Series II ECU Tuning
07-28-2011, 09:41 PM
#253
Registered
No need to drive across the country for a tune; simply log the ecu data in your car during your dyno runs( or in a presribed manner on the road) and send us the information, along with the ecu. We will take that info and look at your mods and tune your ecu to make it perfect for your car.
Due to the nature of the new MCU used in the second Gen Denso, there is not an end user option, and we don't have plans to offer one due to cost, sorry
Due to the nature of the new MCU used in the second Gen Denso, there is not an end user option, and we don't have plans to offer one due to cost, sorry
Question for you . If I add nitrous to the car, and send you the seperate pulls on the dyno with and without nitrous, can you flash the ecu and add some type of piggyback ecu for a second setting ? I didn't see this brought up by anyone else so if it was i apologize for being redundant, but let me know, thanks,
B
07-28-2011, 11:49 PM
#254
No need to drive across the country for a tune; simply log the ecu data in your car during your dyno runs( or in a presribed manner on the road) and send us the information, along with the ecu. We will take that info and look at your mods and tune your ecu to make it perfect for your car.
Well, no harder or more costly than doing it on the Series I. It is just there is no market position that will ensure a profit. There are only a handful of Series II cars out there compared to the Series I and it took a few hundred Series I cars to make it profitable the first time around.
07-29-2011, 12:19 AM
#255
Super Moderator
OK, that makes sense...what a pity for us though, I would have enjoyed seeing-experiencing your exceptional talents used on/in my car.
07-29-2011, 06:41 AM
#256
Registered
Join Date: Jan 2011
Posts: 43
Likes: 0
Received 0 Likes
on
0 Posts
Question for you . If I add nitrous to the car, and send you the seperate pulls on the dyno with and without nitrous, can you flash the ecu and add some type of piggyback ecu for a second setting ? I didn't see this brought up by anyone else so if it was i apologize for being redundant, but let me know, thanks,
B
B
07-29-2011, 06:56 AM
#257
Registered
Join Date: Jan 2011
Posts: 43
Likes: 0
Received 0 Likes
on
0 Posts
Not quite sure why this route seems so amazing to you; in effect its the same routine you use to E tune with the AP set up, correct? Only real difference is the manner in which the file is loaded.
Well, no harder or more costly than doing it on the Series I. It is just there is no market position that will ensure a profit. There are only a handful of Series II cars out there compared to the Series I and it took a few hundred Series I cars to make it profitable the first time around.
07-29-2011, 08:41 AM
#259
Registered
Join Date: Jul 2005
Posts: 115
Likes: 0
Received 0 Likes
on
0 Posts
dynotronics, what's your guideline for building a turbo S2 and having you tune the ecu? What would we have to do and how would we get the data. Additionally, let's say I want to use a boost controller for a low boost setting and a high boost setting. How would I accomodate both maps?
Let's say thereafter, that I want to add water/meth. How would you guys accomodate that in your tuning?
Let's say thereafter, that I want to add water/meth. How would you guys accomodate that in your tuning?
07-29-2011, 09:18 AM
#260
Ahh, yeah we are pretty good at what we do, Thanks. BTW, did you notice the part in that about datalogs? Wouldn't that effectively answer your question about feedback?
Not quite sure why this route seems so amazing to you; in effect its the same routine you use to E tune with the AP set up, correct? Only real difference is the manner in which the file is loaded.
Not quite sure why this route seems so amazing to you; in effect its the same routine you use to E tune with the AP set up, correct? Only real difference is the manner in which the file is loaded.
07-29-2011, 01:42 PM
#262
Ahh, yeah we are pretty good at what we do, Thanks. BTW, did you notice the part in that about datalogs? Wouldn't that effectively answer your question about feedback?
Not quite sure why this route seems so amazing to you; in effect its the same routine you use to E tune with the AP set up, correct? Only real difference is the manner in which the file is loaded.
Not quite sure why this route seems so amazing to you; in effect its the same routine you use to E tune with the AP set up, correct? Only real difference is the manner in which the file is loaded.
You seem to be able to do it with a single shot - Get on the dyno, pull some logs and mail your PCM. That isn't feedback, that is base calibration.
I'm just mystified how you can "tune your ecu to make it perfect for your car" in one shot. I don't know anybody else that can do that.
07-29-2011, 05:11 PM
#263
I read this post a while ago, then lost it, then stumbled upon it again today. Anyhow, this is a thumbnail description of what goes into reverse engineering Renesas/Denso ECUs. Written by Colby Boles of tactrix.com
link to original
a) 2001-2005 WRX - 68HC916Y5 based
* get the chip docs!
