Close

    • Why the Siemens SDI21 ECU is making 2017 on Porsche 991.2 Carrera/S/GTS tuning problematic and how BDM tuning circumvents the issue

      We are now entering the end of Summer 2017 yet there is still no OBD-II tuning option for the 991.2 generation Porsche 911. Why? Well, the new generation of Siemens ECU's utilized is doing a good job keeping tuners out.


      You might be saying, wait, doesn't GIAC have a tune? Indeed they do and to their credit they are the only company flashing the ECU. What they are truly doing is anyone's guess (and impressive) but tuners speculate they are doing what is known as BDM tuning or Background Debugging Mode.

      This is commonly called a bench flash as the ECU must be physically removed. Cobb for example does not do bench flashing (although they do have bench flash access) and wants OBD-II access so you can flash at home with your Cobb Accessport.

      That creates a problem though:

      Quote Originally Posted by Cobb
      Unfortunately, no news in this instance is indeed bad news. We're currently in the same spot that the "other" option is in - able to flash ECUs on the bench but not yet able to flash via OBD. We are going to be dialing up resources on the 991.2/718 project in the coming weeks in hopes of a breakthrough sooner rather than later. Once this last piece of the puzzle is done, we should be able to push support out rather quickly.
      As stated we are just speculating on GIAC's approach but BoostAddict was told they likely get the ECU to the point where it accepts commands for programming as if it were delivered from Siemens themselves to Porsche. How much can be programmed this way or what level of control is offered only each tuner knows. Clearly, this is very early in the 991.2 ECU tuning process.

      There are authentication steps that are posing problems which we will now go over.

      1. For OBD-II access there is a seed key algorithm with a private key to gain write access to the ECU. If the wrong response is given then you are locked out of the ECU. Someone already solved this part.

      2. Read access can be an issue as with the 991.1 tuners were able to use factory tools through OBD-II to get a read. Now, you have to build a file library through BDM access since it is not possible through OBD-II.

      3. Things get tricky with the write process. The files are all encrypted at the OEM level and when a dealer writes to the ECU the files are encrypted and decrypted at the ECU level. It is this new encryption and decryption process that is posing the big problem.

      The new ECU's have stronger processing power so the write time is about the same despite the encryption protocol.

      Additionally, when the ECU boots up it checks for a signature. You must have this signature or you will be locked out. This signature is computed on the fly. The signature validation process is arguably the hardest part depending on which hacker/tuner you talk to. BDM flashing does not have this requirement.

      If you program via OBD-II when you upload data or erase memory the validation status is reset and cleared. It is not set again until the validation routine is run. In the past the signature pointer was manipulated through a binary patch which pointed to a valid signature in section that was not normally tuned. The early SDI3 and SDI4 Porsche ECU's did not have this validation requirement enabled for whatever reason but they did not check for actual validation but just the checksums.

      The Porsche 991.1 SDI9 did implement signature validation but you could bypass it as it was previously bypassed by pointing it somewhere else. This is a common exploit and a bug Siemens seemingly patched which means people are going to need to get very creative to bypass it.

      The various checksums (a digit representing the sum of the correct digits in a piece of stored or transmitted digital data, against which later comparisons can be made to detect errors in the data) of course still pose a problem so overall this is a very difficult process but one would guess it is only a matter of time before it is solved.

      How much time? Who knows. With the Infineon Tricore ECU's and some Bosch ECU's there was help from someone in the factory on the inside who sold codes for hundreds of thousands of dollars. It would be with great risk for someone at Porsche or even Siemens to help tuners get around the security measures. A great financial reward too but is it worth a potential jail sentence?

      There are very smart people working against very smart people with billions of dollars of resources to make sure those smart people do not get access.

      Ultimately, it is a huge battle being fought behind the scenes for some who wish to prove their talent and others who want to make tons of money. These two aspects often overlap in the tuning world.

      One way or another, this ECU will be broken into.

      This article was originally published in forum thread: Why the Siemens SDI21 ECU is making 2017 on Porsche 991.2 Carrera/S/GTS tuning problematic and how BDM tuning circumvents the issue started by Sticky View original post
      Comments 22 Comments
      1. Sticky's Avatar
        Sticky -
        Updated with some more details for accuracy.
      1. 93siro's Avatar
        93siro -
        JB4
      1. Sticky's Avatar
        Sticky -
        Click here to enlarge Originally Posted by 93siro Click here to enlarge
        JB4
        Tried, Terry won't do it.
      1. 93siro's Avatar
        93siro -
        Click here to enlarge Originally Posted by Sticky Click here to enlarge
        Tried, Terry won't do it.
        Shiv then Click here to enlarge
      1. Sticky's Avatar
        Sticky -
        Click here to enlarge Originally Posted by 93siro Click here to enlarge
        Shiv then Click here to enlarge
        Who?
      1. 93siro's Avatar
        93siro -
        Click here to enlarge Originally Posted by Sticky Click here to enlarge
        Who?
        LOL
      1. 135Hoser's Avatar
        135Hoser -
        Very informative article, I loved it.

        Do you know if this is the same ECU as the 991.2 Turbo non S? I am anxiously awaiting a tune for mine, maybe, but it seems that GIAC is the only player right now for that platform.
      1. Sticky's Avatar
        Sticky -
        Click here to enlarge Originally Posted by 135Hoser Click here to enlarge
        Do you know if this is the same ECU as the 991.2 Turbo non S?
        Yes I believe it is.
      1. John Mclane's Avatar
        John Mclane -
        I had the patience to check the relevant parts comparing base, s and GTS. Essentially only the inner portions of the turbo are different between the base and S and the GTS turbo as a whole is slightly bigger. Everything else is software.

        I dont believe a swap is possible without the blessing of HQ, as all is coded and the code is fragmented in various parts (eg the X51 package requires recoding keys).

