Link ECU Unlocking

All,

As I understand there is no way of unlocking the ECU pass if one is set unless you start form scratch .

I have G4 for R34 GTT and unfortunately things didn't work out between my and the tuner so want to know what are my options.

I think none unless I start from scartch and do street maping.

Hello, you are correct there is no back door to break the password even at link head office sorry you will need to start from scratch

Regards Ross

This is probably the way for tuner to lock in the begginers . Do you see this done at many places?

Some tuners lock the ECU to supposedly protect their IP. In reality from what I see, the majority of tuners who lock their maps do it because they have no clue what they're doing and don't want others to see their maps. The only time I ever locked a map was when I was pretty confident the customer was going to 'have a play' after I'd finished. this just protected me from them blowing the engine up and coming back to blame me. If they asked for the password I would provide it but that gave me the opportunity to tell them that if they wanted to make changes, don't blame me if things turn ugly.

Had a follow-up question and thought to use this thread.

I have little experience with ecu reflash but the concept is the files are encrypted and using a software they can be read.

Now by encrypted I am not sure if this means there is no definition file so unless ones spends time to work out what each hex value means etc then sort of it is a gebbrish langauge or encrypyted.

or it is simply encrypted and needs a key and I wonder how companies discover this. is the key stored on some module and they find it etc

now to my question, can the same approach not be applied and read the map from Link. I would say surely if we can read manufacture maps which are not intended to be tampred with and are protected then Link should be sort of the same.

something like kess or ktag if it supports the link chip

in brief, bmw will spend way more that link to protect their ecu so if bmw can be read then could same principle be applied to link

thanks

So if you've got a Link G4 (non Plus), You can find the password rather easily by saving the map onto your PC and opening it in a text editor.

You'll find the password in [LinkMemData] the password starts after the 9741st , (comma)

You can see the password is decimal number, but if you read the number in ASCII, you can see my password is cheese

You can't zero out the password here without changing the checksum at the bottom of the map either, so just read the password and type it in.

https://imgur.com/RuAMjBh

I haven't had much luck doing the G4+ or G4X, they are encoding their maps differently which makes it more difficult. So it's then cheaper to get a new dyno tune.

you mean open file via text editor? U sed notepads plus plus and it is bunch of unrecognisable text

the extension is ..pclr

I was thinking , I could factory reset, give it a password I know what it is then save map onto pc and open it with hex editor and look for the password . if I find where it is then I can load the tuned map and know its location.

Am I looking at this at a very simplistic way? certainly this is not any more secure than many mainstream manufacture where you can reflash and read their file using hex editor. it is a bit of wind up and think no one has ever tried to remove the pass hence why no one knows how

I tried sending you the file but can't message the file over. It is rb25 det g4+ plugin

Yeah this is why I said G4 non-plus. The PLCR file is a G4+ file, it's encoded differently.

Do you think what I said earlier works?

Hi Armsa,

Yes so your proposed method works with the Link G4.

I have now found another method to get passwords off Link G4+, but unfortunately I need the ECU here on my big computer to do it.

Also, tuners. Don't use the same password you use for your e-mail, facebook and everything else, to lock your ECUs.... I've done a few now and what do you know... it's the same.

Another common theme is that it's just the registration number of the vehicle. Doesn't help if you've changed plates when you buy the car though.

Many thanks, would you mind sharing how? I can put the ecu on bench if needed

i will hugely appreciate this and big relief

Find the 14Volt Input and main ground Input pins on the ECU pinuout diagram.

Apply regulated 12 volts.

Connect computer.

That is all for bench access.

How would I read it once on bench? Has anyone done it?

I am quite happy to pay using paypal for any advice to recover the nap

i was thinking of loading the file into winols and see if I convert it to asci, whethere I get any clue as to what the pass is

i have used kess and ktag however no clue what to use to read the link from bench and if I read it via bench, does that mean pass wont be there?

i am assuming link software looks at certain section of binary file and if not empty, it asks for password there which winols can bypass it

post earlier by Peter suggested it can be cracked/retrived.

Perhaps a mediator could facilitate an agreement, work out a price, to hand over the PW.

If all efforts fail, I could hook you up with a reputable tuner in the UK for a fresh calibration, specialized with LinkECU and your pain will end instantly.

Aram,

Send me a message on Instagram @ptmotorsportau

or reach out through my website www.ptmotorsport.com.au

I can get your password hash out remotely, copy the hash file to my password cracking PC, crack the password and then unlock your ecu for you remotely.

You are a legend. Pinged you from your website, let me know where to upload the file to

many thanks

Peter is a legend and clever chap. He unlocked my ecu

I will refer him to whoever I see having this issue. Thanks again Peter you are a legend

You're very welcome! Glad I could help!

G4x unlock is possible, not from the encrypted file, only can do it at the ECU unit.