follow ft86club on our blog, twitter or facebook.
FT86CLUB
Ft86Club
Delicious Tuning
Register Garage Members List Calendar Search Today's Posts Mark Forums Read

Go Back   Toyota GR86, 86, FR-S and Subaru BRZ Forum & Owners Community - FT86CLUB > Technical Topics > Software Tuning

Software Tuning Discuss all software tuning topics.


User Tag List

Reply
 
Thread Tools Search this Thread
Old 01-22-2013, 09:45 PM   #267
xwd
Senior Member
 
Join Date: Feb 2012
Drives: 2013 DGM Subaru BRZ (Subie #9)
Location: ATL, US
Posts: 2,667
Thanks: 123
Thanked 860 Times in 552 Posts
Mentioned: 32 Post(s)
Tagged: 0 Thread(s)
I know the guy who did most of the reverse engineering of the WRX ECU for Cobb and did the design for the original AccessPort. The methods used are not rocket science, some of the same hacks used to root other devices to load custom code are used with ECUs. There are plenty of smart guys who can do it given the time to do so. I do not think Ccolby stole code from anyone to get things figured out, but I do think he got help from those who had already done it....
xwd is offline   Reply With Quote
Old 01-22-2013, 09:49 PM   #268
xwd
Senior Member
 
Join Date: Feb 2012
Drives: 2013 DGM Subaru BRZ (Subie #9)
Location: ATL, US
Posts: 2,667
Thanks: 123
Thanked 860 Times in 552 Posts
Mentioned: 32 Post(s)
Tagged: 0 Thread(s)
Quote:
Originally Posted by Dimman View Post
Found a reference to source code for Ecuflash version 0.9 basically the first one ever, with something called an HC16?

Apparently command line, Subaru only.
HC16 refers to the Motorola 68HC16 micro controller which is the 16-bit CPU used in the old Subaru ECUs
xwd is offline   Reply With Quote
The Following User Says Thank You to xwd For This Useful Post:
Dimman (01-22-2013)
Old 01-22-2013, 10:19 PM   #269
Visconti
Banned
 
Join Date: Apr 2012
Drives: 05 STi
Location: Norwalk, CT
Posts: 2,843
Thanks: 196
Thanked 3,188 Times in 1,197 Posts
Mentioned: 375 Post(s)
Tagged: 2 Thread(s)
Send a message via AIM to Visconti
Quote:
Originally Posted by dwx View Post
I know the guy who did most of the reverse engineering of the WRX ECU for Cobb and did the design for the original AccessPort. The methods used are not rocket science, some of the same hacks used to root other devices to load custom code are used with ECUs. There are plenty of smart guys who can do it given the time to do so. I do not think Ccolby stole code from anyone to get things figured out, but I do think he got help from those who had already done it....
Yea

John is a good guy.. Could do this no problem.

Just a matter of money
Visconti is offline   Reply With Quote
Old 01-23-2013, 11:02 AM   #270
King Tut
NASA SpecE30 Racer
 
King Tut's Avatar
 
Join Date: May 2012
Drives: 2006 Honda S2000
Location: Gulf Breeze, FL
Posts: 7,279
Thanks: 607
Thanked 5,759 Times in 3,055 Posts
Mentioned: 274 Post(s)
Tagged: 10 Thread(s)
Send a message via AIM to King Tut
All I want is the ability to tune my own car for a reasonable price. Right now the only way to make that happen is to become an Ecutek tuner, which I am unsure of how much that costs, but I would guess in the $5k to $10k range or buy a Hydra EMS for $1900. If there was any option available for sub $1k I would be all over it. I just want to know if anyone out there is working on this or if we can see this anytime soon.
__________________
King Tut is offline   Reply With Quote
Old 01-23-2013, 04:01 PM   #271
fuddbutter
Potato Farmer
 
fuddbutter's Avatar
 
Join Date: Jun 2012
Drives: #SLOBRZ
Location: Melbourne Aust
Posts: 787
Thanks: 493
Thanked 247 Times in 152 Posts
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quote:
Originally Posted by King Tut View Post
All I want is the ability to tune my own car for a reasonable price. Right now the only way to make that happen is to become an Ecutek tuner, which I am unsure of how much that costs, but I would guess in the $5k to $10k range or buy a Hydra EMS for $1900. If there was any option available for sub $1k I would be all over it. I just want to know if anyone out there is working on this or if we can see this anytime soon.


