Dumping 90’s Honda ECU Programming With Arduino

[P1kachu] owns a pair of early 1990’s Honda’s with custom tuning on their stock ECUs, and after having to get the ECU repaired on his ’93 civic, he found himself going down the rabbit hole of Honda ECU EPROM chips.

During the repair process, the tuning shop owner, or [Tuner-san] as [P1ikachu] refers to him, made a backup of the custom tuning to another EPROM chip.  This was done with an old Advantest R4945A EPROM programmer, which [Tuner-san] supposedly also used to clone Famicom cartridges back in the day. After realizing that [Tuner-san] could only clone the contents, but not view or modify it, he started looking at ways to do that.

EPROMS are programmed using higher voltage (12.5 V – 25 V) but to read them 5 V is used. The memory address is selected by setting each of the 15 address pins high or low, and then reading the status of the 8 data pins to extract one byte of data. Rinse and repeat for each of the 256 memory addresses on the Microchip 27C256 EPROM. One of the previous owners of [Pikachu]’s Civic made some unknown tuning changes, so he is in the process of looking at the dumped data to see what was changed. Once he has completed figuring out the programming table of the EPROM, he plans to do some testing with [Tuner-san] to possible smooth out the rev limited.

An interesting aspect of EPROMs is that they are erased using UV light, which sets all the memory bits to 1. During programming, selected bits can be set to 0, but it’s not possible to set them back to 1 without erasing the entire chip again.

Messing around with the computers in cars is not only for tuning, but can also expose some rather serious security flaws, especially in modern vehicles.