cracking the ecu....
#351
Is this title ok?
but a J2534 such as this is only part of the issue? you still need software to read/download a flash - edit it then -flash.
what about winols? I have been told it can be utilized but isn't a solution by itself?
what about winols? I have been told it can be utilized but isn't a solution by itself?
You can use WinOLS or FlashEdit or any other binary editor out there to edit the binary. You will then need a file format convertor. Then you use Mazda/Ford programmer software to do the flash. If WinOLS support plugin you can write your own plugin to support the WDS compatible file format. But if you are a vendor or someone want to go this route, I'm sure you want to create your own software and interface with J2534 directly without the hazzle of running multiple application and majority of the profit come bundle in hardware price and not the software itself. And in order to hide features and secret such as auto-tunning or map switching, etc, a black box hardware married to the car is the only way.
#352
Anti Establishment
Join Date: Jul 2008
Location: NorthEast USA
Posts: 42
Likes: 0
Received 0 Likes
on
0 Posts
I see this post has been dead for awhile... Has there been a tuning solution found? Or is the idea abandoned?
I have been rereading alot of what's been posted, and I was wondering if anyone has a list compiled for known map locations yet? Any help is appreciated, and all your work so far has been great. There are quite a few smart people in this forum with much knowledge and insight, you folks amaze me. Keep up the good work.
I have been rereading alot of what's been posted, and I was wondering if anyone has a list compiled for known map locations yet? Any help is appreciated, and all your work so far has been great. There are quite a few smart people in this forum with much knowledge and insight, you folks amaze me. Keep up the good work.
#353
Registered
iTrader: (4)
The Cobb AccessPort is available. You will need to go to a pro tuner to have this customized for the car. An addition that will allow you to tune yourself has been promised.
RX8Club member "Hymee" is enhanceing (an inside joke and a pun all in one) his Scanalyzer to be able to tune the car also.
These are all done through the ODBII port found under the steering column.
RX8Club member "Hymee" is enhanceing (an inside joke and a pun all in one) his Scanalyzer to be able to tune the car also.
These are all done through the ODBII port found under the steering column.
#354
Anti Establishment
Join Date: Jul 2008
Location: NorthEast USA
Posts: 42
Likes: 0
Received 0 Likes
on
0 Posts
I was looking for the scanylizer but it's not available yet...? is it? And I was seriously considering the AP, but the lack of USER tuning has made me look for another solution, which made me consider the E_management setup, but I would rather stay away from a piggy-back if I can. If I do gothe AP route, I will definately go with MM for his tuning services though.
#355
Registered
iTrader: (4)
The tuning version of the Scanalyzer isn't available yet. It is being beta tested, however, by a group of people on here. There haven't been any word about it from other than Hymee, so I think they aren't allowed to talk about it. For an ETA on a release date, PM him.
Eventually, either Hymee or Cobb will offer a personal tunning solution. Most likely before the end of the year. But, that would just be a guess.
Eventually, either Hymee or Cobb will offer a personal tunning solution. Most likely before the end of the year. But, that would just be a guess.
#359
Rotorheaded Geek
Join Date: Oct 2006
Location: Manchester,NH
Posts: 517
Likes: 0
Received 0 Likes
on
0 Posts
ya, I got to hesitant about the exact flash protocol and didn't have the time to invest in that portion so I've just worked on the ROM's and identifying as many maps as I can and am using the Harrison unit to do the flashing.
#361
Rotorheaded Geek
Join Date: Oct 2006
Location: Manchester,NH
Posts: 517
Likes: 0
Received 0 Likes
on
0 Posts
same here, found a few utilities that can help you make an XML then I got a disassembler and sat down with a friend of mine who is good in ASM programming and we started to poor over the over 300k lines of code that make up the car so we could start to figure out the MAPs that aren't as easily identified. I personally want to tune the electronic power steering map.
#362
No respecter of malarkey
iTrader: (25)
I had no idea it was that far developed, but after my experience with the earlier Harrison CanScan, which still to this day is the most buggy, unreliable scan tool ever, I'd be reluctant to place my faith in him again, plus there's no credit for that previous version after all the headaches it caused
#363
Anti Establishment
Join Date: Jul 2008
Location: NorthEast USA
Posts: 42
Likes: 0
Received 0 Likes
on
0 Posts
Glad to here you've made some progress. I haven't done much of anything in the way of mapping since last spring, and that was adding the DTC's. Are more people getting involved or has it stagnated completely? I haven't been searching the web or club for awhile to know if there has been progress/products out there.