you not see the UniChip threads??
__________________
Something something butter..
www.vic86brzclub.com
fuddbutter is offline   Reply With Quote
Old 01-23-2013, 04:35 PM   #272
King Tut
NASA SpecE30 Racer
 
King Tut's Avatar
 
Join Date: May 2012
Drives: 2006 Honda S2000
Location: Gulf Breeze, FL
Posts: 7,279
Thanks: 607
Thanked 5,759 Times in 3,055 Posts
Mentioned: 274 Post(s)
Tagged: 10 Thread(s)
Send a message via AIM to King Tut
I think we have advanced past the days of piggy backs. Oh the good ole days of tuning my B series Honda with an APEX'i VTEC Controller.
__________________
King Tut is offline   Reply With Quote
The Following User Says Thank You to King Tut For This Useful Post:
PRORICAN (01-23-2013)
Old 01-23-2013, 07:00 PM   #273
Dimman
Kuruma Otaku
 
Dimman's Avatar
 
Join Date: Dec 2009
Drives: Mk3 Supra with Semi-built 7MGTE
Location: Greater Vancouver (New West)
Posts: 6,854
Thanks: 2,398
Thanked 2,265 Times in 1,234 Posts
Mentioned: 78 Post(s)
Tagged: 2 Thread(s)
Garage
So what exactly are the major components here?

Dump the ROM/extract the data.

Figure out what that raw data means.

Be able to display the data in a way that makes sense to the user.

Edit the data.

Flash the new data to the ROM.

These are, very simply, the things that need to be sorted out?
__________________


Because titanium.
Dimman is offline   Reply With Quote
Old 01-23-2013, 07:14 PM   #274
Visconti
Banned
 
Join Date: Apr 2012
Drives: 05 STi
Location: Norwalk, CT
Posts: 2,843
Thanks: 196
Thanked 3,188 Times in 1,197 Posts
Mentioned: 375 Post(s)
Tagged: 2 Thread(s)
Send a message via AIM to Visconti
Quote:
Originally Posted by Dimman View Post
So what exactly are the major components here?

Dump the ROM/extract the data.

Figure out what that raw data means.

Be able to display the data in a way that makes sense to the user.

Edit the data.

Flash the new data to the ROM.

These are, very simply, the things that need to be sorted out?
Dumping the ECU with non commercial tools is what you need to do.

You'll need to find someone that knows how to communicate with the ECUS.

After you have the raw data from the ECU, the RomRaider Community can help understand the data, locate maps etc.

They have a map editing program that can be used.

-John
Visconti is offline   Reply With Quote
The Following User Says Thank You to Visconti For This Useful Post:
jedibow (02-08-2013)
Old 01-23-2013, 07:51 PM   #275
Dimman
Kuruma Otaku
 
Dimman's Avatar
 
Join Date: Dec 2009
Drives: Mk3 Supra with Semi-built 7MGTE
Location: Greater Vancouver (New West)
Posts: 6,854
Thanks: 2,398
Thanked 2,265 Times in 1,234 Posts
Mentioned: 78 Post(s)
Tagged: 2 Thread(s)
Garage
Quote:
Originally Posted by Visconti View Post
Dumping the ECU with non commercial tools is what you need to do.

You'll need to find someone that knows how to communicate with the ECUS.

After you have the raw data from the ECU, the RomRaider Community can help understand the data, locate maps etc.

They have a map editing program that can be used.

-John
This is something I've been looking into for only a few days now, so please bear with me if there are a shit-ton of errors. This is more to spark some thinking in the community rather than something I'll ever do myself.

Anyways, the main ecu chips in the past were CPU, ROM and RAM all combined. And we only want access to the ROM, right? In the past, engine ecu's were dumped by basically removing the chip and using a dedicated hardware/software combination hooked up to a PC. Something to do with EPROM.

The data was probably simpler back then given memory limitations, and probably much easier to define. Either way someone figures the tables out. Great.

Then the chips were written with whatever the tuner decided, while out of the computer and put back in. Sounds like a tuning nightmare.

Now I'm not certain if this was all or varied by chip/ecu. There is also mention of soldering in a different board that had sockets for the factory chip as well as an EPROM. From the sounds of it the purpose if the board is to physically change the ROM location to the add-on EPROM.

Tuning is still a nightmare at this point. I think this brings us to the JET era of mail your ecu in and get it back 'tuned'.

The next (or even historically current) step was the use if emulator hard/software that could be plugged into the add-on EPROM socket and have a computer emulate the ROM. So finally real-time tuning, but you still had to burn and install a chip after you figured out the tune.

How am I doing with the history so far?

Hondata sounds similar to this point, but maybe a more advanced add-on board? I'll be researching a bit about them next.

Still miles away from OBD2 Port flashing...
__________________


Because titanium.
Dimman is offline   Reply With Quote
Old 01-23-2013, 09:53 PM   #276
SkullWorks
Banned
 
Join Date: Mar 2012
Drives: SSM LT MT BRZ
Location: SoCal
Posts: 1,033
Thanks: 803
Thanked 754 Times in 328 Posts
Mentioned: 23 Post(s)
Tagged: 1 Thread(s)
you are getting it,

things like nistune and hondata use the solder in boards usually attached to something like a "debugging port" used for development by the OEM's i assume, and that is how you gain access to the data channels and command the ECU to read from an external (daughter board) eeprom location, or while live tuning there is ram allocated for the timing/fuel tables etc that you may be editing, when you burn the file at the end of the session you are saving the changes to the daughter board's eeprom so that it can be read directly after you disconnect the laptop.

The firmware varies in complexity, some "suites" use all factory protocols, others eliminate things like EGR function and others still completely re-visit the logic that controls the engine...

the huge change came when the ECU's were required to be upgradeable via obd2 port, now it is really just a software issue, it doesn't have to be mysterious, you can be as clever as to plug the dealer tool in and re-flash while watching the com lines and seeing what packets are being sent and received to get a rough idea of the protocol required to open the flash port.


I'll have to try and remember to look again but i had seen somewhere that the Denso ECU is using a very similar address file to the diesel H4's in other subaru's but with some of the original spark and fuel tables used in their historical gas injection motors....I also believe the ECU has already been dumped for analysis (by other than ECUtek)
SkullWorks is offline   Reply With Quote
The Following User Says Thank You to SkullWorks For This Useful Post:
Dimman (01-23-2013)
Old 02-08-2013, 01:21 AM   #277
jedibow
post whore extraordinaire
 
Join Date: Jun 2012
Drives: 2013 Asphalt Grey FR-S 2003 Evo 8
Location: Land of drama looking for a way out
Posts: 456
Thanks: 177
Thanked 114 Times in 73 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Garage
Wow.... Okay, I've been gone fora while. A few things...

John thank you for what you have submitted, and for your continued help.

Dimman, the basic problem we are facing right now is the proprietary code that "unlocks" the communication between the ecu ROM data and the obd2 port. As of this moment I'm unaware of ANYBODY besides Ecutek, or the dealer that has the ability to "dump" the ROM image. However there are numerous people (including a few involved with this thread) that are attempting to do so.

Once we have the ROM image it can be defined into various maps located at various addresses within the Edu. Whoever said that this process is easy, please fly to my house and help me continue defining the ROM in my CEO, which has been unlocked for 7 years, and is still not completely defined yet.

This will take time, patience, and community involvement. One aspect that was awesome in the evo community was the fact that many people where working on ROM definitions and would share findings openly (myself included). I can't say this enough, if we are to succeed it will take a united effort, and complaining about who stole this, or what does the entire community a disservice.

The entire reason for this discussion is so that we can post finding for one another and help each other.

Again thank you to all that have contributed!

