RomRaider

I've been spending way too much time reverse engineering a BIU compatible with SSM-III. There are around ~95 SSM commands. Some commands provide information, some customise the BIU and some enable registration of keys, keyless units, ECUs and Combination Meters. There are also various inter ECU-BIU commands which can be used for the same registration processes. The meaning of most bytes in the BIU EEPROM is now clear along with the associated encryption processes. Unlike an ECU, the BIU code is loaded with bitflag logic with very few recognisable float calculations. Hence, there are still some areas that are guesses or unknown. The more help I can get from folks testing these commands, the more accurate the reverse engineering will become. I am hopeful these commands will be useful for many folks for troubleshooting electrical gremlins, or for registering replacement parts. There is way too much information for one post, so I will be adding more information to this thread as time goes on. The more help I get, the faster the remaining uncertainty can be cleared up. Those wishing to support the effort can do so via testing and/or paypal to rimwall@gmail.com (some help would be nice - this is a horribly time consuming project).

Credits:
- Sasha_A80 for the ROM image
- Ryan and other contributors for some of the info here https://www.subaruoutback.org/threads/immobilizer-reverse-engineering-2005-obxt-probably-other-year-models.501753/
- feugrec and predecessor authors of freediag

Warnings:
- The BIU is a very important micro-processor which sits in the middle of all the other micro-processors, playing with it carries risks
- Information requests to your BIU are low risk, but other commands many render your BIU inoperable or unreliable
- This is experimental status. No warranties or guarantees whatsoever. You proceed at your own risk.

FAQ:

Which Subarus will this work for?
- I'm not sure yet. It should work for all Subarus that use serial comms via the OBD port. It may also work for CAN cars. I haven't been able to test this.

What software / hardware is required?
- You can use freediag (available here: https://freediag.sourceforge.io) or any other serial comms software
- Use a USB to OBD serial cable (eg: a cheap VAG-COM cable plus driver will work)

Will there be a GUI / user-friendly software to talk to the BIU?
- Volunteers welcome! Maybe integrate it with RR?

What are the serial comms settings?
- For the BIU use ISO14230 comms protocol
- 10,400 bps (or 10,417bps to be exact)
- The destination id for the BIU is 0x40
- command to BIU syntax is [0x80 + n] 0x40 0xF0 [cmd_byte_1] [cmd_byte_2] ... [cmd_byte_n] [checksum]
- response from BIU syntax is [0x80 + n] 0xF0 0x40 [rsp_data_1] [rsp_data_2] ... [rsp_data_n] [checksm]

How do I get started?
1. Download & build freediag
2. Edit the freediag.ini file so it contains the following:

3. Run freediag
4. Enter 'diag'
5. Enter 'connect'
6. To send a command to the BIU enter 'sr [command]' where command is described below. If you use the 'sr' command you don't have to worry about the source/destination/length/checksum bytes. This is all done by freediag.
7. When finished, enter 'disconnect' and 'quit'

Can I flash the BIU?
- Maybe, but I doubt if it's worth it. There are only two tables in the BIU. One relates to the calibration of the ambient temperature sensor. The other I'm not yet completely sure about. Not very exciting stuff.
- There are no commands to load/run a kernel, so a reflash will require a physical approach (eg: opening the BIU case and connecting to the chip on the PCB)
- A reflash is theoretically possible because the various chips do have reflash procedures in their hardware manuals. However the chips would need to have no reflash protection or you would need to circumvent the protection.

What's the plan / how can I help?
- I'll provide & explain the various commands over time, starting with the information request commands
- Folks can help by running these commands and posting the results to check whether all details are correct
- Once the information commands are solid, I'll move on to the BIU customisation and various registration commands

BIU Commands:
- all the commands below exclude the leading 3 bytes and trailing checksum (these are done automatically by freediag)
- the first byte of the response data is an echo of the command + 0x40

Commands to connect / disconnect
- this is done automatically by freediag, but for completeness the commands are as follows


Command to read BIU specific DTCs

- it is possible that a pending DTC hasn't yet been saved, so the saved_DTC_status will be 0x00. If the DTC has been saved, the saved_DTC_status will be 0xFE.
- the DTC will have the number "B" + pending_DTC_code_byte_1 + pending_DTC_code_byte_2
- example: 0x58 0x82 0x01 0xFE means there is a pending DTC B0201 (which is "HS CAN off") and the DTC has been saved (ie: not temporary).

