Most ECUs have diagnostic messages that can read/write memory. This is often intended to be controlled by what "mode" the ECU is in (manufacturing/engineering/p

Most ECUs have diagnostic messages that can read/write memory. This is often intended to be controlled by what "mode" the ECU is in (manufacturing/engineering/production/dealer-service), but these aren't always well tested or properly implemented controls. Fuzzing these leads to weird behavior and state machines with not-well-tested transitions. Whether you can reset these to a known state is ECU specific, and often will involve knowledge that isn't publicly known.