follow ft86club on our blog, twitter or facebook. Interested in the FT-1? Check out FT1Club
FT86CLUB
Ft86Club
Delicious Tuning
Register Garage Members List Calendar Search Today's Posts Mark Forums Read

Go Back   Scion FR-S Forum | Subaru BRZ Forum | Toyota 86 GT 86 Forum | AS1 Forum - FT86CLUB > Technical Topics > Software Tuning

Software Tuning Discuss all software tuning topics.

User Tag List

Reply
 
Thread Tools Search this Thread
Old 01-22-2013, 08:36 PM   #265
Dimman
Kuruma Otaku
 
Dimman's Avatar
 
Join Date: Dec 2009
Drives: Mk3 Supra with Semi-built 7MGTE
Location: Greater Vancouver (New West)
Posts: 6,545
Thanks: 1,646
Thanked 1,836 Times in 1,034 Posts
Mentioned: 68 Post(s)
Tagged: 0 Thread(s)
Garage
Quote:
3. You seem to keep questioning how to reverse engineer ECUs, so let me tell you how. I expect the you will be sharing what you have learned as well...

a) 2001-2005 WRX - 68HC916Y5 based
* get the chip docs!
* get a BDM from P&E Microsystems
* solder a BDM header the ECU using the handy solder pads Denso left for this purpose
* read out the rom (including the TPU area) with a couple clicks of the BDM software
* get IDA Pro
* write your own HC16 module for IDA Pro because you don't want to spend the money to buy IDA Pro advanced
* publish the source of your HC16 module for free for others to use
* start disassembling - find all the references to code that accesses the serial port
* notice that there is TPU code that uses the serial port ???
* figure out that the TPU area is a bootloader!
* learn what the bootloader wants, including checksums, etc.
* learn how the bootloader keeps the WDT happy
* get a HC16 assembler (COSMIC)
* write a simple kernel program to read out the CPU
* write a better kernel program to reflash the CPU
* discover that your 02 WRX works, but your 04 WRX won't enter the bootloader
* read out 04 WRX with BDM and go through the serial code
* find seed/key algorithm before jumping to bootloader!
* add see/key to PC reflash program

b) 2004+ Subaru DBW - SH7055 and SH7058 based
* get the chip docs!
* try using the same initialization sequence as the WRX
* it works!!!
* build SH cross-compiler
* start writing test kernels - some trial and error here
* the ECU is being reset by a watchdog!
* start tracing pins on the board with a scope - PB15 is twiddling!
* add WDT code to kernel - it works!
* write flashing code - test - test - test
* reprogram using boot mode (solder into ECU) when you screw up
* write another kernel for SH7058 that uses built in reflash functions

c) EVO 7/8 - SH7052 based
* get the chip docs!
* borrow a MUTIII - very handy
* snoop a TSB reflash using the MUTIII (only get one chance!)
* identify init sequence and kernel upload - no seed/key - this is easy!
* Mitsubishi uses boot mode for bootloader, which makes development and flash failures easily recoverable...
* write a simple kernel to dump all of ram so I can see what the Mitsubishi bootloader looks like
* buy IDA Pro Advanced - don't want to write any more modules!
* disassemble bootloader completely to understand how it all works, including initialization codes
* modify Subaru SH7055 kernel to work with SH7052 - easy!
* done!

d) EVO 9 - SH7055 derivative
* get the chip docs!
* borrow a MUTIII
* snoop a reflash using the MUTIII
* same init sequence!
* try loading my SH7055 kernel, and the ECU takes it, but doesn't seem to run the code
* I am stuck in the bootloader for some reason!
* from the snooping, I can see how to read / erase / write with the bootloader, but I want to use my own kernel - but how - I need to be able to read out the bootloader to find out how to load a kernel...
* create a EVO 9 ROM with a trojan kernel in it.
* flash this into the ECU, but is doesn't respond
* start tracing board and discover that there is a WDT that needs to run off of PD8 - but only when not in the init mode
* add WDT code to trojan kernel
* flash it and it runs!
* read out EVO 9 bootloader still left in RAM
* see command to load a kernel!
* see that bootloader uses built in flashing function like SH7058
* make new SH7055 kernel to support new flashing method like SH7058
* it works!
From here: http://forums.nasioc.com/forums/show...5&postcount=73

