OpenRemap

🌐 openremap.com — the project site: what OpenRemap is, how to install it, and the latest news.

📚 docs.openremap.com — the wiki: concepts, every command, and per-family references.

🐙 openremap-docs — the open-source repo behind the docs/wiki — suggestions and contributions welcome.

The open-source ECU binary intelligence layer — identify firmware, health-check it, verify its checksums, diff a tune into a portable recipe, and apply it to another binary of the same family.

Offline-first. No accounts, no telemetry, no data leaves your machine.

OpenRemap began as a final-semester thesis project, presented at SAEK Orestiadas (v0.4.5), and has been actively developed since (current release line: 0.7.x).

Where the project is going (short-term roadmap)

0.7.x (current): stabilise the 0.7.0 release — fix bugs that surface in real use, and integrate third-party open-source libraries (ported with credit — never copy-paste, see THIRD_PARTY.md). A stability cycle for the engine, not a feature cycle — the tooling that grows here is the tooling for contributing (see Contributing below).

Upcoming milestones:

• 0.8.0 — cross-firmware experiment: learn a tune from one software revision and relocate it to another by structural map matching, plus community plugin tooling.
• 0.9.0 — a refined, modern TUI.
• 1.0.0 — OpenRemap Harness: a desktop app for Windows / macOS / Linux.

Quick start

pip install openremap        # or: uv tool install openremap

openremap identify stock.bin     # what is this ECU?  (family, SW, confidence)
openremap health  stock.bin      # is the file sane?  (checksums, maps, VINs)
openremap cook    stock.bin tuned.bin --output stage1.remap   # diff → recipe
openremap cook-volatile stockA.bin stage1.bin --output portable.remap  # car-portable recipe
openremap tune    target.bin stage1.remap --output tuned.bin  # apply → verify
openremap synth   --output demo.bin                          # an ECU-like file, no ECU needed

Runs entirely offline. .bin, .ori, and .hex files are all accepted.

What it is

• Identify — 38 extractors across 6 OEMs (Bosch, Siemens, Delphi, Magneti Marelli, Denso, Hitachi), each result with a confidence tier and the evidence behind it
• Health-check — one command: checksums, axis sanity, map-count envelope, erased blocks, VIN duplication (CI-gateable)
• Checksums — verifies ME7, IronFelix, NefMoto, MS43, GS20/SMG2 and Denso Subaru schemes (detection only, no correction)
• Cook / tune — diff stock vs tuned into a portable .remap recipe (schema 4.5, map-annotated; cook-volatile excludes VIN/checksum-store bytes with evidence for cross-car portability), apply with validate-before → apply → verify-after; merge recipes; audit the receipt
• Map tooling — structural map discovery, map-level diffing, CSV export, probabilistic labels
• Synthetic fixtures — openremap synth generates ECU-like binaries from scratch (deterministic, no ECU data involved), so you can try the tooling, build tests, or file a reproducible bug report without owning a dump. Generated files identify as Unknown by design.
• Contribute an ECU family — openremap contribute measures your own dump for a signature that is stable in that family and absent from every family the engine already recognises, then writes the fixture, an extractor skeleton, a test and a PR description. Your dump never leaves your machine.
• Library-first — every service is importable Python (identity, patching, map scanning) with a mandatory Rust core for the hot loops

Supported ECUs

6 manufacturers, 38 extractors — from LH-Jetronic (1982) to EDC17 and Denso/Hitachi Subaru (2020s). → Per-family reference

Own an ECU that is not listed? You can add support for it without sharing your dump — openremap contribute extractor my.bin --measure-only runs offline and tells you what the engine makes of the file.

Decoders & CPU coverage

To extract code references and read routines, OpenRemap decodes the ECU's CPU directly — no manufacturer lookup needed. Decoders power the code-reference signal, CPU auto-detection, and the routine command's pseudo-decompiler. Two backends cover the supported families:

• Rust-native decoders — written from scratch for CPUs that the capstone disassembly library does not support (C166/ST10, 8051, MCS-96), each verified against an independent oracle: Ghidra's SLEIGH spec (C166), the at51 disassembler (8051 — 100% agreement on ~312k real instruction boundaries), and MAME's opcode tables + Ghidra (MCS-96).
• Capstone-backed decoders — the mature disassembly library, used for TriCore, SuperH, x86, M680X, 68K and PowerPC.

Every mapping above is evidence-backed: an internal audit established each family's CPU from reset-vector header bytes and independent decoder evidence, and corrected several extractor docstrings along the way (M2.x / MP9 / M4.x are 8051, not 68xxx; EDC16 / MED9 are TriCore, not C166). The 16-bit Denso Subaru units are Motorola 68HC16 (CPU16) — capstone has no HC16 support, so they are not disassembled. Denso EE20 is believed to be SuperH per community docs, but there is no corpus binary to verify against yet.

Documentation

The wiki is live at docs.openremap.com — its content lives in the open-source v-arapidis/openremap-docs repo. This repository keeps only repo-internal docs (docs/internal/ — dated audits and version audits).

• Getting started — install, quick start, CLI, TUI
• Concepts — how it works, decoders, confidence, evidence, recipe format
• Commands — every command, simple + advanced
• Manufacturers — per-OEM, per-family pages

Contributing

See CONTRIBUTING.md — extractor guides, code style, PR process. Changes are tracked per version in changelog/.

Have an ECU that is not supported? You can add it without sharing your dump — and without knowing what the family is called:

# what is this file?  (no repository needed, no family name)
openremap contribute extractor stock.bin --also tuned.bin --measure-only

# from a clone: write the contribution
openremap contribute extractor stock.bin --also tuned.bin --brand X --family Y --write

The wizard measures a signature that is stable in your family and absent from every family the engine already recognises, then writes the fixture recipe (a few hundred bytes — never your ROM), an extractor skeleton that already passes the review bar, a test, and a PR description. It executes the generated extractor against every known-family fixture before calling it verified. Details: contributing/extractors.md.

License

MIT · Third-party credits