Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: How to hack the ECU of Isuzu Trucks from Japan


Member

Status: Offline
Posts: 11
Date:
How to hack the ECU of Isuzu Trucks from Japan


Hi to everyone,

I am Billy from the Philippines. I have been reading lots of posts in this site regarding how to hack the ECU and I've decided to post my concern here. I am working in a company that specializes on rebuilding of trucks. Our company buys surplus Isuzu trucks (basically a front-cut with engine and transmission only or a complete body unit) from Japan, make some modification to them and rebuild them as if theyre brand new trucks. Most of the units that come to us are N series trucks. These units come to us together with its ECU. Since our trucks are already remanufactured, we realized that our ECUs need to be reconfigured or reprogrammed since most trucks that weve already rebuilt have different specifications (like tire size and transmission) from the original to which the ECU is originally designed to perform normally and efficiently.

I have made a lot of researched in the internet how to reprogram the ECU but usually what I can find are diagnostic tools for vehicles which are being connected to the OBDII connector (SAE J1962) of the vehicle. This connector is connected to the ECU and provides access of the diagnostic tools to the ECU. Some of the diagnostic tools in the internet offers reprogramming of ECU but the problem is they do not support reprogramming of ECUs of Isuzu trucks from Japan or they do not cover the models that come to us. Also, as I have read the website of Isuzu in Japan, I have found out that they're already offering diagnostic and reprogramming services for Isuzu vehicles but they only support models from the year 2005 and up. The models that come to us are usually from 1999-2004. So I thought there's no way I can reprogram our ECUs here anymore. But thanks to this forum, which give me an idea that there's still a way to reprogram our ECUs and that is by hacking it through its microcontroller's pins.

I was very lucky to find this forum in the internet. Though I found out that many of the post here are concerned in ECU of bikes, I am still being positive that some guys here can help me. Ive read this particular post in this forum and realized that the microcontroller posted here is similar to what to the one used by the ECUs of the Isuzu trucks from Japan. Ive realized that ECUs of Isuzu trucks were manufactured by Denso and Transtron. And ECUs manufactured by Denso uses a Freescale microcontroller which is similar to the microcontroller of the ECU mentioned in this post.

I am a beginner. I am humbly asking anyone out there who could possibly assist me how to hack our ECUs. Please let me know what are the special softwares and hardwares that I need to possibly do it. Ive attached below several pictures of one of our ECUs including the close up image of its microcontroller. Its an ECU manufactured by Denso designed for a 4HF1-1 engine. Isuzu Part Number is 897217 6312, and Supplier Part Number is 275800-5245.

3.JPG

 

 

4.JPG

5a.JPG


10.JPG

Lastly, I want to know if someone here know some special softwares which can be used to reprogram the ECU through the SAE J1962 connector of the vehicle. Alex Eisenberg from Australia offers a software called TOAD which include functions like diagnostic, recalibration of fuel injections and even reflashing of ECUs through the SAE J1962 connector but still it doesn't cover the models that we have. Please check this site: http://www.totalcardiagnostics.com/toad/ . 



__________________


Senior Member

Status: Offline
Posts: 350
Date:

If there are no commercial solutions you need to do ALL by yourself so you understand that.
Locate BDM pins, trace from processor and try to read out the file. Without it you can´t do anything...

SAE J1962 is just the name for the plastic OBD plug. Not what interfaces are available in YOUR car.
Wich pins is used in the car? K-Line? CAN? etc.
http://en.wikipedia.org/wiki/On-board_diagnostics
http://www.scantool.net/support/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=3 

But to read/write file through any of the OBD protocols there is some seed key algorithms that needs to be
hacked in order to get access to programming. That by my knowledge is done by disassemlbing the bin.
And not all cars/protocols even support programming via OBD and if thats the case you must reflash them via BDM also.
So first read have to be BDM if nobody has hacked the SPECIFIC diagnostic protocol for your SPECIFIC car.

You do any Nissan Navara D40 2.5D? Also uses a Denso ECU. 
I might need an cheap ECU to cut open in a couple of weeks... 