From another post in the thread @Silverpike posted. Anyone have insight into what prerequisites are needed to understand this?
__________________


Because titanium.
Dimman is offline   Reply With Quote
The Following 2 Users Say Thank You to Dimman For This Useful Post:
D-VO (01-24-2013), Sportsguy83 (01-22-2013)
Old 01-22-2013, 09:19 PM   #266
Dimman
Kuruma Otaku
 
Dimman's Avatar
 
Join Date: Dec 2009
Drives: Mk3 Supra with Semi-built 7MGTE
Location: Greater Vancouver (New West)
Posts: 6,545
Thanks: 1,646
Thanked 1,836 Times in 1,034 Posts
Mentioned: 68 Post(s)
Tagged: 0 Thread(s)
Garage
Found a reference to source code for Ecuflash version 0.9 basically the first one ever, with something called an HC16?

Apparently command line, Subaru only.
__________________


Because titanium.
Dimman is offline   Reply With Quote
Old 01-22-2013, 09:45 PM   #267
dwx
Senior Member
 
Join Date: Feb 2012
Drives: 2013 DGM Subaru BRZ (Subie #9)
Location: ATL, US
Posts: 2,142
Thanks: 88
Thanked 645 Times in 421 Posts
Mentioned: 28 Post(s)
Tagged: 0 Thread(s)
I know the guy who did most of the reverse engineering of the WRX ECU for Cobb and did the design for the original AccessPort. The methods used are not rocket science, some of the same hacks used to root other devices to load custom code are used with ECUs. There are plenty of smart guys who can do it given the time to do so. I do not think Ccolby stole code from anyone to get things figured out, but I do think he got help from those who had already done it....
dwx is offline   Reply With Quote
Old 01-22-2013, 09:49 PM   #268
dwx
Senior Member
 
Join Date: Feb 2012
Drives: 2013 DGM Subaru BRZ (Subie #9)
Location: ATL, US
Posts: 2,142
Thanks: 88
Thanked 645 Times in 421 Posts
Mentioned: 28 Post(s)
Tagged: 0 Thread(s)
Quote:
Originally Posted by Dimman View Post
Found a reference to source code for Ecuflash version 0.9 basically the first one ever, with something called an HC16?

Apparently command line, Subaru only.
HC16 refers to the Motorola 68HC16 micro controller which is the 16-bit CPU used in the old Subaru ECUs
dwx is offline   Reply With Quote
The Following User Says Thank You to dwx For This Useful Post:
Dimman (01-22-2013)
Old 01-22-2013, 10:19 PM   #269
Visconti
Banned
 
Join Date: Apr 2012
Drives: 05 STi
Location: Norwalk, CT
Posts: 2,847
Thanks: 196
Thanked 3,185 Times in 1,197 Posts
Mentioned: 375 Post(s)
Tagged: 2 Thread(s)
Send a message via AIM to Visconti
Quote:
Originally Posted by dwx View Post
I know the guy who did most of the reverse engineering of the WRX ECU for Cobb and did the design for the original AccessPort. The methods used are not rocket science, some of the same hacks used to root other devices to load custom code are used with ECUs. There are plenty of smart guys who can do it given the time to do so. I do not think Ccolby stole code from anyone to get things figured out, but I do think he got help from those who had already done it....
Yea

John is a good guy.. Could do this no problem.

