2GR-FE stock ECU has been hacked and the immobilizer can be removed! - MR2 Owners Club Message Board
 119Likes
Reply
 
LinkBack Thread Tools
post #1 of 567 (permalink) Old May 17th, 2016, 20:40 Thread Starter
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 35
Posts: 2,826
OldTrader Rating: (14)
Cool 2GR-FE stock ECU has been hacked and the immobilizer can be removed!

check it out guys:

So a couple weeks ago someone contacted me to say that the IS350 ECUs were hacked and asked me about the 2GR-FE ecus again. Instead of ignoring it this time i contacted the vendor to see if the technique was applicable to the 2GR-FE. they were initially very friendly, i shipped them an ECU overnight and then they stopped responding to e-mails.

a few days later they said they'd be happy to help me out at the cost of about $4000 per ECU type.

needless to say, this was a bit of a shock and nothing like what we discussed.

so now i was armed with two bits of info: first it is actually possible and second i have some yahoo out there to prove wrong https://xkcd.com/386/

With that motivation i brushed up my notes from a few years ago about this chip just being a rebranded renesas V850 chip. went and read all the unintended acceleration reports again for more information and then dusted out some of my old renesas gear.

Some more digging and it ended up being pretty easy to read the information from the chip. it also made me notice that the Toyota programming wizard files are not encrypted in any way.

So i ordered up a few "junk" ecus from e-bay and got to testing. it turns out the immobilizer is stored on a 2nd chip but it wasn't hard to figure that one out.

So once i cloned that and the other chip the "junk" ecu starts the engine just fine.

i did a cursory scan for some info and found a few things, the DTCs were somewhat obvious so i was able to remove all the automatic transmission and emissions DTCs so now i have a functioning CEL!.

I need to get the rev-limiter raised and then i'll offer this as a service.

Here's what the costs will be:
$100 remove immobilizer
$250 do any changes to the tune (that are currently supported of course)
$50 core charge if you want me to ship an ECU out before you return yours.

and if you end up wanting more changes done at a later date I will charge $80 for any of the allowed changes.


Currently I can do this to any Highlander ECU if you want to keep your immobilizer. or if you want the immobilizer removed i can do any ECU that has the part number 275036-0360 written on the circuit board. (as far as i know this is all highlander, avalon and sienna ECUs.) That will involve converting it over to being a highlander ECU since only the highlander calibration seems to support the no immobilizer calibration.

as for modifications i can do to the calibration right now:
1) remove unwanted DTCs
2) fix VVT-I maps to stop torque drop-off
3) raise redline

obviously more changes will come in time.

*update, 2nd video:

Last edited by Gouky; May 19th, 2016 at 19:38.
Gouky is offline  
Sponsored Links
Advertisement
 
post #2 of 567 (permalink) Old May 17th, 2016, 21:01
Jackstand Club
 
Join Date: Jul 2006
Location: monroeville, al
Age: 31
Posts: 789
OldTrader Rating: (16)
So, Should I go buy a camry ecu now or hold off until the rev limiter and cruise control have been tested?


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
donteatbugs is offline  
post #3 of 567 (permalink) Old May 17th, 2016, 21:17 Thread Starter
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 35
Posts: 2,826
OldTrader Rating: (14)
I can't make that decision for you, but i can tell you that my focus is still on getting that Lotus stuff out for emissions compliance people, then get the rev-limiter stuff bumped up for the 5-plug then add in support for the 2-plug ECU.

The camry ECU is a 2-plug ECU, i can likely apply everything I've done here to it but i need to make a test mule first otherwise i can't test anything.

There's also a potential hang-up with the 2 plug. the non immobilizer tune is a rav4 tune and the cheap ECUs are camry ECUs. the rav4 has a slightly different VVTI pinout so it may have a different circuit board which may mean the firmware cannot be cloned over directly.
Gouky is offline  
 
post #4 of 567 (permalink) Old May 17th, 2016, 21:30
Jackstand Club
 
Join Date: Jul 2006
Location: monroeville, al
Age: 31
Posts: 789
OldTrader Rating: (16)
Thanks, I have a non imobilized rav4 ecu with cruise control right now so I dont have to have anything right away. My trans is coming out soon for a rebuild after my next track day . I just wanted to get ahead of the buying rush if there is such a thing.


