[WolfPlayer]

Once this is completed, I will move it to the How-To forum. However, for now, it is here because I am not done.

2005+ STI ECUs cannot just be swapped. The 2004 guys have it lucky The 2005+ ECUs are configured to work with the immobilizer box (under the dash) and the 'chipped' keys. All 3 work together to give you anti-theft capability. Thus, you can't just buy a used ECU and plug it in. That won't work. So, What do you?

1) First, of course, find a used ECU from the same market and same year. For me that was a 2005 USDM STi. Do what you can to have the owner supply you with the VIN. As far as I know, this will absolutely be necessary in order to eventually configure the used ECU. People try to sell these for quite a lot because they are almost $700 new from the dealer. HOWEVER, for us 2005+ STi guys these ECUs are basically paperweights unless you are willing to work with a Subaru dealer to get the ECU 'synched' to your keys. Use this to your advantage in order to get a good price. I got mine for $175 shipped.

2) Follow the shop manual to get to the stock ECU. It's really easy. If you can't do this then please close this thread and ignore it. You'll have to remove the side carpet trim and another plastic connector that holds the carpet down. Peel the carpet back. Remove the 3 10mm bolts and one 10mm nut in order to take out the formed sheet metal protecting the ECU. Remove the clear plastic cover that protects the ECU from water. Finally, compare the codes on the sticker of your ECU to the used ECU. They should match. Here's a picture of mine. They matched perfectly.



3) Unplug your stock ECU (you can leave it bolted in), and plug in the used ECU. If you want, disconnect the battery first if it makes you feel safer. I don't.

4) If you have a standard OBD-2 scanner (not an SSM protocol scanner like Enginuity, StreetTuner, ECUExplorer), use it now. You can utilize standard OBD-2 requests to get the VIN, CVN, and CIN off the used ECU. I had one handy (that I bought a long time ago from obd-2.com) and verified that the VIN number the seller gave me was correct. Hurray for an honest seller. By doing this, I also verified that the ECU is capable of OBD-2 communications and, therefore, was in good working order (at least with regard to OBD-2 communications). Here is a screenshot from reading my used 2005 USDM STi ECU:



5) If your car is relatively stock (Stage 2 or less) and you are running the stock injectors and stock MAF, then you can skip directly to step 6. For those guys who are thinking about getting a Stage 1 or Stage 2 tune but never want to tamper with their stock ECU, this is the option for you. Skip to step 6. However, if your car has a custom tune that is absolutely necessary in order for the car to run, then you should continue with Step 5. Generally speaking, if you have stock injectors and stock MAF, you can skip to step 6. If you are staying on step 5, now is the time to flash your ECU with the tune that is currently on your stock ECU. This is important because you really want this ECU to be in working condition for step 6. You will need a Tactrix cable for this step and you will be using ECUFlash available from OpenECU.org. If you have already been utilizing ECUFlash and DIY tuning then you are set. Simply keep the used ECU plugged in and flash your latest map to the ECU. If you have an AccessPORT, things get complicated. The AccessPORT can only be married to 1 ECU. The same goes for ECUTek.

6) Make an appointment with a dealer who will work with you on this. I'LL ADD TO THIS LATER WITH REGARD TO EVERYTHING THAT NEEDS TO BE DONE. I DON'T KNOW FOR SURE HOW THIS WILL WORK OUT BUT I HAVE A GOOD IDEA AFTER A LOT OF RESEARCH. with that said, I contacted 2 dealers: 1 who is very into Subaru performance and another who is the local dealer without a lot of experience. The local dealer didn't know what I was talking about. Basically, you want the dealer to be willing to allow you to swap ECUs in the parking lot and then they will 'synch' your keys with the used ECU. There is a charge for this. I received quotes of $59 and $89. This is what I am hoping for: I take all 3 of my keys and my used ECU with me to the dealer for my 'appointment'. I swap ECUs in the parking lot. They hook up their tool in the parking lot (handheld tool). I give them the VIN number of the used ECU. From what I understand, it is very important to have the VIN number of the used ECU or else they cannot do anything. With that VIN number, they can resynch the used ECU to your keys.

