Really?
I know you can buy licences for Power Vision, and Keys for direct link, but I've never seen anyone offer to unlock a blue TTS VCI. I have heard of someone who can replace the lock chip inside an old SE super tuner VCI, but that's not unlocking, that's essentially rebuilding the VCI with new components.

 

The SE super tuner can be unlocked by software. Some guys can then do it remotely once it's done initially.
It's about $160 CDN for the service. I've used it.

No idea about blue TTS whatever.

 

From a tech perspective, there is no reason to bind the tuner to the ecu. This is about licensing the tuner for use on a single bike. Technically it would be possible to know if the tuner has downloaded a tune as it retains the stock tune. Again, technically it would be possible to know if the stock tune had been restored to the bike it is married to, the tuner could essentially be unlocked, but for either Dynojet or V&H it appears they want to be able to charge for unlocking as well.

I doubt the comms to the ECU is encrypted, but as mentioned likely encoded. The problem will be figuring out which locations in the data map correspond to the data values you want to download, and then raw data values my not at all correspond to anything understandable. Likely these numbers will be either a signed or unsigned data type INT, UINT, LONG, SINGLE, DOUBLE ... or some user/OEM defined data type. There will be multiple values that will interact with one another further complicating the choice of what number to use to affect a specific change. If you have access to the ECU data map, this would be the only starting point. Otherwise one could risk serious damage to the ECU data set. One could inadvertently overwrite a necessary value that is part of a sanity check and effectively brick the ECU. All of this on top of fully understanding CAN as implemented by the ECU manufacturer. Sniffing comms packets in an existing tuner/ECU marriage would be the easiest, unless you have a full protocol spec, but then you'd already have a tuner.

I've done some comms reverse engineering in the past, no way would this be worth the effort for me. Best of luck to whoever tackles it though.

 

Worth the effort? No, I can't honestly say it would be. But an interesting challenge? To me, yes. I've done some CAN reverse engineering before on a simple control system and I've got the necessary tools to read the traffic between the tuner and the ECM. And of course I've already got the tuner, (two now I picked up a second bike - an FP3 and a H-D tuner). I'll take your 'best of luck' well wishes though, as I'm sure I'm going to need plenty of it!

 

Keep us posted. The HD world needs more of this sort of thing and less "which website do I order a set of 2-1 chrome pipes for my *insert random touring model* for way, way too much money?"

 

This might be an interesting READ for ya ...
https://www.hdforums.com/forum/ignit...ock-efi-3.html

 

Thanks! It certainly was interesting, and answered a few key questions.

 

I did unlock my own PV a while back because I fried my own ECM and I wasn't going to pay another 500 bucks for a tuner that I already had, neither I was going to pay 200 for the same reason, I've used it to flash some friend bikes but that's all, all the tuners can be unlocked, is just a matter of time and effort to do so, I know people that unlocks the harley tuner, the powervision is harder since you have to emulate some internal stuff but It can (have been) done

 

Interesting stuff. Clearly talk of seed/key pairs implies encryption, yet checksum algorithm suggests data integrity. Not sure how those get used in the same sentence. I haven't taken the plunge, but wonder if the PV is running on some OS? If it is, likely a Linux or Linux derivative. If that were the case, it should likely be easier to replicate/reverse the PV firmware than it is to map the ECU data space. Of course reversing the PV would reveal the ECU data map, or at least, the significant map portions. I'm sure there are areas of the data map the PV is not concerned with, and neither DynoJet or HD would want anyone to touch.

 

So here's a little nugget of information I found on the Dynojet website as a reason you might not be able to lock a PowerVision to a particular ECM:

ECM was previously tuned with TTS Mastertune

• When an ECM is flashed with TTS MasterTune, it puts a proprietary lock in the ECM. You or your tuner must have saved the original backup (.mte file), that flashed back in the ECM with the TTS’s MasterTune.
• The Power Vision, Screamn’ Eagle’s Super Tuner, or even the Digital Tech dealer tool CAN NOT enter flash (read or write the calibration) on that particular ECM. That being said a guy needs to be careful when using a TTS device, because if you’re out on the road and need service, or diagnostic work you’ll need a laptop with TTS Mastetune, the flash dongle, and the original .mte backup file.
• If you don’t have the .mte backup file and the dongle, or access to any TTS dongle, you’ll need to replace the ECM with a new one or send the existing ECM to TTS to be unlocked!

Sounds like great fun if you buy a used bike from someone other than the original owner, (or owner that might have tuned the bike before it found it's way to you).