        They made it complex and not for the faint of heart. I wonder to which degree a turbo swap alone wouldn't generate enough gains (enough hp, what is that?) as the turbos are so similar. Meaning, base ECU running GTS (or bigger) turbos. There's a lot of adaptation the ECU mandates to accept different fuel and air (temperature, barometric pressure, humidity etc). If it was more plug and play I'd do it. Some folks have Carrera S turbos sitting after the X51 install, nice pre and post dyno test... Added advantage, most delaers will never notice you changed turbos as they look the same, just different parts #. It's all mechanical, no nosy chip to tell on you. The ECU wont be flashed or swapped...
      1. Sticky's Avatar
        Sticky -
        Click here to enlarge Originally Posted by John Mclane Click here to enlarge
        Essentially only the inner portions of the turbo are different between the base and S and the GTS turbo as a whole is slightly bigger. Everything else is software.
        Exactly.

        Click here to enlarge Originally Posted by John Mclane Click here to enlarge
        I dont believe a swap is possible without the blessing of HQ, as all is coded and the code is fragmented in various parts (eg the X51 package requires recoding keys).
        They won't do a swap onto the base but physically it will fit. In theory couldn't one swap a GTS ecu in?
      1. John Mclane's Avatar
        John Mclane -
        Click here to enlarge Originally Posted by Sticky Click here to enlarge
        Exactly.



        They won't do a swap onto the base but physically it will fit. In theory couldn't one swap a GTS ecu in?
        Physically theres no trouble, but the ECU wouldn't work without the codes. It is linked to the VIN. Even if the stealership orders a replacement for any given reason, they need the codes from HQ in Germany. Even for new keys you need it.

        The dealers may not do a X51 on a base model, but both S and GTS turbos are plug and play on the base model. All connectors have the same part numbers.

        If I had the cash and time I would definitely try. Even an used S turbo from someone that installed a X51 on a base model to measure the differences. Chicago is not very friendly to find tuners...
      1. Sticky's Avatar
        Sticky -
        Click here to enlarge Originally Posted by John Mclane Click here to enlarge
        Physically theres no trouble, but the ECU wouldn't work without the codes. It is linked to the VIN. Even if the stealership orders a replacement for any given reason, they need the codes from HQ in Germany. Even for new keys you need it
        Supposedly someone found a way around it but you're generally right here. Maybe a BDM flash will work with larger turbos?

        Click here to enlarge Originally Posted by John Mclane Click here to enlarge
        The dealers may not do a X51 on a base model, but both S and GTS turbos are plug and play on the base model. All connectors have the same part numbers.
        Agree 100%. I've written extensively on this topic: http://www.porscheboost.com/content....arrera-9A2-3-0

        Click here to enlarge Originally Posted by John Mclane Click here to enlarge
        If I had the cash and time I would definitely try.
        I am trying Click here to enlarge
      1. John Mclane's Avatar
        John Mclane -
        Click here to enlarge Originally Posted by Sticky Click here to enlarge
        Supposedly someone found a way around it but you're generally right here. Maybe a BDM flash will work with larger turbos?

        I guess that's possible.



        I am trying Click here to enlarge

        Some fellas on 6speed (I know, the horror) have already swapped. Maybe they're willing to donate for the cause (right...). Eventually those turbos will make it to ebay. Maybe someone on BorgWarner may actually know the right answer to it.
      1. Sticky's Avatar
        Sticky -
        Click here to enlarge Originally Posted by John Mclane Click here to enlarge
        Some fellas on 6speed (I know, the horror) have already swapped. Maybe they're willing to donate for the cause (right...). Eventually those turbos will make it to ebay. Maybe someone on BorgWarner may actually know the right answer to it.
        The turbo part numbers were posted so they can ordered in theory.

        Honestly, a hybrid option is coming that will blow everything away and there will be no reason to bother with GTS turbos.
      1. John Mclane's Avatar
        John Mclane -
        Click here to enlarge Originally Posted by Sticky Click here to enlarge
        The turbo part numbers were posted so they can ordered in theory.

        Honestly, a hybrid option is coming that will blow everything away and there will be no reason to bother with GTS turbos.
        I know. The ECU is the issue, but I think the base program should pick up some slack, so perhaps a turbo upgrade alone for now will yield some decent gains, even better later when the ECU is cracked
      1. Sticky's Avatar
        Sticky -
        Click here to enlarge Originally Posted by John Mclane Click here to enlarge
        I know. The ECU is the issue, but I think the base program should pick up some slack, so perhaps a turbo upgrade alone for now will yield some decent gains, even better later when the ECU is cracked
        We're going to find out Click here to enlarge
      1. John Mclane's Avatar
        John Mclane -
        Click here to enlarge Originally Posted by Sticky Click here to enlarge
        We're going to find out Click here to enlarge

        Now im tempted to buy them turbos and install it myself, believe in hardware over software that the turbos with the OEM ECU would be awesome

        https://www.suncoastparts.com/produc...0Winter%20Gear
      1. Sticky's Avatar
        Sticky -
        Click here to enlarge Originally Posted by John Mclane Click here to enlarge
        Now im tempted to buy them turbos and install it myself, believe in hardware over software that the turbos with the OEM ECU would be awesome

        https://www.suncoastparts.com/produc...0Winter%20Gear
        Yep we all saw the price drop. Just be patient on the software. It's being tested.
      1. quattr0's Avatar
        quattr0 -
        I should have a definitive answer in 2 days that they could do it or not, in conjunction with Euro tuning company, my shop has promised me.
      1. Sticky's Avatar
        Sticky -
        Click here to enlarge Originally Posted by quattr0 Click here to enlarge
        in conjunction with Euro tuning company, my shop has promised me.
        Which company?