Break-thru: Reading ACD ECU with EcuFlash

Reply Subscribe

Thread Tools

Search this Thread

Mar 31, 2010 | 03:35 AM

#211

acamus

Evolved Member

Joined: Mar 2008

Posts: 730

Likes: 3

From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude

Is it possible to flash stock ROM with different ID?
let us say 40150001 into 40140003 without the problem mentioned in above?

Last edited by acamus; Mar 31, 2010 at 04:46 AM.

Mar 31, 2010 | 04:11 AM

#212

merlin.oz

Evolved Member

Joined: Jun 2008

Posts: 824

Likes: 24

From: Sydney

^ I have not tried to but I dont see why not.
It would be a bit of a dissapointment if all we could do is flash stock ralliart code without mods.

Mar 31, 2010 | 04:24 AM

#213

sba

Thread Starter

Evolving Member

Joined: Nov 2007

Posts: 153

Likes: 2

From: East Europe

I couldn't change the file directly with a different one.

Mar 31, 2010 | 04:35 AM

#214

acamus

Evolved Member

Joined: Mar 2008

Posts: 730

Likes: 3

From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude

Quote:

Originally Posted by merlin.oz

^ I have not tried to but I dont see why not.
It would be a bit of a dissapointment if all we could do is flash stock ralliart code without mods.

I am asking in order to sort out the problem.
If it is in code or some "processor security setting".
If you can flash any other stock file and it is running,
means there is something in the code. But if you are unable
to run other stock it means there is some processor intrinsic check.

Last edited by acamus; Mar 31, 2010 at 04:47 AM.

Mar 31, 2010 | 10:03 AM

#215

Ceddy

Evolving Member

Joined: Apr 2008

Posts: 265

Likes: 1

From: Reading, PA

Quote:

Originally Posted by merlin.oz

Well I have hit a hole in the road here.
There is a checksum in the ACD code. Change any byte and all three mode lights are lit.
Re-flash the stock ROM back and it reverts to normal.

I suspect its going to take some dis-assembly to get around this issue.

Does it do this with only a change to one of the maps?

Mar 31, 2010 | 11:18 AM

#216

mrfred

EvoM Guru

iTrader: (50)

Joined: Mar 2006

Posts: 9,675

Likes: 132

From: Tri-Cities, WA // Portland, OR

Quote:

Originally Posted by merlin.oz

I think Colby can handle this within ECUFlash. If no reply from him in this thread within a few days, I'll send him an email.

Mar 31, 2010 | 12:09 PM

#217

colby

Newbie

iTrader: (3)

Joined: Dec 2005

Posts: 87

Likes: 0

From: Seattle, WA

I'm on it... I should have a fix shortly.

Colby

Quote:

Originally Posted by merlin.oz

Mar 31, 2010 | 01:38 PM

#218

merlin.oz

Evolved Member

Joined: Jun 2008

Posts: 824

Likes: 24

From: Sydney

^ acamus, i see your point and will check

^ ceddy, I changed one byte by one bit in one map and the checksum triggered

^ colby, thank you

Mar 31, 2010 | 01:47 PM

#219

merlin.oz

Evolved Member

Joined: Jun 2008

Posts: 824

Likes: 24

From: Sydney

ok, acamus and colby, its in the code, not hardware.
I just flashed a ralliart ROM into a normal Evo7 ACD ecu and it ran ok in my Evo9.
A bit of cross-checking there.

Mar 31, 2010 | 02:05 PM

#220

colby

Newbie

iTrader: (3)

Joined: Dec 2005

Posts: 87

Likes: 0

From: Seattle, WA

I sent this back via FedEx 2-day yesterday, FYI.

Quote:

Originally Posted by scheides

My spare ACD ECU is on its way to him.

Mar 31, 2010 | 02:47 PM

#221

iTune

Evolved Member

iTrader: (3)

Joined: Feb 2007

Posts: 790

Likes: 1

From: Jacksonville

Subscribed!

Do i need a 2.0 cable to be able to help with this, or can i use my 1.3 cable?

Mar 31, 2010 | 02:48 PM

#222

iTune

Evolved Member

iTrader: (3)

Joined: Feb 2007

Posts: 790

Likes: 1

From: Jacksonville

Never mind.....i found the info i was asking about. Only 2.0 will work. I've been waiting for reason to upgrade my 1.3 and now i think i've found it.

Mar 31, 2010 | 04:32 PM

#223

merlin.oz

Evolved Member

Joined: Jun 2008

Posts: 824

Likes: 24

From: Sydney

A little bit more data:
The ralliart Evo7 code will only run for a short time in an Evo9 before lighting all the mode lamps.

I dont know why, but suspect its the pressure sensor signal going out of spec.
Maybe the FSM will show why.

Mar 31, 2010 | 04:44 PM

#224

Ceddy

Evolving Member

Joined: Apr 2008

Posts: 265

Likes: 1

From: Reading, PA

Had a quick look at the code. Appears the the two lower bytes of the ASCII Name might be used as a CheckSum. DM4014

There is also a check against the ASCII Name, that is hard coded in.

If Colby has the CheckSum under control, I won't investigate further.

Mar 31, 2010 | 04:56 PM

#225

colby

Newbie

iTrader: (3)

Joined: Dec 2005

Posts: 87

Likes: 0

From: Seattle, WA

yep.

small roms / older procs make it much easier to find this stuff

Quote:

Originally Posted by Ceddy