Results 1 to 4 of 4

Thread: PCM555 ECU Security Access

  1. #1
    Potential Tuner
    Join Date
    Jul 2019
    Posts
    1

    PCM555 ECU Security Access

    Hello,

    This is not about a car engine at all, but I'm still hoping somebody may have some idea. It's a Mercury marine engine, controlled by Mortorola PCM555 ECU. I think some Ford engines may use the same ECU, but I'm not 100% sure.
    I'm trying to understand the security access to this ECU. It looks a bit different from the usual seed-key method, unless the seed is really long number.
    I have Mercury OEM scanner that uses RS485 and of course knows what the algorithm is. Every time scanner connects a different stream of bytes is sent from the ECU.
    One of the logic analyzer logs shows the following:

    Scanner (Hex) ECU (Hex)
    FD,02,01 DF,05
    FD,02,01 8A,E5
    FD,02,01 52,79
    FD,02,01 B0,98
    FD,02,01 38,48
    FC,27,CC 02,01

    Every log I have shows different number of FD,02,01 commands and different response from the ECU. After unknown number of FD,02,01 requests, scanner always sends FC,XX,YY, where XX and YY are always different values.
    So, I have two unknowns: first - how does the scanner know how many FD,02,01 commands to send and second - how if knows which value to send with FC command.
    It would be really great if any of you can give me some hint on this one. Have you ever seen similar protocol or even better - any chance you have some info on the algorithm used?

    Thanks in advance,
    Nick

  2. #2
    Potential Tuner
    Join Date
    Dec 2020
    Posts
    2
    Quote Originally Posted by ndjur View Post
    Hello,

    This is not about a car engine at all, but I'm still hoping somebody may have some idea. It's a Mercury marine engine, controlled by Mortorola PCM555 ECU. I think some Ford engines may use the same ECU, but I'm not 100% sure.
    I'm trying to understand the security access to this ECU. It looks a bit different from the usual seed-key method, unless the seed is really long number.
    I have Mercury OEM scanner that uses RS485 and of course knows what the algorithm is. Every time scanner connects a different stream of bytes is sent from the ECU.
    One of the logic analyzer logs shows the following:

    Scanner (Hex) ECU (Hex)
    FD,02,01 DF,05
    FD,02,01 8A,E5
    FD,02,01 52,79
    FD,02,01 B0,98
    FD,02,01 38,48
    FC,27,CC 02,01

    Every log I have shows different number of FD,02,01 commands and different response from the ECU. After unknown number of FD,02,01 requests, scanner always sends FC,XX,YY, where XX and YY are always different values.
    So, I have two unknowns: first - how does the scanner know how many FD,02,01 commands to send and second - how if knows which value to send with FC command.
    It would be really great if any of you can give me some hint on this one. Have you ever seen similar protocol or even better - any chance you have some info on the algorithm used?

    Thanks in advance,
    Nick
    Hi Nick,
    I realize this is a rather old post, but I just noticed it. If you still need help figuring out how the algorithm works please let me know. I managed to find some information on those.

  3. #3
    Potential Tuner
    Join Date
    Sep 2023
    Posts
    1
    Quote Originally Posted by Diagmate View Post
    Hi Nick,
    I realize this is a rather old post, but I just noticed it. If you still need help figuring out how the algorithm works please let me know. I managed to find some information on those.
    Diagmate, I'm interested in learning more about above? Have you ever tuned a 555 using HPTuners?

  4. #4
    Potential Tuner
    Join Date
    Dec 2020
    Posts
    2
    Hello, what exactly would you like to learn?
    I have never tuned a 555, unfortunately.