-- Edited by Twice on Tuesday 18th of December 2012 08:55:36 AM

__________________


Member

Status: Offline
Posts: 11
Date:

Thanks Twice!

Yes, if in case there are no commercial solutions available I will be willing to do it by myself. I hope you could still support me.

I am going to locate the pins and I am going to post it here. 

I have read the post of RidgeRacer here: http://ecuhacking.activeboard.com/t9325284/background-the-project-so-far/ . RidgeRacer's post is where I have learned that I can still reprogram our ECUs through the BDM port. I have found out that the microcontroller used by the ECU of the 2002 kawazaki ZX-1200B1/B2 in his post is same to the microcontroller used by Denso ECUs of our trucks. By that I have assumed that the location of the BDM in his post is also the same to our microcontroller. Here's the picture of the ECU and microcontroller of 2002 kawazaki ZX-1200B1/B2 which he posted and the picture of the microcontroller of our ECU. 

ECU and microcontroller of 2002 kawazaki ZX-1200B1/B2:

ecu_3.jpg

 

Our 4HF1-1 ECU and microcontroller manufactured by Denso:

1.JPG

 

4a.JPG

 

Close up of the microcontroller:

5a.JPG

I have found out that the markings on the microcontroller of the ECU 2002 kawazaki ZX-1200B1/B2 and of the 4HF1-1 ECU of our Isuzu trucks are the same:

D151851-4410

sc505407vfc

185

 

Another problem that I can see is that on the ECU in his post the connection to the BDM port was left easy to access but on our ECU there is none.

The pictures below show where RidgeRacer put a connection inorder to access the microcontroller through the BDM port:

ecu_3a.jpg

ecu_7a.jpg

I've looked on our ECU and I cannot find a connection like this one. And also making a connection directly to the pin is risky because the pins are very small and the microcontroller could be damaged. We do not have special devices to make a connection directly to the pins.

I'm sorry to tell that we are not working with Nissan cars, only Isuzu.

If in case I will be willing to do the reprogramming of our ECU through the OBD connector, will you be willing to assist me how to do it?

According to my research from the Internet, Isuzu in America uses SAE J1850-VPW protocol from 1996 before CAN is required in US and Alex Eisenberg told me it could be JOBD protocol which I do not know where to find.

But here's the Pinout of the SAE J1962 of our trucks. And I assume that it uses ISO 14230 KWP2000 (Keyword Protocol 2000) because it's pin 7 is connected to the ECU. Though we have been able to diagnose our trucks using GM Tech2 which uses SAE J1850-VPW protocol.


SAEJ1962 female connection.JPG 



Attachments
__________________


Senior Member

Status: Offline
Posts: 350
Date:

To read the file first time you better get set on that you WILL probably have to use BDM. (One way or another)
Have you flipped the PCB and checked bottom side for BDM pads? Else try smaller pads or on components. (See attached) 
You will usually not get access to read or write ecu from OBD unless you have the security keys/codes. Thay are IN the file. 

From your OBD pinout it does not look standard. No battery voltage at 16?
2 - SAE J1850 VPW (+)
4 & 5 - GND 
6 - CAN (+) But cannot be used without (-) should be in 14. ????
7 - K-Line ISO 9141-2 OR ISO 14230-4
11 - FORD DLC (-) Should be used with 3. ???? 
12 & 13 - MFG Specific, normally not used. ????

GM Tech 2 works on many protocols, or did you specify J1850 when connected? No programming, read/write options for Isuzu in Tech2?

So guessing pin 2 or 7 would be your best bet for programming. If not any special Isuzu pinout is used wich at least half seem to be...
But without have read the file with BDM and disassembled the file to hack k-line/j1850 security no need to even try. 

If you need help on writing custom software, bdm and disassembly i would contact Psyche here on the forum.
He can probably help you out for a small fee. And if your company go through many trucks it will probably be worthwhile!

