I am learning how to reverse engineer the EEprom data in Automotive ECUs.
For such purposes as to disable the immobilisers, find millage data and workout encoded VIN numbers among other things.
I can slowly work out certain things like the VIN number by changing it through diagnostics software and then comparing the difference.
Where I struggle is when trying to disable the immobilisers and other configurations. There are companies who have worked out how to on certain ECUs and supply the data. Often the solution is just to change one or two bytes of data.
Im struggling to understand how they would go about finding what bit of data to change, obviously they don't just each bit of data bit by bit and hope for the best as there would be millions of combinations.
How would you approach reverse engineering such system?