HackyourcarforBoostandPower

ByAaronHigbee
Aaron.higbee@intrepidusgroup.com
http://blog.phishme.com
http://intrepidusgroup.com
 Thisslideintentionallyleftblank.
Videoclips
 WhoAmI?
ASEcertifiedmechanic? Nope
CISSP Notanymore,Ispentmydueson
somethinguseful,carparts.
Imjustageekwholovestechnology,cars,
andhacks
Ihackedmyowncarusinggoogle,Internet
forums,opensourcesoftware,sweat,and
bloodyknuckles
ThankstoIntrepidus Group
 WhatisthistalkNOTabout
Howtomaintainyourcarswarrantyingood
standing.
Stayinggreen?Fueleconomy?Noway
InstallingacomputerinyourcartoplayMP3s
andWoW?Nope.
Wardriving?Thatsso2002.
 WhatthistalkISabout
0wningyourcar,tomakeitFaster
Introductiontomoderncomputercontrolled
enginemanagement
ToolsforECUprogramming
CommercialandOpensource
Carprotocols
Theroleofdifferencesensorsforelectronicfuel
injection
Performancetuningtheory

Continuedonnextpage
 Continued:WhatthistalkISabout
Whatsadyno andhowtogetdatawithout
one
Analyzinglogsandmakingchanges
Turbochargersandsupercharges
Fueloctane,ignitiontiming
Removingpeskyemissionsequipment

Continuedonnextpage
 Continued:WhatthistalkISabout
Computercontrolledalcoholormethanolto
copewithhighboostandlowqualityfuel
OtherECUdataandprivacyconcerns
ECUfirmwarepiracy
BypassingRFIDchipsincarkeys
Carmodificationlaws
ODBIIemissionstesting

Continuedonnextpage
Carhackers
Howtheseguysdidit
Theirpowermakingtools:
Americaniron
Carburetor
Ignitionadvance
Dirtandgrime
 Andtheirsecretweapon
UncleJessesmoonshine
Yeeeeeeehaw!
Todayscarhackers
Todayspowermakingtools:
 Somethingsremainthesame
Then Andnow
 Moonshine,alcohol,methanol
Dukesmethod Todaysmethod
Pourmoonshineinthe
generalleesgastank.
Result:

*Picturefromaquamist.co.uk
 Theresnoreplacementfor
displacement?
454ci 8cylinderbigblock500hp 152ci 4cylinder300hp
7.44liters 2.5liters
Actuallycompressingairandfuel

Turbosizeenvy
 Toolsofthetrade
ECU EngineControlUnit Methodsofalteringthecode
Thebrain justanother ReplacementECUs
computer EPROMchips
ControlsFuelInjection PiggyBackECUs
ControlsIgnitiontiming ECUreflashing
Programmable
 ReplacementECUs
Standaloneunits
completelyreplacethe
factoryECU
Upside
Enhancedfeatures
Quickedits
Downside
NoODBII
Costly
 EPROMChips
EarlyChip tuningwas
exactlythat
Upside
Canaltertheoperationof
olderECUs
Downside
Slower
Setandforget,soldering,
etc..
 PiggyBackECUs
ThinkManInThe
Middleattack
Upside
Fasttomarket
Extrafeatures
QuickEdits
Downside
Costly
Increased
complexity
 ECUReflashing
ThankyouODBII
Everycar,1996
andup
Primarilyfordata
acquisitionand
troubleshooting
Alsousedfor
firmware
updates

Continuedonnextpage
 Continued:ECUReflashing
TheECUisacomputer
loadedwithsoftware
ECUs occasionallyhave
bugs
nhtsa.dot.gov TSBs
Automanufacturersfix
thesewithareflash,often
timesthroughtheODBII
port

Continuedonnextpage
 Continued:ECUReflashing
Theautomanufacturesdontpublishtheirre
flashingprotocols.
TheydontpublishECUcode
$$$Bigbusinessforreverseengineers
Wouldyoupay$1000dollarsforaPSPfirmware
update?

