ECU question =)
#1
Despise Enmity
Thread Starter
Join Date: May 2001
Location: Richmond, VA
Posts: 2,420
Likes: 0
Received 0 Likes
on
0 Posts
ECU question =)
Howdy!
Now that I have the redneck out of me, I was wondering if anyone knows much about the chips that you buy. You know the remapped fuel/ignition ones. What i'm wondering is, does anyone know the chip specifics? 5v? How many pins are on the EPROM? How is the ECU encrypted? Has anyone modified it themselves?
Now that I have the redneck out of me, I was wondering if anyone knows much about the chips that you buy. You know the remapped fuel/ignition ones. What i'm wondering is, does anyone know the chip specifics? 5v? How many pins are on the EPROM? How is the ECU encrypted? Has anyone modified it themselves?
#2
Lives on the Forum
It's a Hitachi brand EEPROM that's a variant on the Motorola 8bit microprocessors (6811 family).
I don't know of anyone that has been able to crack it yet.  I tried a few years ago, but I couldn't get the code to disassemble nicely.  I still got the code dumps sitting somewhere.
-Ted
I don't know of anyone that has been able to crack it yet.  I tried a few years ago, but I couldn't get the code to disassemble nicely.  I still got the code dumps sitting somewhere.
-Ted
#3
Despise Enmity
Thread Starter
Join Date: May 2001
Location: Richmond, VA
Posts: 2,420
Likes: 0
Received 0 Likes
on
0 Posts
Can the chips data be copied from chip to chip? Say you rip everything from one EEPROM, copy to another, it'd work right? Any clues onto what they used to write it/crypt it?
EDIT: Well, since you got the dumps, I think your answered the question already...any hints on q#2?
EDIT: Well, since you got the dumps, I think your answered the question already...any hints on q#2?
#4
Despise Enmity
Thread Starter
Join Date: May 2001
Location: Richmond, VA
Posts: 2,420
Likes: 0
Received 0 Likes
on
0 Posts
#6
SRT-4 User
Join Date: Mar 2002
Location: Rhode Island
Posts: 170
Likes: 0
Received 0 Likes
on
0 Posts
I have a EEPORM reader/burner and my system runs (dual boot) win2000pro and OpenBSD (one of the most powerful free unix's). I wonder if I would have a chance at cracking it.? The GNU (www.gnu.org) programming tools are VERY powerful. I would prob have to break it down to assembly or hex but might be able to. All the information avalible would help greatly. I have a n/a but i'm sure the turbo has a similar code just differant codes. One other thing that may help is the size of the roms (I can only do up to a 8Mb, but i'm sure it's under that.) I'm thinking a 512K, or somewhere around there. I may ask some dumb questions here about rotaries (something I'm pretty new at), but when it comes to cracking software thats my specialty. I'v been rewriting .exe's for games for years (taking copy protection off. Just bacially redirecting the peace of code that asks for a security key to read it from c:\ insted)
#7
Despise Enmity
Thread Starter
Join Date: May 2001
Location: Richmond, VA
Posts: 2,420
Likes: 0
Received 0 Likes
on
0 Posts
Originally posted by gold87na
I have a EEPORM reader/burner and my system runs (dual boot) win2000pro and OpenBSD (one of the most powerful free unix's). I wonder if I would have a chance at cracking it.? The GNU (www.gnu.org) programming tools are VERY powerful. I would prob have to break it down to assembly or hex but might be able to. All the information avalible would help greatly. I have a n/a but i'm sure the turbo has a similar code just differant codes. One other thing that may help is the size of the roms (I can only do up to a 8Mb, but i'm sure it's under that.) I'm thinking a 512K, or somewhere around there. I may ask some dumb questions here about rotaries (something I'm pretty new at), but when it comes to cracking software thats my specialty. I'v been rewriting .exe's for games for years (taking copy protection off. Just bacially redirecting the peace of code that asks for a security key to read it from c:\ insted)
I have a EEPORM reader/burner and my system runs (dual boot) win2000pro and OpenBSD (one of the most powerful free unix's). I wonder if I would have a chance at cracking it.? The GNU (www.gnu.org) programming tools are VERY powerful. I would prob have to break it down to assembly or hex but might be able to. All the information avalible would help greatly. I have a n/a but i'm sure the turbo has a similar code just differant codes. One other thing that may help is the size of the roms (I can only do up to a 8Mb, but i'm sure it's under that.) I'm thinking a 512K, or somewhere around there. I may ask some dumb questions here about rotaries (something I'm pretty new at), but when it comes to cracking software thats my specialty. I'v been rewriting .exe's for games for years (taking copy protection off. Just bacially redirecting the peace of code that asks for a security key to read it from c:\ insted)
Trending Topics
#8
Full Member
Join Date: Mar 2002
Location: kittery, maine
Posts: 159
Likes: 0
Received 0 Likes
on
0 Posts
so what is the difference between what you guys are doing and buying a modified ecu from a place like md racing? because those have modified fuel maps and ignition timing right?
