ForScan "Development"/Discovery - How it Happens?

[V1Rotate]

It is my understanding that Ford's view is that FORScan is for Ford only (say for configuring vehicles for different countries (hence regulations and laws) as well as for dealers to install some factory mods) and they do not in any way support the public use of the tool.

Much of what you see in such spreadsheets is available in the Motorcraft as built data.

I suppose you don't have any evidence of this claim?

Make no mistake - Ford itself does not in any way support, use, develop or endorse forscan.. its entirely of foreign origin and to be used at one's own risk. Definitely a useful tool though and I find it more trustworthy than the majority of stuff you unknowingly agree to here domestically

Sponsored

 

[Neigh]

It is my understanding that Ford's view is that FORScan is for Ford only (say for configuring vehicles for different countries (hence regulations and laws) as well as for dealers to install some factory mods) and they do not in any way support the public use of the tool.

It seems that you're confusing FORScan with module configuration data.

Much of what you see in such spreadsheets is available in the Motorcraft as built data.

It is!? As-Built files enumerate all the possible configuration values for each byte for each module?? An official source for this will revolutionize Ford tweaking, you'll be a global hero! Please share the link with all of us!

 

[Epiphany]

I think it is a combination of both. Spreadsheets like this could only come from Ford. There's way, way, way, way too much detail in there for it to have come from anywhere else.

That is not "from Ford."

 

[Neigh]

That is not "from Ford."

Then where's it from?

Wait....do you think I mean that Ford literally logged in and posted that spreadsheet? Of course not! But I do think it is highly, highly likely that somebody inside Ford shared it to someone outside the company and eventually it made its way onto the forum.

 

[Epiphany]

Then where's it from?

Livinitup has been on this for years now, and he's not alone. These guys have spent the time testing and documenting as many configurations as possible, one at a time. If you spend some time on the relevant F150 forums you'll see what I mean.

 

[Neigh]

Livinitup has been on this for years now, and he's not alone. These guys have spent the time testing and documenting as many configurations as possible, one at a time. If you spend some time on the relevant F150 forums you'll see what I mean.

So you're telling me that someone sat there and tested all 256 combinations of these two bytes in the APIM and figured out all these different permutations? Then they repeated that process for tens of thousands more bytes across all the modules? No way.

 

[CarGuy]

All it does it edit hexadecimal values in a config file over a serial connection. The more likely risk is this application has embedded spyware taking over your OS on the computer you're running it on. Then again if you're running Windows you're pretty much perpetually screwed from a vulnerability standpoint.

I work in Cybersecurity for a living, and I have absolutely no reservations about using this software, its clean. Take that as you will.

How did you determine it is “clean?”

 

[mike8675309]

So you're telling me that someone sat there and tested all 256 combinations of these two bytes in the APIM and figured out all these different permutations? Then they repeated that process for tens of thousands more bytes across all the modules? No way.

I expect what they do is the get access to the main computer, have a harness that lets them get in between the signal lines and they just data log power on, startup, and some driving.

They can then look at what locations the engine computer is looking at in memory at different points. That tells them what they need to know to document what is going on.


It's not an exhaustive search. Also, all of these systems are documented somewhere. Sometimes they get access to the documentation.

 

[Epiphany]

No way.

Way.

 

[RoverDude]

So you're telling me that someone sat there and tested all 256 combinations of these two bytes in the APIM and figured out all these different permutations? Then they repeated that process for tens of thousands more bytes across all the modules? No way.

You don't need to try every combination, you only need to find differences between certain values.

Those hex values are related to the equivalent of a four-digit binary number.
When you see differences, typically that is a single bit difference.
From there, you use the basis of comparison to see what's different about the vehicle, settings.
It is time consuming but you can deduct some information from that.

Really, that's all you're looking for is differences in values, and what the difference is between the two vehicles, and then you can extrapolate relevant information.
A terrible analogy would be put ting together a a puzzle.
Not need to try every combination to figure out what one piece goes, but based on relevant information like color shape. If it's a corner can narrow it down real quick.

 

[Neigh]

You don't need to try every combination, you only need to find differences between certain values.

I'm not talking about how to figure out which bits to flip to add fog lights to a Bronco. I know that can be done by comparing two As-Builts.

We're talking about how that spreadsheet came into existance. For just 2 bytes out of one module the spreadsheet lists 256 values for those two bytes and details exactly what each and every value does. (See screenshot above)

If the spreadsheet was a result of reverse engineering then you'd have to either try all the combinations or compare As-Builts between a hell of a lot of different models, and when doing that I can't fathom how you'd tell the difference between "DCM Enabled (Legacy)" and "DCM Enabled (Version 2.0)".

 

[RoverDude]

Again look at the bit value
If you look at the spreadsheet you attached, you can see.
None of those features are enabled at 00
01. Trailer guidance 2 is enabled
02 power box enabled and trailer guidance is not
That gives me 2 bits of value out of 8.
If you convert the hex decimal value to a binary value and then make a spreadsheet, you can determine what each bit does
It is time consuming but it not something that is not unsurmountable.
I would not necessarily need to try every combination. Just find what bits are different when I change a feature.

 

[swamp2]

It seems that you're confusing FORScan with module configuration data.

I don't think so. As built data contains all of the FORScan locations/addresses and their current (once vehicle over writes the actual as built) values. No it's obviously not a full "magic decoder ring".

Furthermore, although some prior leaks from Ford seem reasonably probable, Ford absolutely doesn't support the FORscan "community" in any way. And most employees are plenty smart to not risk their jobs for a leak for such purposes.

Regardless other have restarted and expanded on my educated guesses on this topic

 

[EasternSierra]

I don't think so. As built data contains all of the FORScan locations/addresses and their current (once vehicle over writes the actual as built) values. No it's obviously not a full "magic decoder ring".

Furthermore, although some prior leaks from Ford seem reasonably probable, Ford absolutely doesn't support the FORscan "community" in any way. And most employees are plenty smart to not risk their jobs for a leak for such purposes.

Regardless other have restarted and expanded on my educated guesses on this topic

Or the info could have been hacked. Seems like every week there's a new security breach somewhere that's bad enough to be publicized.

 

[Neigh]

I don't think so. As built data contains all of the FORScan locations/addresses and their current (once vehicle over writes the actual as built) values.

They are not FORScan locations/addresses. Ford chose the addresses. Ford decided what to put in the addresses. FORScan is just showing you what Ford put into each module.

Sponsored