Continuedonnextpage
 Continued:ECUReflashing
Overviewofhowitsdone
Stepone,crackthere
flashingprotocol
Steptwodownloadthe
ECUcode
StepthreemapoutECU ^Willthatmake
Stepfoureditandreflash yourcarfaster?
Stepfiveprayyoudidnt
brickyourECU Orwillyourair
(ordosomethingthatwill bagsdeploywhen
blowupyoucar) youhonkthehorn?
Continuedonnextpage
 Continued:ECUReflashing
$$$BigBusiness
AlotofR&Disrequired
Expensiveequipment
AntiPiracymethods
Specialcode DRM?
Hardwaretokensetc..
Lawyers

Continuedonnextpage
 Continued:ECUReflashing
Then:takeyoucartoa
tuner wholicensedthe
software
Theychargeyouforthe
licenseandtuningfees
Now:Theindustryismoving
tomoreDIYapplications
Portablereflashers
LaptopandPDAbased
Continuedonnextpage
Continued:ECUReflashing
Portabletuners
Usuallyhavepreset
settingsorstages
Increaseperformance
Changeshiftpoints
Accountforlarger
wheels
Securityfeaturestotie
thedevicetoonlyone
vehicle
Pricing$400$1000
Continuedonnextpage
 Continued:ECUReflashing
Laptopbasedtuners
Usuallyhavepreset
settingsorstages
Typicallygivetheend
usermorecontrol
Increaseperformance
Alsohaveanticopy
features$$$

Continuedonnextpage
 Continued:ECUReflashing
Laptopbasedtuners
Morecontrol
PerformanceStages
Highlycustomizable

Continuedonnextpage
 Continued:ECUReflashing
OpenSourcereflashing
Moreonthislater

http://www.osecuroms.org
http://www.enginuity.org
http://www.openecu.org

Continuedonnextpage
Sowhatcanyoudowithcomplete
controloveryourECU?

Continuedonnextpage
 Youcandoalot ofDAMAGE
PistonBefore: PistonAfterbadtune:

Connectingrodbefore: Connectingrodafter:
 ButyoucanalsomakePowAH!
Stock2006Corvette

6literV8
320whp
330ft/lbs
torque
Brochuresays
400hp
~23%drivetrain
loss

Wheelhorse
power
Drivetrainloss
Everydyno is
different
 What'saDyno?(dynamometer)
Atooltoplaceloadon
theenginetomeasure
power
 BeforeECUtuning

2.5liter
238awhp
242ft/lbs
torque

Brochure
says300hp
~25%drive
trainloss
 AfterECUtuning

andsome
parts
397awhp
401ft/lbs
torque
X25%driveline
loss==~500hp
 Introductiontoperformancetuning
Wecantbeexpertsin75minutes,butwecan
coverthefundamentals.
 ElectronicFuelInjection
Topicsforperformancetuning
Protocols
ImportantEFIsensors
Fuel,Spark,andAir
Boost
DataAcquisition

Continuedonnextpage
 EFIPerformancetuning
Importantsensors
Oxygensensors(O2sensors)
MassAirFlow(MAF)
ManifoldAbsolutePressure
(MAP)
IntakeAirTemperature(IAT)
Throttlepositionsensor(TPS)
Coolanttemperature
Knock sensor

Continuedonnextpage
 EFIPerformancetuning:Fuel
TheECUhastocopewith
differentgradesandqualityof
fuel
Itprocessesdatafromthe
differentsensors
Basedoninformationitgetsfrom
MAF,MAP,andO2sensors,it
determinesaninjectordutycycle
neededtoreachadesiredairfuel
ratio(AFR)
Continuedonnextpage
 EFIPerformancetuning:Fuel
Aperfectlymixedbatchoffueland
airfortotalcombustionis~14.7
partsairto1partfuel
Thisiscalledstoichiometric
Apologiestothelambdafolks
14.7:1ARFisalsoknownas1lambda
Mostenginesmakesthebestpower
runningAFRs between12.2:1and
12.8:1
Moreonoctanelater

Continuedonnextpage
 EFIPerformancetuning:Fuel
Anairfuelmixtureis
ignited
Exhaustgasesare
measuredforoxygen
TheECUmakes
adjustmentstoreachits
programmedAFRvalues

Continuedonnextpage
 EFIPerformancetuning:Fuel
Automanufactureshavemanyfactorstocopewith
whenprogrammingthedesiredairfuelratiosfor:
Safetyandenginelongevity
Fueleconomy
Emissionscontrol
Altitudeandfueloctaneratings
Differentpartsoftheworldhavedifferentgradesoffuel
ForinstancepremiumoctaneinCaliforniaisonly91octane
BecausetheAFRs accountforawidevarietyof
conditionstheyarenotoptimizedformaxhorsepower

