Reverse Engineering HHT-Win using ChatGPT

[DarkHelmet]

Having read a few articles like "New Exemption to Digital Millennium Copyright Act Broadens Protection for Vehicle Data Access", I got to thinking, what if we could reverse engineer the HHT tools..? Obviously a big job... But then I thought, what would ChatGPT have to say about it, so I uploaded HHT-Win to ChatGPT.. Here is a sample of just one question i asked: (I dont think this example used the uploaded data, but for other questions, it actually started to tell me how the program is architected)

What controllers can HHT-Win read?

HHT-WIN (Hand-Held Tester for Windows) can communicate with many legacy Mercedes-Benz control modules, primarily from vehicles manufactured in the 1980s through early 2000s, including your 2002 SL500 (R129). Its coverage focuses on K-line (ISO 9141) and Mercedes proprietary protocol modules, not CAN-based systems.

---

Typical Controllers HHT-WIN Can Read​

Engine & Transmission:​

Module	Name	Function
ME	Motor Electronics (ME-SFI)	Engine control (fuel, air, ignition)
LH	LH-Jetronic	Early engine management
EZL	Ignition control	Timing and knock detection
EGS	Electronic Gear Selector	Automatic transmission

Chassis & Brakes:​

Module	Name	Function
ABS/ASR/BAS	Brake systems	Anti-lock, traction, stability
EA/ISC	Electronic Accelerator	Throttle-by-wire / idle speed
ESP	Electronic Stability	Stability control module

Body & Interior:​

Module	Name	Function
IC	Instrument Cluster	Gauges, warning lights
EZL	Central Locking/Immobilizer	Security and access
AAC	Automatic Air Conditioning	HVAC control
SAM	Signal Acquisition Module	Light and switch control
ZGW	Central Gateway (rare)	Bus communication

Safety Systems:​

Module	Name	Function
SRS	Supplemental Restraint	Airbags, seatbelt pretensioners
IR/CL	Infrared Remote / Central Locking	Key fob & locking control

How It Works in Practice​

• When you enter DAS and select a module in an older Mercedes (e.g., R129), if that module is not CAN-based, DAS launches HHT-WIN in a separate window.
• You’ll then see:
  • Job options (e.g., read DTCs, erase DTCs, actuator tests)
  • Short test (scan all available modules)
  • Live data / analog values

Limitations of HHT-WIN​

Limitation	Detail
No CAN Bus support	Won’t talk to modern modules (e.g., post-2003)
No flash programming	Cannot update ECU firmware
Text-based UI	Functional, but very old-school
Not standalone	Must be launched from DAS/Xentry

Confirmed R129 HHT-WIN Modules (2002 SL500)​

You can expect support for:

• ME 2.0 / ME 2.1 (engine ECU)
• EGS51 (transmission)
• EA/ASR (throttle)
• SRS (airbags)
• AAC (HVAC)
• IC (cluster)
• ABS/ASR/BAS

Let me know if you want a list of exact PRG files present in your installation — these determine which modules can be accessed.

 

[R129 UK]

This is a list of what my version of HHT-Win shows as possible modules to read:

 

[DarkHelmet]

Oh wow, thanks.. Does it have definitions for each module? It would be kind of cool to reverse engineer it and design an open source/python program to read and clear codes. On older models, that would eliminate the need to have all this unneeded software with keygens and all to trouble shoot older cars. You would just need the Multiplexer and a computer (or maybe a smartphone). Though it is doubtful I would have the time to complete such a project, having the info in the public domain would be a great start.

One thing I worry about with ChatGPT/AI is it has this issue it will hallucinate answers sometimes.. So it is always best to trust but verify it's answers.

Thanks

 

[R129 UK]

Oh wow, thanks.. Does it have definitions for each module? It would be kind of cool to reverse engineer it and design an open source/python program to read and clear codes. On older models, that would eliminate the need to have all this unneeded software with keygens and all to trouble shoot older cars. You would just need the Multiplexer and a computer (or maybe a smartphone). Though it is doubtful I would have the time to complete such a project, having the info in the public domain would be a great start.

One thing I worry about with ChatGPT/AI is it has this issue it will hallucinate answers sometimes.. So it is always best to trust but verify it's answers.

Thanks

Do you mean what do the acronyms represent?

I have a Word document with a lot of MB acronyms in it but not all of those in the table above from a very quick glance so I could provide at least some of this but not for a couple of days as I'm working on other things currently.

 

[DarkHelmet]

... so I could provide at least some of this but not for a couple of days as I'm working on other things currently.

Sure, definitely no rush..

 

[R129 UK]

Here is the list which I have populated as much as I know:

Gasoline engine
01	HFM, ME2	Bosch HFM injection, and ME 2.0 injection
02	ME1 RE	Bosch ME 1.0 injection (right bank?)
03	ME1 LI	Bosch ME 1.0 injection (left bank?)
04	LH1	Bosch LH-SFI injection (6-cyl, 8-cyl and V12 bank 1)
05	LH2	Bosch LH-SFI injection (V12 bank 2)
06	EZ1	Electronic ignition (6-cyl, 8-cyl and V12 bank 1)
07	EZ2	Electronic ignition (V12 bank 2)
08	DM	Diagnostic Module
09	EPF, TPM, ISC	E-GAS / T-LLR / ISC = Idle Speed Control (ETA / Throttle control module)
10	GM	General (or Base) Module
Chassis
1	Traction	ASR / ABS
2	BAS	Brake Assist (later 90's models only)
3	ADS	Adaptive Damping System (140 / 129 only)
4	ASD	Automatic Locking Differential
5	EGS, EAG	Electronic Transmission Control (722.6 transmission, 1996-up)
Body
01	RFL	???
02	RCL / IRCL	Infrared Remote Central Locking
03	RV	Roadster Soft Top
04	ATA	Anti Theft Alarm
05	AB	Air Bag (SRS)
06	KI	Instrument Cluster (IC)
07	LWR	Headlamp Range Adjustment
08	APS	???
09	TELE AID	Telephone?
10	AUDIO, COMAND	Entertainment unit?
Climate Control
1	KLA	Automatic Air Conditioning
2	STH	Stationary Heater

Hopefully others can help to fill in the blanks, the engine modules are mostly from earlier vehicles and I don't know the acronyms for these.

EDIT 27/05/2025 - added a few more details which were blank.

 

[gsxr]

I updated some of the descriptions in the previous post...