Notices
Series I Aftermarket Performance Modifications Discussion of power adding modifications

cracking the ecu....

Thread Tools
 
Rate Thread
 
Old Nov 5, 2006 | 02:41 AM
  #276  
seikx8's Avatar
Is this title ok?
 
Joined: Jan 2003
Posts: 300
Likes: 2
From: El Monte, CA
Well, I completed my homework and here is the update and teaser

There are two methods to trick the "Mazda Module Programming" software to reflash the PCM.

Method 1. Edit the active saved session with a hex editor and replace all reference of the latest
flash entry with the old entry, for example changing level T to S: SW-N3Z2ET000 -> SW-N3Z2ES000
The session files are location at:
C:\Documents and Settings\All Users\Application Data\Ford Motor Company\MMP\Users

Method 2. By entering special function Generic Module Configuration by entering code "23198"
with Module Setting: Protocol>CAN, Address>PCM-7E0>Mazda

The following is a screen shot of the available menu:


In order to successfully force the application to use the file saved on the system, when you first install the software you must first edit the file Registry.xml and edit the value of "ForceCalibrationDownload" to 00 (originally default to 01). If you didn't happen to done this first, you will need to remove the session folder from C:\Documents and Settings\All Users\Application Data\Ford Motor Company\MMP\Users.

Once the application fire, you place the file .PHF in a .zip file and save it in the "Calibration Files" Folder which by default is at "C:\Program Files\Ford Motor Company\Calibration Files" this will bypass the download online.

An of course, once you have a legit copy you will be allow to auto-update to the latest version. And method 2 doesn't require you to establish internet connection, so it is a good and alternative mechanism for a reflash. However, if your subscription expired, method 1 will required you to host your own status server to trick it into by serving the ping status Or patched a few bytes in the .exe file to ignore the status.

NOTES: Any mistake made on Method 2 may render the PCM inoperative; especially VID or PATs info, or even flashed the wrong flash file.

Disclaimer: use it at your own risk.

Because method 2 is very dangerous, I'm currently working on some protocol emulation to study its behavior before doing the real reflash as I do not have a spare PCM to work with.

Until next time,
Attached Thumbnails cracking the ecu....-mmp-a6.jpg   cracking the ecu....-mmp-a7.jpg  
Old Jan 11, 2007 | 08:23 AM
  #277  
jird20's Avatar
Mad for a Furai
 
Joined: Sep 2004
Posts: 117
Likes: 0
From: Madrid - Spain
Dear seik8,

Any updates two months later?

Cheers

jird20
Old Jan 13, 2007 | 03:01 PM
  #278  
seikx8's Avatar
Is this title ok?
 
Joined: Jan 2003
Posts: 300
Likes: 2
From: El Monte, CA
Originally Posted by jird20
Dear seik8,

Any updates two months later?

Cheers

jird20
Since you ask, I have to reply. No

I didn't have time over the holiday and was too busy with work these past weeks and it will not settle down until maybe late march or so. Because I have no spare pcm, I'm being very cautious of the next step I'm going to do. So it will be a little while before I have something new to share. And tracing those PCM pins are like search the needle in a haze stack and they are very hard to see as most of the connection are tiny. I'm not sure if it use multi-layer PCB, if it is, then tracing the pins will be almost impossible without a scope.
Old Jan 13, 2007 | 03:21 PM
  #279  
swoope's Avatar
Zoom-Freakin'-Zoom
iTrader: (5)
 
Joined: Jan 2004
Posts: 14,603
Likes: 36
From: orlando, fl
Originally Posted by seikx8
Since you ask, I have to reply. No

I didn't have time over the holiday and was too busy with work these past weeks and it will not settle down until maybe late march or so. Because I have no spare pcm, I'm being very cautious of the next step I'm going to do. So it will be a little while before I have something new to share. And tracing those PCM pins are like search the needle in a haze stack and they are very hard to see as most of the connection are tiny. I'm not sure if it use multi-layer PCB, if it is, then tracing the pins will be almost impossible without a scope.
which model pcm are you looking for???

my guess would be an 04 6sp?

beers
Old Jan 13, 2007 | 04:47 PM
  #280  
TeamRX8's Avatar
Registered
iTrader: (25)
 
Joined: Apr 2005
Posts: 26,936
Likes: 2,140
I'm expecting to have a spare 05 PCM hanging around soon, not sure when exactly that will be
Old Jan 22, 2007 | 10:36 PM
  #281  
zoom44's Avatar
Administrator
 
Joined: Jul 2002
Posts: 21,958
Likes: 115
From: portland oregon
BIG BIG NEWS!!! just opened an email from Brian Herron over at DrewTech

The Mongoose vehicle interface/cable is availalbe for shippingNOW with the FEPS programing voltage capability for ecu flashing!!!

this is an additonal $100 dollars bringing the Mongoose to $395- thats friggin cheap folks. we can crack the code and actaul flash it using seik's methods ford/mazda's module reprogramming software and one of theseDrewTech Mogoose.

http://www.drewtech.com/products/mongoosepwm.html
Old Jan 22, 2007 | 10:43 PM
  #282  
TeamRX8's Avatar
Registered
iTrader: (25)
 