Just a matter of money
Visconti is offline   Reply With Quote
Old 01-23-2013, 11:02 AM   #270
King Tut
NASA SpecE30 Racer
 
King Tut's Avatar
 
Join Date: May 2012
Drives: 2006 Honda S2000
Location: Gulf Breeze, FL
Posts: 6,452
Thanks: 591
Thanked 4,823 Times in 2,598 Posts
Mentioned: 250 Post(s)
Tagged: 9 Thread(s)
Send a message via AIM to King Tut
All I want is the ability to tune my own car for a reasonable price. Right now the only way to make that happen is to become an Ecutek tuner, which I am unsure of how much that costs, but I would guess in the $5k to $10k range or buy a Hydra EMS for $1900. If there was any option available for sub $1k I would be all over it. I just want to know if anyone out there is working on this or if we can see this anytime soon.
__________________
- King Tut
Street/Track Car: 2006 Honda S2000 TT3 || Race Car: 1987 BMW 325is SpecE30 || Daily Driver: 1987 BMW 325is || Tow Vehicle: 2014 RAM 1500 EcoDiesel
Sold Cars: 2012 BMW M3 || 2013 Subaru BRZ || 2012 Porsche Cayman R || 2009 Chevrolet Z06 || 2009 BMW M3 || 2004 BMW M3 || 2004 Nissan 350Z
King Tut is offline   Reply With Quote
Old 01-23-2013, 04:01 PM   #271
fuddbutter
Senior Member
 
fuddbutter's Avatar
 
Join Date: Jun 2012
Drives: BRZ, White with dirt all over it.
Location: Melbourne Aust
Posts: 656
Thanks: 444
Thanked 182 Times in 125 Posts
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quote:
Originally Posted by King Tut View Post
All I want is the ability to tune my own car for a reasonable price. Right now the only way to make that happen is to become an Ecutek tuner, which I am unsure of how much that costs, but I would guess in the $5k to $10k range or buy a Hydra EMS for $1900. If there was any option available for sub $1k I would be all over it. I just want to know if anyone out there is working on this or if we can see this anytime soon.


you not see the UniChip threads??
__________________
Something something butter..
www.vic86brzclub.com
fuddbutter is offline   Reply With Quote
Old 01-23-2013, 04:35 PM   #272
King Tut
NASA SpecE30 Racer
 
King Tut's Avatar
 
Join Date: May 2012
Drives: 2006 Honda S2000
Location: Gulf Breeze, FL
Posts: 6,452
Thanks: 591
Thanked 4,823 Times in 2,598 Posts
Mentioned: 250 Post(s)
Tagged: 9 Thread(s)
Send a message via AIM to King Tut
I think we have advanced past the days of piggy backs. Oh the good ole days of tuning my B series Honda with an APEX'i VTEC Controller.
__________________
- King Tut
Street/Track Car: 2006 Honda S2000 TT3 || Race Car: 1987 BMW 325is SpecE30 || Daily Driver: 1987 BMW 325is || Tow Vehicle: 2014 RAM 1500 EcoDiesel
Sold Cars: 2012 BMW M3 || 2013 Subaru BRZ || 2012 Porsche Cayman R || 2009 Chevrolet Z06 || 2009 BMW M3 || 2004 BMW M3 || 2004 Nissan 350Z
King Tut is offline   Reply With Quote
The Following User Says Thank You to King Tut For This Useful Post:
PRORICAN (01-23-2013)
Old 01-23-2013, 07:00 PM   #273
Dimman
Kuruma Otaku
 
Dimman's Avatar
 
Join Date: Dec 2009
Drives: Mk3 Supra with Semi-built 7MGTE
Location: Greater Vancouver (New West)
Posts: 6,545
Thanks: 1,646
Thanked 1,836 Times in 1,034 Posts
Mentioned: 68 Post(s)
Tagged: 0 Thread(s)
Garage
So what exactly are the major components here?

Dump the ROM/extract the data.

Figure out what that raw data means.

Be able to display the data in a way that makes sense to the user.

Edit the data.

Flash the new data to the ROM.

