Automotive security specialist by day [P1kachu] hacks his own cars as a hobby in his free time. He recently began to delve into the Engine Control Units (ECUs) of the two old Hondas that he uses to get around in Japan. Both the 1996 Integra and the 1993 Civic have similar engines but different ECU hardware. Making things more interesting; each one has a tuned EPROM, the Civic’s being of completely unknown origin.
[P1kachu] took his Civic to a shop to have some burned-out transistors replaced in the ECU, and a chance conversation with the proprietor [Tuner-san] sends him on a journey into the world of old EPROMs. [Tuner-san] pulled out an old PROM duplicator stashed away under the counter which he originally used as a kid to copy PROM chips from console games like the Famicom. These days he uses it to maintain a backup collection of old ECU chips from cars he has worked on. This tweaked [P1kachu]’s curiosity, and he wondered if he could obtain the contents of the Civic’s mysterious PROM. After a false start trying to use the serial port on the back of the PROM copier, he brute-forces it. A few minutes of Googling reveals the ASCII pinout of the 27C256 EPROM, and he whips out an Arduino Mega and wires it up to the chip and is off and running.
He’s currently digging into the firmware, using IDA and a custom disassembler he wrote for the Mitsubishi M7700 family of MCUs. He started a GitHub repository for this effort, and eventually hopes to identify what has been tweaked on this mysterious ECU chip compared to factory stock. He also wants to perform a little tuning himself. We look forward to more updates as [P1kachu] posts the results of his reverse engineering efforts. We also recommend that you be like [P1kachu] and carry an Arduino, a breadboard, and some hookup wire with you at all times — you never know when they might come in handy. Be sure to checkout our articles about his old Subaru hacks from in 2018 if these kinds of projects interest you.
https://hackaday.com/2021/07/02/dumping-90s-honda-ecu-programming-with-arduino/
Kind of reminds of this article from ages ago:
https://hackaday.com/2021/07/02/dumping-90s-honda-ecu-programming-with-arduino/
Ahhh, those were the days, eh? The good old days of yore ..
What is the secret of being featured here twice?
I for one see nothing wrong with that, since there are separate “goals” involved:
The first one was about dumping the ROM chips, while the second one is about hacking the firmware. ;)
Also, there’s a saying that says, essentially “once is not enough” (translated).
While another one says “all good things come in threes”. :)
Measure once, cut twice.
hmm
Two authors engaged in a write-off?
Now this is beginning to be silly …
So nice we’ll feature it twice!
Leave both articles up! Even though it’s about the exact same blog post, it does have an interestingly different focus to the earlier article.
Yes, let’s not turn into stonk overflow around here.
Ebin doublepost :D
Is this Slashdot? Do I have to get Natalie Portman to put hot grits down my pants on this site too?
As far as contributor competitions go this second writeup by Chris Lott wins hands down – links to github and previous article highlighting same author.
Now back to p1kachus blog
>Those EPROMs are now out of production and thus stupidly expensive
$3 per 5 27C256 eproms …
> which is why people tend to turn to some full-aftermarket solutions instead now.
nah, people moved on to $200-400 Hondata S300 or Moates Demon/Ostrich because burning eproms is the most stupid way of tuning cars ever devised – you want to see changes live on the dyno after every PgUp, not wait 15 minutes per iteration while tuner erases your chip and burns new one.
Hondata & clones employ Xilinx CPLD and SRAM/MRAM performing Eprom emulation. This lets you change values live during the tuning session. They also do logging for easier diagnosing of problems, some even have bluetooth option so you can monitor live stats on ODB0/1 cars.
Another crazy Honda fact: all their ECUs from 1992 (P05) onward had full facility to drive individual coil on plug, but officially Honda switched away from mechanical distributor in 1999 (S2000?). You can trivially convert 92 car with a small adapter board, ECUs shipped with all the needed firmware and hardware in place sitting unused for 7 years.
>He proudly showed me the newest addition to his collection: my EG6’s unknown firmware. I asked a few details about it, like where is it from and what’s different compared to the Spoon one, but since he can only copy the firmware from one chip to another using his machine, he had no mean of actually reading the code and answer my questions
There are >5 Honda tuning programs able to interpret raw eprom images, with couple free like TurboEDIT, yet here we have a tuner master from Japan unable to dump emproms and not curious enough to figure it out, just collecting physical chips. Typical Japan, retro futurism personified :o
> Tuner-san … that there was really no real reason to do so as he already has some high quality firmwares ready for those cars
/slaps forehead. This indeed works if your mechanical modification to the car is 100% repeatable. Slap Spoon Intake and Exhaust, replace prom with one of the “high quality firmwares ready for those cars” and job done. Doesnt really work if you arent using off the shelf parts from one vendor.
“nah, people moved on to $200-400 Hondata S300 or Moates Demon/Ostrich because burning eproms is the most stupid way of tuning cars ever devised”
It’s not quite as stupid as Honda choosing to use a battery backed up chip for storing the data then not mentioning to anyone that same chip only had a live of around 3years max when not being powered externally.
Then completely absolving themselves of any responsibility over warranty.
Because funnily enough not everyone has their ECU powered 24/7 in a track car, race car, modified car and so on.
Just to show how dishonest Hondata can be, they acknowledged the problem and fixed in in the later S300’s but instead of telling people and showing them how to fix it, they instead change around $200 for you to “upgrade” to the alter board because of a problem they know 100% all about.
But then a company based on reverse engineering other people’s (Honda’s) copyright that then goes after people that reverses their copyright (PGMFI forum, Cracked Hondata, HondaVert, etc) clearly has a problem in the ethics department.
You can buy replacement dallas chips for $10-20, or dremel/melt the case to access battery terminals and bodge your own replacement for the price of a coin cell https://ardent-tool.com/misc/Dallas_Rework.html
I didnt know they didnt inform users about perishable nature of the product, kinda shitty of them :/
There’s open source software that was developed 15+ years ago that reads the prom data dump and allows you to view settings, ignition/fuel maps in 3d and edit the files. Software is called crome. I was dumping and editing proms back in 2008 with it.
I used to sell the pre-tuned chips on eBay. I have a load of ROMs somewhere.
http://forum.pgmfi.org/ has an abundance of information if you’re interested in Honda ECU’s. How to, roms, tuning software, ect.
So no one took away from this article that the he was taking the ECU to a shop to have a few transistors replaced?
Anyone know where one of those kind of shops in the US is?
try hackerspaces, laptop/phone repair shops (but not the franchised ones), eevblog repair forum