RomRaider

So what brings this topic up, is I unknowingly purchased an EcuTek locked V7 207 ECU (AF481). Like many others, I've scoured looking for potential solutions, but for 16bit, they seem fairly limited.

From what I've gathered, there's only a few options to render this ECU usable again (i.e., open source flashable)

1.) Pay ~$200 to purchase ecuEdit and attempt to flash a stock ROM over the EcuTek lock, reports of this working in the past

2.) De-solder MCU from ECU PCB, re-solder replacement (non-EcuTek locked) MCU onto PCB

3.) Use BDM headers on ECU PCB to re-flash MCU bootloader and ROM with stock values.

Now, I've seen a lot about people using homebrew BDMs, buying PE software, etc., but only for live tuning, and breaking down unknown ROMs.

It doesn't seem too far fetched of an idea to me, but with the proper BDM and access to read a non locked MCU, could the locked MCU be re-flashed via the BDM to a stock/open source friendly ROM/bootloader combination?

I do have a stock 16bit ECU that responds properly to opensource tuning, and then the EcuTek locked ECU.

I've done some reading on this, and haven't got much further than it seems possible, however I'm not capable of developing my own BDM and software to do this, nor do I fancy spending $200 on PE software, or EcuEdit.

Does anyone have a known working homebrew type of BDM and some way to read/write the 68HC(9)16 that has been shared, and I just haven't found yet? Or is this sort of not even feasible.

I'm not 100% positive, but with 16bit ECU's you should just be able to swap out another 16bit board and use that providing it's got the same plugs/pinout without changing anything. Can you try the unlocked one in the car?

Unfortunately, swapping the ECU isn't exactly helpful in the case, as the other 2 I have don't have the internal circuitry to run the AVCS. I did start looking into adding that onto non AVCS ECUs, but I have some more digging to do and find out exactly what components are needed, and if they are even sourceable.

There is a datasheet I had used for hacking.
Hope this helps to clarify BDM connection.

Some ECU PCBs had BDM interface named soldering points. Not all PCBs have those points marked as far as I remember.

might be a bit unrelated, but avcs controller as addon - viewtopic.php?f=7&t=11237

Anyone who has bricked 16bit HC16 Denso ECU, FastECU includes quite easy way to unbrick it... using Arduino as BDM device.

https://github.com/miikasyvanen/FastECU