Continuedonnextpage
 EFIPerformancetuning:Spark
Therightmixoffuelneedstobeignited
attherighttime
TDC TopDeadCenter
Thehighestpointapistoncanreach
SparkAdvance
Adjustingthetimingtofirethesparkplug
beforeTDCisreached.(whilethepistonis
travelingup)
Measuredindegrees
Sparkretard
Continuedonnextpage
 EFIPerformancetuning:Spark
Advancingtiming
Benefits:
Increasedpressure,morepowerfulexplosion==
morepower
Thedrawbacks:
Toomuchadvance:
Noadditionalpower
Toomuchcylinderpressure
Morepronetopreignition
AKAdetonation,akaknock
Rememberthispicture:
Continuedonnextpage
EFIPerformancetuning:Air
Wewilltalkaboutknock
morelater
Measuringairisnecessary
tocalculatethecorrect
fuelmix
Increasedpressure,more
powerfulexplosion==more
power
Measuringairand
manifoldpressurealso
helpstheECUfigureout
howmuchloaditsunder
Continuedonnextpage
 EFIPerformancetuning:Air
Superchargersand
Turbochargers
Createboost
Increasecylinder
pressure
Increaseheat
Boostisavolumeknob
HugeGarrettGT4202

800+whp

Continuedonnextpage
 EFIPerformancetuning:Air
MoreboostMoreproblems
Boostpressurizesmoreairinthe
cylinders.TheECUneedstotoss
morefuelintothemixture.
Fuelinjectors,fuelpumps,and
motorsallhavephysical
limitations
Morevigilantmaintenance
Mostcarownersaren't
responsibleenoughtocarefor
boostedmotors

Continuedonnextpage
EFIPerformancetuning:KNOCK

Continuedonnextpage
 EFIPerformancetuning:KNOCK
MoreboostMoreproblems
Knockiswhentheairfuelmixtureignites
withouttheECUfiringthesparkplug
Knockoccurswhentemperatureandcylinder
pressuresaretoohighcausingthemixtoignite
withoutspark
AKAping detonation

Continuedonnextpage
 EFIPerformancetuning:KNOCK
Yourmotorsisapreciseorchestraof
explosionsturningacrankshaft
Imaginewhathappenswhenoneofthese
cylindersfiresoutofsequence

Continuedonnextpage
 EFIPerformancetuning:KNOCK
AnECUlistenstoknock
sensorsattachedtothe
engine
Ifitdetectsknock,itwill
switchtodifferent
settings
Ex.Richerfuel,less
timingadvance

Continuedonnextpage
 EFIPerformancetuning:KNOCK
Becauseautomanufacturesplayitsafe,the
ECUcanberemappedtomakemorepower
Especiallyifyouhelptheengineinotherways
wardoffknock
Thisalsohelpstakefulladvantageof
aftermarketpartsbecausefactoryECU
partswillonlyuptheperformancetoa
certainpoint
Ex.Alargerexhaust
Continuedonnextpage
 DownloadingandReflashing
Protocols
CANOBD2
ODBII
ISO91412KLine
ISO91412LLine
VW/AudiCANBUS
ISO11898/11519
SubaruSelect
Monitor(SSM)

Continuedonnextpage
 Reflashing:Hardware
ThisisaUSBtoODBIIcablefromtactrix.com
Whatisit?
TheOpenPort 1.3UisanUSBdevicethatinterfacesbetween
yourPCandcarenginecomputers(ECUs)thatuseaISO9141
2compatibleOBDIIinterface.Italsocontainsspecial
hardwareandconnectorstoallowitreprogram(reflash)most
modern(1996+)MitsubishiECUs and2002+SubaruECUs.