These are, very simply, the things that need to be sorted out?
__________________


Because titanium.
Dimman is offline   Reply With Quote
Old 01-23-2013, 07:14 PM   #274
Visconti
Banned
 
Join Date: Apr 2012
Drives: 05 STi
Location: Norwalk, CT
Posts: 2,847
Thanks: 196
Thanked 3,185 Times in 1,197 Posts
Mentioned: 375 Post(s)
Tagged: 2 Thread(s)
Send a message via AIM to Visconti
Quote:
Originally Posted by Dimman View Post
So what exactly are the major components here?

Dump the ROM/extract the data.

Figure out what that raw data means.

Be able to display the data in a way that makes sense to the user.

Edit the data.

Flash the new data to the ROM.

These are, very simply, the things that need to be sorted out?
Dumping the ECU with non commercial tools is what you need to do.

You'll need to find someone that knows how to communicate with the ECUS.

After you have the raw data from the ECU, the RomRaider Community can help understand the data, locate maps etc.

They have a map editing program that can be used.

-John
Visconti is offline   Reply With Quote
The Following User Says Thank You to Visconti For This Useful Post:
jedibow (02-08-2013)
Old 01-23-2013, 07:51 PM   #275
Dimman
Kuruma Otaku
 
Dimman's Avatar
 
Join Date: Dec 2009
Drives: Mk3 Supra with Semi-built 7MGTE
Location: Greater Vancouver (New West)
Posts: 6,545
Thanks: 1,646
Thanked 1,836 Times in 1,034 Posts
Mentioned: 68 Post(s)
Tagged: 0 Thread(s)
Garage
Quote:
Originally Posted by Visconti View Post
Dumping the ECU with non commercial tools is what you need to do.

You'll need to find someone that knows how to communicate with the ECUS.

After you have the raw data from the ECU, the RomRaider Community can help understand the data, locate maps etc.

They have a map editing program that can be used.

-John
This is something I've been looking into for only a few days now, so please bear with me if there are a shit-ton of errors. This is more to spark some thinking in the community rather than something I'll ever do myself.

Anyways, the main ecu chips in the past were CPU, ROM and RAM all combined. And we only want access to the ROM, right? In the past, engine ecu's were dumped by basically removing the chip and using a dedicated hardware/software combination hooked up to a PC. Something to do with EPROM.

The data was probably simpler back then given memory limitations, and probably much easier to define. Either way someone figures the tables out. Great.

Then the chips were written with whatever the tuner decided, while out of the computer and put back in. Sounds like a tuning nightmare.

Now I'm not certain if this was all or varied by chip/ecu. There is also mention of soldering in a different board that had sockets for the factory chip as well as an EPROM. From the sounds of it the purpose if the board is to physically change the ROM location to the add-on EPROM.

Tuning is still a nightmare at this point. I think this brings us to the JET era of mail your ecu in and get it back 'tuned'.

The next (or even historically current) step was the use if emulator hard/software that could be plugged into the add-on EPROM socket and have a computer emulate the ROM. So finally real-time tuning, but you still had to burn and install a chip after you figured out the tune.

How am I doing with the history so far?

Hondata sounds similar to this point, but maybe a more advanced add-on board? I'll be researching a bit about them next.

Still miles away from OBD2 Port flashing...
__________________


Because titanium.
Dimman is offline   Reply With Quote
Old 01-23-2013, 09:53 PM   #276
SkullWorks
Banned
 
Join Date: Mar 2012
Drives: SSM LT MT BRZ
Location: SoCal
Posts: 1,036
Thanks: 803
Thanked 745 Times in 328 Posts
Mentioned: 23 Post(s)
Tagged: 1 Thread(s)
you are getting it,

things like nistune and hondata use the solder in boards usually attached to something like a "debugging port" used for development by the OEM's i assume, and that is how you gain access to the data channels and command the ECU to read from an external (daughter board) eeprom location, or while live tuning there is ram allocated for the timing/fuel tables etc that you may be editing, when you burn the file at the end of the session you are saving the changes to the daughter board's eeprom so that it can be read directly after you disconnect the laptop.

