Subaru Outback Forums banner

Immobilizer Reverse Engineering (2005 OBXT, probably other year/models)

47381 Views 179 Replies 32 Participants Last post by  rimwall
Introduction:
This thread will be an attempt to distill the work that I've done to understand the immobilizer circuit in my 2005 OBXT.

My initial goal was to "clone" the ECM so that I could run either my stock ECM, or a JDM ECM which has the necessary hardware to run dual AVCS which my engine swap will require.

As I got deeper into it, I got more interested in actually understanding the entire system, and I'm well on my way.

You can read all of the discovery in my engine swap thread, from post 39, until about post 73. Of course, the actual findings will be documented here.

Organization of this thread:
The first five posts will contain the latest information about what I have discovered. They will be organized as such;

  1. This post, an introduction and overview
  2. Details on about the ECM
  3. Details about the BIU
  4. Details about the Combination Meter
  5. Placeholder for TBD content

I will regularly post new replies indicating an update, or just for discussion (please provide feedback, and ask questions!). However, the first 5 responses will always be the canonical, and up-to-date "truth" as discovered by my work.

Immobilizer system design and operation:
In order to effectively manipulate the immobilizer system, it's important to understand how it is designed and how it operates.

While actual details of the inner workings are hard to find, the factory service manual provides a fairly detailed, tho high level, description of the system.



From this, we learn that the BIU, the ECM, and the Combination Meter (gauge cluster) are all used in authenticating a transponder key. This is why when any one of these computers is changed, the key registration process must be completed, since the three systems will no longer be synchronized.

There are two communications between the BIU and the ECM. A high-speed (500Kbps) CAN network, and a dedicated immobilizer line.

There is one communication channel between the BIU and the Combination Meter. A low-speed (125Kbps) CAN network.

This is also shown in the factory service manual.



Answered Questions:

Remaining Unanswered Questions:
  • How to clone the combination meter EEPROM?
  • What size (in bytes) is a key code?
  • How can a new key code be added?
  • Are the key codes encrypted in some way?
  • Is there a "shared secret" which is used between all three computers when authenticating a key? An encryption key perhaps?
  • What protocol is the dedicated immobilizer line between the ECM and BIU?
  • How can a transponder key be "read" to get it's unique code?
  • Where is the key count stored in the ECM EEPROM?
  • Where would a 4th key code be stored in the ECM EEPROM?
  • What low speed CAN message(s) are sent from the BIU to the combination meter?
  • What dedicated message is sent from the BIU to the ECM?
  • What additional high speed CAN message(s) are sent from the BIU to the ECM?
  • What is the exact data organization of the BIU EEPROM?
  • Is it possible to enable/disable the immobilizer check in the BIU?
  • Is it possible to enable/disable OBD-II Mode 9 responses from a JDM ECU?
  • What command sequence does the SSM tool use to perform the key programming ritual?
  • What is the order of operations for validating a key?
    • Does it occur on keysense, on ignition on?
    • Which computer does the BIU validate with first, the Combination Meter, or the ECM?
    • Does the ECM validation happen over the dedicated immo communication line(s) as well as high speed CAN?

Common Tools:
In the process of reverse engineering this system, I used several tools, with varying effectiveness.

EEPROM Programming tools:
Reveltronics REVELPROG-IS.

This can read and write the BIU and ECM EEPROMs with proper settings. However, it can not read or write the ECM EEPROM in system, it must be desoldered from the board for this programmer to access it.

Adafruit FT232H
This can read and write the ECM EEPROM, both in system, and when it is desoldered from the ECM.

It can probably be made to read and write the BIU EEPROM, but I'm still working on code that properly supports this.

SOIC8 IC Test Clip
Not a programmer, per-say, but a necessary tool for reading and programming the EEPROM chips without desoldering them from the computer(s) they reside in.

The above link will likely die, and isn't the definitive source for shopping for such things. What you're looking for is something that looks like this.

Attachments

161 - 180 of 180 Posts

· Registered
Joined
·
63 Posts
Fantastic! Thanks for helping out @badbutte, @seagrass, @aero901 !