Tuning the Power steering... that could be interesting. More power to you, the more we all learn the better. Can I be dumb and ask why the power steering though? Perhaps you've figured everything else out?
Any chance you've found anything on the DSC? From a performance perspective I thought it may have some merit. I know it's a seperate controller, but at the very least it DOES send a torque down/up request via CAN to the PCM. I think a performance adjustable DSC could work well. The stock setup cuts much power and uses much brake, if we could alter those amounts from the torque down request, this could increase the cars performance in certain conditions. Any thoughts?
Tuning the Power steering... that could be interesting. More power to you, the more we all learn the better. Can I be dumb and ask why the power steering though? Perhaps you've figured everything else out?
Any chance you've found anything on the DSC? From a performance perspective I thought it may have some merit. I know it's a seperate controller, but at the very least it DOES send a torque down/up request via CAN to the PCM. I think a performance adjustable DSC could work well. The stock setup cuts much power and uses much brake, if we could alter those amounts from the torque down request, this could increase the cars performance in certain conditions. Any thoughts?
#364
Rotorheaded Geek
Join Date: Oct 2006
Location: Manchester,NH
Posts: 517
Likes: 0
Received 0 Likes
on
0 Posts
Well as far as the powersteering is concerned, I drove around for about a month with it disabled and loved the feel and feedback so I was hoping to knock it down a few notches instead of having to pull the fuse and get the feel like my 7 has. As for the DSC, I'm still working on locating those controls, I have the ROM disassembled and am just working through all the assembly code (about 300k lines of it) to figure out what does what. And yes this includes having to learn all the sensor connections and so on so as I go deeper it's taking longer but I'm hoping to have the whole thing documented and available and since many parts are universal between ROM's (it is just the Hitachi OS) it shouldn't be hard to take any version and break it down.
I also have put on priority to find the fuel handling aspect of the ROM, since I know everyone says that's the week point of the stock ECU, perhaps the code around that could be changed. But that is off in the future, since I would need to setup all the Renesas 705x compilers and simulators to make sure that any modification to the code will not brick the PCM.
As for the Harrison unit, I've only just started really playing with it and to me it comes across as a much more technically advanced unit since you have to follow specific steps and have to do manual checks and balances as you go through the reading and flashing processes. So to that end the AP could be a better choice for novices and the such but I like the freedom that the Harrison system has, esp since I do enjoy reverse-engineering.
I also have put on priority to find the fuel handling aspect of the ROM, since I know everyone says that's the week point of the stock ECU, perhaps the code around that could be changed. But that is off in the future, since I would need to setup all the Renesas 705x compilers and simulators to make sure that any modification to the code will not brick the PCM.
As for the Harrison unit, I've only just started really playing with it and to me it comes across as a much more technically advanced unit since you have to follow specific steps and have to do manual checks and balances as you go through the reading and flashing processes. So to that end the AP could be a better choice for novices and the such but I like the freedom that the Harrison system has, esp since I do enjoy reverse-engineering.
#365
Anti Establishment
Join Date: Jul 2008
Location: NorthEast USA
Posts: 42
Likes: 0
Received 0 Likes
on
0 Posts
That would be great if you figure it out! Especially if you share it.
The pcm is closely related to the one subaru uses and they can control everything and still make 500hp on a stock pcm controling 4 plug timing, dual or quad cam timing, 4 injectors, turbo and more. We got 200 hp 6 fuel inj, 4 plug timing and a series of switches for the sdais and more, I would hope it can handle it. I almost forgot, 4 oil inj, maybe that puts it over the top... I guess that also implies the code is efficient, and maybe that's where the issue is, or did I misunderstand? Side note: I did look back through some old subaru roms to find similarities and equations when making my definition.
My only fueling gripe is the lean spike at the sdais activations, which you can do a little compensation for with tuning but I wouldn't classify that as pcm shortfall, I think it's just inherent to the operation of the valves. Maybe some users of aftermarket pcms could confirm of deny that... I haven't been using a dyno, but I have been able to control fuel to my liking with logs and a wideband. It seems to respond accordingly to changes in the maps like other cars do.