But there are no guarantees that its even hackable, or able to be reprogrammed through the plug etc. That you have to find out along the way... 



Attachments
__________________


Member

Status: Offline
Posts: 11
Date:

Thanks again Twice!

Before I forget I want to greet you and everybody out there a happy holiday! Merry Christmas!

I have just read your reply. Yes I am going to see the other side of the PCB for the BDM pads.

Do you mean that I can only get access to read and write ECU from OBD if I already have the security keys/codes which I can get by first reading the file through the BDM?

If that is so we will be willing to do it by first reading the file through the BDM.

Since the electronic components and connections within the PCB of our ECUs are microscopic or small, our next problem is we don't have special devices or gadgets to make connections to the BDM ports.

I am afraid we could damage the components especially during soldering.

Can you recommend special devices or gadgets that we can use?

In GM Tech2 we do not select the protocol, it automatically detects the protocol.

It just gives options for the service that we want to do like Diagnostic, Programming, and some other options.

On it's diagnostic function it we are ask to select what system what kind of system do we want to diagnose like the Engine, Powertrain, Body and Chassis.

Then we select the year model. Then the series model. And lastly the engine model. Once these informations are provided GM Tech2 now communicates with the ECU.

GM Tech2 can diagnose the truck models that we have. But we cannot perform on reprogramming of our ECUs using GM Tech2.

It provides options that indicates that it can reprogram our ECUs. But once we're there an error message always appears.

I've tried to look for the reason why we cannot work on reprogramming.

I was able to read from the website of Isuzu in America the list models which are supported by the reprogramming using GM Tech2.

From the list, I could not find the models that we have. So I assumed that most probably our models cannot be reprogrammed through the OBD.

But I'm still not sure that's why I'm trying to find out until now.

 

Yes sir, I think I am interested in writing custom software, bdm and disassembly since I really like to learn to do something like that.

Writing custom software is amazing.

And yes we are working on many trucks so I think our company will support it.

 

Thanks.



__________________


Senior Member

Status: Offline
Posts: 350
Date:

How did the bottom side look?

Yup, BDM is also used to debugging/recover an ECU so you will need it if you are working with the trucks. Usually a backdoor without a lock.
But as you said, not sure its supports read/write through obd protocol, might only be engine data as on Suzuki bikes for example. What Tech 2 showed.
If thats the case you can hope that you got any other interface pinout in the connector, else you will have to BDM read/write everytime.

If it was a sketchy Teach 2 CLONE, i would try to find someone with a genuine to test also.
At least one ECU you can count on to be scrapped, for testing, soldering, tracing etc.
Main concern now would be to test if BDM port works and try to get the file out.



__________________


Member

Status: Offline
Posts: 11
Date:

hello Twice!

here's how the bottom side looks:

3.JPG

but I haven't tried to traced it yet..

we have two Tech2 here, one bought from Hongkong (most probably a clone) and the other from US.

If in case I was able to trace the bdm port in our ECU, will you be willing to give me an idea how to build an interface device from bdm to PC?



Attachments
__________________


Senior Member

Status: Offline
Posts: 350
Date:

I can not see any regular bdm connector, no drinking or smoking when soldering that one :)
Hopefully there is an easier way to reprogram them, once you have the file and traced all connector pins etc.

I have no experience with this processor and bdm programming, all my bdm software and hardware are for other specific ecu´s.
And the little software i have written is a slow process so i rather have someone do that for me.

Here is Psyche´s email and homepage, contact him. I am sure he knows much more than me and can write the software for you!
http://ecuhacking.activeboard.com/m964656/profile/

__________________


Member

Status: Offline
Posts: 11
Date:

Twice, Thanks a lot for trying to help. I greatly appreciate your efforts. :) Yes I'm currently contacting him. I've already posted some things about my concern in their website here: http://pvtech-ecu-research.co.nf/ "Salamat sa iyo Twice!" Filipino term for "Thanks to you Twice!" have great day.:)

__________________


Senior Member

Status: Offline
Posts: 350
Date:

