V7 SLR Posted September 12, 2002 Share Posted September 12, 2002 One of my friends took delivery of a beautiful R400 this week. It has an MBE ECU. I understand these are programmable and in fact are mapped by Caterham themselves and lock non-Caterham people out by the use of a password. Why? Is it purely a commercial reason or are Caterham trying to keep the cars they supply "standard" in the event they buy them back later for resale? What's the chance that this password could be cracked, and is the software freely available? Worcs L7 club joint AO.//Membership No. 4379//Azure Blue SLR No. 0077//Se7ens List Tours Link to comment Share on other sites More sharing options...
Nick M Posted September 12, 2002 Share Posted September 12, 2002 Password is often left as 1111. However, for warranty purposes they may have changed it to avoid tinkering. Software and cable is about £50 from MBE dealers such as SBD. Link to comment Share on other sites More sharing options...
murph7355 Posted September 12, 2002 Share Posted September 12, 2002 I've got the software and cable (for the older car). Doubt 1111 will work but you never know. Classic IT security gaff that Caterham might have fallen into. Locked out to prevent anyone changing Caterham's settings and them having agg' with warranties. I wouldn't even try if I were your mate until the 12mths is up. That said, if you want to try it, you can. The software has nice rev counters and gauges with numbers flickering up and down and stuff. Do Caterham map these? I think the R500s were done by a firm in Cheltenham. Maybe they just do final tweaks from a std. map (or maybe they just load the std. map and leave it). Link to comment Share on other sites More sharing options...
Red SLR Posted September 12, 2002 Share Posted September 12, 2002 I was told Minster did the map? Any way I was also told by Caterham that they are PW protected as my car has possible ECU problems and the only way to look at the ECU is either Caterham come to me or the car goes to them. See X777CAT here Link to comment Share on other sites More sharing options...
Nick M Posted September 13, 2002 Share Posted September 13, 2002 Actually thinking about it, unless you have the serial plug on the loom the only way to read the ECU is to unplug it and connect it direct to the PC using a bigger plug / cable - and I'm not sure you can easily buy those ones off the shelf. Hence why the ECU might need to go back to Caterham or they come out to you. Link to comment Share on other sites More sharing options...
Julian Thompson Posted September 13, 2002 Share Posted September 13, 2002 The idea of mapping an engine "by post" is a cause for some amusement. 😳 Link to comment Share on other sites More sharing options...
Nick M Posted September 13, 2002 Share Posted September 13, 2002 LOL !! 😬 Could take a while !! Link to comment Share on other sites More sharing options...
V7 SLR Posted September 13, 2002 Author Share Posted September 13, 2002 The idea of mapping an engine "by post" is a cause for some amusementHe he, you may laugh, but part of V7 was mapped via email. 😬 Karl's a clever chap. Andy, can you give me the details of the cable (I may make one up) 🤔 I guess the software is emailable or downloadable 🤔 Or does it require a unique id/password itself 🤔 We're not going to mess with his map (or warranty) because we have a second ECU to play with. I am not sure who actually mapped the original engine, but I have heard enough stories to believe that Caterham themselves enter that standard map into each ECU, hence them knowing the password. Worcs L7 club joint AO.//Membership No. 4379//Azure Blue SLR No. 0077//Se7ens List Tours Link to comment Share on other sites More sharing options...
Nick M Posted September 13, 2002 Share Posted September 13, 2002 The cable I've got is a simple serial cable which plugs into a connector on the loom. But I'm not sure if the R400 loom has this, which is where my comment about needing a cable with a connector that links straight onto the ECU came in. I think it's the ECU / map which has the password, not the software - you fire up the software and can look at the map freely. But if you want to change it you need the password. I have a copy of the Easimap software but it's on a CDROM - I could post it tomorrow if you wanted to *cough* look at it *cough* and then send it back. Edited by - Nick M on 13 Sep 2002 11:07:04 Link to comment Share on other sites More sharing options...
TorAtle Posted September 13, 2002 Share Posted September 13, 2002 Is the password limited to 4 digits??? Link to comment Share on other sites More sharing options...
Graham Sewell Posted September 13, 2002 Share Posted September 13, 2002 If there is no lock out for too many tries, why not just start at 0000 and work up. With a laptop it should not take long... Low tech luddite - xflow and proud! Link to comment Share on other sites More sharing options...
V7 SLR Posted September 13, 2002 Author Share Posted September 13, 2002 Nick, I understand now, thanks. My Emerald has a dedicated PC connector, separate and distinct to the engine-loom connector hence my confusion. I'll check with my friend about how the R400 is wired up. It must be possible to connect them both (engine and PC) to the ECU together or you can't map the engine... but then again perhaps Caterham don't allow you to ever (whether they do it or someone else) engage in any bespoke (to your) engine tuning, and haven't included the connector in the engine loom. Pity if that's the case. Anyone know the answer to Tor's Q? Worcs L7 club joint AO.//Membership No. 4379//Azure Blue SLR No. 0077//Se7ens List Tours Link to comment Share on other sites More sharing options...
