturers want a modular system, designed by someone else, for very cheap.
      Based on how awesome on-star is to maintain, I do not expect this to happen anytime soon…

      And OTA updates are an even longer way out as manufacturers still need to provide updates, but there is a large market who don’t want to pay for a data plan or subscription for their car.

  7. Off-topic, but someone should really sell a small breadboard like that with a snap-on cover, with some knockout holes distributed about the cover for wire access and whatnot.

    I have a little Arduino ADB->USB keyboard adapter that would fit perfectly which I’ve been meaning to model and print a case for, but a breadboard and snap-on cover would be perfect.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.