Here is what I don't know: Will the 'synching' of the used ECU with my Keys basically wipe out the 'syching' of my stock ECU with my keys? I don't know. I have no definite answer with regard to this. That is why it is important for me to have a working used ECU with the correct tune on it. It is possible that maybe the immobilizer unit under the dash gets programmed with the ECU identification. If that is the case, then it is impossible to have a spare ECU unless you also have a spare immobilizer unit. I'll keep everybody up to date. I am going to try to schedule an appointment soon.

t

[Szumita]

AWESOME write up... you know your stuff for sure.

[Impretzle]

Hey this is Cameron from Frederick Subaru.
If you set up an appointment next week, I won't be there (I goto school fulltime)
I too am actually really curious as to how this will work. Never really dealt with anything close to this. (I've reflashed my ecu, tinkered around with openecu/enginuity)
Hope everything goes well!
-Cameron

[daemon]

Ya' know... If you had bought a 2004...

Edit: I should have started reading your post before the halfway point. Hmmm...

[CenCali07STI]

just curious since you had the obd-2 scan tool was it actually necessary to have the seller give you the vin from the ECU? I understand that him being honest about it was surely a plus just curious is all. In case someone gets a dishonest answer from the seller but still has the ability to get the real vin through the scanner.

[WolfPlayer]

Originally Posted by CenCali07STI

just curious since you had the obd-2 scan tool was it actually necessary to have the seller give you the vin from the ECU? I understand that him being honest about it was surely a plus just curious is all. In case someone gets a dishonest answer from the seller but still has the ability to get the real vin through the scanner.

If you have an OBD-2 scanner that can obtain the VIN then no, it is not necessary. However, the majority of people won't have one available to them.

t

[halfelite]

If my understanding are correct the keys hold the RFID and has pre set amount of codes that it cycles. Then the immobilzer has matching codes for the keys then the ECU has a string to match it to the immobilzer. Seems they should be able to change the string in the ecu to match the immobilizer. Some open source software should be able to find the stored string in the ECU to change without going to the dealer.

[crystal_Imprezav]

Jeez, who did you get that info from ?

[halfelite]

Originally Posted by crystal_Imprezav

Jeez, who did you get that info from ?

From readin the how to hack the immobilzer thread and thinking about it. But i think that its either encrypted with md5 and has some sort of check built in. Or maybe its just burried somewere in the ECU that no one has looked yet. I see now you need the SKC Code and only subaru has it on the car info they pull up.

[WolfPlayer]

Originally Posted by halfelite

Seems they should be able to change the string in the ecu to match the immobilizer. Some open source software should be able to find the stored string in the ECU to change without going to the dealer.

This information is wrong given the current information and programs that are currently available.

The 1mb (for '05 STi) of binary data that we currently flash to the ECU does not contain anti-theft security information. This information is contained on a different part of the ECU that OpenSource is not capable of flashing (at this time). Trust me - been there done that In fact, if you read my initial thread, you will see that I already flashed my used ECU with my current image.

Additionally, if you think about this, it doesn't make sense (with regard to what is currently available). There are tons of ROMs available on the internet for our cars. You can grab any of them (for your make, model, year) and flash it. You'll be able to start your car. ECUFlash flashes any section of that 1mb (for 2005) image that is different. Obviously, the anti-theft information is different and would be flashed

Now, with all of that said, YES - theoretically - you should be able to do this with OpenSource software. However, the OpenSource community has not figured out how to do this (or has not published it publicly). In fact, I know that this is totally possible because ECUTek has a command in their software to synch keys to a different ECU .

Also, for the record, I talked to Cobb and was told that they cannot do this (even if I sent my ECU to them). This totally makes sense because the tool needs access to the immobilizer unit and your keys. This type of functionality could theoretically be worked into an AccessPORT. However, the demand for this is extremely low and it really doesn't go hand-in-hand with Cobb's whole 1-ecu=1AP marrying process.

t

[WolfPlayer]

Originally Posted by halfelite

From readin the how to hack the immobilzer thread and thinking about it. But i think that its either encrypted with md5 and has some sort of check built in. Or maybe its just burried somewere in the ECU that no one has looked yet. I see now you need the SKC Code and only subaru has it on the car info they pull up.