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
donteatbugs is offline  
post #5 of 567 (permalink) Old May 17th, 2016, 21:42 Thread Starter
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 35
Posts: 2,826
OldTrader Rating: (14)
Quote:
Originally Posted by donteatbugs View Post
Thanks, I have a non imobilized rav4 ecu with cruise control right now so I dont have to have anything right away. My trans is coming out soon for a rebuild after my next track day . I just wanted to get ahead of the buying rush if there is such a thing.
nah, the rav4 is the one that is likely to be supported anyways. so since you have one already i would not worry about it.
Gouky is offline  
post #6 of 567 (permalink) Old May 17th, 2016, 22:54
Registered User
 
Join Date: Jan 2006
Location: Perth, Western Australia
Age: 44
Posts: 64
OldTrader Rating: (0)
So if I just wanted a clone of my TRD Ecu with a rev limit increase and DTC remove I could send you a Camry or Aurion ECU and I would just need to re-pair my immobiliser?
perthmr2 is online now  
post #7 of 567 (permalink) Old May 17th, 2016, 22:56 Thread Starter
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 35
Posts: 2,826
OldTrader Rating: (14)
I can clone your current immobilizer settings easily if you need that. that way both ECUs will register with the same immobilizer. the thing to check is that the part number on the TRD circuit board is the same as the one on the Camry and i haven't checked that yet.
Gouky is offline  
post #8 of 567 (permalink) Old May 17th, 2016, 23:09
Registered User
 
Join Date: Mar 2004
Location: Burnaby/Blaine
Age: 37
Posts: 878
OldTrader Rating: (22)
Garage
My hero! So, as soon as you can raise the rev limit on my '06 2 plug Rav4 ECU it will be on it's way to you!
immorality is online now  
post #9 of 567 (permalink) Old May 17th, 2016, 23:17
Registered User
 
Join Date: Jan 2006
Location: Perth, Western Australia
Age: 44
Posts: 64
OldTrader Rating: (0)
In theory if I was to grab an Aurion one they should be the same

Not sure if you know the history of the TRD Aurion but basically they took a finished Aurion off the production line and only installed the supercharger and pulley to existing engine and re flash of ECU
They disable the Acis vsv setting on ECU and programme the air intake vsv to always be open, they just tape up the Acis plug in the loom under charger
perthmr2 is online now  
post #10 of 567 (permalink) Old May 17th, 2016, 23:18 Thread Starter
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 35
Posts: 2,826
OldTrader Rating: (14)
Quote:
Originally Posted by perthmr2 View Post
In theory if I was to grab an Aurion one they should be the same

Not sure if you know the history of the TRD Aurion but basically they took a finished Aurion off the production line and only installed the supercharger and pulley to existing engine and re flash of ECU
They disable the Acis vsv setting on ECU and programme the air intake vsv to always be open, they just tape up the Acis plug in the loom under charger
I agree that in theory you're correct. I just don't want to get anyone's hopes up until it is actually verified.
Gouky is offline  
post #11 of 567 (permalink) Old May 18th, 2016, 01:34
Registered User
 
Join Date: Jan 2006
Location: Perth, Western Australia
Age: 44
Posts: 64
OldTrader Rating: (0)
If you get your hands on a Camry ECU we could compare part numbers
I might even order in an Aurion one to check
perthmr2 is online now  
post #12 of 567 (permalink) Old May 18th, 2016, 02:51
Gold Level
 
Join Date: Mar 2004
Location: Santa Babylon
Age: 52
Posts: 3,778
OldTrader Rating: (59)
And the immobilizer on my actual 2GR-FSE ecu? So can skip hooking up the ID Code Box, Certification ECU and ignition key cylinder antenna (and praying it works).
JimKing is offline  
post #13 of 567 (permalink) Old May 18th, 2016, 04:17
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 314
OldTrader Rating: (0)
This is stupendous. You've got my head spinning.

I have a 2-plug non-immobilized ECU that I think came from a Camry, and a 2-plug harness. Can this be flashed for a "sport tune" with higher rev limit and possibly cams, and support CEL? I would be all over this in a New York minute.
merryfrankster is online now  
post #14 of 567 (permalink) Old May 18th, 2016, 04:18
Registered User
 
Join Date: Feb 2016
Location: Maui, HI
Posts: 314
OldTrader Rating: (0)
Sorry duplicate post/Database error.
merryfrankster is online now  
post #15 of 567 (permalink) Old May 18th, 2016, 06:54 Thread Starter
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 35
Posts: 2,826
OldTrader Rating: (14)
Quote:
Originally Posted by perthmr2 View Post
If you get your hands on a Camry ECU we could compare part numbers
I might even order in an Aurion one to check
The obstacle here isn't the ECU, i need a test car that uses a 2-plug ECU before i can get started on the 2-plug stuff. don't worry, i will get around to this one soon.