I don't know much about this subject, so if you guys could explain it to me in very simple terms it would be great.
I don't know much about this subject, so if you guys could explain it to me in very simple terms it would be great.
#10
SRT-4 User
Join Date: Mar 2002
Location: Rhode Island
Posts: 170
Likes: 0
Received 0 Likes
on
0 Posts
Heh. Ya have to get it installed?? hmmmm they must be glueing them in then. It's just a chip on a socket not even soldered. I can rip the chip from mine witch is a nonturbo if someone that had a reader and a turbo could rip a turbo map that would make it easier. I'm expecting it to look something like:
001:9E7A4
002:7BC91
003:7BC85
^^ ^^^
|.........+-> Value
|
+-> bit number (would need the definitions. examp. 001 = timing advance, 002 = a/f @ 500rpm 003 = a/f @ 1000, etc...)
Right now i have no roms so all of this may be wrong. It's all just a guess right now.
If i could get a turbo I would expect the same encription so then i could compair values, and also compair that the bit numbers were the same. That would prove that I used the correct method of decryption.
001:9E7A4
002:7BC91
003:7BC85
^^ ^^^
|.........+-> Value
|
+-> bit number (would need the definitions. examp. 001 = timing advance, 002 = a/f @ 500rpm 003 = a/f @ 1000, etc...)
Right now i have no roms so all of this may be wrong. It's all just a guess right now.
If i could get a turbo I would expect the same encription so then i could compair values, and also compair that the bit numbers were the same. That would prove that I used the correct method of decryption.
Last edited by gold87na; 04-10-02 at 01:44 PM.
#11
SRT-4 User
Join Date: Mar 2002
Location: Rhode Island
Posts: 170
Likes: 0
Received 0 Likes
on
0 Posts
someone should give this thread a good rating. I would release the information to this forum if I get it. Also within a few days i will post my rom on this thread so others can give it a whack and compair data..
#12
Lives on the Forum
I just uploaded my copy of the N332 (1987 Turbo II ECU) at:
http://n-xsi.com/ECU/
filename = "n332.zip"
Maybe you guys can crack this thing.
Right-click save after going through the URL...
-Ted
http://n-xsi.com/ECU/
filename = "n332.zip"
Maybe you guys can crack this thing.
Right-click save after going through the URL...
-Ted
#13
Eats, Sleeps, Dreams Rotary
iTrader: (1)
Join Date: Jun 2001
Location: London, Ontario, Canada
Posts: 3,106
Likes: 0
Received 0 Likes
on
0 Posts
If someone can get the actual program code from that .rom file, I can convert it to assembly and figure out what the code does. (binary is fine) I'm just about to wrap up my Microprocessors course (third year computer engineering), which is on the 6800.
That link Josphi posted is pretty complete. Here's the hex to assebly conversion.
Actually, when the summer starts I have to get a start on my 4th year project/thesis. I've been leaning towards doing something like a AFC or ECU.
Gold87na: What do you use your EPROM r/w for? (besides the obvious )
That link Josphi posted is pretty complete. Here's the hex to assebly conversion.
Actually, when the summer starts I have to get a start on my 4th year project/thesis. I've been leaning towards doing something like a AFC or ECU.
