BAWC Forums

https://forum.efilive.com/showthread.ph ... 17-Duramax

There's not a hell of a lot of detail there, but it's worth a skim. In a nutshell, the newest GM diesel ECMs use digitally signed software that can't be overridden.

What happens is GM 'signs' the flash file using a private key code that only they know. The ECU then reads this file, and it's able to unscramble the signature using a public key that anyone is allowed to know.

This type of public+private security system has been in use on computers for years, and when implemented correctly, it cannot be cracked.

If the signature doesn't match, the code won't run. This is enforced at the hardware level deep within the main CPU, and can't be disabled or overridden. Even the assembly line programming interfaces are password protected.

This has been tried before, and usually the only way around it was to hope the manufacturer left the hardware unlocked so you could disable the security enforcement in the CPU, or hope the vendor didn't implement the software algorithm correctly.

As long as GM implemented the algorithm correctly, and Infineon built their chips properly, this will not be cracked. Ever.

Right now it's just the diesels, but it will trickle down into the gas cars. I'm already reading that some of the 2018 cars like the Camaros and Corvettes have this type of ECU.

As of 2017, they supposedly implemented secure CANbus packets that use a similar signature method. So not only will it be impossible to flash the ECU, but you won't be able to mess around with the onboard data network either. You'll still be able to read it, but the various modules in the car will refuse and messages that don't have the correct signature.

I really don't blame them for doing this. The only reason it wasn't done sooner was because the hardware and software were too expensive. As we start moving more towards autonomous and networked cars, this kind of security is absolutely necessary.

But we may be witnessing the sunset of aftermarket tuning.

Sad.

But... we can still tune/mess with older cars. So there is still hope to have some fun.

Eh, they will figure it out a couple years after technology has passed those ecu's by.


Coop

Coop wrote:Eh, they will figure it out a couple years after technology has passed those ecu's by.

That's usually said by people who don't actually know how this stuff works. They just take it on faith that "someone smart" will figure it out. As long as there are no bugs in the code, this will not get cracked. That's the entire point of public key encryption. It's used in everything from digital payment systems to document storage to email. It's only just now trickling down to cars.

It'd be nice if they'd offer an unlock service once the warranty is up, but that'll never happen. Especially with the rise in network connectivity.

I think VW uses a similar system for their component protection scheme. About half the modules in my car implement this. You can replace them and program them all day long. But until the component protection function is updated, they won't function in the car. Only dealers and authorized partners can do this.

I never got too deep into it, but I think what happens is the replacement module phones home to the VW mothership in Germany and requests a new certificate signed with the private VW key. Then the CAN gateway checks that cert against a public key. If they don't match, the new module goes into reduced functionality mode.

So while it's not quite as extensive as what GM might be doing, it's still secure enough that there's only a couple aftermarket solutions that can bypass it, and only for some modules on some cars.

Something as silly as replacing an HVAC control head still requires a pricey visit to a dealer. You're basically paying them for permission to allow you to fix your own car. That's the part that pisses me off most.

Good, although I can see that they may allow certain sections of memory to be tunable depending upon how they want to implement it for aftermarket purposes. But then again, maybe not.

Anyway...

BRING ON THE HATE SO THAT I MAY BASK IN IT.

[quote=""Chris95RT""]
BRING ON THE HATE SO THAT I MAY BASK IN IT.[/quote]

Yeasssssssss!

Writing was kind of on the wall with the last attempt to get their codes into DMCA

Oh no, our cars are hackable.

Automakers: Watch this.

I mean, if I understand the certificate method they're using since Renesas does something similar all you have to do is go in and steal them- mission impossible style.

I can see the benefits of this, especially in automated vehicles. Do you think GM would sell name brand tuning software for say the ECU to allow tuners to tune for more power (and void any warranty at that time)?

That's what I was thinking.

If GM is selling it wouldn't people expect to keep warranty?

I ain't scared. We have a Jeff.


And a Chris2

Are you kidding me? I wouldn't touch this shit. I can barely handle the unsecured Mitsubishi stuff.

[quote=""Chris GTO TT""]If GM is selling it wouldn't people expect to keep warranty?[/quote]

I would think maybe they would potentially sell staged upgrades that would maintain the warranty, but maybe also a tuner kit to shops etc where they can tune the ECU, but it voids the warranty. :d ontknow:

I gotta believe gearheads will be quite upset if they cannot upgrade/tune their vehicles to their liking, and it could potentially hurt sales (though probably not enough for GM to care).

They used to do factory upgrades for the Supercharged Cobalt. They're also offering that MagRide software upgrade for the Corvette. So it's not unprecedented.

[quote=""Jeff V.""]They used to do factory upgrades for the Supercharged Cobalt. They're also offering that MagRide software upgrade for the Corvette. So it's not unprecedented.[/quote]

Yeah. Mopar did it too with the SRT4s. Ford racing does offer parts for the ST that maintain the factory warranty too.

I do agree that it is th beginning of the end for things like ECU Flash and Cobb Accessports, unless they sign major deals with GM etc.

Guess you better buy your corvette now

Aaron wrote:Guess you better buy your corvette now

Ok

It is a sad day when we can't tune cars anymore... But the bright side is that there are cars out now that really don't need tuning. Seems like 400+ hp cars are relatively common now from the factory if power is what you want.

Kind of makes sense that they started with the diesel trucks. The way those guys "tune" them, it is kind of a black eye on the brand when you see a truck just spewing soot all over the place.