List of DTCs I have compiled so far is:
B0100 BIU internal error
B0101 Battery Power supply error
B0102 Battery Power backup error
B0103 IGN power error
B0104 ACC power error
B0105 Key interlock circuit short
B0106 Shift Lock circuit short
B0201 HS CAN off
B0202 HS CAN off
B0211 HS CAN EGI error
B0212 HS CAN TCM error
B0213 HS CAN VDC/ABS error
B0214
B0216
B0217 HS CAN EPS data error
B0218
B0221 HS CAN ECM no data
B0222 HS CAN TCM no data
B0223 HS CAN VDC/ABS no data
B0224
B0226
B0227 HS CAN EPS no data
B0228
B0300 LS CAN error
B0301 LS CAN malfunction
B0302 LS CAN off
B0303 Wake up line abnormal
B0311 LS CAN meter error
B0313
B0314
B0321 LS CAN meter no data
B0323
B0327 LS CAN gateway no data
B0401 M collation bad
B0402 Immobilizer Key Collation bad
B0403 E/G request bad
B0404 Smart registration bad
B0500 Keyless UART comm error

Command to clear BIU specific DTCs
- clears all saved and pending DTCs

Not all BIU's are flashable.
There are masked ROM programmed among them as well.
As far as I remember M16C based BIU's were flashabled and were masked ROM.
M32C based I have at hand were flashable.

There is a hope that eeprom data area layout is similar for a number of BIU flash images.
This may simplify hacking.

There may exist the ability to readout the eeprom thru diagnostic connector.
I have seen this for Volvo ECU\TCU.
Or there is a way to download a kernel for eeprom reading\writing.
EEPROM copy\recovery ability is a must if you need to revive a car if something goes wrong while hacking.

Thanks Sasha_A80. I have not found a command to read-out the entire EEPROM contents. All the commands are in one subroutine, so I suspect such a command doesn't exist. There are a few different commands that read out parts of the EEPROM content. For example, saved DTCs, key serial numbers, pairing codes and car configuration / installed options. But no command that reads out the entire EEPROM. An alternative would be to save the EEPROM contents via direct connection to the EEPROM chip. In terms of the EEPROM data, the various 128kB EEPROMs seem quite similar. I imagine a 256kB EEPROM will also be similar, but I haven't yet checked.

The next command provides a very long list of the status of input switches, output switches and various CAN values. Some of these are confirmed, some are guesses, and some are still unknown. My car is pretty basic so I can't check quite a few. It would be great if others can try this command to confirm the list and also work out the unknown ones by (eg) run the command, change something, and run the command again to see what changes in the response. The more of these that can be confirmed, the more accurate the reverse engineering will be.

Command to list switch inputs / switch outputs / CAN data

Here is what I have figured out so far:

Data bit & Information
Byte0 bit0 key-lock warning SW
Byte0 bit1 Stop Light Switch
Byte0 bit2 Front fog lamp SW input
Byte0 bit3 Rear fog lamp SW input
Byte0 bit4 lighting SW input
Byte0 bit5 Door key-lock SW input
Byte0 bit6 Door unlock SW input
Byte0 bit7 ---- unused ----
Byte1 bit0 Driver’s door SW input
Byte1 bit1 P-door SW input
Byte1 bit2 Rear right door SW input
Byte1 bit3 Rear left door SW input
Byte1 bit4 R Gate SW input
Byte1 bit5 Manual lock SW input
Byte1 bit6 Manual unlock SW input
Byte1 bit7 Lock SW (guess)
Byte2 bit0 Bright SW input
Byte2 bit1 Shift Button SW input
Byte2 bit2 Economy Switch
Byte2 bit3 Tiptronic Mode Switch
Byte2 bit4 TIP UPSW input
Byte2 bit5 TIP DOWN SW input
Byte2 bit6 P SW
Byte2 bit7 MT Reverse Switch
Byte3 bit0 R wiper ON SW input
Byte3 bit1 R wiper INT SW input
Byte3 bit2 R washer SW input
Byte3 bit3 wiper deicer SW input
Byte3 bit4 Rear Defogger SW
Byte3 bit5 Driver’s Seat SW input
Byte3 bit6 P seatbelt SW input
Byte3 bit7 Fr wiper input
Byte4 bit0 Parking brake SW
Byte4 bit1 Registration SW
Byte4 bit2 Identification SW input
Byte4 bit3 Driver’s seat lock status SW input
Byte4 bit4 Passenger’s seat lock status SW input
Byte4 bit5 R gate lock status SW input
Byte4 bit6 Smart wake-up input
Byte4 bit7 ---- unknown ----
Byte5 bit0 Rr defogger output
Byte5 bit1 ---- unused ----
Byte5 bit2 lock actuat. LOCK output
Byte5 bit3 All seat UNLOCK output
Byte5 bit4 D-seat UNLOCK output
Byte5 bit5 R gate/trunk UNLK output
Byte5 bit6 Double lock output
Byte5 bit7 R wiper output
Byte6 bit0 Shift Lock Solenoid
Byte6 bit1 Key locking output
Byte6 bit2 wiper deicer output
Byte6 bit3 Starter cutting output
Byte6 bit4 Hazard Output
Byte6 bit5 Belt buzzer output
Byte6 bit6 Horn Output
Byte6 bit7 Siren Output
Byte7 bit0 D-belt warning light O/P
Byte7 bit1 P-belt warning light O/P
Byte7 bit2 Illumination lamp O/P
Byte7 bit3 Room lamp output
Byte7 bit4 key illumi. lamp o/p
Byte7 bit5 R fog lamp output
Byte7 bit6 R fog lamp monitor
Byte7 bit7 Immobilizer lamp output
Byte8 bit0 Keyless Operation 1
Byte8 bit1 Keyless Operation 2
Byte8 bit2 EK alarm output
Byte8 bit3 TL alarm output
Byte8 bit4 ---- unused ----
Byte8 bit5 ---- unused ----
Byte8 bit6 ---- unused ----
Byte8 bit7 ---- unused ----
Byte9 bit0 CC Main Lamp
Byte9 bit1 CC Set Lamp
Byte9 bit2 SPORT Lamp
Byte9 bit3 SPORT Blink
Byte9 bit4 ATF Temperature Lamp
Byte9 bit5 ATF Blink
Byte9 bit6 ECO Lamp (AT)
Byte9 bit7 ECO Lamp (MT)
Byte10 bit0 Tire diameter 1
Byte10 bit1 Tire diameter 2
Byte10 bit2 Shift Up indication
Byte10 bit3 Shift Down indication
Byte10 bit4 Sport Shift (buzzer 1)
Byte10 bit5 Sport Shift (buzzer 2)
Byte10 bit6 ABS/VDC Judging
Byte10 bit7 ADA Existence Judging
Byte11 bit0 Small Light SW
Byte11 bit1 Headlamp
Byte11 bit2 Headlight HI ON/OFF
Byte11 bit3 Turn signal LH ON/OFF
Byte11 bit4 Turn signal RH ON/OFF
Byte11 bit5 RR Defogger Switch
Byte11 bit6 Australia Judging Flag
Byte11 bit7 Large Diameter Tire
Byte12 bit0 Number of Cylinders
Byte12 bit1 Camshaft Type
Byte12 bit2 Turbo
Byte12 bit3 E/G displacement (2.5L)
Byte12 bit4 E/G displacement (3.0L)
Byte12 bit5 AT Vehicle Signal ID
Byte12 bit6 E/G Cooling Fan
Byte12 bit7 Heater Cock V/V Output
Byte13 bit0 Power Window (Up)
Byte13 bit1 Power Window (Down)
Byte13 bit2 Keyless Buzzer
Byte13 bit3 Bright Request
Byte13 bit4 P/W ECM Failure
Byte13 bit5 Keyless Hook SW
Byte13 bit6 ---- unknown ----
Byte13 bit7 ---- unused ----
Byte14 bit0 Door lock SW (open)
Byte14 bit1 Door lock SW (closed)
Byte14 bit2 Door Key SW (open)
Byte14 bit3 Door Key SW (closed)
Byte14 bit4 under hook registration
Byte14 bit5 hook registration end
Byte14 bit6 unlock request
Byte14 bit7 ---- unknown ----
Byte15 bit0 Centre Display Failure
Byte15 bit1 Navi Failure
Byte15 bit2 IE Bus Failure
Byte15 bit3 Auto A/C Failure
Byte15 bit4 EBD Warning Light
Byte15 bit5 ABS Warning Light
Byte15 bit6 VDC Off Flag
Byte15 bit7 VDC/ABS OK