WhatcarsuseISO91412?
Mostallpost1996Chrysler,
European,andAsianvehicles.
Cost:~$90

Continuedonnextpage
 Reflashing:Hardware
Ithasbeenusedin
Windows,Linux,OSX
Theopenport cableis
recognizedasaserial
COMportsimilartoa
USB>Serialadapter
OpenECU.orgs
ECUFlash comeswith
adriver
Continuedonnextpage
 Reflashing:Software
ECUflash
fromopen
ECU.org

Continuedonnextpage
 Reflashing:Software
Connectthe
openport
cable
Connectthe
reflash
jumpercable
Turnignition
toON
Takes34
minutes

Continuedonnextpage
 Reflashing:Software
Somehelpfultips
Securetheopenport
cable
Makesureyourlaptop
hasafullcharge
(bettertojustplugitin)
Sitstillduringthere
flash

Continuedonnextpage
 Datalogging
LoadKnockModMod Mod WB
RPMMAPMAFTPSSiteCountAFRIgn#1Inj#1Ign FuelBoostMAFAFR
psia V%degdutydeg%(CL)V
3013+5.13.1104300013.3+32.622.3+21.72.4230.002.913.78
3129+6.43.2104300012.2+31.424.7+20.22.4230.003.012.61
3220+8.23.3104400012.0+31.526.9+18.92.4230.003.111.62
3418+9.63.41045000rich+29.729.7+18.12.2230.003.211.55
3599+11.53.51045000rich+28.233.0+17.61.6230.003.410.93
3741+13.73.61046000rich+25.340.3+16.02.2230.003.610.93
3916+16.83.91048000rich+22.147.5+16.72.2230.003.710.84
4105+19.84.01049000rich+17.459.7+17.21.4230.004.010.86
4312+21.24.010410000rich+17.858.2+18.31.8230.004.010.76
4623+22.14.110410000rich+20.163.1+19.13.0230.003.910.81
4823+22.54.210410000rich+23.265.5+19.53.4230.004.010.70
5159+21.54.310410000rich+21.771.5+19.63.3230.004.010.74
5376+21.74.410410000rich+21.574.0+20.23.2230.004.110.82
5500+21.74.410310000rich+21.578.5+21.13.2230.004.110.86
5737+21.74.410410000rich+21.880.3+21.53.2230.004.110.78
5878+21.74.510410000rich+23.479.0+22.03.2230.004.210.78
6161+21.74.510410000rich+24.980.8+22.03.2230.004.210.87
6385+21.54.510310000rich+26.081.4+22.03.1230.004.210.93

Continuedonnextpage
Datalogging:Creatingyourowndyno

Longstraightroad
LowRPM
Mashthepedaltoredline

<Videocliphere>

Continuedonnextpage
Datalogging:Creatingyourowndyno

Youmaywant
topurchasean
Intrusion
Detection
Systemforyour
simulateddyno
roadpulls

Continuedonnextpage
 Reflashing:ECUEditingSoftware
Enginuity Open
SourceECUTuning
http://www.enginui
ty.org
Datalogging and
ROMeditor

Continuedonnextpage
 Reflashing:ECUEditingSoftware
Besidesfuel,spark,
andboost,what
else?

Continuedonnextpage
 Reflashing:ECUEditingSoftware
Besidesfuel,spark,andboost,whatelse
canyoudo?
TheCAAalsorequiredthatvehicle
emissionsinspectionprogramsaround
thecountrybegininspectionofthe
OBDIIsystem. Forseveralyears,DEQ
hasbeenpreparingtoimplementan
OBDIIinspectionprocedure. Effective
July1,2005,thenewOBDIIinspection
procedurebecametheofficialinspection
processformost1996andnewermotor
vehicles.
Continuedonnextpage
Reflashing:ECUEditingSoftware
Removingcatalytic
convertersforoffroad
useonly
Someemissions
equipmentlimitsfull
powerpotential

Continuedonnextpage
 Reflashing:ECUEditingSoftware
BeforeECUedits

Continuedonnextpage
 Reflashing:ECUEditingSoftware
WithECUedits,itsa
twoclickeffort

Doesthiswork?
Ipassedwiththe
externaldumptube,
theydidn'tevendo
avisual....Just
pluggeditintothe
OBDIIandpassed
thecarwithin5
minutes.

Continuedonnextpage
Reflashing:ECUReFlashSoftware
Rememberthese
things?
$400$1000?
Companiesspend
thousandson
researchand
equipment

Continuedonnextpage
Reflashing:ECUReFlashSoftware
Freeopensource
toolscandownload
andreflash?

(Itturnsoutweare
nottheonlyones
thinkingaboutthis)

Continuedonnextpage
Reflashing:ECUReFlashSoftware
Hereisoneofthefirstpoststotheopenecu.org forums:
(Thiswasalsosentasaprivatemessagetoseveralforum
members)
DavidEcuTeK writes:

EcuTeK LLPwishesittobeknownthatitownscopyrightinEcuTeK softwareanditssupporting

documentsandthatitwillacttoprotecttheserights.

