Go Down

Topic: Automotive ECU reading to .bin (Read 94 times) previous topic - next topic


May 19, 2017, 05:40 pm Last Edit: May 19, 2017, 05:41 pm by Gahhhrrrlic
Has anyone every written a sketch for any AVR that allows you to read the ECU of a modern car via OBDII port and save it as a raw .bin file?


Search for Arduino and OBD2. There are a lot of projects that do it. Once you can read the CAN data you can save it in any format you like.


I have seen a few articles talking about intercepting the CAN bus' diagnostic signals and being able to do stuff like opening windows and the like but that's just traffic going across the bus.

What I'm interested in doing is downloading the tune file (usually 512 kb) from the Engine Control Unit.  This file contains the OS for the car and also all of the tables and tuning parameters like fuel tables, spark tables, torque management, etc, etc.  I've never seen anything that talked about how to download that bin file.  It should be technically possible with arduino and the shield but I've never seen anyone who did it.


I'm sorry to discourage you, but if you are talking about uploading the code and calibrations from an OEM engine controller from the last 10-15  years, forget it. Starting in the early 2000's they implemented security feature that make it difficult or impossible without the manufacturer's tool, or at least the protocol and security keys. There may be a few exploits out there on the internet, but they are probably specific to a limited number of model years.

New designs from the last few years and in the future have advanced security and encryption built into the hardware of the micros. The OEM tool has to be connected to the internet to access a secure site to get the seed and key values for that particular serial number.

The calibration data will be stored in a format. What format? depends on the OEM and the year and sometimes the model. Calibration tables almost always have check sums embedded in them which also have to be updated if you make a change. Sometimes the calibration tables are written in 2 different areas of FLASH in different formats (commonly 1's complement). If they don't agree, the SW sets a fault code and goes to limp home mode.

If you really want to do this, spend a lot of time searching the deep recesses of the internet. Someone might have figured something or there might have been a leak from the manufacturer. Most of the aftermarket chips or re-FLASH files you can buy are from people who have a connection to the OEM, maybe legit, maybe under the table, so they can get the OEM tools and memory map.

Go Up