Inside the code of an automotive Engine Control Module

Presented at PhreakNIC 22 (2018), Oct. 20, 2018, 11 a.m. (45 minutes)

I can do either a Ford diesel pickup from 1995-2003, or a newer Bosch unit such as used on VW, Audi, BMW, Volvo, Puegeot, Citroen, Ferrarri, Mercedes...you name it. The Ford ECM is very simple: a 256K EEPROM that uses less than 212 KB of code, and a 8 Mhz microprocessor and there is no software documentation. The Bosch units range from 2000 to 2015, run 4MB-8MB EEPROM's and 56 Mhz to 160 Mhz microprocessors, and the software documentation runs 8,000 to 11,000 pages for a given ECM. ps, what is an iframe? ;)

Presenters:

  • Jonathan Ryan - CHO (Chief Hacking Officer) at Swamp's Diesel Performance
    In 1995 I bought a Ford 7.3L Power Stroke Diesel pickup. Knowing that it was the first computer controlled diesel sold in the US, I know mechanics wouldn't know anything about it, so I bought the service manual and read it cover to cover more than once. In 1998 I found an enthusiast's forum for truck owners on the 'net, and since I had the service manual, I became a de-facto expert. Curiosity led me into tinkering with the truck's injectors to make more power. Then people started asking me to make injectors for them, too. That in turn led to custom tuning the engines and reverse engineering the circuit boards for the various control modules in the truck. In 2003 I started a hobby with a fellow enthusiast, and it is now a business with 20+ employees and sales to the USA, Canada, Australia, Norway and Germany!

Links: