BA-BF PATS-off binary patch

[pman92]

Over the last few months I've (slowly) been deciphering the BA-FG1 falcon PATS system. As some will probably know it's not really convenient to turn PATS off in a stock standard falcon. The ICC / audio module will display a security code error and the light / warning will be on the dash.

I originally intended to create an emulator module as a simple DIY fix that could be used in combination with a PATS off PCM reflash. No need for 2 ignition keys or replacing a faulty BEM on a 20 year old vehicle that's often not worth much. Just turn it off and forget about it.

I've dumped firmware and disassembled the BEM, audio control module and PCM. After many hours in ghidra and playing/testing with modules on the bench, I've got a pretty good understanding of how it all works. I know how the 6F6/6F8 ID CAN messages are formatted, the encryption algorithm used, how they do a challenge/response exchange, and how the audio module listens to it all to know if its fitted to the correct vehicle or not. I still have a little left to do on FG1 but I will worry about that after I have finished BA/BF. FG2 onwards are completely different and I haven't looked into them at all.
Considering the work I've put in I'm not going to release any of that information publicly (it's also a security concern).

A few weeks ago I had a brain wave and realized an emulator module isn't required at all. All the problems can be resolved by patching the PCM code. So that's exactly what I've done.
The PCM will run without even changing the PATS flags once that patch is applied. The security light will stay off. And the audio module / ICC is happy.

Current strategy's I have a code patch bench tested for:

Code: Select all

BA (black oak)
HAAN9
HAANC
HAAND
HAANF
HAANG
HAAO7
HAA08
HAAPA
HAAS4
HAAT3
HABNC
HABND
HABO6
HABS2

BF (spanish oak)
HACCD
HACCE
HACCF
HACCG
HACCH
HACCI
HACCK
HACH3
HACH4
HADCD
HADCE
HADCG
HADCH
HADCK

FG S1 (spanish oak)
HACD9
HAEDJ
HAEDL
HAEE3
HAEE4
HAEE5
HAEF7
HAEJ1
HAEJ2
HAFDJ
HAFFB

Each strategy is slightly different due to code being in different locations. However the code structure is pretty well the same. I've got a script that pattern matches to help porting it to new strategies, and then I've been verifying in ghidra and bench testing on a PCM.

I'm looking for someone with a BA / BF and ability to reflash it who is willing to try the patch out in the real world (PM me a read and I'll send a patched copy back).
Bench testing it seems to work fine (I've got a crank signal generator setup checking coil/injector outputs), but I don't have an actual vehicle to try it in.

I am also looking for copies of any of the following files which I do not have (so I can port it to them as well):

Code: Select all

BA (black oak)
HAAKA
HAAL3
HAAM8
HAAMA
HAAMC
HAAME
HAAMF
HAAMG
HAAMW
HAAO4
HAAO6
HAAP6
HAAP7
HAAP8
HAAP9
HAAS2
HAAT0
HAAT2
HABKA
HABM3
HABM8
HABM9
HABMA
HABMC
HABME
HABMG
HABMW
HABN8
HABN9
HABO4

BF (spanish oak)
HACC6
HACCA
HACCB
HACD1
HACH2
HADC6
HADCA
HADCB
HADCC

FG S1 (spanish oak)
HAEDB
HAEDD
possibly others as well...

[hjtrbo]

Spanish Oak:
Missing:
HADCC
HADCB
HADCA
HADC6
HACH2
HACD1
HACCB
HACCA
HACC6

[pman92]

Spanish Oak:
Missing:
HADCC
HADCB
HADCA
HADC6
HACH2
HACD1
HACCB
HACCA
HACC6

Thanks, I have done all them as well and updated the list in first post.

I've now tested it in a real world vehicle and it works a treat.
Testing out a few more probably wouldn't hurt though. If anyone needs one done PM me

[VX L67 Getrag]

This is awesome as yeah it was one of the annoying things I found when just needing to chuck another controller in a BA onwards falcon just to test/diagnose!

GREAT WORK!!!

[pman92]

Been working on FG series 1, and I've got the following patched:

HACD9 (4spd LPG ute, tested on my own vehicle, working great)
HAEDJ
HAEDL
HAEE3
HAEE4
HAEE5
HAEF7
HAEJ1
HAEJ2
HAFDJ
HAFFB

Works the same as BA BF - no warning on the cluster, no audio code error assuming the PCM serial number remains the same. If you do use a different PCM, you can re-link the audio module as normal (which isn't possible if PATS is turned off via the flags)

I'm not entirely sure how many series 1 strategies there are.
If anyone's got any others, PM them through.

[Knackersjewels]

One of my mates has a BA XR8 ute, and an FG1 barra sedan, that I may be able to use to test with. I have some spare ecus I wouldn't cry over if I bricked them trying to flash different strategies onto to test, BA has HAAPA on it, and an FG1 with HAEE3

[pman92]

One of my mates has a BA XR8 ute, and an FG1 barra sedan, that I may be able to use to test with. I have some spare ecus I wouldn't cry over if I bricked them trying to flash different strategies onto to test, BA has HAAPA on it, and an FG1 with HAEE3

Send them through and I'll do them for you.
I haven't got a copy of HAAPA.

I think it's pretty well impossible to brick these. Everything before 0x10000 in the binary is the bootloader / RTOS which cannot be flashed over OBD. It's also where the serial number lives. If anyone did find a way to flash it, I'm sure all the commercial software that licences per controller would be in trouble

[hjtrbo]

I think it's pretty well impossible to brick these. Everything before 0x10000 in the binary is the bootloader / RTOS which cannot be flashed over OBD. It's also where the serial number lives. If anyone did find a way to flash it, I'm sure all the commercial software that licences per controller would be in trouble

A man in the middle box fixes that issue on the Falcons