Quote:
Originally Posted by JimKing View Post
And the immobilizer on my actual 2GR-FSE ecu? So can skip hooking up the ID Code Box, Certification ECU and ignition key cylinder antenna (and praying it works).
While this is likely the same technique, each calibration likely has a different format for the secondary memory and i don't have a non immobilizer pattern for the 2GR-FSE. it's certainly doable but it isn't on my list at the moment.

Quote:
Originally Posted by merryfrankster View Post
This is stupendous. You've got my head spinning.

I have a 2-plug non-immobilized ECU that I think came from a Camry, and a 2-plug harness. Can this be flashed for a "sport tune" with higher rev limit and possibly cams, and support CEL? I would be all over this in a New York minute.
That's the idea, but let me get the 5-plug ECU there first guys
merryfrankster likes this.
Gouky is offline  
post #16 of 567 (permalink) Old May 18th, 2016, 09:54
Registered User
 
Join Date: Jul 2015
Posts: 6
OldTrader Rating: (0)
THANK you Gouky!
I couldn't get the immobilizer out of my 2GR donor Van and now I am going to still be able to have my ECU work!
Pastidipdaworld is offline  
post #17 of 567 (permalink) Old May 18th, 2016, 11:41
Registered User
 
Join Date: Sep 2004
Location: MN
Age: 32
Posts: 2,101
OldTrader Rating: (4)
I have an immobilized rav 4 ecu you can use as a test dummy.
rdyzz is offline  
post #18 of 567 (permalink) Old May 18th, 2016, 12:24 Thread Starter
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 35
Posts: 2,826
OldTrader Rating: (14)
Quote:
Originally Posted by rdyzz View Post
I have an immobilized rav 4 ecu you can use as a test dummy.
because i will want to continue supporting the 2 plug i think the right answer is for me to make an adapter harness.

if someone wants to help with that i need the harness pigtails for the 2 plug ECU to build it.
Gouky is offline  
post #19 of 567 (permalink) Old May 18th, 2016, 13:57
Registered User
 
Join Date: Dec 2006
Location: Northern Utah
Age: 31
Posts: 925
OldTrader Rating: (16)
What does this mean for people who want the Lotus setup mostly for 7200RPM and eventual SC and could care less about CA emissions (only sniffer where I am at)? Is the Lotus route still the way to go?

Guess I am asking what all the Lotus setup is looking to have vs the Toyota route now that you've cracked the ECU.

And seriously, this is boss. Brilliant work! Not only for the MR2 community but as a whole for anyone looking to swap 2GRs (and maybe eventually other motors...2ARs maybe?) into other vehicles without going standalone.
PearlJammzz is online now  
post #20 of 567 (permalink) Old May 18th, 2016, 14:07 Thread Starter
Gold Level
 
Join Date: Sep 2005
Location: Fort Wayne, IN
Age: 35
Posts: 2,826
OldTrader Rating: (14)
it’s way too early to call that, right now we know that the Lotus ECU can handle a supercharger. honestly i probably announced this too early, but i'm so damn excited about where i've gotten i had to spread the word.

I’m pretty confident i’ll be able to raise the rev-limiter

I’m also confident i’ll be able to clone the TRD ECU. but i may or may not be able to disable the immobilizer on that one. the way i disabled the immobilizer on the highlander is just by copying the secondary memory from a non immobilized highlander and there’s no such thing as a non immobilized TRD ECU. I do feel reasonably confident that i will be able to disable the immobilizer on the TRD ecu.

and even if the immobilizer is solvable the calibration may be difficult to port to a 5 plug, we may be locked into 2 plug ECUs for supercharging.

One thing that is for sure is the Lotus will still be the only route to go for a full CA emissions compliant build. your local emissions regulations may or may not allow you to run this setup. the 2GR is MUCH cleaner than the 3s-gte and the 5s-fe. but not all regulations are written in a way that makes sense. I also don't plan on removing the monitors so the ECU will still fail that kind of test. in fact, if i can figure it out i'd like to leave the emissions faults in there but just make them not illuminate the CEL.
Gouky is offline  
Reply

Tags
2gr-fe

Quick Reply
Message:
Options

Register Now



In order to be able to post messages on the MR2 Owners Club Message Board forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.

Password:


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:
OR

Log-in









Human Verification

In order to verify that you are a human and not a spam bot, please enter the answer into the following box below based on the instructions contained in the graphic.




Currently Active Users Viewing This Thread: (0 members)
 
Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page



Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
For the best viewing experience please update your browser to Google Chrome