Ferrari 360 IMMO OFF finally a reality!

sass0 · Feb 18, 2023

Hey Trev thanks for the advice.

im not used to using Galetto any more. I actually use KTag or Kess way more (430 for example) and actually closeted my K+Dcan/Galetto cables since i used those for older diesels i recently pulled this one out just for the 360

But never had a bad experience with it and it read more then a 100 cars in its time of use. But will keep ur words in the back of my mind when reading this 7.3.

Dvdw · Feb 21, 2023

360trev said: ↑

100% none of the 360 ECUs are H4 (Hardware revision 4) skew.

I would strongly recommended to take extreme caution and use anti static protection and measures when dealing with 360 ECUs now. They are so valuable now and difficult to source you don't want your inexperience to cause damage.

Pirated galetto sw (clone) is garbage and not recommended. Many have viruses and malware in the drivers so take care. Some even have fake cloned k-line chips which are at one time where killed by genuine FDTI drivers.

I will release my solution soon which will be fully warranted and work across multiple operating systems, Windows, Linux and Mac.
Click to expand...

Well i very much would like to use your solution, do you have any idea how long it takes before that is available? As time is kind of a thing in this case. Or would you recommend something else to read the ecu for now?

Dvdw · Feb 21, 2023

And i do have some spare ecu's here if you need one

lmkocore · Jun 28, 2023

@360trev where i can find contact with you? have small problem with 360 immo

Ingenere · Jul 6, 2023

lmkocore said: ↑

@360trev where i can find contact with you? have small problem with 360 immo
Click to expand...

Send a PM and he should respond. The immo delete is great.

My CS was one of the first that failed and Trev really went above and beyond to figure it out and eventually figured out how to delete it completely in the software. Getting rid of that was one of the best things I ever did. It would have been impossible without Trev.

hessank · Jul 6, 2023

Ingenere said: ↑

............ The immo delete is great........Getting rid of that was one of the best things I ever did......
Click to expand...

Me too. I now use my key to open/lock the doors.
Same with you Dino?

> cause I was thinking it should be possible now to install an aftermarket keyless entry system with alarm/tracking

edumiudo · Jul 7, 2023

@360trev
hello im interested in your immo off for a ferrari 360.
but I can't call you in pm, could you help me!!

Ingenere · Jul 12, 2023

hessank said: ↑

Me too. I now use my key to open/lock the doors.
Same with you Dino?

> cause I was thinking it should be possible now to install an aftermarket keyless entry system with alarm/tracking
Click to expand...

Yup..... key now. But it is possible to install an aftermarket solution. But honestly, I don't think I've ever locked it.... ever!

Ingenere · Jul 12, 2023

edumiudo said: ↑

@360trev
hello im interested in your immo off for a ferrari 360.
but I can't call you in pm, could you help me!!
Click to expand...

I'll reach out to him and ask him to check on here.

edumiudo · Jul 26, 2023

Ingenere said: ↑

I'll reach out to him and ask him to check on here.
Click to expand...

hello !!!
did you ever do immo off on your 360?
do you have the file to share?
Why can't I contact @360trev!!
and I wanted to put a 360 to work for a customer who has a damaged immo box

Dash_Burner · Nov 8, 2023

360trev said: ↑

Where do I begin?

... Well it all started out really as trying to offer to help out a good friend of mine and member on here, Ingenere.
He'd been experiencing the famous 'will it, won't it start' problems seriously denting his confidence in an otherwise fantastic Challenge Stradale ownership experience. I guess 15+ year old Bosch electronics pre-dating the millenium where never going to last forever where they, especially in a desert climate of Arizona!

And so it began. As it happens I was planning a trip over in San Francisco last year on a month long business trip and I reached out to help him. I brought all the kit i needed with me 'just in case'. As it happened in my spare time at the weekend I took a flight over to Arizona to see him and that's when I saw it for myself. Obviously very little hot weather testing was done on this kit.

Opening up the Immobilizers for the first time I was greeted with some horrific things. The first of which was soldered on Mechanical relays in the immobilizer box (!). Why oh why where they not relocated into the swappable area of the car? All mechanical relays will eventually die and these immobilizer relays are no different meaning your 360 *will* eventually get this issue... Sigh.

Tracing the pins with a multimeter I was able to easily identify that the first box behind the seats (the bigger one) is actually just a reciever for the keyfob with an old Motorola MC68H (16-bit) processor from the 80's... Really really cheap old kit that I haven't seen for decades. Anycase on to the relay's. They are in actual fact part of the immobilizer circuit but in a rather crude way. All of the relays are controlled by the MCU (micro controller). One of the relay's controls flashing of the indicators when you blip the key fob and the other does the lock/unlocking of the central locking function. The 3rd i never really discovered what it actually did (maybe nothing on the 360 since this immobilizer unit is actually a generic piece of Bosch kit used on many cars of that era). The 4th relay simply enabled power to the starter motor. There is also an additional function of the big box immobilizer and that is to send an start authorization message over to the smaller immobilizer box (the second box behind the seats). This then sends a start authorization message over to the right bank ignition computer to tell it to grant access to start the engine. Without that start authorization message the ignition computers will not run the engine regardless of if the starter motor relay is bypassed or not.