Joined: Apr 2005
Posts: 26,936
Likes: 2,140
you also need another $99.95 for the PCM Scan software, still great news

then you still have to figure out which parameters to change, how to change them, and how much change without blowing your engine ... that's the not so easy part for most people
Old Jan 22, 2007 | 10:44 PM
  #283  
swoope's Avatar
Zoom-Freakin'-Zoom
iTrader: (5)
 
Joined: Jan 2004
Posts: 14,603
Likes: 36
From: orlando, fl
zoom.

pm

beers




Originally Posted by zoom44
BIG BIG NEWS!!! just opened an email from Brian Herron over at DrewTech

The Mongoose vehicle interface/cable is availalbe for shippingNOW with the FEPS programing voltage capability for ecu flashing!!!

this is an additonal $100 dollars bringing the Mongoose to $395- thats friggin cheap folks. we can crack the code and actaul flash it using seik's methods ford/mazda's module reprogramming software and one of theseDrewTech Mogoose.

http://www.drewtech.com/products/mongoosepwm.html
Old Jan 22, 2007 | 10:46 PM
  #284  
zoom44's Avatar
Administrator
 
Joined: Jul 2002
Posts: 21,958
Likes: 115
From: portland oregon
Originally Posted by TeamRX8
you also need another $99.95 for the PCM Scan software, still great news

then you still have to figure out which parameters to change, how to change them, and how much change without blowing your engine ... that's the not so easy part for most people

meh thats the small stuff

i should say- if we have a tweaked map in hand we can flash it with seik's method the ford software and this cable
Old Jan 23, 2007 | 01:49 AM
  #285  
jird20's Avatar
Mad for a Furai
 
Joined: Sep 2004
Posts: 117
Likes: 0
From: Madrid - Spain
Amazingly amazing news,

We are getting closer to suit the RX8 to our tastes.

Go seik so!!!

Cheers

jird20
Old Jan 23, 2007 | 03:56 AM
  #286  
turbosa22c's Avatar
Registered User
 
Joined: Mar 2006
Posts: 125
Likes: 0
i dont know about that. getting into the code is one thing but trying to figure what lines of code does what is another. if it were that simple the big mazda tuners would have done so.
Old Jan 23, 2007 | 04:03 AM
  #287  
RX8PDX's Avatar
Registered User
 
Joined: Mar 2005
Posts: 221
Likes: 0
From: St. Helens, OR
Nice!

Drewtech is also the one that has the DashDAQ. Sounds like they are close to having a nice touch LCD tuning interface.
Old Jan 23, 2007 | 07:28 AM
  #288  
Japan8's Avatar
Int'l Man of Mystery
 
Joined: Jan 2004
Posts: 3,651
Likes: 0
From: Central Florida
Originally Posted by turbosa22c
i dont know about that. getting into the code is one thing but trying to figure what lines of code does what is another. if it were that simple the big mazda tuners would have done so.

What big Mazda tuners? That's the issue at hand. There aren't any. I hope no one is going to say RE Amemiya, RMagic or Racing Beat, because first... they all have cracked and can flash the ECU for the RX-8... you just have to mail it in to them. Second... none of them are that large... Racing Beat is about the only one that comes close to counting as a large professional aftermarket tuning company among them.

It's not rocket science. It's a matter of business... there's been little money in Mazdas compared to Fords, GM's and Chryslers... then Subarus and Evos...
Old Jan 23, 2007 | 07:43 AM
  #289  
LostAngel's Avatar
Registered User
 
Joined: May 2005
Posts: 685
Likes: 0
Cobb is working on a tune for the rx8
Old Jan 23, 2007 | 09:11 AM
  #290  
california style's Avatar
Londons Yellow Peril
 
Joined: Apr 2005
Posts: 1,340
Likes: 2
From: North London
hmmm interesting times it seems.


My main concern with any kind of substantial power increase is still the ECU tuning elements.....

Go research crew!
Old Jan 23, 2007 | 11:24 AM
  #291  
zoom44's Avatar
Administrator
 
Joined: Jul 2002
Posts: 21,958
Likes: 115
From: portland oregon
mind you this will also allow just about anyone with a modicum of sense and a pc/laptop to reflash their PCM with whatever Flash comes out next from mazda- without going to the dealer

japan i was about to say those 3. however small they are they ar ethe Major Players as afar as the rotary world goes. and they have the abiltiy to offer non-stock tunes. perhaps this will allow for a delivery method besiddes sending the pcm to them?
Old Jan 23, 2007 | 12:12 PM
  #292  
Japan8's Avatar
Int'l Man of Mystery
 
Joined: Jan 2004
Posts: 3,651
Likes: 0
From: Central Florida
^ That would be cool.
Old Jan 23, 2007 | 02:04 PM
  #293  
TeamRX8's Avatar
Registered
iTrader: (25)
 
Joined: Apr 2005
Posts: 26,936
Likes: 2,140
Originally Posted by zoom44
mind you this will also allow just about anyone with a modicum of sense and a pc/laptop to reflash their PCM with whatever Flash comes out next from mazda- without going to the dealer
japan i was about to say those 3. however small they are they ar ethe Major Players as afar as the rotary world goes. and they have the abiltiy to offer non-stock tunes. perhaps this will allow for a delivery method besiddes sending the pcm to them?


careful, it's possible to screw up a PCM flash ...


