I have created a J2534 Tool for Bruteforcing 0X27 Security Access on Ford modules. Haven't implemented FEPS yet, so it will not work on a PCM, but other modules it will. Uses the keybag from the Ford hack and bruteforces service 0x27 with those keys and some others. Used an OBDxPro FT interface so t...

Ford has software called FJDS, which is just IDS that works with any J2534 interface. "Ford J2534 Dignostic Software". Might save some effort.

I have been working on diagnostic software for the Ford FG. Attached is video of it in action.

I've put a list of J2534 open source stuff here at https://GitHub.com/jakka351/openj2534

hjtrbo wrote: ↑Sun Feb 04, 2024 10:30 am I've successfully used the Forscan recovery mode on a soft bricked FG Mk1 turbo PCM. It had no problem retrieving the cal from it's database and sending it over the net. Flashed it no worries. The extended license is a bargain. Very impressive.

Try it with an ELM327 and see what happens lol.

Keep in mind this is circa 2000's era stuff basically. CCP was superseded by XCP, this is all pre-VBF and GGDS.

This is pretty amazing stuff. Nice work. Is F2A9 a standard DID for Ford CCP? I've been chipping away at the software for a newer truck cluster and I don't see that DID in the list of 2F sub functions. So do I just assume CCP isn't supported on this module, or do I need to dig into each of the unkn...

Logs taken using socketcan eavesdropping on Ford FJDS software talking to an FG1 Falcon.

https://github.com/jakka351/FG-Falcon-CAN-Logs/

Updated the git readme and now have the RCM on the bench with the raspberry.

Whiteford wrote:

VX L67 Getrag wrote:GREAT WORK, I hadn't checked this but after the crash module data I thought it was worth looking & WOW!

Had you found a resolution via OBD for RCM?

Read RCM flash then disassemble methinky. I have an RCM ready to be bench tested, start on it next year