Howdy!

Now that I have the redneck out of me, I was wondering if anyone knows much about the chips that you buy. You know the remapped fuel/ignition ones. What i'm wondering is, does anyone know the chip specifics? 5v? How many pins are on the EPROM? How is the ECU encrypted? Has anyone modified it themselves?

 

It's a Hitachi brand EEPROM that's a variant on the Motorola 8bit microprocessors (6811 family).

I don't know of anyone that has been able to crack it yet.&nbsp I tried a few years ago, but I couldn't get the code to disassemble nicely.&nbsp I still got the code dumps sitting somewhere.



-Ted

 

Can the chips data be copied from chip to chip? Say you rip everything from one EEPROM, copy to another, it'd work right? Any clues onto what they used to write it/crypt it?

EDIT: Well, since you got the dumps, I think your answered the question already...any hints on q#2?

 

I did find this lil neato info on the 6811

http://handyboard.com/techdocs/6811intr.pdf

 

Oh yeah, they can easily be "ripped."&nbsp You just needs something that can read and burn Motorola 6811 stuff.&nbsp It's been done already.



-Ted

 

I have a EEPORM reader/burner and my system runs (dual boot) win2000pro and OpenBSD (one of the most powerful free unix's). I wonder if I would have a chance at cracking it.? The GNU (www.gnu.org) programming tools are VERY powerful. I would prob have to break it down to assembly or hex but might be able to. All the information avalible would help greatly. I have a n/a but i'm sure the turbo has a similar code just differant codes. One other thing that may help is the size of the roms (I can only do up to a 8Mb, but i'm sure it's under that.) I'm thinking a 512K, or somewhere around there. I may ask some dumb questions here about rotaries (something I'm pretty new at), but when it comes to cracking software thats my specialty. I'v been rewriting .exe's for games for years (taking copy protection off. Just bacially redirecting the peace of code that asks for a security key to read it from c:\ insted)

 

Please try, if you want, i'll even goto a junkyard and rip you a whole ECU out of a FC and send it to ya. The big problem is going to be dissasembling I guess. You do realize that if you figured out how to crack the EEPROM, you could make some decent money by adjusting some numbers and selling maps off to people .

 

so what is the difference between what you guys are doing and buying a modified ecu from a place like md racing? because those have modified fuel maps and ignition timing right?

I don't know much about this subject, so if you guys could explain it to me in very simple terms it would be great.

 

i was told u cant get a singe chip but u have to get it sent in and installed like that

 

Heh. Ya have to get it installed?? hmmmm they must be glueing them in then. It's just a chip on a socket not even soldered. I can rip the chip from mine witch is a nonturbo if someone that had a reader and a turbo could rip a turbo map that would make it easier. I'm expecting it to look something like:

001:9E7A4
002:7BC91
003:7BC85
^^ ^^^
|.........+-> Value
|
+-> bit number (would need the definitions. examp. 001 = timing advance, 002 = a/f @ 500rpm 003 = a/f @ 1000, etc...)

Right now i have no roms so all of this may be wrong. It's all just a guess right now.

If i could get a turbo I would expect the same encription so then i could compair values, and also compair that the bit numbers were the same. That would prove that I used the correct method of decryption.

 

someone should give this thread a good rating. I would release the information to this forum if I get it. Also within a few days i will post my rom on this thread so others can give it a whack and compair data..

 

I just uploaded my copy of the N332 (1987 Turbo II ECU) at:
http://n-xsi.com/ECU/
filename = "n332.zip"
Maybe you guys can crack this thing.
Right-click save after going through the URL...


-Ted

 

If someone can get the actual program code from that .rom file, I can convert it to assembly and figure out what the code does. (binary is fine) I'm just about to wrap up my Microprocessors course (third year computer engineering), which is on the 6800.

That link Josphi posted is pretty complete. Here's the hex to assebly conversion.

Actually, when the summer starts I have to get a start on my 4th year project/thesis. I've been leaning towards doing something like a AFC or ECU.

