S650 Tuning Info

[Cz_Ziemniak]

The only thing I heard is that I basically have a ferrari.

Epic

Would love to know how much of a difference running a flat plane crank would make in combination with the dual throttle bodies. That firing order could probably make far better use of the dual bodies.

Sponsored

 

[AZ_Ryan]

Good info seems like the upper executives are still clowns ruining the show. I don't know what's worse the stupid screens on the dash, dual t bodies, or no tunning available

I think you might be in the wrong forum.

 

[5.0 Steve]

I think you might be in the wrong forum.

Worry about yourself clown

 

[robvas]

.

 

[LouG]

The only thing I heard is that I basically have a ferrari.

Epic

Would love to know how much of a difference running a flat plane crank would make in combination with the dual throttle bodies. That firing order could probably make far better use of the dual bodies.

And lose that proper V8 sound? No thanks.
A flat plane V8 sounds great at 8000-9000 rpm, but sounds like two 4 pots at low revs.

 

[Cz_Ziemniak]

And lose that proper V8 sound? No thanks.
A flat plane V8 sounds great at 8000-9000 rpm, but sounds like two 4 pots at low revs.

Very strongly disagree

 

[LouG]

Very strongly disagree

OK. It'd be a boring world if we all thought the same.

 

[AZ_Ryan]

Worry about yourself clown

Triggered much?

 

[NegativeMultiplier]

He did say they are openly trying to figure out a way to let us start tuning them but without the security risk.

FP, or Ford proper? Because it sounds like they're effectively trying to figure out a way to create a sort of SDK (software development kit) for tune creation.

If Ford or FP released what was needed to tune the Mustang as, say, a package (as it's referred to) that tuners could use to make it so the PCM worked with the rest of the car, this would basically unlock the car and make it possible to tune correctly.

This, as I once hypothesized long ago, would effectively mean that tuners would likely need to become software developers in some capacity.

Hope they figure a way to allow tuning without compromising the security of the s650.

It's not impossible, but it wouldn't be permanent. In the tech space, the instant you give some leeway to end users, bad actors will take advantage of it and use it as an exploit, hence why Ford hasn't granted anyone access to the system yet.

If I had to guess, the few companies who do have access are paying a hefty premium (probably a six figure integer) and have likely had to have their entire workforce sign an NDA that explicitly forbids disclosure of any and all methods used to prevent bricking the car post-modification.

Tuning access will need to be leaked by someone within Ford, or cracked by someone with deep pockets.

Probably the latter, for the reasons I just mentioned. I don't think anyone wants to risk the skin off their back if it means the possibility of being pursued by the full force of Ford's legal team.

bootloader encryption of the PCM is what we need access to. Getting the PCM to boot once the encryption checksum has changed allowing the car to start.

They have been flashed already not too soon after the s560 showed up, but after the flash the car would not start and it had to be flashed back to stock with Ford tools.

This tracks. Having the bootloader have the final say in if the checksum is valid or not makes sense not just because it's the deepest, most authoritative level of the architecture, but also because most people could and would not be arsed trying to figure out how to reverse engineer it.

I don't know what the specifics are of the architecture Ford is using for the S650, but if I had to guess it's probably coded in ASM, C, or some combination of the two. C is very basic and requires a high level of knowledge to code in without causing a considerable number of problems at this complexity level, and ASM is just hellish, period. Imagine needing to wait for a secondary human to manage 10,000,000 addresses for that many different people (C), or doing it yourself, and you have to manually deliver every piece of mail to all those people yourself (ASM). That should give you an idea as to, if I'm right, the level of difficulty behind what it means to reverse engineer the PCM.

Modifying the bootloader would be significantly easier than reverse engineering it, but you're still presented with the major problem of having to gain access to the bootloader in the first place, understand what the hell the code is doing next, and then determining what and where exactly the checksum is being received and how to spoof one that'll pass the validation. Removing the validator isn't a safe option, because it's very likely many other components are dependent on the validation check not only passing but existing in the first place to operate, and removing that would be like removing a 20A fuse from the fusebox that you have no idea what it's for, but now the cluster doesn't turn on, the lights don't work, and your engine won't turn over.

TL;DR: Ford's pursuit of the ultimate level of security went so far in the direction of security that access to the individual modules needed for tuning dropped to an effective zero, unless you're a software engineer at Ford or any of the companies with the required digital tooling to work with the encryption they devised. Cracking it is not going to be easy, as your options are either brute-forcing it, spending an unholy amount of time trying to access and study the code behind the encryption, or working for Ford and breaking an NDA that will likely leave you in debt by millions of dollars and behind bars.

 

[robvas]

I would guess it's as simple as they need to distribute signing keys. Much like Apple and the iPhone.

 

[Cobrakit]

When the 2018s came out, it took about 2 years for FRPP to release a calibration. Since we have seen P/Ns for 2024 calibrations, I believe there will be a calibration offered, but will just take some more time.

 

[Abilor]

FP, or Ford proper? Because it sounds like they're effectively trying to figure out a way to create a sort of SDK (software development kit) for tune creation.

If Ford or FP released what was needed to tune the Mustang as, say, a package (as it's referred to) that tuners could use to make it so the PCM worked with the rest of the car, this would basically unlock the car and make it possible to tune correctly.

This, as I once hypothesized long ago, would effectively mean that tuners would likely need to become software developers in some capacity.

It's not impossible, but it wouldn't be permanent. In the tech space, the instant you give some leeway to end users, bad actors will take advantage of it and use it as an exploit, hence why Ford hasn't granted anyone access to the system yet.

If I had to guess, the few companies who do have access are paying a hefty premium (probably a six figure integer) and have likely had to have their entire workforce sign an NDA that explicitly forbids disclosure of any and all methods used to prevent bricking the car post-modification.

