cracking the ecu....
but a J2534 such as this is only part of the issue? you still need software to read/download a flash - edit it then -flash.
what about winols? I have been told it can be utilized but isn't a solution by itself?
what about winols? I have been told it can be utilized but isn't a solution by itself?
You can use WinOLS or FlashEdit or any other binary editor out there to edit the binary. You will then need a file format convertor. Then you use Mazda/Ford programmer software to do the flash. If WinOLS support plugin you can write your own plugin to support the WDS compatible file format. But if you are a vendor or someone want to go this route, I'm sure you want to create your own software and interface with J2534 directly without the hazzle of running multiple application and majority of the profit come bundle in hardware price and not the software itself. And in order to hide features and secret such as auto-tunning or map switching, etc, a black box hardware married to the car is the only way.
I see this post has been dead for awhile... Has there been a tuning solution found? Or is the idea abandoned?
I have been rereading alot of what's been posted, and I was wondering if anyone has a list compiled for known map locations yet? Any help is appreciated, and all your work so far has been great. There are quite a few smart people in this forum with much knowledge and insight, you folks amaze me. Keep up the good work.
I have been rereading alot of what's been posted, and I was wondering if anyone has a list compiled for known map locations yet? Any help is appreciated, and all your work so far has been great. There are quite a few smart people in this forum with much knowledge and insight, you folks amaze me. Keep up the good work.
Registered
iTrader: (4)
Joined: Aug 2004
Posts: 12,255
Likes: 8
From: Buddhist Monastery, High Himalaya Mtns. of Tibet
The Cobb AccessPort is available. You will need to go to a pro tuner to have this customized for the car. An addition that will allow you to tune yourself has been promised.
RX8Club member "Hymee" is enhanceing (an inside joke and a pun all in one) his Scanalyzer to be able to tune the car also.
These are all done through the ODBII port found under the steering column.
RX8Club member "Hymee" is enhanceing (an inside joke and a pun all in one) his Scanalyzer to be able to tune the car also.
These are all done through the ODBII port found under the steering column.
I was looking for the scanylizer but it's not available yet...? is it? And I was seriously considering the AP, but the lack of USER tuning has made me look for another solution, which made me consider the E_management setup, but I would rather stay away from a piggy-back if I can. If I do gothe AP route, I will definately go with MM for his tuning services though.
Registered
iTrader: (4)
Joined: Aug 2004
Posts: 12,255
Likes: 8
From: Buddhist Monastery, High Himalaya Mtns. of Tibet
The tuning version of the Scanalyzer isn't available yet. It is being beta tested, however, by a group of people on here. There haven't been any word about it from other than Hymee, so I think they aren't allowed to talk about it. For an ETA on a release date, PM him.
Eventually, either Hymee or Cobb will offer a personal tunning solution. Most likely before the end of the year. But, that would just be a guess.
Eventually, either Hymee or Cobb will offer a personal tunning solution. Most likely before the end of the year. But, that would just be a guess.
Registered
iTrader: (4)
Joined: Aug 2004
Posts: 12,255
Likes: 8
From: Buddhist Monastery, High Himalaya Mtns. of Tibet
There wasn't enough people with the ability or desire to come up with an Open Source way to flash our PCM. That plus the availability of the Cobb, Hymee & Harrison units basically ended any progress.
ya, I got to hesitant about the exact flash protocol and didn't have the time to invest in that portion so I've just worked on the ROM's and identifying as many maps as I can and am using the Harrison unit to do the flashing.
same here, found a few utilities that can help you make an XML then I got a disassembler and sat down with a friend of mine who is good in ASM programming and we started to poor over the over 300k lines of code that make up the car so we could start to figure out the MAPs that aren't as easily identified. I personally want to tune the electronic power steering map.
I had no idea it was that far developed, but after my experience with the earlier Harrison CanScan, which still to this day is the most buggy, unreliable scan tool ever, I'd be reluctant to place my faith in him again, plus there's no credit for that previous version after all the headaches it caused
Glad to here you've made some progress. I haven't done much of anything in the way of mapping since last spring, and that was adding the DTC's. Are more people getting involved or has it stagnated completely? I haven't been searching the web or club for awhile to know if there has been progress/products out there.
