I am using recent enquiries as a trigger to carry on with our Tech Bits section and start with the question "What is Anti Tuning" by using the BOSCH Anti Tuning messures of the EDC17xx and MED17xx ECU
Many people have asked why we need to open the ECU's of the later cars i.e. x35i with N55 engines, and what is this "tuning protection" many companies are talking about.
Here's a brief explanation of it.
"Tuning Protection" for the Infineon TriCore TC-series processors (Bosch MED17/EDC17) On the Common Rail TDI and the Turbo Petrol engines with the latest Bosch ECU generation (MED17 for the petrols, EDC17 for the diesels, I'll just refer them to MED17 and EDC17 from now on...), Bosch has implemented some new security measures to protect against aftermarket reprogramming of the engine control unit calibration data.
Bosch originally started to use various checksums in the late 80's to verify the data integrity of the engine control unit memory content. Originally this was just a simple additive checksum, where you count the sum of all bytes in the file, and store the value in one place. Later on, it was also used to protect the data from unauthorised modifications (thats us, the software tuners).
For example, ME7.5 ECU (VW 1.8 Turbo) contains about 70 different checksum blocks, and the result values are filtered through various functions to have a secure method of verifying data integrity.
At around the same time, Bosch started using access control on the outside ECU reprogramming (that is what we call the OBD flashing nowadays). It's usually a normal challenge-response scheme with a seed-key algorithm.
Of course, the chiptuning industry kept on and solved these functions to have methods of correcting the checksums, and to have OBD programming capability of these ECUs. What one man can do, another can undo![Idea]( "Idea")
About 7-8 years ago, Bosch started using RSA signatures to control the ECU contents. Early on, just a 256bit RSA, then 512bit RSA, and nowadays, on these new ECUs, its a hash from a 1024Bit RSA signature. Something thats virtually un-crackable with traditional brute force methods.
Since these keys are yet to be solved, tuners have had to find other ways of programming the ECUs. When the MED17 / EDC17 ECU family was released, a backdoor was found in the programming algorithm. Originally this hash was checked only after certain conditions were met.
If they are not met, it was not checked. So the programming method made sure that was the case every time they programmed the ECU.
This "Tuning Protection" (TProt), as it is commonly called, just means that this backdoor has been sealed, and the ECU always checks the hash validity after every OBD programming attempt. If this is not valid, it sets a flag in the memory that prevents the car from starting.
Expensive tools can detect this function just by reading the ECU via OBD.
Many others, including some big brand names, have problems with cars not starting after writing.
That is why, for now, on these protected ECU's, we need to open the ECU to use a processor function built in the TC17xx-series processors, which allows us to boot and reset the ECU at any given moment from pins on the motherboard. This way the ECU does not detect it as being an OBD programming attempt, and skips the hash validity check.
At this time, there are no tuning companies who can bypass this security check and if an ECU has "Tuning Protection" then it will need to be programmed by taking the ECU out and opening it.
Some call it "bench flashing", some say they "install a probe", but this is how it is done by ALL tuners who are offering remaps on "protected" MED17 / EDC17 ECUs and others as well!
We at Promotec have written a patch software which overwrites part of the code in the ECU and AFTER we did the bench probe and applying our patch, we then can access the ECU via OBD port just like the "older" versions before![Joy]( "Joy")
![[Image: pos_frame.jpg]]()
Source: BOSCH, TProt, K-Tag possitioning frame manual and Internet
Many people have asked why we need to open the ECU's of the later cars i.e. x35i with N55 engines, and what is this "tuning protection" many companies are talking about.
Here's a brief explanation of it.
"Tuning Protection" for the Infineon TriCore TC-series processors (Bosch MED17/EDC17) On the Common Rail TDI and the Turbo Petrol engines with the latest Bosch ECU generation (MED17 for the petrols, EDC17 for the diesels, I'll just refer them to MED17 and EDC17 from now on...), Bosch has implemented some new security measures to protect against aftermarket reprogramming of the engine control unit calibration data.
Bosch originally started to use various checksums in the late 80's to verify the data integrity of the engine control unit memory content. Originally this was just a simple additive checksum, where you count the sum of all bytes in the file, and store the value in one place. Later on, it was also used to protect the data from unauthorised modifications (thats us, the software tuners).
For example, ME7.5 ECU (VW 1.8 Turbo) contains about 70 different checksum blocks, and the result values are filtered through various functions to have a secure method of verifying data integrity.
At around the same time, Bosch started using access control on the outside ECU reprogramming (that is what we call the OBD flashing nowadays). It's usually a normal challenge-response scheme with a seed-key algorithm.
Of course, the chiptuning industry kept on and solved these functions to have methods of correcting the checksums, and to have OBD programming capability of these ECUs. What one man can do, another can undo
About 7-8 years ago, Bosch started using RSA signatures to control the ECU contents. Early on, just a 256bit RSA, then 512bit RSA, and nowadays, on these new ECUs, its a hash from a 1024Bit RSA signature. Something thats virtually un-crackable with traditional brute force methods.
Since these keys are yet to be solved, tuners have had to find other ways of programming the ECUs. When the MED17 / EDC17 ECU family was released, a backdoor was found in the programming algorithm. Originally this hash was checked only after certain conditions were met.
If they are not met, it was not checked. So the programming method made sure that was the case every time they programmed the ECU.
This "Tuning Protection" (TProt), as it is commonly called, just means that this backdoor has been sealed, and the ECU always checks the hash validity after every OBD programming attempt. If this is not valid, it sets a flag in the memory that prevents the car from starting.
Expensive tools can detect this function just by reading the ECU via OBD.
Many others, including some big brand names, have problems with cars not starting after writing.
That is why, for now, on these protected ECU's, we need to open the ECU to use a processor function built in the TC17xx-series processors, which allows us to boot and reset the ECU at any given moment from pins on the motherboard. This way the ECU does not detect it as being an OBD programming attempt, and skips the hash validity check.
At this time, there are no tuning companies who can bypass this security check and if an ECU has "Tuning Protection" then it will need to be programmed by taking the ECU out and opening it.
Some call it "bench flashing", some say they "install a probe", but this is how it is done by ALL tuners who are offering remaps on "protected" MED17 / EDC17 ECUs and others as well!
We at Promotec have written a patch software which overwrites part of the code in the ECU and AFTER we did the bench probe and applying our patch, we then can access the ECU via OBD port just like the "older" versions before
![[Image: pos_frame.jpg]](http://s21.postimg.org/ulc0qgzh3/pos_frame.jpg)
Source: BOSCH, TProt, K-Tag possitioning frame manual and Internet