Gold87na: What do you use your EPROM r/w for? (besides the obvious )
#14
SRT-4 User
Join Date: Mar 2002
Location: Rhode Island
Posts: 170
Likes: 0
Received 0 Likes
on
0 Posts
I have been into electronics/computers since i was 9 years old. I once needed it to get a very expencive peice of audio equipment working. It was a very nice DSP rackmount processer for over 200+ sterio effects for bands(or in my case, my audio system that i had in my minivan (i lost all pics over a winbloz crash )
#15
Lives on the Forum
If you find the right dissassembler, even I could translate it.
I couldn't find the right entry address or the correct disassembler that could decode all the hex all at one time.  That's why I gave up...
I was up to my 3rd year CompSci major and had a specific course on assembly and machine langauge.  I actually aced that course, cause it was pretty fun - I normally HATE programming (i.e. C++).
-Ted
I couldn't find the right entry address or the correct disassembler that could decode all the hex all at one time.  That's why I gave up...
I was up to my 3rd year CompSci major and had a specific course on assembly and machine langauge.  I actually aced that course, cause it was pretty fun - I normally HATE programming (i.e. C++).
-Ted
#16
Eats, Sleeps, Dreams Rotary
iTrader: (1)
Join Date: Jun 2001
Location: London, Ontario, Canada
Posts: 3,106
Likes: 0
Received 0 Likes
on
0 Posts
Don't know if this will help your cracking case, but here is a very basic program, complier, linker, etc. for x86 DOS.
commands:
AVMAC68 PROG
!This creates .prn and .obj files
AVLINK PROG=PROG.OBJ OF=MOT -SYMBOLS
!Linker
AVLINK PROG=PROG.OBJ, PROG2.OBJ OF=MOT -SYMBOLS
!Linking for multiple files
Please let me know if you'd like anything else or want me to do anything.
commands:
AVMAC68 PROG
!This creates .prn and .obj files
AVLINK PROG=PROG.OBJ OF=MOT -SYMBOLS
!Linker
AVLINK PROG=PROG.OBJ, PROG2.OBJ OF=MOT -SYMBOLS
!Linking for multiple files
Please let me know if you'd like anything else or want me to do anything.
Last edited by Snrub; 04-10-02 at 08:20 PM.
#19
Eats, Sleeps, Dreams Rotary
iTrader: (1)
Join Date: Jun 2001
Location: London, Ontario, Canada
Posts: 3,106
Likes: 0
Received 0 Likes
on
0 Posts
Ted: I know what you mean, I don't like programming normally, but assembly is much more interesting. I'm currently doing a course on SPARC as well. MC6800 is a bit more rudimentary. I can't say I'd like to program something really complicated with the MC6800, but I wouldn't mind too much in SPARC. Did you finish your degree? You a programmer now?
#20
Since we're on the subject of ECUs I found this site the other day. www.mdrace.com I don't know if any have heard of this site but they reprogram the stock ECUs. I was considering have it done to mine. I was would just like to hear some feedback first and hear what you guys think. Take a look at the site if you haven't heard of it. Thanks
#21
Lives on the Forum
Originally posted by Snrub
MC6800 is a bit more rudimentary. I can't say I'd like to program something really complicated with the MC6800, but I wouldn't mind too much in SPARC. Did you finish your degree? You a programmer now?
MC6800 is a bit more rudimentary. I can't say I'd like to program something really complicated with the MC6800, but I wouldn't mind too much in SPARC. Did you finish your degree? You a programmer now?
Nope, I got kicked out after a while - classic burn-out. I'm looking forward to finishing up a BSEE degree that WILL have emphasis on circuit and circuit design through, hopefully starting next year!
-Ted
#22
Despise Enmity
Thread Starter
Join Date: May 2001
Location: Richmond, VA
Posts: 2,420
Likes: 0
Received 0 Likes
on
0 Posts
Originally posted by Streetracr68
Since we're on the subject of ECUs I found this site the other day. www.mdrace.com I don't know if any have heard of this site but they reprogram the stock ECUs. I was considering have it done to mine. I was would just like to hear some feedback first and hear what you guys think. Take a look at the site if you haven't heard of it. Thanks
Since we're on the subject of ECUs I found this site the other day. www.mdrace.com I don't know if any have heard of this site but they reprogram the stock ECUs. I was considering have it done to mine. I was would just like to hear some feedback first and hear what you guys think. Take a look at the site if you haven't heard of it. Thanks
You know, if someone was terribly bored, they could create a package of an EEPROM flasher, basic software for editing roms, and cables into a product. Sell it to businesses. Hmmmm.
