Help With Home Made OBD2 Tunning Device... - Diesel Truck Forum -
Thread Details Posted by CYRAX, this thread has received 3 replies and been viewed 3812 times.

LinkBack Thread Tools Display Modes
post #1 of 4 (permalink) Old 08-23-2011, 12:33 AM Thread Starter
Junior Member
CYRAX's Avatar
Join Date: Aug 2011
Posts: 1
Points: 8,728
Thanks: 0
Thanked 0 Times in 0 Posts
Help With Home Made OBD2 Tunning Device...

after recently purchasing a 06 f250 it must have included the tinker bug with the sale, as a electronics tinker bug its made me want to figure out how exactly these after market "Power" tuners are able to flash the ecu's eeprom. So now that you know what started this nightmare here's what ive figured out so far lol.

===== To enter programming mode =====
- Turn key from OFF to ON position then apply 18 volt DC signal to pin 13 on J1962 connector to initiate PCM reprogramming.

This is where it gets tuff the ecu has a type of security (seed/key algorithm) to protect it from accidentally entering programing mode with code scanners ect..

With 18v on pin 18
- Step 1 The external device shall request a “seed” from the on-board controller by sending data bytes (27 01)
-The controller shall respond by sending a "Seed"(67 01 ==seed value==). A seed value of zero will indicate that the controller is currently unlocked.

- Step 2 The external device shall respond by returning a "Key" number back to the controller (27 02 ==key bytes==).
The controller shall compare this "Key" to one internally determined and issue Response. If the two numbers agree, then the controller shall enable ("Unlock") the external device's access to secured communication modes.

When it comes to a ford the challenges (seeds) and responses (keys) are both just 16 bits.

Ford uses a proprietary hash algorithm that requires two inputs to generate the Key. The two inputs are a 3 Byte Seed + 5 Byte Static Offset. The three Byte Seed is given to you at the start of the Unlock process. These 3 Bytes are generated by the controller. The 5 Byte Static Offset is specific to each controller. This allows Ford to use the same algorithm for each controller but have different result given the same Seed because the output is a function of the Seed + the Offset. The Seed changes each time it is requested, while the Offset does not change. To sum this process up we take the 3 Byte Seed we requested from the controller, the 5 Byte Static Offset and apply it to the security algorithm. This will yield a 3 Byte Key. We send this Key to the controller and voila, it's now unlocked and we can write data to its memory regions without restriction. So how do you get the 5 Byte Offset from the controller.

where im stuck at now is im needing a "dump/rom" of a fords ecu to decompile it and see if i can figure out the algorithm to generate the needed key to return...

Last edited by CYRAX; 08-23-2011 at 12:48 AM.
CYRAX is offline  
Sponsored Links
post #2 of 4 (permalink) Old 10-01-2011, 03:19 AM
Junior Member
Join Date: Dec 2010
Posts: 721
Points: 51,373
Thanks: 51
Thanked 140 Times in 115 Posts
Way over my head!
lenzhotrod is offline  
post #3 of 4 (permalink) Old 10-01-2011, 04:20 AM
7.3 addict
Join Date: Jul 2007
Location: waterloo Il. (stlouis)
Posts: 644
Points: 44,437
Thanks: 82
Thanked 48 Times in 42 Posts
WOW I'm lost too!

1) 99 f-350 srw 7.3 6pos. bully dog, afe intake, mrbp 4" exhaust,250,000 miles and still rollin.
2) 2000 excursion 7.3 afe intake, mrbp 4" exhaust. chip coming
3) NEW TO ME2000 cc drw 7.3 let the mods begin
4) FOR SALE 87 f250 6.9 9' utility body.
5) SOLD 91 f150 good truck just well used.Gonna miss the old girl allways started even after sitting for 6 months.

I think i'm trailer poor ) 22' w\18' tilt car hauler, 18' flat bed, 2 horse D&D, 12' utility, 19' "v" nose, and 37' 5er

"quote from tank"
"I use baby wipes.....

Because if you think that a wadded up piece of paper is actually getting the chit off of your butt.....then I have to ask a question....

.....if you wiped a turd on your arm....would you just use a paper towel to get the turd off?.....or would you wash your arm?...

...let that thought roll around in your head for a moment...

" thank you tank for that insightful thought

#46 AMERICAN (blood) club
#241 singles club
# ? Dually club
# ? Excursion club
jestersv is offline  
post #4 of 4 (permalink) Old 09-08-2019, 08:53 PM
Junior Member
KET19's Avatar
Join Date: Feb 2010
Posts: 79
Points: 69,893
Thanks: 13
Thanked 16 Times in 11 Posts
That is where you would need a tuner's software like SCT and decompile for what you are after.
KET19 is offline  

j1850 pwm, j1850 vpw, j2190, odb2, sae

Quick Reply

Register Now

In order to be able to post messages on the Diesel Truck Forum - forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Please enter a password for your user account. Note that passwords are case-sensitive.


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:


Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page
Display Modes
Linear Mode Linear Mode

Similar Threads
Thread Thread Starter Forum Replies Last Post
Traction Bars????? Home made bigdaddysdaddy 5.9L Cummins (Pre 1994) 6 10-01-2010 12:07 PM
home made wastgate controler... derek3382 6.5L Diesel Engine 12 09-12-2009 11:32 PM
Home Made Fuel system??? 2tonePSD 1994-2003 7.3L Power Stroke 13 01-19-2008 05:42 PM
home made stacks imported_machine2 5.9L Cummins 12 Valve (1994-1998.5) 11 06-14-2007 05:11 AM
Finally made it Home!!! 95psdF250 The Parking Lot 4 05-06-2006 10:28 PM

Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

For the best viewing experience please update your browser to Google Chrome