Tuning the Power steering... that could be interesting. More power to you, the more we all learn the better. Can I be dumb and ask why the power steering though? Perhaps you've figured everything else out?
Any chance you've found anything on the DSC? From a performance perspective I thought it may have some merit. I know it's a seperate controller, but at the very least it DOES send a torque down/up request via CAN to the PCM. I think a performance adjustable DSC could work well. The stock setup cuts much power and uses much brake, if we could alter those amounts from the torque down request, this could increase the cars performance in certain conditions. Any thoughts?
Tuning the Power steering... that could be interesting. More power to you, the more we all learn the better. Can I be dumb and ask why the power steering though? Perhaps you've figured everything else out?
Any chance you've found anything on the DSC? From a performance perspective I thought it may have some merit. I know it's a seperate controller, but at the very least it DOES send a torque down/up request via CAN to the PCM. I think a performance adjustable DSC could work well. The stock setup cuts much power and uses much brake, if we could alter those amounts from the torque down request, this could increase the cars performance in certain conditions. Any thoughts?
Well as far as the powersteering is concerned, I drove around for about a month with it disabled and loved the feel and feedback so I was hoping to knock it down a few notches instead of having to pull the fuse and get the feel like my 7 has. As for the DSC, I'm still working on locating those controls, I have the ROM disassembled and am just working through all the assembly code (about 300k lines of it) to figure out what does what. And yes this includes having to learn all the sensor connections and so on so as I go deeper it's taking longer but I'm hoping to have the whole thing documented and available and since many parts are universal between ROM's (it is just the Hitachi OS) it shouldn't be hard to take any version and break it down.
I also have put on priority to find the fuel handling aspect of the ROM, since I know everyone says that's the week point of the stock ECU, perhaps the code around that could be changed. But that is off in the future, since I would need to setup all the Renesas 705x compilers and simulators to make sure that any modification to the code will not brick the PCM.
As for the Harrison unit, I've only just started really playing with it and to me it comes across as a much more technically advanced unit since you have to follow specific steps and have to do manual checks and balances as you go through the reading and flashing processes. So to that end the AP could be a better choice for novices and the such but I like the freedom that the Harrison system has, esp since I do enjoy reverse-engineering.
I also have put on priority to find the fuel handling aspect of the ROM, since I know everyone says that's the week point of the stock ECU, perhaps the code around that could be changed. But that is off in the future, since I would need to setup all the Renesas 705x compilers and simulators to make sure that any modification to the code will not brick the PCM.
As for the Harrison unit, I've only just started really playing with it and to me it comes across as a much more technically advanced unit since you have to follow specific steps and have to do manual checks and balances as you go through the reading and flashing processes. So to that end the AP could be a better choice for novices and the such but I like the freedom that the Harrison system has, esp since I do enjoy reverse-engineering.
That would be great if you figure it out! Especially if you share it.
The pcm is closely related to the one subaru uses and they can control everything and still make 500hp on a stock pcm controling 4 plug timing, dual or quad cam timing, 4 injectors, turbo and more. We got 200 hp 6 fuel inj, 4 plug timing and a series of switches for the sdais and more, I would hope it can handle it. I almost forgot, 4 oil inj, maybe that puts it over the top... I guess that also implies the code is efficient, and maybe that's where the issue is, or did I misunderstand? Side note: I did look back through some old subaru roms to find similarities and equations when making my definition.
My only fueling gripe is the lean spike at the sdais activations, which you can do a little compensation for with tuning but I wouldn't classify that as pcm shortfall, I think it's just inherent to the operation of the valves. Maybe some users of aftermarket pcms could confirm of deny that... I haven't been using a dyno, but I have been able to control fuel to my liking with logs and a wideband. It seems to respond accordingly to changes in the maps like other cars do.
Bricking a pcm... well it's possible. I had one scrapped, turns out it's an emmisions device which can be replaced as warranty. I've also used one that eventually quite accepting flashes after extensive testing for alternative fuel mapping.
Harrison-As far as ease of use, well, it's not really that bad, actually after you have a definition, it's quite easy. ie. make your map change, save it, flash it. Is the AP any easier than that? I thought you had to map at a pc, and send it to your AP, than upload to your car... actually in that respect, it's an additional step with the AP and that's only if you have the software to tune. Are all AP owners allowed to make their own custom tunes for free?