* get a BDM from P&E Microsystems
* solder a BDM header the ECU using the handy solder pads Denso left for this purpose
* read out the rom (including the TPU area) with a couple clicks of the BDM software
* get IDA Pro
* write your own HC16 module for IDA Pro because you don't want to spend the money to buy IDA Pro advanced
* publish the source of your HC16 module for free for others to use
* start disassembling - find all the references to code that accesses the serial port
* notice that there is TPU code that uses the serial port ???
* figure out that the TPU area is a bootloader!
* learn what the bootloader wants, including checksums, etc.
* learn how the bootloader keeps the WDT happy
* get a HC16 assembler (COSMIC)
* write a simple kernel program to read out the CPU
* write a better kernel program to reflash the CPU
* discover that your 02 WRX works, but your 04 WRX won't enter the bootloader
* read out 04 WRX with BDM and go through the serial code
* find seed/key algorithm before jumping to bootloader!
* add see/key to PC reflash program
b) 2004+ Subaru DBW - SH7055 and SH7058 based
* get the chip docs!
* try using the same initialization sequence as the WRX
* it works!!!
* build SH cross-compiler
* start writing test kernels - some trial and error here
* the ECU is being reset by a watchdog!
* start tracing pins on the board with a scope - PB15 is twiddling!
* add WDT code to kernel - it works!
* write flashing code - test - test - test
* reprogram using boot mode (solder into ECU) when you screw up
* write another kernel for SH7058 that uses built in reflash functions
c) EVO 7/8 - SH7052 based
* get the chip docs!
* borrow a MUTIII - very handy
* snoop a TSB reflash using the MUTIII (only get one chance!)
* identify init sequence and kernel upload - no seed/key - this is easy!
* Mitsubishi uses boot mode for bootloader, which makes development and flash failures easily recoverable...
* write a simple kernel to dump all of ram so I can see what the Mitsubishi bootloader looks like
* buy IDA Pro Advanced - don't want to write any more modules!
* disassemble bootloader completely to understand how it all works, including initialization codes
* modify Subaru SH7055 kernel to work with SH7052 - easy!
* done!
d) EVO 9 - SH7055 derivative
* get the chip docs!
* borrow a MUTIII
* snoop a reflash using the MUTIII
* same init sequence!
* try loading my SH7055 kernel, and the ECU takes it, but doesn't seem to run the code
* I am stuck in the bootloader for some reason!
* from the snooping, I can see how to read / erase / write with the bootloader, but I want to use my own kernel - but how - I need to be able to read out the bootloader to find out how to load a kernel...
* create a EVO 9 ROM with a trojan kernel in it.
* flash this into the ECU, but is doesn't respond
* start tracing board and discover that there is a WDT that needs to run off of PD8 - but only when not in the init mode
* add WDT code to trojan kernel
* flash it and it runs!
* read out EVO 9 bootloader still left in RAM
* see command to load a kernel!
* see that bootloader uses built in flashing function like SH7058
* make new SH7055 kernel to support new flashing method like SH7058
* it works!
* get the chip docs!
* get a BDM from P&E Microsystems
* solder a BDM header the ECU using the handy solder pads Denso left for this purpose
* read out the rom (including the TPU area) with a couple clicks of the BDM software
* get IDA Pro
* write your own HC16 module for IDA Pro because you don't want to spend the money to buy IDA Pro advanced
* publish the source of your HC16 module for free for others to use
* start disassembling - find all the references to code that accesses the serial port
* notice that there is TPU code that uses the serial port ???
* figure out that the TPU area is a bootloader!
* learn what the bootloader wants, including checksums, etc.
* learn how the bootloader keeps the WDT happy
* get a HC16 assembler (COSMIC)
* write a simple kernel program to read out the CPU
* write a better kernel program to reflash the CPU
* discover that your 02 WRX works, but your 04 WRX won't enter the bootloader
* read out 04 WRX with BDM and go through the serial code
* find seed/key algorithm before jumping to bootloader!
* add see/key to PC reflash program
b) 2004+ Subaru DBW - SH7055 and SH7058 based
* get the chip docs!
* try using the same initialization sequence as the WRX
* it works!!!
* build SH cross-compiler
* start writing test kernels - some trial and error here
* the ECU is being reset by a watchdog!
* start tracing pins on the board with a scope - PB15 is twiddling!
* add WDT code to kernel - it works!
* write flashing code - test - test - test
* reprogram using boot mode (solder into ECU) when you screw up
* write another kernel for SH7058 that uses built in reflash functions
c) EVO 7/8 - SH7052 based
* get the chip docs!
* borrow a MUTIII - very handy
* snoop a TSB reflash using the MUTIII (only get one chance!)
* identify init sequence and kernel upload - no seed/key - this is easy!
* Mitsubishi uses boot mode for bootloader, which makes development and flash failures easily recoverable...
* write a simple kernel to dump all of ram so I can see what the Mitsubishi bootloader looks like
* buy IDA Pro Advanced - don't want to write any more modules!