Probably the latter, for the reasons I just mentioned. I don't think anyone wants to risk the skin off their back if it means the possibility of being pursued by the full force of Ford's legal team.

This tracks. Having the bootloader have the final say in if the checksum is valid or not makes sense not just because it's the deepest, most authoritative level of the architecture, but also because most people could and would not be arsed trying to figure out how to reverse engineer it.

I don't know what the specifics are of the architecture Ford is using for the S650, but if I had to guess it's probably coded in ASM, C, or some combination of the two. C is very basic and requires a high level of knowledge to code in without causing a considerable number of problems at this complexity level, and ASM is just hellish, period. Imagine needing to wait for a secondary human to manage 10,000,000 addresses for that many different people (C), or doing it yourself, and you have to manually deliver every piece of mail to all those people yourself (ASM). That should give you an idea as to, if I'm right, the level of difficulty behind what it means to reverse engineer the PCM.

Modifying the bootloader would be significantly easier than reverse engineering it, but you're still presented with the major problem of having to gain access to the bootloader in the first place, understand what the hell the code is doing next, and then determining what and where exactly the checksum is being received and how to spoof one that'll pass the validation. Removing the validator isn't a safe option, because it's very likely many other components are dependent on the validation check not only passing but existing in the first place to operate, and removing that would be like removing a 20A fuse from the fusebox that you have no idea what it's for, but now the cluster doesn't turn on, the lights don't work, and your engine won't turn over.

TL;DR: Ford's pursuit of the ultimate level of security went so far in the direction of security that access to the individual modules needed for tuning dropped to an effective zero, unless you're a software engineer at Ford or any of the companies with the required digital tooling to work with the encryption they devised. Cracking it is not going to be easy, as your options are either brute-forcing it, spending an unholy amount of time trying to access and study the code behind the encryption, or working for Ford and breaking an NDA that will likely leave you in debt by millions of dollars and behind bars.

The exploit, when it comes, will drip through a social crack somewhere I bet rather than be brute-forced. Likely Ford will be tolerant of it if not wholly behind it somehow, for all reasons mentioned. Kind of like getting the VHS copy of a movie after a year in theaters, like back in the Dark Ages when Reagan was in office.

 

[ZXMustang]

The exploit, when it comes, will drip through a social crack somewhere I bet rather than be brute-forced. Likely Ford will be tolerant of it if not wholly behind it somehow, for all reasons mentioned. Kind of like getting the VHS copy of a movie after a year in theaters, like back in the Dark Ages when Reagan was in office.

This is how the 2018+ mopar cars were unlocked and can be tuned.

For Ford, here is the exact technical reason why you cant tune an S650.


1. Secure Gateway & Controller Locking

Starting with the S650 (2024+ Mustang GT), Ford moved to an enhanced cybersecurity architecture under what’s commonly referred to internally as Global B electrical architecture. Key elements include:

• Secure Gateway Module (SGW): Sits between the OBD-II port and most vehicle networks. It filters requests, denying write access unless routed through an authenticated service path.
• Locked PCM Bootloaders: The PCM/ECU firmware now includes signed bootloaders which only accept flash updates that pass cryptographic signature verification — meaning only Ford-signed calibration packages are accepted.
• AES-based Calibration Encryption: Calibration sections within the PCM are encrypted and indexed using internal cryptographic keys. These keys are not exposed on the CAN bus, not stored in flash memory in clear text, and are inaccessible without Ford’s internal development toolchain.

2. No Read/Write Access

HP Tuners tools (MPVI2, MPVI3) cannot read the binary from the PCM of the S650 Mustang GT. This is because:

• The "Read" request is rejected at the security level by the PCM — either via the SGW or the controller itself.
• No “seed/key” security access pairing is available (or known) to elevate permission to a level required for memory access.
• No .HPT file can be created, and therefore no modifications, scanning of editable parameters, or writing of a modified file is possible.

Even if scanning works at the basic OBD-II PID level, access to the tuning calibration area is completely blocked.



3. Ford Global B ECU Platform (GPEC GenX / Bosch MG1)

The 2024+ Mustang GT uses a Bosch MG1CS026 or similar variant under the Global B platform, the same family used in late-model GM and Ford vehicles that also remain untunable without physical unlock services. These ECUs:

• Use hardware-level secure enclaves to store keys.
• Implement anti-rollback counters and code-signature hash checks.
• Have physical memory partitioning that cannot be bypassed by current aftermarket flashing tools.

4. Implication for Tuners

As of June 2025:

• No commercial tool can read or flash the S650 PCM.
• Bench unlocks are not possible unless Ford’s seed/key algorithms or signing certificates are compromised (as has occurred in other OEM contexts, but not Ford Global B yet).
• User Defined Parameters (UDP) support in HP Tuners is not applicable, because you must first have a readable PCM image to define custom parameters.
• FORScan also cannot access PCM flash memory — it's limited to configuration-level changes (e.g., as-built data), not calibration changes.

Summary: Why It’s Untunable

Security Layer	Effect on Tuning
Secure Gateway Module (SGW)	Blocks write commands at OBD level
Cryptographic Calibration	Prevents unauthorized read/write of calibration memory
Locked Bootloader	Prevents loading unsigned custom OS or bin
No Known Unlock Path	No seed/key access, no bypass, no factory-backdoor exploits
Encrypted Flash Structure	Cal section is unreadable, even if raw flash dump was possible

Status

HP Tuners, SCT, and other companies have not announced or released an unlock protocol, custom OS support, or tune-read/write solution for the S650 Mustang GT. Until Ford authorizes access (e.g., via licensing or emissions-compliant calibration APIs), or reverse engineering cracks the chain of trust, tuning the S650 is entirely blocked.

Sponsored