Follow these steps:
1. Download Freediag
2a. Edit the freediag.ini file so it contains the following:

set
interface dumb
port \\.\COM1
(this needs to be the COM port that is assigned to your USB cable)
speed 10400
l1protocol iso14230
l2protocol iso14230
initmode fast
testerid 0xf0
destaddr 0x40
addrtype phys
up
help
debug l1 0x8c
(only include this if you want detailed debugging info)

2b. Connect the cable to your laptop (USB) and the car (OBD port). Turn the key in the ignition to 'on' (no need to start it). No need to worry about green connectors.
3. Run freediag using a command prompt (run 'cmd' from windows start menu, navigate to the folder that holds freediag and enter 'freediag')
4. Enter 'diag'
5. Enter 'connect'
6. To send a command to the BIU enter 'sr [command]' where command is described below.
7. When finished, enter 'disconnect' and 'quit'

Sending commands.
  • the commands and responses are described here
  • freediag will tell you the hexadecimal response from the BIU

You can help by
a) seeing if the command works (do you get the expected response?) and
b) going through the bytes and bits of the response data to see if it matches the current state of your car, then change something (eg: open a door) and run the command again. Does the response change? Which bytes/bits?
c) by doing the above helping to figure out some of the bytes/bits that are still unknown

In particular try command 0x21 0x53 because once we figure out what the bytes / bits mean, we will then be able to use a different command to customise your car setup (eg: do you want to turn on/off the horn beep that happens with central locking, or do you want to turn on/off the seatbelt buzzer)

@badbutte - freediag (the freeware comms software) won't work with a Tactrix. The good news is that it will work with any cheapo VAG-COM USB to OBD cable from eBay. Just need to get the cable, install its drivers and then freediag should work fine.

@seagrass - you're all good to go. It will be really interesting to see whether the responses across Outbacks, Imprezas etc are consistent. So far I've only been able to try a Gen3 Outback.

@aero901 - you should be good to go when the VAG-COM cable arrives.

Once we get these more boring commands/responses working and accurate we can move on to more exciting ones like registration of new parts and keys.
 

· Registered
Joined
·
63 Posts
Thanks @kiwisix! Let me know what sort of BIU responses you get.

I had a quick look at the github source of Cascade. Not much documentation, but I searched the code to find the details of the serial commands / responses. Couldn't find anything. Why? At a guess, this looks like a software emulation of the CPU in the HiScan Pro tool. Perhaps they extracted the tool's ROM and then they feed the ROM into a software emulation of the tool's CPU. Does that sound right? If so, this unfortunately means all the commands / responses are still 'hidden' in the tool's ROM. If so, then, yes, sniffing would get the commands. Sniffing an SSM-III unit should also work. I don't have a sniffing setup, but someone else might?
 

· Registered
Joined
·
63 Posts
On the question from @TheCaddyMan99 ... from what I've worked out so far, the BIU and CM (combination meter) share a 'pairing code', but it doesn't seem like this has any relevance to the immobilizer. The BIU and ECU also share a different 'pairing code', and this one does influence the immobilizer. If the BIU / ECU pairing code doesn't match then the ECU cuts the fuel (aka 'the immobilizer').
 

· Premium Member
2008 JDM Outback 3.0R, 5EAT
Joined
·
635 Posts
@rimwall I was able to connect to the BIU with FreeDiag using your steps which was neat. Tried to grab DTC's with sr 0x18 I may have that wrong but received an error which I didn't keep unfortunately. However other commands worked. Is there any script or such to render the output bytes for analysis?

freediag/diag> sr 0x21 0x50
msg 00 src=0x40 dest=0xF0
msg 00 data: 0x61 0x50 0x00 0x00 0x41 0x20 0x44 0x00 0x00 0x40 0x00 0x10 0x01 0x00 0x17 0x00 0x00 0x80

freediag/diag> sr 0x21 0x40
msg 00 src=0x40 dest=0xF0
msg 00 data: 0x61 0x40 0x90 0x90 0x8E 0x90 0xF9 0xFA 0x45 0x80 0x1A 0x16 0x00 0x00

freediag/diag> sr 0x21 0x41
msg 00 src=0x40 dest=0xF0
msg 00 data: 0x61 0x41 0x00 0x00 0x15 0x01 0x00 0x40 0x16 0x00 0x00 0x43 0x01 0x00 0x07

freediag/diag> sr 0x21 0x52
msg 00 src=0x40 dest=0xF0
msg 00 data: 0x61 0x52 0x02 0x03 0x04

freediag/diag> sr 0x21 0x53
msg 00 src=0x40 dest=0xF0
msg 00 data: 0x61 0x53 0x30 0x1F 0x34 0x36
 