Gold87na: What do you use your EPROM r/w for? (besides the obvious )

 

I have been into electronics/computers since i was 9 years old. I once needed it to get a very expencive peice of audio equipment working. It was a very nice DSP rackmount processer for over 200+ sterio effects for bands(or in my case, my audio system that i had in my minivan (i lost all pics over a winbloz crash )

 

If you find the right dissassembler, even I could translate it.
I couldn't find the right entry address or the correct disassembler that could decode all the hex all at one time.&nbsp That's why I gave up...

I was up to my 3rd year CompSci major and had a specific course on assembly and machine langauge.&nbsp I actually aced that course, cause it was pretty fun - I normally HATE programming (i.e. C++).


-Ted

 

Don't know if this will help your cracking case, but here is a very basic program, complier, linker, etc. for x86 DOS.

commands:
AVMAC68 PROG
!This creates .prn and .obj files

AVLINK PROG=PROG.OBJ OF=MOT -SYMBOLS
!Linker

AVLINK PROG=PROG.OBJ, PROG2.OBJ OF=MOT -SYMBOLS
!Linking for multiple files

Please let me know if you'd like anything else or want me to do anything.

 

More

 

third part

 

Ted: I know what you mean, I don't like programming normally, but assembly is much more interesting. I'm currently doing a course on SPARC as well. MC6800 is a bit more rudimentary. I can't say I'd like to program something really complicated with the MC6800, but I wouldn't mind too much in SPARC. Did you finish your degree? You a programmer now?

 

Since we're on the subject of ECUs I found this site the other day. www.mdrace.com I don't know if any have heard of this site but they reprogram the stock ECUs. I was considering have it done to mine. I was would just like to hear some feedback first and hear what you guys think. Take a look at the site if you haven't heard of it. Thanks

 

What all this machine and assembly language does is give you a good idea of what uP's do.&nbsp Although there isn't a HUGE demand for uP's tech people (maybe all internal?), I find tinkering with uP's a lot more satisfying - I guess maybe because you get to see what happened from start to finish or the fact that text computer "instructions" can be turned into a physical change on conditions (through solenoids and switches)...

Nope, I got kicked out after a while - classic burn-out. I'm looking forward to finishing up a BSEE degree that WILL have emphasis on circuit and circuit design through, hopefully starting next year!



-Ted

 

Yes, what we are talking about doing is decrypting and changing the stock ECU ourselves. Something short of what the guy on ebay is doing by buying one, copying it, and selling copies. What they are doing is basically the same thing. I seriously doubt they would tell you how to decrypt it, as that would create a competitor for them...

You know, if someone was terribly bored, they could create a package of an EEPROM flasher, basic software for editing roms, and cables into a product. Sell it to businesses. Hmmmm.

Ted, you got the classic burn-out thing working with you too eh?

 

Funny, we got concurrent threads in here and the fc3s_org list...
Some very useful information popped up in there...


<insert text>
To: fc3s_org@yahoogroups.com
From: "Gary Walker" <gwmaz@paradise.net.nz>
Subject: Re: [fc3s_org] Just a little info for a report.

The '86-88 ECUs used a Hitachi HD6303 processor (Motorola 6301 with a couple
of extra instructions). It's an 8-bit processor running at (I think) 2MHz.
2k RAM, 16k ROM, and support chips for timing and interfacing.
I haven't had a later one to pull apart

Gary
<end of insert>

<insert text>
To: fc3s_org@yahoogroups.com
From: "Andrew R. Ghali" <andrewg@16paws.com>
Subject: Re: [fc3s_org] Just a little info for a report.

The processor is a HD6303 which is a clone of the Motorola 6803 with
a pair of extra instructions. It runs from a 4MHz crystal which is
internally divided by 4 to yield a 1 MHz instruction rate. More
tedious details at http://www.16paws.com/ECU/

I believe that a series 5 uses the same processor. The series 6 has
a 16 bit processor; post '95, I believe Mazda moved to a 32 bit CPU
(which we never saw in North America) for the series 7.

I hope this helps.

Andrew
<end of insert>


-Ted

 

When I had MD upgrade my ECU, I spent the day there also having the car tuned.

When I spoke with Mario about the development of the chip, he said that interpretting the data on the ROM was by far the most diffacult part of the entire process. Mario had a degree in computer science as well as course work in engineering.

 

Don't think they'd care to share do ya?