Bricking a pcm... well it's possible. I had one scrapped, turns out it's an emmisions device which can be replaced as warranty. I've also used one that eventually quite accepting flashes after extensive testing for alternative fuel mapping.
Harrison-As far as ease of use, well, it's not really that bad, actually after you have a definition, it's quite easy. ie. make your map change, save it, flash it. Is the AP any easier than that? I thought you had to map at a pc, and send it to your AP, than upload to your car... actually in that respect, it's an additional step with the AP and that's only if you have the software to tune. Are all AP owners allowed to make their own custom tunes for free?
Anyway, at this point, I am pretty sure the AP can tune more things than what I've managed to obtain. But for half the price, and personal customizations, as well as the eventual open sourcing of information regarding tuning and rom definitions, I am quite pleased that I didn't choose the AP, even though that little gadget looks pretty cool, and soft map changes on the fly would be nice, but oh well.
Sorry it's so winded... Just some of my thoughts and opinions.
The pcm is closely related to the one subaru uses and they can control everything and still make 500hp on a stock pcm controling 4 plug timing, dual or quad cam timing, 4 injectors, turbo and more. We got 200 hp 6 fuel inj, 4 plug timing and a series of switches for the sdais and more, I would hope it can handle it. I almost forgot, 4 oil inj, maybe that puts it over the top... I guess that also implies the code is efficient, and maybe that's where the issue is, or did I misunderstand? Side note: I did look back through some old subaru roms to find similarities and equations when making my definition.
My only fueling gripe is the lean spike at the sdais activations, which you can do a little compensation for with tuning but I wouldn't classify that as pcm shortfall, I think it's just inherent to the operation of the valves. Maybe some users of aftermarket pcms could confirm of deny that... I haven't been using a dyno, but I have been able to control fuel to my liking with logs and a wideband. It seems to respond accordingly to changes in the maps like other cars do.
Bricking a pcm... well it's possible. I had one scrapped, turns out it's an emmisions device which can be replaced as warranty. I've also used one that eventually quite accepting flashes after extensive testing for alternative fuel mapping.
Harrison-As far as ease of use, well, it's not really that bad, actually after you have a definition, it's quite easy. ie. make your map change, save it, flash it. Is the AP any easier than that? I thought you had to map at a pc, and send it to your AP, than upload to your car... actually in that respect, it's an additional step with the AP and that's only if you have the software to tune. Are all AP owners allowed to make their own custom tunes for free?
Anyway, at this point, I am pretty sure the AP can tune more things than what I've managed to obtain. But for half the price, and personal customizations, as well as the eventual open sourcing of information regarding tuning and rom definitions, I am quite pleased that I didn't choose the AP, even though that little gadget looks pretty cool, and soft map changes on the fly would be nice, but oh well.
Sorry it's so winded... Just some of my thoughts and opinions.
#366
Just my forth penath's
Hi by the way, i help out on the openecu stuff and also reversed engineer'd the early evo ecu to make it mappable, now i own a Rex ive started to look at the ecu options for it, with the early evo i used a program called Tunerpro, guy called Mark first wrote it and it works a treat leaving you only to have to write a definition file for the software to arrange the downloaded .bin file out.
http://www.tunerpro.net/
I haven't read all pages on here but has anyone managed as yet to download the whole rom file from the ecu?
Hi by the way, i help out on the openecu stuff and also reversed engineer'd the early evo ecu to make it mappable, now i own a Rex ive started to look at the ecu options for it, with the early evo i used a program called Tunerpro, guy called Mark first wrote it and it works a treat leaving you only to have to write a definition file for the software to arrange the downloaded .bin file out.
http://www.tunerpro.net/
I haven't read all pages on here but has anyone managed as yet to download the whole rom file from the ecu?
#370
Gold Wheels FTW
iTrader: (1)
I'm pretty interested in helping too. I have several tools that can push the ASM to a simulated C code for readability.
I've also emailed www.tactrix.com about helping to create a linux / mobile compatible version for the openPort driver.
I've also emailed www.tactrix.com about helping to create a linux / mobile compatible version for the openPort driver.
#375
Maybe AccessTuner can do that. Or mazdaEdit. But they are pretty expensive software.
Has anyone tested it?