Reading a 370 ECU ROM

I’ve always been interested in tuning my vehicles; even when I had cars that weren’t worth the effort. Now that I have a fun car, I’m going to finally get the chance to do it.

I’m aware that the Subaru community has a lot of support in the form of Open Source tools for ECU tuning, and we simply don’t have that for our newer Nissans. I would like to change that.

As I’m doing my research I’ve also learned that there are several “classes” of ECUs for most Nissan vehicles. It seems that before around 2008/2009 most of the ECUs were not exclusively controlled/queried over the CAN bus. There is some limited community support for these older K-line-equipped ECUs.

For our newer vehicles, we for the most part have to turn to one of two tuning systems; ECUTek or UpRev. From what I hear, ECUTek is more advanced software, but UpRev allows individuals to tune on their own. This is important to me. I waited around until I found a good deal on a used UpRev tuner cable/license on the 370z forums and I got it at a little less than half price. I’ve only casually played around with their software, but I was hoping for it to be more open than it is. I understand the need for companies to protect their IP, but I was hoping for a little more access, in general, than they provide. For example, I would like the ability to read my stock ROM from the vehicle. There is no reason for their tool not to support reading and saving a STOCK ROM… but they don’t.

There is an option in their software to “Copy ECU Data”. It seemed to me like this would dump my ROM. I connected the tool and read the data. After the tool finished, I was excited to be able to open up my ROM in a hex editor and stare at beautiful tables. Unfortunately, the tool stores even the stock ROMs encrypted on your PC. Why? Surely there’s no harm in giving me my own data. The tool instructed me to send the encrypted ROM file to UpRev. After some reading, I think that I learned that this is mainly used for sending ROMs from new, unsupported vehicles to UpRev, so that you can pay them to add a new model to their lineup.

So how do I get my ROM?

It just so happens that I work in the automotive industry, as a software engineer for company that makes braking ECUs. Because of this, I have access to some high-quality CAN tools. I figured that even if UpRev decides to store my stock ROM encrypted on my laptop, the reading of my ROM by the tool will still be cleartext. I figured that maybe if I take a bus log of the entire ECU read, then I could possibly recover my ROM from the data in the CAN transfer…

I figured right.

I brought my work laptop and my Vector CAN card home, and fired up my personal laptop with UpRev installed. I re-read my ECU with their tool, but this time I was watching in the background on my other laptop. I logged the entire 15 minute bus transfer in Vector’s CANAlyzer software. In order to accomplish this, I had to make a “Man in the middle” cable that will allow me to watch the CAN bus during the transfer. I left the rest of the OBD lines undisturbed, in case the tool uses those for some reason during the transfer.

After I pulled the entire log I was encouraged that this was going to work; the entire ECU ROM is read through CAN service 0x23 requests. For those unfamiliar, this is a CAN message used to request data stored at an arbitrary address. Support for this service is fading for good reasons revolving around security concerns. The ECU ROM is read 63 bytes at a time.

Below is a small sample of the data transfers:

CANFD 1 Rx 7e0 0 0 8 8 07 23 00 00 27 9f 00 3f
CANFD 1 Rx 2de 0 0 8 8 00 00 80 05 70 00 02 9c
CANFD 1 Rx 7e8 0 0 8 8 10 40 63 00 81 65 85 66
CANFD 1 Rx 2de 0 0 8 8 00 00 80 05 70 00 02 9c
CANFD 1 Rx 7e8 0 0 8 8 10 40 63 00 81 65 85 66

The tool’s ID is 0x7e0, and the ECU responds on 0x7e8. So this message is the UpRev tool asking for 63 bytes of data (0x3f) from memory address 0x279f. After the request the ECU sends this data. After seeing how simple and structured these requests are, I wasn’t worried about being able to recover my ROM.

What I ended up doing was writing a small piece of software (two, actually) to parse out the ROM data. First off, I wrote a small perl script to filter out everything except for the messages from IDs 0x7e0 and 0x7e8. Then, I wrote a small CSharp program to reconstruct the ROM from the remaining CAN messages. It’s not professional or beautiful code; it’s utilitarian and it works. It’s not abstracted to the point where it can be used on other vehicles with other CAN IDs, but I’m happy with how it turned out for 97 minutes of coding (yes, I timed it). I will post the code here. I haven’t modified it to make it pretty. Also, I note that the small perl scritp I wrote was my first and last experience with perl. I’m sure its inefficient, and I’m probably doing everything in all the wrong ways. Hopefully no one will laugh at me too hard, and maybe it will be useful to someone else. I’ll also add my original CAN bus log, and the ROM that my tool produced. I had to zip the stock ROM with a password for WordPress to accept the binary as an upload. The password is “leftoverpi” Enjoy!

Please comment with any tips, corrections or opinions!