Open ECU?

[S1000rr]

Not doubting Visconti or EcuTek product... but the arguments that people hacked EcuTek to get their product out is stupid. Didn't EcuTek hack the ECU to get their product out? Didn't Microsoft steal Apple's OS?

The case where other companies copy a design or reverse engineer something has happened for decades. And if it didn't happen, then we would have no competitors out there or new innovations. Is something worth the extra dime for original design? Sure, no doubt. But the argument is stale already....

The convo is about OpenEcu/Open Source, not about how EcuTek was hacked or reverse engineered, because orignally EcuTek reverse engineers everything they do.

The OpenECU community puts pressure on EcuTek and these other flash companies, to make their products stand out and not gouge us, the consumer....

[Sportsguy83]

EDIT: Oh! Nevermind, thread has been cleaned


I see everyone here claim "I want open source I want open source I want open source, and I know the open source community works for free", and in the same sentence say "I want to throw my money at them".... Is it free or will you be throwing money at them???


Also, to the people that keep saying John is discouraging people... Honestly... haven't you read his posts???? He is saying he is ALL UP FOR IT, and is pointing you guys in the RIGHT direction. He is just stating facts....


For real... read the thread!

[Visconti]

Originally Posted by Sportsguy83

EDIT: Oh! Nevermind, thread has been cleaned


I see everyone here claim "I want open source I want open source I want open source, and I know the open source community works for free", and in the same sentence say "I want to throw my money at them".... Is it free or will you be throwing money at them???


Also, to the people that keep saying John is discouraging people... Honestly... haven't you read his posts???? He is saying he is ALL UP FOR IT, and is pointing you guys in the RIGHT direction. He is just stating facts....


For real... read the thread!

+100000000

You sir are the only person reading everything... I thought I was speaking a other language for a second !

[SkullWorks]

Originally Posted by Visconti

+100000000

You sir are the only person reading everything... I thought I was speaking a other language for a second !

you were speaking another language, as he pointed out the thread has now been cleaned, you look better now

[Sportsguy83]

Originally Posted by SkullWorks

you were speaking another language, as he pointed out the thread has now been cleaned, you look better now

My reply was typed before thread cleaning. The cleaning was done on all posts including the people that kept posting the same "stuff" and Visconti replying the same thing over and over and people not reading/understanding his posts. It doesn't change a thing, what i say still stands.

[SkullWorks]

My bad i assumed you could were keeping up with the thread...not defending a buddy

Originally Posted by Sportsguy83

My reply was typed before the cleaning.
The cleaning was done on the people that kept posting the same song and Visconti replying the same thing. It doesn't change a thing, what i say still stands.

you have missed quite a bit apparently, because that doesn't even resemble what john was communicating, typing maybe, but not what was coming across however you want to cut it.


and I do not believe the cleaning up was to let john speak in free air. His failure to answer questions doesn't invalidate those questions,

[Visconti]

Originally Posted by SkullWorks

you have missed quite a bit apparently, because that doesn't even resemble what john was communicating, typing maybe, but not what was coming across however you want to cut it.


and I do not believe the cleaning up was to let john speak in free air. His failure to answer questions doesn't invalidate those questions,

You are wrong , and ill continue to communicate that..

The end result might make nothing come of this thread but it will be your fault not mine.

[buditjoenawan]

Who stole from whom? Dooooo tell.

- budi

[Dimman]

@Silverpike Where would you recommend for a starting point for people that want to start learning more about this stuff?

I saw a quick reference somewhere to something called IDA. A disassembler (???).

[fuddbutter]

How good is arguing!

[Sportsguy83]

Originally Posted by SkullWorks

My bad i assumed you could were keeping up with the thread...not defending a buddy


you have missed quite a bit apparently, because that doesn't even resemble what john was communicating, typing maybe, but not what was coming across however you want to cut it.

and I do not believe the cleaning up was to let john speak in free air. His failure to answer questions doesn't invalidate those questions,

I have read the entire thread from day one. I read all the deleted responses, from all members including John.

I never said the clean up was made to let John speak in free air WTF does that even mean?