· Registered
Joined
·
63 Posts
Great stuff @kiwisix! Eventually I will customise freediag or nisprog to do all the response parsing automatically. In the meantime, here is an excel sheet. Just need to copy paste the response (as text) into the yellow boxes. I've done this for your data above. See Google Drive File

Let me know if any of the switches or values seem wrong. And try opening / closing doors, putting seatbelt on, turning lights on / off etc to see what changes and whether it matches. You can also get a passenger to run the commands while driving.

Is there a byte missing from the end of the response to 0x21 0x53?
 

· Registered
Joined
·
3 Posts
On the question from @TheCaddyMan99 ... from what I've worked out so far, the BIU and CM (combination meter) share a 'pairing code', but it doesn't seem like this has any relevance to the immobilizer. The BIU and ECU also share a different 'pairing code', and this one does influence the immobilizer. If the BIU / ECU pairing code doesn't match then the ECU cuts the fuel (aka 'the immobilizer').
A pairing code? is that why the car won't start without cluster, or with a cluster that isn't paired to the BIU? You wouldn't happen to know anything about this pairing code and how I might be able to move it from one cluster to another. I'm trying to upgrade to the Impreza GT cluster with the coolant temp gauge, otherwise I'd just copy the contents of the original EEPROM to the new one. I've modified mileage to match what it was, it's just this hang up now
 

· Registered
Joined
·
63 Posts
@TheCaddyMan99 - copying the EEPROM is the current approach to set up a new CM. Editing the EEPROM is also typically how the mileage is set. I suppose that once the EEPROM of the new CM matches that of the old CM, the car will start.

I have found the BIU commands which I suspect are used to register a new CM. You can help out by trying them if you want. There are a few different commands which I am guessing is for different generations of CMs. Just need to be aware that trying out the commands may result in your BIU no longer being paired with your existing cluster.

To avoid this risk, best approach is probably a) make sure you can send / receive from the BIU using the approach above b) remove the existing CM c) copy the EEPROM contents of the existing CM as a backup d) copy the EEPROM contents of the existing BIU as a backup e) install the new CM f) try out the BIU commands g) if we can't get BIU commands to work, then use the BIU backup to restore the BIU EEPROM and the existing CM backup for the new CM EEPROM.

Some fiddling around, but probably no worse than the current approach. And potentially makes it far simpler for everyone that follows. Let me know if you want to try.
 

· Premium Member
2008 JDM Outback 3.0R, 5EAT
Joined
·
635 Posts
Thanks @kiwisix! Let me know what sort of BIU responses you get.

I had a quick look at the github source of Cascade. Not much documentation, but I searched the code to find the details of the serial commands / responses. Couldn't find anything. Why? At a guess, this looks like a software emulation of the CPU in the HiScan Pro tool. Perhaps they extracted the tool's ROM and then they feed the ROM into a software emulation of the tool's CPU. Does that sound right? If so, this unfortunately means all the commands / responses are still 'hidden' in the tool's ROM. If so, then, yes, sniffing would get the commands. Sniffing an SSM-III unit should also work. I don't have a sniffing setup, but someone else might?
Yes that makes sense it seems Cascade emulates a hardware device in Windows. I had a look inside the 8MB Cascade/HiScan file ( "Asian Pack 2.bin") that works with my Subaru BIU as it contains most all the parameter wording when viewed with a hex editor. I know very little about reverse engineering binaries but anyways for fun tried to load this .bin file into Ghidra as Intel MCS-96 family (a guess from Cascade's Github page) but seems the file is the wrong size expected. I was hoping to see some reference between the parameter description addresses and the de-complied functions. Also ran the binary through BinWalk which produced nothing I understood aside 2779 .lha files (?) and 29 .bmp graphic illustrations to instruct auto techs how to connect diagnostic cables and such. After that I worked through the Cascade app to type out all of the parameters and values into a .txt file which is attached here if it helps. I'll continue to try out FreeDiag over the coming weeks too.