The firmware varies in complexity, some "suites" use all factory protocols, others eliminate things like EGR function and others still completely re-visit the logic that controls the engine...

the huge change came when the ECU's were required to be upgradeable via obd2 port, now it is really just a software issue, it doesn't have to be mysterious, you can be as clever as to plug the dealer tool in and re-flash while watching the com lines and seeing what packets are being sent and received to get a rough idea of the protocol required to open the flash port.


I'll have to try and remember to look again but i had seen somewhere that the Denso ECU is using a very similar address file to the diesel H4's in other subaru's but with some of the original spark and fuel tables used in their historical gas injection motors....I also believe the ECU has already been dumped for analysis (by other than ECUtek)
SkullWorks is offline   Reply With Quote
The Following User Says Thank You to SkullWorks For This Useful Post:
Dimman (01-23-2013)
Old 02-08-2013, 01:21 AM   #277
jedibow
post whore extraordinaire
 
Join Date: Jun 2012
Drives: 2013 Asphalt Grey FR-S 2003 Evo 8
Location: Land of drama looking for a way out
Posts: 469
Thanks: 177
Thanked 114 Times in 73 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Garage
Wow.... Okay, I've been gone fora while. A few things...

John thank you for what you have submitted, and for your continued help.

Dimman, the basic problem we are facing right now is the proprietary code that "unlocks" the communication between the ecu ROM data and the obd2 port. As of this moment I'm unaware of ANYBODY besides Ecutek, or the dealer that has the ability to "dump" the ROM image. However there are numerous people (including a few involved with this thread) that are attempting to do so.

Once we have the ROM image it can be defined into various maps located at various addresses within the Edu. Whoever said that this process is easy, please fly to my house and help me continue defining the ROM in my CEO, which has been unlocked for 7 years, and is still not completely defined yet.

This will take time, patience, and community involvement. One aspect that was awesome in the evo community was the fact that many people where working on ROM definitions and would share findings openly (myself included). I can't say this enough, if we are to succeed it will take a united effort, and complaining about who stole this, or what does the entire community a disservice.

The entire reason for this discussion is so that we can post finding for one another and help each other.

Again thank you to all that have contributed!

George

P.S

The latest from open ecu...

Re: Subaru BRZ ROM Pulling? Anyone successfully done
by radsdau

I believe it's quite a different animal, even though the ECU is Denso. None of the current Subaru methods will work with it AFAIK.
No KLine for start.
__________________
Originally Posted by ImAwesome
Great info in here. arghx7 what do you do?

He's obviously a very knowledgable landscaper.

Last edited by jedibow; 02-08-2013 at 01:25 AM. Reason: post quote
jedibow is offline   Reply With Quote
The Following User Says Thank You to jedibow For This Useful Post:
Sportsguy83 (02-08-2013)
Old 02-08-2013, 01:32 AM   #278
jedibow
post whore extraordinaire
 
Join Date: Jun 2012
Drives: 2013 Asphalt Grey FR-S 2003 Evo 8
Location: Land of drama looking for a way out
Posts: 469
Thanks: 177
Thanked 114 Times in 73 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Garage
Quote:
Originally Posted by SkullWorks View Post
I have to try and remember to look again but i had seen somewhere that the Denso ECU is using a very similar address file to the diesel H4's in other subaru's but with some of the original spark and fuel tables used in their historical gas injection motors....I also believe the ECU has already been dumped for analysis (by other than ECUtek)
What is similar is the direct injection tables
__________________
Originally Posted by ImAwesome
Great info in here. arghx7 what do you do?

He's obviously a very knowledgable landscaper.
jedibow is offline   Reply With Quote
Old 02-08-2013, 09:51 AM   #279
Shankenstein
Frosty Carrot
 
Shankenstein's Avatar
 
Join Date: Jan 2013
Drives: The Atomic Carrot
Location: Boston, MA
Posts: 322
Thanks: 183
Thanked 207 Times in 99 Posts
Mentioned: 6 Post(s)
Tagged: 0 Thread(s)
I will 100% support these efforts in any way possible.