* disassemble bootloader completely to understand how it all works, including initialization codes
* modify Subaru SH7055 kernel to work with SH7052 - easy!
* done!
d) EVO 9 - SH7055 derivative
* get the chip docs!
* borrow a MUTIII
* snoop a reflash using the MUTIII
* same init sequence!
* try loading my SH7055 kernel, and the ECU takes it, but doesn't seem to run the code
* I am stuck in the bootloader for some reason!
* from the snooping, I can see how to read / erase / write with the bootloader, but I want to use my own kernel - but how - I need to be able to read out the bootloader to find out how to load a kernel...
* create a EVO 9 ROM with a trojan kernel in it.
* flash this into the ECU, but is doesn't respond
* start tracing board and discover that there is a WDT that needs to run off of PD8 - but only when not in the init mode
* add WDT code to trojan kernel
* flash it and it runs!
* read out EVO 9 bootloader still left in RAM
* see command to load a kernel!
* see that bootloader uses built in flashing function like SH7058
* make new SH7055 kernel to support new flashing method like SH7058
* it works!
07-30-2011, 11:21 AM
#266
Registered
meaning you would actually need the car there for you to put on the dyno ? Not just my ecu ?
07-30-2011, 06:58 PM
#269
The only good news is that the tools keep getting better, Ida Pro does a much better job of disasm on SuperH than it did when people started on these ecus, and there is cheaper/better hardware for doing BDM type stuff.
08-02-2011, 09:18 PM
#271
Registered
Join Date: Jul 2011
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
dynotronics,
I have a 2010 RX8 stock in Austin and some time off during the week.
You still need a car for a sample? I could have it down there this or next week. The whole car. You could Dyno before and after in ludicrous Texas heat and post here.
You guys still up for this?
I have a 2010 RX8 stock in Austin and some time off during the week.
You still need a car for a sample? I could have it down there this or next week. The whole car. You could Dyno before and after in ludicrous Texas heat and post here.
You guys still up for this?
08-03-2011, 01:28 AM
#272
Registered
Join Date: Jul 2011
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
I Emailed and responded in another thread.
I am about 40 miles from Dynotronics with a 2010 Stock RX8 AT.
I can drive down there during the week and they say they can do this in a few hours.
I gawk at car tuning and grab a bite to eat, maybe catch a movie. Pick up my RX8 with new numbers.
At one point they were wanting to demonatrate their service.
You guys up for dyno - tune - dyno with results to be posted here?
Can it be done reasonably quick?
What would it cost me?
If I am paying full price, are there benefits I get as guinea pig?
In short, I have the car, the location, the money, and I have weekdays available (not all of them, mind you). So, how would you like to go about it?
I am about 40 miles from Dynotronics with a 2010 Stock RX8 AT.
I can drive down there during the week and they say they can do this in a few hours.
I gawk at car tuning and grab a bite to eat, maybe catch a movie. Pick up my RX8 with new numbers.
At one point they were wanting to demonatrate their service.
You guys up for dyno - tune - dyno with results to be posted here?
Can it be done reasonably quick?
What would it cost me?
If I am paying full price, are there benefits I get as guinea pig?
In short, I have the car, the location, the money, and I have weekdays available (not all of them, mind you). So, how would you like to go about it?
08-04-2011, 07:16 AM
#273
Registered
Join Date: Jan 2011
Posts: 43
Likes: 0
Received 0 Likes
on
0 Posts
dynotronics,
I have a 2010 RX8 stock in Austin and some time off during the week.
You still need a car for a sample? I could have it down there this or next week. The whole car. You could Dyno before and after in ludicrous Texas heat and post here.
You guys still up for this?
I have a 2010 RX8 stock in Austin and some time off during the week.
You still need a car for a sample? I could have it down there this or next week. The whole car. You could Dyno before and after in ludicrous Texas heat and post here.
You guys still up for this?
Sure give me a call
08-06-2011, 08:32 PM
#275
Registered
Join Date: Jul 2011
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
Ok, for those looking for more info on the Dynotronics. I have made arrangements with them, and should have my car done on Thursday July August 11, 2011.
I am working on lining up a dyno in Austin where I can do before and after independently of dynotronics. I will post my results in this thread.
That should pretty much kill any discussion about what they can or cannot do. I know Series II owners everywhere could use the love, so I am definitely pulling for dynotronics.
I am working on lining up a dyno in Austin where I can do before and after independently of dynotronics. I will post my results in this thread.
That should pretty much kill any discussion about what they can or cannot do. I know Series II owners everywhere could use the love, so I am definitely pulling for dynotronics.
Last edited by v3rlon; 08-07-2011 at 02:35 AM. Reason: date malfunction between brain and keyboard