Most of these were obtained from lists in service manuals. But it is tricky because the order is completely different. And some only exist on certain models. Note that the first 5 bytes are inputs, the next 4 bytes are outputs and the last 7 bytes are CAN data.

EDIT 28/2/23: updated item list

Ploughing on with the next command...

Command to list lighting related switch inputs / outputs


Data bit & information
Byte0 bit0 lighting I sw input
Byte0 bit1 lighting II sw input
Byte0 bit2 ---- unused ----
Byte0 bit3 dimmer hi sw input
Byte0 bit4 ---- unused ----
Byte0 bit5 dimmer pass sw input
Byte0 bit6 ---- unused ----
Byte0 bit7 ---- unused ----
Byte1 bit0 lighting I lamp output
Byte1 bit1 lighting II lamp output
Byte1 bit2 lighting hi lamp output
Byte1 bit3 front fog lamp output
Byte1 bit4 DRL cancel output
Byte1 bit5 power supply transistor
Byte1 bit6 foot lamp output
Byte1 bit7 ---- unused ----
Byte2 bit0 ---- unused ----
Byte2 bit1 ---- unused ----
Byte2 bit2 ---- unused ----
Byte2 bit3 ---- unused ----
Byte2 bit4 ---- unused ----
Byte2 bit5 ---- unused ----
Byte2 bit6 ---- unused ----
Byte2 bit7 economy switch

EDIT 1/3/23: updated the last bit

Some analog data in this command...

Command to list key BIU data


Data byte & information
Byte0 battery voltage (control) [x 0.0843 to get volts]
Byte1 battery voltage (backup) [x 0.0843 to get volts]
Byte2 ignition system voltage [x 0.0843 to get volts]
Byte3 accessory voltage [x 0.0843 to get volts]
Byte4 illumination VR volts [x 0.0196 to get volts]
Byte5 illumination d-ratio [x 0.4 to get %]
Byte6 ambient temp sensor volts [x 0.0196 to get volts]
Byte7 ambient temp degrees C [x 0.5 - 40 to get degrees C]
Byte8 fuel level volts [x 0.0392 to get volts]
Byte9 fuel level resistance input to BIU [x 0.4 to get ohms]
Byte10 key lock solenoid volts [x 0.0843 to get volts]
Byte11 number of keys registered for keyless entry

EDIT 28/2/23: updated conversion factors
EDIT 8/3/23: removed volt offsets I should have fixed previously

Command to list key CAN data


Data byte & information
Byte0 Front Wheel Speed, low byte
Byte1 Front Wheel Speed, high byte [combine 2 bytes into a word and x 0.05625 to get km/hr]
Byte2 VDC/ABS latest f-code, low byte
Byte3 VDC/ABS latest f-code, high byte [latest DTC from VDC/ABS]
Byte4 Blower Fan Steps
Byte5 Fuel level resistance sent to combination meter, low byte
Byte6 Fuel level resistance sent to combination meter, high byte [combine 2 bytes into a word and x 0.0016 to get ohms]
Byte7 fuel consumption, low byte
Byte8 fuel consumption, high byte [combine 2 bytes into a word and x 0.001 for cc/s]
Byte9 ECT [- 40 to get degrees C]
Byte10 Vehicle longitudinal G force [x 0.1235 to get m/s^2]
Byte11 SPORT shift stages [0 - 7 step]
Byte12 Shift position [0 - 7]

Has anyone given these commands a try?