Questions:
- Do we have specs for the dealer cable?
- Do we know what ELM chips are used on the boards?
- Do we know what CAN protocol is used on these chips?
- Do we know the available commands for that protocol?

Most systems like this have a run mode and one (or more) diagnostic modes. More questions:
- What are the known modes of operation?
- Which one allows hex-level access to ROM?
- Has anyone successfully enabled this mode? How?

I'm just trying to establish a current status for those new to this adventure?
__________________
If you think you're nerd enough, join in the discussions about Suspension and Aerodynamic modelling!
Wall of Fame - Ground Control, Motiv, Nameless, Perrin, RaceComp Engineering, Essex, Hancha Group
Wall of Shame - aFe Takeda, Wilwood, FA20Club
Shankenstein is offline   Reply With Quote
Old 02-08-2013, 10:32 AM   #280
pozer
Member
 
pozer's Avatar
 
Join Date: Oct 2012
Drives: 13 FR - s
Location: Madison wi
Posts: 47
Thanks: 0
Thanked 15 Times in 11 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Send a message via AIM to pozer
Check the BRZedit thread
pozer is offline   Reply With Quote
Old 02-08-2013, 09:26 PM   #281
jedibow
post whore extraordinaire
 
Join Date: Jun 2012
Drives: 2013 Asphalt Grey FR-S 2003 Evo 8
Location: Land of drama looking for a way out
Posts: 469
Thanks: 177
Thanked 114 Times in 73 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Garage
Quote:
Originally Posted by pozer View Post
Check the BRZedit thread
we are discussing openecu, or romraider here, not ecuedit. Not to get into the differences too much, but one is a purchased ROM editor that cannot be altered (ecuedit), and the other is completely user defined.

We need all the tuning options we can get however, this is two different platforms. To clarify ecuedit would be closer to ecutek, than openecu.
__________________
Originally Posted by ImAwesome
Great info in here. arghx7 what do you do?

He's obviously a very knowledgable landscaper.
jedibow is offline   Reply With Quote
Old 02-08-2013, 09:38 PM   #282
Dimman
Kuruma Otaku
 
Dimman's Avatar
 
Join Date: Dec 2009
Drives: Mk3 Supra with Semi-built 7MGTE
Location: Greater Vancouver (New West)
Posts: 6,545
Thanks: 1,646
Thanked 1,836 Times in 1,034 Posts
Mentioned: 68 Post(s)
Tagged: 0 Thread(s)
Garage
Quote:
Originally Posted by jedibow View Post
we are discussing openecu, or romraider here, not ecuedit. Not to get into the differences too much, but one is a purchased ROM editor that cannot be altered (ecuedit), and the other is completely user defined.

We need all the tuning options we can get however, this is two different platforms. To clarify ecuedit would be closer to ecutek, than openecu.
You're back at this? Nice.

How are things?
__________________


Because titanium.
Dimman is offline   Reply With Quote
The Following User Says Thank You to Dimman For This Useful Post:
jedibow (02-08-2013)
Old 02-08-2013, 09:43 PM   #283
jedibow
post whore extraordinaire
 
Join Date: Jun 2012
Drives: 2013 Asphalt Grey FR-S 2003 Evo 8
Location: Land of drama looking for a way out
Posts: 469
Thanks: 177
Thanked 114 Times in 73 Posts
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Garage
Quote:
Originally Posted by Dimman View Post
You're back at this? Nice.

How are things?
I will be now...LOL

Good, made it to Canada, loved it! Herniated my bicep so had to pull out of ninja warrior, and converted the Evo to a dedicated time attack car. LOL

Now time for some 86 love...

George
__________________
Originally Posted by ImAwesome
Great info in here. arghx7 what do you do?