EFA Posted September 13, 2002 Share Posted September 13, 2002 The MBE units have a password lockout to protect the intellectual property of the map. As Caterham do not have you sign a license agreement for "runtime" of the map, the map on an R500 is actually property of the cars owner. (I dealt significantly in software licencing in a former job, so take this as gospel) So you are quite entitled to phone Caterham and tell them you need the unlock code. The following is from an MBE manual: (sorry no graphics!!) PIN Numbers (Password protected ECU's) Introduction To protect customers against having their maps stolen or changed (and possibly causing damage to the engine) password protection has been added to the ECU. The following ECU's have the ability to password protect their maps: 956 - all models 941 - version 170 onwards 967 - all models When the ECU is first built, there will be no password enabled in the chip and the maps can be accessed freely. Valid Characters for Passwords Up to four digits, each in the range 0-9. The following list contains example valid passwords: 1234, 9999, 1045, 1, 333, 21 It is recommended that you always choose four digit passwords for maximum security. Setting the Password Menu: Keyboard: Alt + O, S Toolbar: Assuming the ECU you are connected to supports PINs you will be presented with the following box … You will be prompted to enter the old password as well as the new one. If the ECU does not currently have a password DO NOT type anything in the old password box. You must then click on the 'OK' button with the mouse or press Return. If this ECU did not have a password then the new password will be set unconditionally. However, if the ECU already had a password and you did not enter the correct old password then the password will not be changed. Accessing maps in a password protected ECU If you try to access a map or upload/download the chip in a protected ECU, a box will appear on the screen asking for the password. If you know the password then enter it here and click the retry button. If you do not know the password, you will not be able to look at or alter any part of the chip. For convenience the PC will remember this password for the duration on the current session with Easimap and you will not have to enter the password again whilst you are still connected to that ECU. Note that for security reasons, the password is not stored in any file on the PC. Once you finish the Easimap session, the password is forgotten in the PC. Fat Arn Visit the K2 RUM website See the Lotus Seven Club 4 Counties Area Website here Link to comment Share on other sites More sharing options...
V7 SLR Posted September 13, 2002 Author Share Posted September 13, 2002 Excellent. Thanks Arn. Think we're going to have a go at cracking it... if Caterham refuse to supply the password of course. Worcs L7 club joint AO.//Membership No. 4379//Azure Blue SLR No. 0077//Se7ens List Tours Link to comment Share on other sites More sharing options...
TorAtle Posted September 15, 2002 Share Posted September 15, 2002 Not trying to state the obvious, but if you intend to crack the password (which is apparently only hidden in the ECU), get hold of a port sniffer (could be software-based, search on google) and have a look at what's transmitted and received when you hit ENTER after typing in the password. Link to comment Share on other sites More sharing options...
Julian Thompson Posted September 16, 2002 Share Posted September 16, 2002 This could be interesting........ 😬 Link to comment Share on other sites More sharing options...
Chelspeed Posted September 16, 2002 Share Posted September 16, 2002 You can get a demo version of easimap from SBD's website http://www.sbdev.co.uk Not sure how powerful this is and what features are enabled or disabled. I've got the full version of Easimap 5, I think mines actually version 5.46. V7 - you're welcome to a disc, cd or evening laptop borrow if useful. The 941 ECU has a 9 pin D connector inside the box, you take the lid off and can connect your laptop to this while the ECU is connected to the engine via the loom and running or whatever. Not sure if the 967 is the same. The password in mine is 1111, not a security gaffe as previously posted but the default setting, if anyones bothered enough to change it they can, if not then it stays as 1111. Link to comment Share on other sites More sharing options...
murph7355 Posted September 16, 2002 Share Posted September 16, 2002 The security gaffe if you want to protect something is to leave the password as the (often widely known) default. My 967 has a 9pin D connected to the ECU. ECU is in the cockpit so you can map it whilst driving. Probably. Link to comment Share on other sites More sharing options...
jonwolff Posted September 19, 2002 Share Posted September 19, 2002 I've had a quick look at the Easimap demo software. This seems too obvious for no-one to have already tried, but I'll suggest it any way just in case. There is an option in the Tools menu to Erase Device. Does anyone know if this (a) needs the PIN, and (b) erases the PIN? The simulator doesn't seem to model the PIN behaviour, and I certainly wouldn't suggest trying it to find out, but I guess the manual for the full software might say. If the PIN mechanism was put there to protect the IP in the map, it may still let you completely clear the device. You would expect there to be a way for MBE to do this anyway, so that they can fix and recycle any returns that have an unknown PIN. If you can erase it, it should be simple enough to get hold of an initial map and whatever other setup is required for the Caterham configuration. -- Jonathan Wolff Link to comment Share on other sites More sharing options...
jonwolff Posted September 19, 2002 Share Posted September 19, 2002 Here's where I look really silly. This is in the help for the demo software: "I do not know/have forgotten the PIN Code for an ECU. "If, for whatever reason, you cannot access the ECU because you do not know the PIN code for the ECU, you have no option but to erase the device and reload the data from a chipfile. This requires that you have backed up the data inside the ECU to a chipfile while you still had access to the ECU. If you have this chipfile, you can goto 'Erase Device' in the 'Tools' menu and erase the ECU. Then goto 'Transfer Chip Data' in the 'ChipFile' menu and select the source device as your backup chipfile and the target as the ECU. The ECU should now be returned to normal operation. "If you have no backup of the ECU data and it is vital that you gain access to this specific data, you may have to return the device to your distributor for decoding. This will mean that your ECU is unavaliable to you for a period of time. Ask your distributor for advice." Seems fairly conclusive to me. Is there any problem with starting from scratch? You would not be able to return to the standard Caterham mapping (without reverse engineering whatever happens when you send it off for decoding, and risking the wrath of Caterham and MBE), but that shouldn't worry anyone who needs to remap. -- Jonathan Wolff Edited by - JonWolff on 19 Sep 2002 23:04:44 Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now