What I typed is what I understood reading the whole thread. Quite funny that was pretty much what he was trying to say.... People can understand things whatever way they want, they can be offended by his tone... ok I understand that.

But at the end of the day, what I wrote is basically a summary of what was going on before clean up... And FWIW, I have not flashed my car with ECUTek, so I am not biased to them at all. I'm just reading and calling it like I see it from the outside.

[fuddbutter]

Originally Posted by buditjoenawan

Who stole from whom? Dooooo tell.

- budi

I believe you stole the cookie from the cookie jar.

[Dimman]

3. You seem to keep questioning how to reverse engineer ECUs, so let me tell you how. I expect the you will be sharing what you have learned as well...

a) 2001-2005 WRX - 68HC916Y5 based
* get the chip docs!
* get a BDM from P&E Microsystems
* solder a BDM header the ECU using the handy solder pads Denso left for this purpose
* read out the rom (including the TPU area) with a couple clicks of the BDM software
* get IDA Pro
* write your own HC16 module for IDA Pro because you don't want to spend the money to buy IDA Pro advanced
* publish the source of your HC16 module for free for others to use
* start disassembling - find all the references to code that accesses the serial port
* notice that there is TPU code that uses the serial port ???
* figure out that the TPU area is a bootloader!
* learn what the bootloader wants, including checksums, etc.
* learn how the bootloader keeps the WDT happy
* get a HC16 assembler (COSMIC)
* write a simple kernel program to read out the CPU
* write a better kernel program to reflash the CPU
* discover that your 02 WRX works, but your 04 WRX won't enter the bootloader
* read out 04 WRX with BDM and go through the serial code
* find seed/key algorithm before jumping to bootloader!
* add see/key to PC reflash program

b) 2004+ Subaru DBW - SH7055 and SH7058 based
* get the chip docs!
* try using the same initialization sequence as the WRX
* it works!!!
* build SH cross-compiler
* start writing test kernels - some trial and error here
* the ECU is being reset by a watchdog!
* start tracing pins on the board with a scope - PB15 is twiddling!
* add WDT code to kernel - it works!
* write flashing code - test - test - test
* reprogram using boot mode (solder into ECU) when you screw up
* write another kernel for SH7058 that uses built in reflash functions

c) EVO 7/8 - SH7052 based
* get the chip docs!
* borrow a MUTIII - very handy
* snoop a TSB reflash using the MUTIII (only get one chance!)
* identify init sequence and kernel upload - no seed/key - this is easy!
* Mitsubishi uses boot mode for bootloader, which makes development and flash failures easily recoverable...
* write a simple kernel to dump all of ram so I can see what the Mitsubishi bootloader looks like
* buy IDA Pro Advanced - don't want to write any more modules!
* disassemble bootloader completely to understand how it all works, including initialization codes
* modify Subaru SH7055 kernel to work with SH7052 - easy!
* done!

d) EVO 9 - SH7055 derivative
* get the chip docs!
* borrow a MUTIII
* snoop a reflash using the MUTIII
* same init sequence!
* try loading my SH7055 kernel, and the ECU takes it, but doesn't seem to run the code
* I am stuck in the bootloader for some reason!
* from the snooping, I can see how to read / erase / write with the bootloader, but I want to use my own kernel - but how - I need to be able to read out the bootloader to find out how to load a kernel...
* create a EVO 9 ROM with a trojan kernel in it.
* flash this into the ECU, but is doesn't respond
* start tracing board and discover that there is a WDT that needs to run off of PD8 - but only when not in the init mode
* add WDT code to trojan kernel
* flash it and it runs!
* read out EVO 9 bootloader still left in RAM
* see command to load a kernel!
* see that bootloader uses built in flashing function like SH7058
* make new SH7055 kernel to support new flashing method like SH7058
* it works!

From here: http://forums.nasioc.com/forums/show...5&postcount=73

From another post in the thread @Silverpike posted. Anyone have insight into what prerequisites are needed to understand this?

[Dimman]

Found a reference to source code for Ecuflash version 0.9 basically the first one ever, with something called an HC16?

Apparently command line, Subaru only.