Unleashing the Power of My 20+ Years Old Car
summary
A 1997 manufacturer model (factory 300 hp) has its ECU dumped (64 KB) over XSM1 serial protocol at ~5 queries/sec, taking nine hours. Reverse engineering targets a Mitsubishi 770-family CPU with an M-flag that changes instruction decoding. Speed-limiter logic flips between 184–188 km/h. A Teensy VSS spoofer with TTL level shifting generates a ~180 km/h wheel-speed frequency so the ECU never cuts fuel, enabling 242 km/h on track. Cutting the VSS instead triggers limp mode.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:50White Motion
- 1:20My Car
- 2:41How to Communicate
- 4:03How to Use
- 4:50ECU Dump
- 5:41ECU Disassembly
- 7:21Reverse Engineering
- 8:25Admin Map
- 8:39Gentleman Agreement
- 9:35Speed Limiter
- 10:28Speed Limiter Explained
- 11:53ESL Solution
- 14:09Speed Limit Defense
related talks
44mMy Car, My Keys: Obtaining CAN Bus SecOC Signing Keys
27mHacking pre-obd car for fun and horsepower
40mThe UDS Security Model of the Tesla CAN Bus and Battery Management System
37mAutomatic Automotive Hacking
41mSecrets Of Simos18: REng The Secure Boot Mechanism Of An ECU
44mResearch Only? Understanding the Scope of Automotive...
50mAdvanced CAN Injection Techniques for Vehicle Networks
32mNo cars were harmed for this talk: Automotive Rust, amateur style