I'm after advice on how to identify a PIN that has been accidently entered and has locked an automotive ECU making it useless. The problem is resolvable by sending the computer back to the manufacturer and have it reset to default, there is no way that a user can do this, and the manufacturer charges about AU$200 including postage for the service.
The ECU in question is a Microtech MTX-8. It uses an HC11 microcontroller. The user interface is via a handset with 6 buttons and a 4 line character display. Now I didn't lock this computer, a friend had a perfectly running car and out of curiosity loaded a saved configuration that unfortunately had a PIN assigned. The unit was second hand. It is now a paper weight. The computer is ancient history these days so we're not interested in spending money on it by sending it back. For reasons of regaining function of the computer and also as an academic exercise I'm continuing to look into this.
I have a bit of background in HC11 but reversing someone else's complex code isn't something I've had anything to do with. What I've been able to work out so far is:
- I've pulled the processor from the mtx-8 computer and put it into a circuit I have hanging around from my Uni days. I am able to pull the firmware off the chip no problem.
- I can decompile the s19 file with IDAPro and get the ASM.
- I can read various text strings which all make sense given the purpose of the device, things like air temp, water temp, basically all the text fields that would be displayed on the handset.
- I have a second mtx-8 that isn't locked and I can lock it, dump the firmware, compare it to the unlocked code from the same device.
I have performed dozens of tweaks to the settings on my second, unlocked mtx-8 and compared with Notepad++ without luck. The PIN is six digits so crunching through 999999 combinations isn't that appealing. It seems to live somewhere other than EEPROM of the processor and given that I think there is some type of external serial EEPROM in use it is a possibility that the PIN or it's hash is living there.
Looking at the memory used by the code, I think the processor is an HC11 MC68HC11E20. The device circuit board has the chip numbers scrubbed off unfortunately. The E20 has 20k of ROM program space from $D000 to $FFFF and from $9000 to $AFFF. I do know that the circuit board has some type of external memory in which the additional tune configs are stored - memcals - there are four slots for saved configs available and the user manual says that these are stored on the handset. There is an 8 pin IC in the hand controller but the numbers are scrubbed off. There are also numerous 8 pin ICs on the main computer board which may or may not also be external EEPROM. The device CONFIG register appears to indicate the the processor is in single chip mode which I think still makes sense if there is an external serial EEPROM involved.
I've just started having a look at HC11 simulators, THRSim11 seems most promising although I really didn't want to start analysing the the code just to find the PIN. I'm not interested in the engine tune which is hiding behind the PIN, I just want to identify this PIN.
So I guess I'm wondering if anyone has any suggestions, or might be curious about having a look at the ASM/S19?
Sorry for the long post! Thanks