Anyway, at this point, I am pretty sure the AP can tune more things than what I've managed to obtain. But for half the price, and personal customizations, as well as the eventual open sourcing of information regarding tuning and rom definitions, I am quite pleased that I didn't choose the AP, even though that little gadget looks pretty cool, and soft map changes on the fly would be nice, but oh well.
Sorry it's so winded... Just some of my thoughts and opinions.
The pcm is closely related to the one subaru uses and they can control everything and still make 500hp on a stock pcm controling 4 plug timing, dual or quad cam timing, 4 injectors, turbo and more. We got 200 hp 6 fuel inj, 4 plug timing and a series of switches for the sdais and more, I would hope it can handle it. I almost forgot, 4 oil inj, maybe that puts it over the top... I guess that also implies the code is efficient, and maybe that's where the issue is, or did I misunderstand? Side note: I did look back through some old subaru roms to find similarities and equations when making my definition.
My only fueling gripe is the lean spike at the sdais activations, which you can do a little compensation for with tuning but I wouldn't classify that as pcm shortfall, I think it's just inherent to the operation of the valves. Maybe some users of aftermarket pcms could confirm of deny that... I haven't been using a dyno, but I have been able to control fuel to my liking with logs and a wideband. It seems to respond accordingly to changes in the maps like other cars do.
Bricking a pcm... well it's possible. I had one scrapped, turns out it's an emmisions device which can be replaced as warranty. I've also used one that eventually quite accepting flashes after extensive testing for alternative fuel mapping.
Harrison-As far as ease of use, well, it's not really that bad, actually after you have a definition, it's quite easy. ie. make your map change, save it, flash it. Is the AP any easier than that? I thought you had to map at a pc, and send it to your AP, than upload to your car... actually in that respect, it's an additional step with the AP and that's only if you have the software to tune. Are all AP owners allowed to make their own custom tunes for free?
Anyway, at this point, I am pretty sure the AP can tune more things than what I've managed to obtain. But for half the price, and personal customizations, as well as the eventual open sourcing of information regarding tuning and rom definitions, I am quite pleased that I didn't choose the AP, even though that little gadget looks pretty cool, and soft map changes on the fly would be nice, but oh well.
Sorry it's so winded... Just some of my thoughts and opinions.
Just my forth penath's
Hi by the way, i help out on the openecu stuff and also reversed engineer'd the early evo ecu to make it mappable, now i own a Rex ive started to look at the ecu options for it, with the early evo i used a program called Tunerpro, guy called Mark first wrote it and it works a treat leaving you only to have to write a definition file for the software to arrange the downloaded .bin file out.
http://www.tunerpro.net/
I haven't read all pages on here but has anyone managed as yet to download the whole rom file from the ecu?
Hi by the way, i help out on the openecu stuff and also reversed engineer'd the early evo ecu to make it mappable, now i own a Rex ive started to look at the ecu options for it, with the early evo i used a program called Tunerpro, guy called Mark first wrote it and it works a treat leaving you only to have to write a definition file for the software to arrange the downloaded .bin file out.
http://www.tunerpro.net/
I haven't read all pages on here but has anyone managed as yet to download the whole rom file from the ecu?
I'm pretty interested in helping too. I have several tools that can push the ASM to a simulated C code for readability.
I've also emailed www.tactrix.com about helping to create a linux / mobile compatible version for the openPort driver.
I've also emailed www.tactrix.com about helping to create a linux / mobile compatible version for the openPort driver.
if it was the original factory flash rom (I didn't open it) you can't even read it with the AP. You can pretty much download any flash with the Harrison tool. Reading (and modifyng) them is the general issue being discussed here.
so is there an easy way to read or interpret the accessport.rom file?
I'm after the injector latency table from the auto. it's easy enough to spot them if I could get the tables.
ecuedit may be an option soon.
I'm after the injector latency table from the auto. it's easy enough to spot them if I could get the tables.
ecuedit may be an option soon.
Last edited by rotarenvy; Mar 5, 2011 at 10:07 PM. Reason: corrected link
Maybe AccessTuner can do that. Or mazdaEdit. But they are pretty expensive software.
Has anyone tested it?