He's obviously a very knowledgable landscaper.
jedibow is offline   Reply With Quote
The Following 2 Users Say Thank You to jedibow For This Useful Post:
Deepseadiver (02-10-2013), Dimman (02-08-2013)
Old 02-26-2013, 02:46 AM   #284
D-VO
Senior Member
 
Join Date: Sep 2012
Drives: Whiteout FR-S, Evo 8 RS
Location: Kissimmee FL.
Posts: 108
Thanks: 77
Thanked 19 Times in 14 Posts
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
http://www.ft86club.com/forums/showthread.php?t=3603

=D
__________________
D-VO is offline   Reply With Quote
Old 05-09-2013, 09:36 AM   #285
ItsRealFast
Junior Member
 
Join Date: May 2013
Drives: s2000 Turbo
Location: FL
Posts: 3
Thanks: 0
Thanked 12 Times in 3 Posts
Mentioned: 1 Post(s)
Tagged: 0 Thread(s)
Development Started

Hey I would like to Thank everyone for this development info into the FRS ecu. I am new here

Well I would like to provide some insight here on exactly what I have planned. My FRS ecu just arrived and my buddy is a Master Tech at Toyota. He has access to all sort of tools. This weekend I will sniff the CAN lines along with K and L lines to see whats really going on the bus. I will gather logs with the car off, logs with the ignition on, logs with the car running, and logs with the dealer tool connected. This way i can filter out idle data vs dealer tool data.

I will then write a program to communicate to my custom hardware which will emulate dealer equipment. I would then connect the Stock ecu and try to reproduce messages and hope to get the same responses.

I know a lot about can bus, hacking ecus, dumping, and protocol stuff. I am still educating myself about about dissembling ecu code to find table data.

I am looking to team up with a couple of people to make this a group effort.

Thanks

Marc
ItsRealFast is offline   Reply With Quote
The Following 3 Users Say Thank You to ItsRealFast For This Useful Post:
D-VO (05-10-2013), Deepseadiver (05-09-2013), xjohnx (05-09-2013)
Old 05-09-2013, 09:43 AM   #286
xjohnx
Grip>Slip
 
xjohnx's Avatar
 
Join Date: Jun 2012
Drives: 13 SWP BRZ Ltd - Innovate Powered!
Location: RVA
Posts: 3,445
Thanks: 647
Thanked 1,602 Times in 972 Posts
Mentioned: 43 Post(s)
Tagged: 3 Thread(s)
Quote:
Originally Posted by ItsRealFast View Post
Hey I would like to Thank everyone for this development info into the FRS ecu. I am new here

Well I would like to provide some insight here on exactly what I have planned. My FRS ecu just arrived and my buddy is a Master Tech at Toyota. He has access to all sort of tools. This weekend I will sniff the CAN lines along with K and L lines to see whats really going on the bus. I will gather logs with the car off, logs with the ignition on, logs with the car running, and logs with the dealer tool connected. This way i can filter out idle data vs dealer tool data.

I will then write a program to communicate to my custom hardware which will emulate dealer equipment. I would then connect the Stock ecu and try to reproduce messages and hope to get the same responses.

I know a lot about can bus, hacking ecus, dumping, and protocol stuff. I am still educating myself about about dissembling ecu code to find table data.

I am looking to team up with a couple of people to make this a group effort.

Thanks

Marc
YES! I wish I could help, but I'm more of an infrastructure guy than a developer, but I'm sure you'll find a couple people here that will be able to assist.
xjohnx is offline   Reply With Quote
 
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Great dealership in NE Ohio.. (still has multiple pre-order slots open) eikond Subaru BRZ General Forum 15 03-02-2012 01:03 PM
Open Air FR-S Concept Rampant Photos, Videos, Wallpapers, Gallery Forum 22 02-01-2012 11:01 PM
Open Deck Block nrclptcnsmniak Engine, Exhaust, Transmission 36 01-27-2012 01:00 PM
Keep your eyes/cameras open in SoCal? Buggy51 Scion FR-S / Toyota 86 GT86 General Forum 14 10-10-2011 09:21 PM


All times are GMT -5. The time now is 02:39 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Garage vBulletin Plugins by Drive Thru Online, Inc.