George

P.S

The latest from open ecu...

Re: Subaru BRZ ROM Pulling? Anyone successfully done
by radsdau »

I believe it's quite a different animal, even though the ECU is Denso. None of the current Subaru methods will work with it AFAIK.
No KLine for start.
__________________
Originally Posted by ImAwesome
Great info in here. arghx7 what do you do?

He's obviously a very knowledgable landscaper.

Last edited by jedibow; 02-08-2013 at 01:25 AM. Reason: post quote
jedibow is offline   Reply With Quote
The Following User Says Thank You to jedibow For This Useful Post:
Sportsguy83 (02-08-2013)
Old 02-08-2013, 01:32 AM   #278
jedibow
post whore extraordinaire
 
Join Date: Jun 2012
Drives: 2013 Asphalt Grey FR-S 2003 Evo 8
Location: Land of drama looking for a way out
Posts: 456
Thanks: 177
Thanked 114 Times in 73 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Garage
Quote:
Originally Posted by SkullWorks View Post
I have to try and remember to look again but i had seen somewhere that the Denso ECU is using a very similar address file to the diesel H4's in other subaru's but with some of the original spark and fuel tables used in their historical gas injection motors....I also believe the ECU has already been dumped for analysis (by other than ECUtek)
What is similar is the direct injection tables
__________________
Originally Posted by ImAwesome
Great info in here. arghx7 what do you do?

He's obviously a very knowledgable landscaper.
jedibow is offline   Reply With Quote
Old 02-08-2013, 09:51 AM   #279
Shankenstein
Frosty Carrot
 
Shankenstein's Avatar
 
Join Date: Jan 2013
Drives: The Atomic Carrot
Location: Baltimore, MD
Posts: 513
Thanks: 272
Thanked 428 Times in 199 Posts
Mentioned: 19 Post(s)
Tagged: 0 Thread(s)
I will 100% support these efforts in any way possible.

Questions:
- Do we have specs for the dealer cable?
- Do we know what ELM chips are used on the boards?
- Do we know what CAN protocol is used on these chips?
- Do we know the available commands for that protocol?

Most systems like this have a run mode and one (or more) diagnostic modes. More questions:
- What are the known modes of operation?
- Which one allows hex-level access to ROM?
- Has anyone successfully enabled this mode? How?

I'm just trying to establish a current status for those new to this adventure?
__________________
If you think you're nerd enough, join in the discussions about Suspension and Aerodynamic modelling!
Wall of Fame - JDL Auto Design, Raceseng, Vishnu Tuning, Penske Shocks, Nameless, Perrin, RaceComp Engineering, Essex/AP Racing, Verus, RacerX
Wall of Shame - aFe Takeda, Wilwood, FA20Club
Shankenstein is offline   Reply With Quote
Old 02-08-2013, 10:32 AM   #280
pozer
Member
 
pozer's Avatar
 
Join Date: Oct 2012
Drives: 13 FR - s
Location: Madison wi
Posts: 54
Thanks: 0
Thanked 18 Times in 12 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Send a message via AIM to pozer
Check the BRZedit thread
pozer is offline   Reply With Quote
 
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Great dealership in NE Ohio.. (still has multiple pre-order slots open) eikond BRZ First-Gen (2012+) -- General Topics 15 03-02-2012 01:03 PM
Open Air FR-S Concept Rampant FR-S & 86 Photos, Videos, Wallpapers, Gallery Forum 22 02-01-2012 11:01 PM
Open Deck Block nrclptcnsmniak Engine, Exhaust, Transmission 36 01-27-2012 01:00 PM
Keep your eyes/cameras open in SoCal? Buggy51 Scion FR-S / Toyota 86 GT86 General Forum 14 10-10-2011 10:21 PM


All times are GMT -4. The time now is 05:14 PM.


Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2024, vBulletin Solutions Inc.
User Alert System provided by Advanced User Tagging v3.3.0 (Lite) - vBulletin Mods & Addons Copyright © 2024 DragonByte Technologies Ltd.

Garage vBulletin Plugins by Drive Thru Online, Inc.