Rectangle Font Screenshot Parallel Software
Font Rectangle Screenshot Parallel Number
 

Attachments

· Registered
Joined
·
63 Posts
Thanks @kiwisix. That's interesting. The txt file list of parameters is similar to what I had worked out. Some match exactly (like the volts, speed data) and some are similar but in a different order (like the list of input/output switches). The Cascade order looks exactly like the SSM-III order so I'm guessing whoever built the HiScan product did it by sniffing an SSM-III unit.

I couldn't find the file "Asian Pack 2.bin" on Cascade's repo - can you send a copy. MCS-96 looks like the right family. I can see if I can get Ghidra to unravel it.

A good way to compare would be to run Cascade, record the values and then immediately run the various freediag commands. Then we can compare switches etc to check for differences. I can do this too…where can I get a copy of the correct version of Cascade?
 

· Premium Member
2008 JDM Outback 3.0R, 5EAT
Joined
·
635 Posts
That's strange @rimwall I think I downloaded those files from the Cascade authors original fishpond website site that is no longer available however someone has re-shared on the first link of this Tiburon page including the .bin file referenced earlier. The same BIU parameter data can be found on GitHub in file C1_GK10B0ENG_101122_CD.HIS_EN.DAT which I've tested on the car. Yes I'm happy to compare to freediag are there any particular params to focus on?
 

· Registered
Joined
·
63 Posts
Thanks @kiwisix. Got Cascade and tried it, but no luck, probably because my cheapo cable has a CH340 chip (not FTDI). Ah well. Maybe I’ll get another cable - do you know any eBay sources that actually send a cable with an FTDI chip and not a knock-off? Plenty of them say FTDI but often they are not.

I managed to get Ghidra to load the whole file. After a quick look, I think this will be much slower than just running both cascade and freediag commands and comparing.

If you could try 0x21 0x50 first, that would be great. Thanks.
 

· Registered
Joined
·
3 Posts
@TheCaddyMan99 - copying the EEPROM is the current approach to set up a new CM. Editing the EEPROM is also typically how the mileage is set. I suppose that once the EEPROM of the new CM matches that of the old CM, the car will start.

I have found the BIU commands which I suspect are used to register a new CM. You can help out by trying them if you want. There are a few different commands which I am guessing is for different generations of CMs. Just need to be aware that trying out the commands may result in your BIU no longer being paired with your existing cluster.

To avoid this risk, best approach is probably a) make sure you can send / receive from the BIU using the approach above b) remove the existing CM c) copy the EEPROM contents of the existing CM as a backup d) copy the EEPROM contents of the existing BIU as a backup e) install the new CM f) try out the BIU commands g) if we can't get BIU commands to work, then use the BIU backup to restore the BIU EEPROM and the existing CM backup for the new CM EEPROM.

Some fiddling around, but probably no worse than the current approach. And potentially makes it far simpler for everyone that follows. Let me know if you want to try.
I'd love to give it a shot, I can't see any harm. What interface/software do I need to communicate with this car? I have an FTDI cable that I used to use with my BMWs, If I need a different cable or interface for subarus, I'll get that.
 

· Registered
Joined
·
63 Posts
@TheCaddyMan99 - cool, sounds good, try the steps listed in post #161 above to see if the laptop / cable / car combination works for basic comms with the BIU (with the existing CM installed). @kiwisix has been using an FTDI cable (I think?) with freediag so hopefully your current cable works. One other thing - how different is the new CM to the original one? Is it from a higher spec car from the same model / generation? Just want to make sure it's not so different that it will be fundamentally incompatible. Once you have established basic comms with the BIU, we can try the specific BIU commands.
 

· Registered
Joined
·
63 Posts
@kiwisix - I had another look at the Asian Pack 2 ROM hoping that the order of items in the ROM would give clues as to the order the data is reported by the BIU. However, the ROM is in alphabetical order, so that feels like a dead end. It seems like comparing Cascade to freediag / Excel spreadsheet is the fastest option. Let me know how you go with this. I'll also try with whatever FTDI cable I can find on eBay.
 
161 - 180 of 180 Posts
Top