Ted, you got the classic burn-out thing working with you too eh?
#23
Lives on the Forum
Funny, we got concurrent threads in here and the fc3s_org list...
Some very useful information popped up in there...
<insert text>
To: fc3s_org@yahoogroups.com
From: "Gary Walker" <gwmaz@paradise.net.nz>
Subject: Re: [fc3s_org] Just a little info for a report.
The '86-88 ECUs used a Hitachi HD6303 processor (Motorola 6301 with a couple
of extra instructions). It's an 8-bit processor running at (I think) 2MHz.
2k RAM, 16k ROM, and support chips for timing and interfacing.
I haven't had a later one to pull apart
Gary
<end of insert>
<insert text>
To: fc3s_org@yahoogroups.com
From: "Andrew R. Ghali" <andrewg@16paws.com>
Subject: Re: [fc3s_org] Just a little info for a report.
The processor is a HD6303 which is a clone of the Motorola 6803 with
a pair of extra instructions. It runs from a 4MHz crystal which is
internally divided by 4 to yield a 1 MHz instruction rate. More
tedious details at http://www.16paws.com/ECU/
I believe that a series 5 uses the same processor. The series 6 has
a 16 bit processor; post '95, I believe Mazda moved to a 32 bit CPU
(which we never saw in North America) for the series 7.
I hope this helps.
Andrew
<end of insert>
-Ted
Some very useful information popped up in there...
<insert text>
To: fc3s_org@yahoogroups.com
From: "Gary Walker" <gwmaz@paradise.net.nz>
Subject: Re: [fc3s_org] Just a little info for a report.
The '86-88 ECUs used a Hitachi HD6303 processor (Motorola 6301 with a couple
of extra instructions). It's an 8-bit processor running at (I think) 2MHz.
2k RAM, 16k ROM, and support chips for timing and interfacing.
I haven't had a later one to pull apart
Gary
<end of insert>
<insert text>
To: fc3s_org@yahoogroups.com
From: "Andrew R. Ghali" <andrewg@16paws.com>
Subject: Re: [fc3s_org] Just a little info for a report.
The processor is a HD6303 which is a clone of the Motorola 6803 with
a pair of extra instructions. It runs from a 4MHz crystal which is
internally divided by 4 to yield a 1 MHz instruction rate. More
tedious details at http://www.16paws.com/ECU/
I believe that a series 5 uses the same processor. The series 6 has
a 16 bit processor; post '95, I believe Mazda moved to a 32 bit CPU
(which we never saw in North America) for the series 7.
I hope this helps.
Andrew
<end of insert>
-Ted
#24
Senior Member
Join Date: Feb 2001
Location: Tallahassee, FL
Posts: 421
Likes: 0
Received 0 Likes
on
0 Posts
When I had MD upgrade my ECU, I spent the day there also having the car tuned.
When I spoke with Mario about the development of the chip, he said that interpretting the data on the ROM was by far the most diffacult part of the entire process. Mario had a degree in computer science as well as course work in engineering.
When I spoke with Mario about the development of the chip, he said that interpretting the data on the ROM was by far the most diffacult part of the entire process. Mario had a degree in computer science as well as course work in engineering.
#25
Despise Enmity
Thread Starter
Join Date: May 2001
Location: Richmond, VA
Posts: 2,420
Likes: 0
Received 0 Likes
on
0 Posts
Originally posted by go_speed_go
When I had MD upgrade my ECU, I spent the day there also having the car tuned.
When I spoke with Mario about the development of the chip, he said that interpretting the data on the ROM was by far the most diffacult part of the entire process. Mario had a degree in computer science as well as course work in engineering.
When I had MD upgrade my ECU, I spent the day there also having the car tuned.
When I spoke with Mario about the development of the chip, he said that interpretting the data on the ROM was by far the most diffacult part of the entire process. Mario had a degree in computer science as well as course work in engineering.