I confirmed all of this in a few hours that weekend I was over in Dino's house that weekend. Fast forward to today and what's been achieved since?

Well I know that one company obviously must have traced the output of the little immobilizer unit with some sort of bus snooper bit of kit then decided to simply send an authorization message REGARDLESS, this approach however still isn't the end of the story since you still have all the problemsof pairing, etc. to contend with and what happens if an ecu goes down that has your pairing information on it? Your buggered...

The approach I've taken (the hardest) and I believe a world 1st is to extract the firmware via the method I first disclosed a few years ago now (2014?) then spend time to understand the format of that firmware image. This was challenging because so little was the same versus other more common ecu's on other cars. However with continued research I discovered how all the checksums work (these are numbers inside the code which verify that nothing has been changed). I then wrote a tool which allowed me to alter parts of the code and re-calculate the checksums. This was the first step towards solving the immobilizer issue since without this I could not disable it completely in the code and then not have the ecu reject those changes. Following me? I hope so..

There had been some attemps to use a EEPROM dumping method but again it varies between car models so the eeprom is not the same across car variants so nobody got this method working correctly.

Anyway after resolving the checksuming issues I then reseached how other cars with similar Bosch ME7 ecu's worked and discoverd a whole wealth of information on VW golf's, Alfa Romeo's and so forth with similar but different code. After this I then wrote a special piece of software which could extract all of the unique functions out of the code and compare them with known functions from other similar bosch cars. This helped me to identify their functions and eliminate them. It also helped me to work out where all the maps and data in our own cars lay in the firmware which has been very useful. Literally many weeks of work...

Finally I stumbled upon the SIA WFS.. What's that? Sia is the Supervisor Immobiliser Authority functions. And
WFS is the term in German (Wegfahrsperre) which is IMMO immobiliser or (drive away lock). Bingo!!! After some time analyzing the code I discovered that helpfully Bosch engineers had left in a back door (!!!!) literally you only need to change a SINGLE BYTE (one byte!) in the code (And ofcourse recalcuate the checksums so that byte isn't rejected) and then volia... Immobilizer is defeated....This applies to all model years, all variants of 360 incluiding Challenge cars. I've worked out how to cleverly isolate the single byte out of the 524,288 bytes in a dump that works for every variant I've tested so far

Yeeehar...

So after doing a simple loop of wire which joins two pin on the big box immobilizer I defeated the first stage immobilizer of the starter motor disabling. Then after reflashing both ecu's (left and right bank) with the modified firmware the WFS is totally disabled and the car can now start without the keyfob, without either of the immobilizer boxes behind the seats but doing this full removal you loose central locking. So you can either do something different (I plan a keyless entry module and clever smart phone app now) or retain the original big box immobilizer and simply bypass the starter relay pins giving you the ability to just get in and start the car. No fussing around having to play with the fob locking unlocking because it timed out, etc. Its wonderful because it makes the car so damn easy to start, like it should have always been.

So next steps are to test my keyless entry next and prepare a few boards for some 'testers'.. If anyone wants to be part of the testing group please let me know. I will initially focus on an Andriod app and later do an Apple one. This will message you every time someone gets into your car, and you can see if its locked, I will add a simple GPS and GSM module so you can also track in realtime its location and I will add in option in the app to place the car in valet mode where it cannot be rev'd past 4000 rpm. Many other things will come with time but this is the starting point.

Best Regards,

Trev
Click to expand...

Hi there. I have a 360 in my workshop and need immo off. I am able to read both ecu files but dont know which byte to change and what to make it. Can you help mate ?

Conversations

Alerts

Ferrari 360 IMMO OFF finally a reality!

sass0 Rookie

Dvdw Rookie

Dvdw Rookie

lmkocore Rookie

Ingenere F1 Veteran
Owner Silver Subscribed

hessank Formula 3
Silver Subscribed

edumiudo Rookie

Ingenere F1 Veteran
Owner Silver Subscribed

Ingenere F1 Veteran
Owner Silver Subscribed

edumiudo Rookie

Dash_Burner Rookie

Share This Page

Ferrari 360 IMMO OFF finally a reality!

sass0 Rookie

Dvdw Rookie

Dvdw Rookie

lmkocore Rookie

Ingenere F1 Veteran Owner Silver Subscribed

hessank Formula 3 Silver Subscribed

edumiudo Rookie

Ingenere F1 Veteran Owner Silver Subscribed

Ingenere F1 Veteran Owner Silver Subscribed

edumiudo Rookie

Dash_Burner Rookie

Share This Page

Ingenere F1 Veteran
Owner Silver Subscribed

hessank Formula 3
Silver Subscribed

Ingenere F1 Veteran
Owner Silver Subscribed

Ingenere F1 Veteran
Owner Silver Subscribed