Reverse Engineering an ECU - Identifying IC's - Page 1
Forum section: electronics / projects

author: AGlass0fMilk
author_rank: Newbie
timestamp: April 09, 2018, 04:41:59 pm
content: Hi everyone,First time post on this site, which is surprising since I've been hacking for the better part of a decade. I'm a firmware/electrical engineer by trade, but I'm really into cars and restoring classics. I'm preparing to swap a Land Rover 4.0L V8 from a 1999 Discovery into my 1973 MGB GT. I'd like to keep the stock EFI system and all the sensors. Unfortunately, this ECU has an immobilizer system built in that needs another, paired body control unit (BCU) to send a serial code to it in order to start. So I'm trying to figure out how to disable this immobilization and simultaneously remap the ignition/fuel maps for a small sports car rather than a lumbering SUV.To that end, I have been reverse engineering the ECU. It's a Sagem-Lucas GEMS 8.2 system (last of production). There are chips out there to accomplish this but I have a problem with paying $700 for $3 worth of silicon and some flipped bits... when it's way more fun to flip them myselfThere are two boards. One with the power electronics on it and another with the logic. I've been focusing on the logic board right now, some of the parts have been difficult to identify since they're either proprietary or pre-PDF.There are two processors on the board with socketed PROMs:- Intel AN87C196KC paired with 1Mbit PROM (STM M27C1001)- Texas Instruments TMS374C003 paired with 512KBit PROM (STM M27C512)Additionally, there's a 2KB EEPROM on the board (Atmel AT28C16E) which is likely where the configurable information is stored (engine displacement, transmission type, VIN, security code, etc)I've ripped the data from all three chips. I'm not sure if the EEPROM binary came out in-tact but I bought another ECU on eBay to do some comparisons.There's a few other chips I have identified likely parts for. I can't find any data on the TMS374C003 but I'm assuming it's an automotive version of the TMS370 family of old TI microcontrollers. I'm thinking (hoping) the authentication and bus communication is handled by the Intel processor, which I have already run the FW through a disassembler.It appears the Intel chip manages the ignition while the TI chip manages the fuel injection PWMing.The other major chip that I have no information on is in the center of the board. Markings on it are TI - 54177642 / CF70116 / 49A6HOWI believe it is some sort of memory bus multiplexer. Possibly a custom part that is combined with external RAM so the processors can share data. The first 8 address lines of the Intel MCU go to data outputs for the EEPROM and PROM (Intel MCU is configured for fixed 8-bit data bus). They also connect to pins on the CF70116. Address and data lines 8-14 connect to the Address lines on the EEPROM and PROM. Address lines 15 and 16 on the M27C1001 are connected only through the CF70116.Any ideas on how to identify this part? I might need to start doing some active reverse engineering and see what data in the EEPROM gets accessed at startup.I've found some literature on the web that indicates the security serial line runs at 366 baud (lol) from 0 - 12V. It also seems to indicate the security key is only 16-bits. So I may be able to set up a brute force where I clock in a key, check the fuel pump relay output, and then reset and loop until the relay output goes high (I think that's how the ECU immobilizes itself).There's a lot more information I have found. But a picture is worth a thousand words. I have attached a picture of the board with chips boxed and current schematic that I have traced out from the Intel MCU.Parts I have identified:- Intel AN87C196KC- ST Micro 1Mbit and 512Kbit PROMs- Atmel EEPROM- Various TI/Phillips/Harris Semi TTL logic chips- ST Micro 2903 Comparator- Texas Instruments LM1009, 2.5V reference circuit- Various transistors from ON Semiconductor- Texas Instruments TL7705A (supply voltage supervisor, on power board)- ST Micro L4945 (5V LDO, on power board)So key parts I need help identifying:- Texas Instruments 54177642 / CF70116 / 49A6HOW- Texas Instruments (?) 77260 / TI 49F / A23N (there are 3 on the board)-- 5417739A4 / 274 H 9315 (in orange)- Texas Instruments TMS374C003 / R40301BPQQ / WB 4AA2V5W- Texas Instruments CF70105 / 48ADY4T

author: Sebastiaanvr
author_rank: Newbie
timestamp: May 10, 2018, 08:54:55 am
content: Hi AGlassOfMilk,How is the reverse engineering going? I'm asking this because together with my brother (software engineer) and me as a mechanical engineer we've started a similar project on a Jaguar XJR Sagem Lucas GEMS6 Ecu. The engine has to run stand alone in my '71 Land Rover 109".There are a few guys in the UK that can turn the immo (GEMS six and eight) off for €300,- but since we really want to understand the ECU we started this exersize for fun.Perhaps we can share some knowledge and findings.SebastiaanThe Netherlands, Amsterdam

author: gnif
author_rank: Unknown
timestamp: May 10, 2018, 10:08:41 am
content: I did a ton of reverse engineering of a Subaru ECU not that long ago, all software based as I had the ROM to work with. In my experience those in the know for these things like to keep all the information tight to their chests, getting any details out of them is like pulling teeth.That said, are you able to identify other makes/models that use the same ECU? They are often a general purpose ECU programmed for the car as was the case with the ECU in my Subaru. You might find other's that have identified parts in the same ECU but for a different car.

author: AustinR
author_rank: Newbie
timestamp: May 12, 2018, 12:08:56 am
content: If everything is still alive and together in the newer Land Rover, I recommend taking a log of the communication between the controllers.Are they communicating on a linbus or early CAN?If you take logs of a few iterations (startup, idle, acceleration, shutdown, etc), you could pick up what values are coming across, and what are changing. Then, you could attempt startup with a device (arduino w/ canshield, or similar) playing back whatever messages are constant (that don't come from the Engine ECU) and see if that works.A Vector CANCase would be ideal, but really any USB-CAN adapter with a CAN sniffing software could work.Edit: I apologize for answering with a solution that you weren't looking for. But, an Arduino sending a single message with the immobilizer identifier may do the trick as well.

author: cs.dk
author_rank: Unknown
timestamp: May 12, 2018, 07:22:42 am
content: Look at mhhauto.com, automotivediagsolutions.com, or similar sites. They know how to fix such things

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 12, 2018, 03:00:16 pm
content: Are there any car wiring manuals for this model? To find an ECU pinout, identify the pins used for communications, trace them to chips ports, then looks for references to the corresponding registers in disassembly.Also - post the binaries, let more people look inside.

author: bob225
author_rank: Frequent Contributor
timestamp: May 12, 2018, 03:45:57 pm
content: If its the last of the 99 4.0, a simple reflash will do iteg.http://www.automotiveelectronic.co.uk/cars/landroverimmobiliser.htmhttps://www.ebay.co.uk/itm/Immo-Off-Lucas-GEMS-8-Range-Rover-Defender-Disco-P38-ECU-Free-Run-/282014905356does it have EDC ?You just need to reflash the ecu back to the lucas factory default I can find plenty of places in the uk but not much your side of the pondMorgan also use gemshttp://www.gomog.com/allmorgan/GEMS/GEMSbyPoole.pdfIf you want to pair down the loom and go with a standlone ecu the budget option is a megasquirt 2 $300-350http://megasquirt.info/products/diy-kits/ms2/full ecu kit you build yourselfhttps://www.diyautotune.com/shop/megasquirt-kits-components/megasquirt-2/- usa supplier