.
Old Jan 23, 2007 | 02:43 PM
  #294  
zoom44's Avatar
Administrator
 
Joined: Jul 2002
Posts: 21,958
Likes: 115
From: portland oregon
i did say modicum
Old Jan 23, 2007 | 03:25 PM
  #295  
lurch519's Avatar
www.evoperform.com
 
Joined: Apr 2005
Posts: 2,010
Likes: 1
From: tax free delaware
Originally Posted by zoom44
i did say modicum
he said modicum.............hehe
Old Feb 7, 2007 | 01:29 AM
  #296  
seikx8's Avatar
Is this title ok?
 
Joined: Jan 2003
Posts: 300
Likes: 2
From: El Monte, CA
I'm bored so I created this Simple WebService so you may use the MMP application without internet connection.

[Edit]
Here is the new version. Written in .NET 2.0

Method 1 (Modify registry.xml):
1) Run application: MMPService.exe
2) Run application Mazda Module Programming (LCT Shell.exe)
3) Do whatever...
4) Shutdown application Mazda Module Programming
5) Shutdown MMPService.exe

Method 2 (Modify hosts file):
1) stop local iis server: net stop iisadmin
2) Run application with following command: MMPService.exe hosts
3) Run application Mazda Module Programming (LCT Shell.exe)
4) Do whatever...
5) Shutdown application Mazda Module Programming
6) Shutdown MMPService.exe

If you zipped up the flash .phf and place the .zip file in folder where the MMPService.exe is located, it will feed the file to the program when MMP application request them. Make sure the .zip file name is the same as the .phf name.

If things doesn't seemed to work, open the task manager and look for process "XMLRegistryD.exe" and kill it or restart the pc. This daemon doesn't seem to terminate when the MMP application exit. Make sure you follow the order of start and stop the application to insure the registry.xml file is restored properly so that you may continue using the application with your active subscription. Registry.xml is also copied to Registry.xml.bak as backup when it first run.

BTW, the MMP version 4.6 is way more stable and easier to use. I would recommend you subscribe and download the latest MMP version from mazdatech if you don't have one already.

DISCLAIMER: use at your own risk. All information and application posted are provided for educational purpose only. In no event shall the author be held liable for any action you may incur. By downloading the application, you have read and understand the disclaimer.

Have fun
Attached Files
File Type: zip
MMPService.zip (5.9 KB, 181 views)

Last edited by seikx8; Feb 15, 2007 at 12:30 AM.
Old Feb 7, 2007 | 12:54 PM
  #297  
j9fd3s's Avatar
Registered
 
Joined: May 2003
Posts: 1,382
Likes: 11
so we had a couple of mazda engineers come out and try to "fix" a problem with a cx7, and to make a long story short mazda can plug a laptop right into the obd2 port and reprogramme anything in the ecu (timing, boost, etc etc)

forget hacking the thing, the software already exists....
Old Feb 7, 2007 | 05:50 PM
  #298  
juanjux's Avatar
Registered User
 
Joined: May 2005
Posts: 213
Likes: 0
From: Madrid, Spain
Originally Posted by j9fd3s
so we had a couple of mazda engineers come out and try to "fix" a problem with a cx7, and to make a long story short mazda can plug a laptop right into the obd2 port and reprogramme anything in the ecu (timing, boost, etc etc)

forget hacking the thing, the software already exists....
And where can we obtain it? Anyway it's most interesting to know first hand how the ECU works than just watching it works in a black box type software.

This thread is amazing anyway.
Old Feb 7, 2007 | 05:58 PM
  #299  
TeamRX8's Avatar
Registered
iTrader: (25)
 
Joined: Apr 2005
Posts: 26,936
Likes: 2,140
Originally Posted by j9fd3s
so we had a couple of mazda engineers come out and try to "fix" a problem with a cx7, and to make a long story short mazda can plug a laptop right into the obd2 port and reprogramme anything in the ecu (timing, boost, etc etc)

forget hacking the thing, the software already exists....

of course Mazda like any manufacturer has the software, but they're not inclined to make it public, sheesh ...

Cobb Tuning has software, but it's not for sale yet
Racing Beat has access to part of the software, but they're not intending to share it
a few others in the works too
Old Feb 7, 2007 | 08:18 PM
  #300  
patrick_andraste's Avatar
Gotta Love Two Strokes
 
Joined: Feb 2005
Posts: 164
Likes: 0
From: Seattle, WA
Originally Posted by TeamRX8
of course Mazda like any manufacturer has the software, but they're not inclined to make it public, sheesh ...

Cobb Tuning has software, but it's not for sale yet
Racing Beat has access to part of the software, but they're not intending to share it
a few others in the works too
You can buy the software from Mazda. It is just very expensive. I think they quoted me around $9,000.00 for it.


You have already rated this thread Rating: Thread Rating: 0 votes,  average.


All times are GMT -5. The time now is 09:37 AM.