EDIT 28/2/23: updated conversion factors

I'm still keen to get some help from others to test & verify these commands. Anyone?

Today's command...

Command to display BIU Customisable Times & Temps


Data byte & information
Byte0 bit0, bit1 - 4 values for room lamp off delay time - OFF, Short, Normal, Long
Byte0 bit2 to bit7 - unused
Byte1 bit0, bit1, bit2 - 5 values for auto-lock time - 20, 30, 40, 50, 60 seconds
Byte1 bit3 to bit7 - unused
Byte2 bit0, bit1, bit2, bit3 - 9 values for outside temperature offset - -2.0 to +2.0 in 0.5 degrees C increments
Byte2 bit4 to bit7 - unused

Still keen for some folks to help out by running these commands to check my interpretation...

Command to list dealer / country options

Data bit & information
Byte0 bit0 rear defogger option
Byte0 bit1 ---- unused ----
Byte0 bit2 security alarm setup
Byte0 bit3 impact sensor setup
Byte0 bit4 alarm monitor delay setting
Byte0 bit5 lockout prevention
Byte0 bit6 impact sensor
Byte0 bit7 siren installed
Byte1 bit0 answer back buzzer setup
Byte1 bit1 hazard answer back setup
Byte1 bit2 automatic locking setup
Byte1 bit3 ans-back buzzer
Byte1 bit4 auto locking
Byte1 bit5 ---- unused ----
Byte1 bit6 ---- unused ----
Byte1 bit7 ---- unused ----
Byte2 bit0 select unlock switch
Byte2 bit1 passive alarm
Byte2 bit2 door open warning
Byte2 bit3 dome light alarm setting
Byte2 bit4 map light setting
Byte2 bit5 belt warning switch
Byte2 bit6 ---- unused ----
Byte2 bit7 keyless P/W switch
Byte3 bit0 illumination control on/off
Byte3 bit1 A/C ECM setting
Byte3 bit2 P/W ECM setting
Byte3 bit3 center display setting
Byte3 bit4 wiper deicer
Byte3 bit5 rear fog light setting
Byte3 bit6 UK security setup
Byte3 bit7 MT/AT
Byte4 bit0 sedan/wagon setting
Byte4 bit1 double lock
Byte4 bit2 6MT setting
Byte4 bit3 Destination code
Byte4 bit4 Destination code
Byte4 bit5 Destination code
Byte4 bit6 Destination code
Byte4 bit7 EK model

This is pretty awesome! I wish I could help, but this is above my level. about all i can do is cheer you on!
BTW, i was looking at installing a remote start and push button start but i need to bypass the immobilzer. any thoughts on a "deactivating" the immobilizer in the BIU? (05 USDM Legacy GT Auto)

The ECU cuts fuel (aka the immobiliser) if the ECU/BIU pairing code does not match or the BIU does not recognise the key. The ECU ROM could possibly be edited to bypass these checks and keep the engine running. I’ve not tried it yet so it may not work.

Command to list VDC/ABS Condition

Data bit & information
Byte0 bits0-2 VDC/ABS Condition, values of 0-7


Command to list Destination Code & Touch Status

Data bit & information
Byte0 bits0-3 Destination Code, values of 0-16
Byte1 bits0-5 Touchscreen SW, values of 0-64


Command to list Destination Code & Touch Status

Data bit & information
Byte0 bit0 - factory initial setting*

* this is an important bit that (with a different command) can be used to reset the BIU

Should have a vagcom cable arriving shortly to try some of this out. I have a factory scan tool too which also have most of these bui settings listed

@mrdohca - that's great to hear! Looking forward to hearing how you go.

Also, MiikaS is kindly helping me incorporate BIU comms into FastECU, so I should soon have a GUI for communicating with the BIU.

With lots of help from MiikaS, communication with the BIU is now possible using a GUI via FastECU. More info here

Doesnt' seem to work on AZ1J500T/71F2514007 2011 Forester S Edition

The connect command gets an header response error.

Using Tactrix OpenPort 2.0 Interface.