Ifyouareconcernedthatyoumighthaveinfringedourcopyright orotherintellectualpropertyrights,or
thatyoumightdosointhefuture,wewouldbehappytodiscuss waysthatareasonableandamicable
solutionmightbefound.

DavidPower

*****************************EcuTeK
7UnionBuildings
WallingfordRoad

<snip>
 Knockisthepowerlimiter
Dealingwithknock
Rememberthis?

Octaneandother
tricksforcoping
withknock

Continuedonnextpage
 Fixingknockwithoctane
Octaneandothertricksforcopingwithknock
Reducecylindertemperatures
AricherAFRcancoolthecylindercharge
Coolboostedair
Intercoolers
Decreasecylinderpressure
Lessignitionadvance
Increasefueloctane
AdirectquotefromStone(p.80):"Theattractionofhighoctane
fuelsisthattheyenablehighcompressionratiostobe
used. Highercompressionratiosgiveincreasedpoweroutputand
improvedeconomy[assumingthesamepowerofengine]...The
octanenumberrequirementsforagivencompressionratiovary
widely,buttypicallyacompressionratioof7.5requires85octane
fuel,whileacompressionratioof10.0requires100octanefuel.

Continuedonnextpage
 Fixingknockwithoctane
Thisiswhymostreflashedcarsandtrucks
requirepremiumgradefuels
Thehighercompressionratioisalsowhy
turbochargedandsuperchargedmotors
requirepremiumoctane
Higheroctanefuelsletsyou getawaywith
runningmoreboostandmoreignitionadvance
makingmorepower

Continuedonnextpage
 SuperDuperHiTechstuff
Whatifyouliveinoneofunfortunatestates
thatpassesoff91octaneaspremiumfuel?
MixinsomeE85
100octane
Waterinjection
WWIIFighterplanes
Coolscombustion
50/50MethanolH20

Continuedonnextpage
 SuperDuperHiTechstuff
Theadvantageofmodernelectronicsisthat
preciseamountscanbeinjectedatoptimal
times

Continuedonnextpage
 SuperDuperHiTechstuff
Results Before50/50methanolinjection
Knockingpast21psiofboost(1.45BAR)

Continuedonnextpage
 SuperDuperHiTechstuff
Results
After50/50methanolinjection
Canrun25psiofboost(1.72BAR)
Increaseof+40whp(11%)+87ft/lbs
(28%)
http://coolingmist.com/
http://www.alcoholinjection.com/
http://www.snowperformance.net/
http://www.aquamist.co.uk/
 Stealinghighendcarswithreflashes
orstandaloneECUs?
CarRFIDSecuritySystemCracked
"TheNYTimesreportsthatthesecuritychipin
newautokeyshasbeencracked.
Thedealershiptoldheritwillcostanother
$1000labortoremovehercar'scomputer,
sendittoLexus'computerrepaircenterto
haveitprogrammedforthenewkey,and
thenreinstallit.
 Isyourcarspyingonyou?
MotorVehicleEventDataRecorders
Itssupposedtohelpanalyzecrashdata
AutoWeek reportedthatOnStar collectsdata
onnearcollisionsandcollisionsandretains
thisdataforaslongas18months.
UndertheHood,withBigBrother:
http://www.autoweek.com/apps/pbcs.dll/arti
cle?AID=/20041108/FREE/411080714
 Somefinalthoughts
Thegreenmovement
Fueleconomylegislation
Dontforgetaboutthose
ofuswhoenjoydriving
TheECUwillplayabig
roleinenforcingfuel
economy
Howaboutalawthat
forceseverybodytodrive
40MPHtoconservefuel?
 Questions?
ThanksandGreetz:
ride5000nhluhr hotrodhippySlorice
TheMadScientist mick_the_ginge Freon
Cdvma Jon[inCT]cboles Tgui crazymike TurbojonLS
Wolfplayer RichardLxcntrk75HighWayDrifter
AcquaCow NavyBlueSubaru Crystal_Imprezav
intrepidusgroup.com waterinection.info
enginuity.org osecuroms.org openecu.org
forums.nasioc.com OTcrewandIDP