Bingo, IMHO, on both counts. Subaru needs a special cartridge for their tool in order to change this information on the ECU. This cartridge, available through Kent-Moore, is NOT available to the public. This suggests to me some type of encryption and/or special routines. Additionally, everytime this has been brought up in the Open Source community, it basically comes down to - no, it can't be done right now - nobody knows how to do it.

t

[WolfPlayer]

Originally Posted by crystal_Imprezav

Jeez, who did you get that info from ?

For the record, I want to point out that Jeff has been very helpful with regard to all of this. He's already been through trying to do this (but took a different route than me so that he wouldn't have to work with a subaru dealer). Talking to Jeff was definitely part of my research .... hence his post here - keeping me honest . Jeff's approach (correct me if I am wrong), was to get a used ECU with that car's immobilizer unit and a key. Thus, he was able to get every part of the system. However, finding all 3 of these available from the same owner is rare.

t

[neverendingmods]

WolfPlayer, great info. After being one of the 1st to have my ECU locked out by accessport 2, I've been wondering about the spare ECU for us 05+guys.
But whatever you ECU gurus do, please don't post up specifics on how to bypass immobilizer. That is info that should only be sent to known individuals on the boards via PM. Not for some punk, crack head thief who's only intent is to steal Subies. Once the immobilizer info 1st leaked out on other forums, 05+ Subies began to vanish out of parking lots. Also be leary of people also asking where the fuel pump relay/ECU pins are on ECU. Many of us have hidden fuel pump kill switches. Just a heads up.
Again, thank you for your hard work on this spare ECU dilemma for us 05+ guys.

[crystal_Imprezav]

Originally Posted by WolfPlayer

For the record, I want to point out that Jeff has been very helpful with regard to all of this. He's already been through trying to do this (but took a different route than me so that he wouldn't have to work with a subaru dealer). Talking to Jeff was definitely part of my research .... hence his post here - keeping me honest . Jeff's approach (correct me if I am wrong), was to get a used ECU with that car's immobilizer unit and a key. Thus, he was able to get every part of the system. However, finding all 3 of these available from the same owner is rare.

t

Why thanks Mr. Wolf, lol. For the record, IMO, EcuTek, writes their new encryption in this general area of the ROM. The system, most likely works as follows. The key has a magnet inside of it. This is checked with an "halo" ring which is mounted around your ignition. EVEN if you use the right key/code but have another coded key on your key ring, your car will not start and will throw a code for "improper key ........." The immobilizer unit most likely works like a TCU unit. The ecu has a RAM address I/O which checks the code that is pulled from you immobilizer and ignition halo. If that checks out, then it then checks this code with what is stored in the ECU. This makes sense b/c their are cases where people are able to start the car for a few seconds before it cuts-out on them.

If I were to do some IDA tracing, it's probably possible if your ROM is disassembled enough to trace back from the key error CEL to a routine which checks the immobilizer and work backwards from there. If I get some free time, I will see if I can dig anything else up. I am far from a computer engineer, so don't get your hopes up.

[halfelite]

Originally Posted by crystal_Imprezav

Why thanks Mr. Wolf, lol. For the record, IMO, EcuTek, writes their new encryption in this general area of the ROM. The system, most likely works as follows. The key has a magnet inside of it. This is checked with an "halo" ring which is mounted around your ignition. EVEN if you use the right key/code but have another coded key on your key ring, your car will not start and will throw a code for "improper key ........." The immobilizer unit most likely works like a TCU unit. The ecu has a RAM address I/O which checks the code that is pulled from you immobilizer and ignition halo. If that checks out, then it then checks this code with what is stored in the ECU. This makes sense b/c their are cases where people are able to start the car for a few seconds before it cuts-out on them.

If I were to do some IDA tracing, it's probably possible if your ROM is disassembled enough to trace back from the key error CEL to a routine which checks the immobilizer and work backwards from there. If I get some free time, I will see if I can dig anything else up. I am far from a computer engineer, so don't get your hopes up.

I think the immobilizer does all the checking of the codes. The ecu only has a code to verify the immobilzer unit In a handshake once. then the immobilzer does the rest. From what i gather there is a 4-6 skc number that is needed to porgram the ecu to the immobilzer. And you can only get it from factory. Does anyone know what standard immobilizer subaru uses there are 3 generations. I would say ecutek has there own program like the dealer that just finds the code by reading the old encrypted code and reverse engineering it then storings it so they can store it in a new ecu again.