No worries, have a spare Navara D40 Denso ECU arriving any day now. Truck is way to slow now.
Is yours Diesel engines too? Keep thread updated and good luck! :)

__________________


Member

Status: Offline
Posts: 11
Date:

Are you going to work on that ECU?

yes Twice, we are working on diesel engines.

yes I will update. Thank you.:)



__________________


Senior Member

Status: Offline
Posts: 350
Date:

Yes, arrived later yesterday. Cracked it open. :)
I had some pads below the processor, (SH7058) all traced and identified today. AUD pads are there.
Will solder a cable to AUD and see if i can get something out. But its damn small hehe.

Edit: Dump complete and .bin file is ready. Now the hard part for Mr. Psyche :)



-- Edited by Twice on Saturday 12th of January 2013 02:15:30 PM

Attachments
__________________


Member

Status: Offline
Posts: 11
Date:

Wow that's great!:)

Yes, it's one of my problems the pads being so small. how did you able to solder to the AUD?

Is there any special tools available which we can purchase in the internet to solder those small pads?

I am not sure yet if there is already available tool like that.

What is AUD? what is it for? is it the same to BDM?

you mean you've already been able to hack your Navara D40 Denso ECU?

I am contacting psyche through e-mail and facebook but I think there's a problem with my e-mail.



__________________


Senior Member

Status: Offline
Posts: 350
Date:

Its small but no special tools, 15W $3 solder iron. Maybe use a magnifier lamp to look through.
Smaller tip on the solder iron, small diameter solder. I use regular computer flatcable for small wires.
And scrape clean from coating and pre-solder on spots where to solder. Pre-solder cable tips and then heat them together.

AUD/BDM are both debugger ports, different family of cpu´s.
Not hacked yet, i just opened it up and read out the file. Lucky for me same family as some Suzuki cpu´s so could read in same way.

__________________


Member

Status: Offline
Posts: 11
Date:

I see...thanks for the tips Twice.:)

I will look out for these tools.

 

I am now in contact with psyche..hopefully to move forward.:)



__________________


Member

Status: Offline
Posts: 11
Date:

hello twice...I have read the manual of 68HC16/916 R series.

Freescale suggests the following pins as the BDM port:

BDM connection.JPG

I would like to know if these pins are the same with the pins used by these BDM interface available in ebay, suggested by psyche.

http://www.ebay.de/itm/BDM-Interface-Saab-Trionic-T5-T7-tuning-Nokia-Dbox-/360561749563?pt=DE_Autoteile&hash=item53f327ae3b

I think psyche is busy at the moment doing many other projects.

And also I was able to trace the pins on one of our ECUs as suggested in the manual.

Here's the picture:

BDM Port Traced.JPG

The manufacturers in Denso left the pins soldered a little bit larger. I think it's not hard enough for soldering a connection. :)



Attachments
__________________


Senior Member

Status: Offline
Posts: 350
Date:

Nicely done Bill, seems like you found the pins you need.
And soldering should be possible after a few beers to get hand steady

I think it was for that interface Psyche wrote his Trionic and Suzuki software. So he can probably add your ecu if different.
And probably hard to find a cheaper one. So start off with that one for testing if he recommended it.

http://hackedecu.com/bdm-pd-interface

You can always look at a USB solution when read/write process are figured out and working.
Keep us updated :)

__________________


Member

Status: Offline
Posts: 11
Date:

Thanks a lot for the support Twice.
I haven't read much yet from the link you gaved but I think this site is very helpful.
Yes I'm gonna try what Psyche recommends. :)

__________________


Newbie

Status: Offline
Posts: 1
Date:

Hi Bill,

 

I'm Wesley. I just joined this forum not too long ago and noticed that you're trying to reverse Isuzu ECUs.

How's your progress in it? Are you still trying to learn? Have you succeeded? If you haven't given up, then

I'm willing to help because I'm currently reversing a '99' Isuzu Rodeo (Which is in the ball park you're in).

 

 

 

Best Regards



__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard