Reading Superchips eeprom

[Furax]

Stumbled across this ecu with a genuine superchips unit in. Ive read somewhere these are read protected. I haven't tried to read it yet in case its got some kind of kill switch on it or anything. Its a pretty complicated unit considering the chip that its replacing is just a plain old 28F512.

Has anybody dealt with one of these before, and has any advice on how i could read it safely .

[exe123]

this is a copy protection socket. you can try to read it with programmer but it will fail (it will read ok but data is crap). they are protected against linear readouts...

[Furax]

Is there any way to get my willem to peform a non linear read out? Or maybe even read a few bytes, power down then back up again... yeah it would take a while but that wouldnt be a problem

[pasonjayne]

Is there any way to get my willem to peform a non linear read out? Or maybe even read a few bytes, power down then back up again... yeah it would take a while but that wouldnt be a problem

I personally wouldn't want the data out of one of those chips. Have you seen some of the older superchips maps, probably just flooding car with loads of fuel.

[Furax]

I personally wouldn't want the data out of one of those chips. Have you seen some of the older superchips maps, probably just flooding car with loads of fuel.

No ive not seen an old map, thats the problem.. i would like to copy it off and load it into ecm see what the differences are vs standard.

I have been looking to see if theres any way of reading a chip non linearly but so far its turned up nothing

[pasonjayne]

No ive not seen an old map, thats the problem.. i would like to copy it off and load it into ecm see what the differences are vs standard.

I have been looking to see if theres any way of reading a chip non linearly but so far its turned up nothing

What ECU is it you are working on?

[Furax]

Pug Gti-6. Magnetti IAW 1ap.10

[pasonjayne]

Pug Gti-6. Magnetti IAW 1ap.10

Wouldnt be that much between standard and modified i think maybe 4-5 BHP.

[Furax]

yeah i know, its just more curious than anything else. My friend would like a copy on his car and 4-5bhp is better than nothing.. all that stands in my way is finding a way to read the eeprom in a none linear fashion

[impactops]

yeah i know, its just more curious than anything else. My friend would like a copy on his car and 4-5bhp is better than nothing.. all that stands in my way is finding a way to read the eeprom in a none linear fashion

Have you read the chip, made a copy of it & put the copy back into the superchip PCB then plugged the superchip PCB into the ECU eeprom socket to see if it works?

[v8 dave]

How did you get on with this, as I have something very similar myself.

I can copy the 'original' chip and put it in the copy protection board, but that itself will not work without the board. I'd like to be able to copy my chip to put in my second (virtually identical) car, but am galled at paying another ?550 for an off the shelf chip

[richy_rich]

I don't know if this helps

GrauTec

(click on KFZ und Kopierschut...etc.) then there's the option to view the site in English. Not 100% sure but this looks like your 'device' above.

There's not much on the site about how they work, but you can contact them for more information.

Looks like it would be a good idea to get a copy of their encoder software and try figure out how that works? They mention a 'client specific algorithm' but I imagine all their h/w would all be standard, no?

[tango]

if u post the files u have read from the copy protected chips i will decode them for u if u like.
i will need the info of the ecu, car and chip

[roth18]

I personally wouldn't want the data out of one of those chips. Have you seen some of the older superchips maps, probably just flooding car with loads of fuel.

Ditto, I had a Superchip "tune", it was terrible. Switched to Upsolute long time ago.

[zilog357]

They use several methods when encrypting those chips. The copy protection board has a PIC microcontroller manipulating the linear read check and the algorithm. Also has a GAL chip (custom logic gates) programmed for custom interfacing the connection between the chip and the ecu. Some also include some of the chip databus pins swapped for more protection.

If I had the time, I would build some circuit with a pic microcontroller to randomly read portions of the chip and summing it up at the end... but hey, too much work for just one chip and the worst, a SuperChips brand.

Anyway, the "linear read" protection theory is still to be tested, though it seems to be the only logical thing to think of when trying to figure out how the protection board distinguish between a programmer and an ecu, but it may also be reading speed, as programmers are slow reading compared with the ecm when booting from these chips.