Break-thru: Reading ACD ECU with EcuFlash
Evolving Member
Joined: Apr 2008
Posts: 265
Likes: 1
From: Reading, PA
Yeah, basically MUT, most of the Actuator commands are the same also.
There is at least a couple protocols, ones a Direct Access type, send two bytes, and you can read any RAM or ROM address, think they use it to read the flash image, but it would be handy for debugging also.
I'm trying to back track off the MUT table to name everything and figure out scaling for the axis.
But, my MUT table isn't agreeing with EvoScans, think Hamish might have it set up for a earlier Evo, or I'm misunderstanding something. Either way I need a log to compare.
There is at least a couple protocols, ones a Direct Access type, send two bytes, and you can read any RAM or ROM address, think they use it to read the flash image, but it would be handy for debugging also.
I'm trying to back track off the MUT table to name everything and figure out scaling for the axis.
But, my MUT table isn't agreeing with EvoScans, think Hamish might have it set up for a earlier Evo, or I'm misunderstanding something. Either way I need a log to compare.
from what i have gathered when going into write mode the ecu seems to shut down or go into sleep mode making it useless.if you need an ecu thats been bricked i can try source one to send it to you.but as far as i know none of the 7203FA processors have been sucessfully reflashed over here.
Evolved Member
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Ceddy can you post/pm/email xml you have so far?
And if you have time (because of snow calamity) I also have H8 TCU to be defined :P
And if you have time (because of snow calamity) I also have H8 TCU to be defined :P
Last edited by acamus; Feb 10, 2010 at 09:49 PM.
Evolved Member
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
ROMID 4015 @ 11000
ROMVER 01 @ 11002
so either
<internalidaddress>2fefa</internalidaddress>
<internalidstring>DM4015</internalidstring>
or
<internalidaddress>11000</internalidaddress>
<internalidhex>401501</internalidhex>
<scaling name="ECU ID" units="units" toexpr="x" frexpr="x" format="%06x" min="0" max="1e+08" inc="1" storagetype="int24" endian="big"/>
<table name="ECU ID" category="Misc" address="11000" type="1D" scaling="ECU ID"/>
ROMVER 01 @ 11002
so either
<internalidaddress>2fefa</internalidaddress>
<internalidstring>DM4015</internalidstring>
or
<internalidaddress>11000</internalidaddress>
<internalidhex>401501</internalidhex>
<scaling name="ECU ID" units="units" toexpr="x" frexpr="x" format="%06x" min="0" max="1e+08" inc="1" storagetype="int24" endian="big"/>
<table name="ECU ID" category="Misc" address="11000" type="1D" scaling="ECU ID"/>
Last edited by acamus; Feb 10, 2010 at 11:14 PM.
Evolving Member
Joined: Nov 2006
Posts: 223
Likes: 0
From: vienna,austria/scotland
Contact me at support@tactrix.com - i would like to get ahold of one of the trouble ECUs. I have been going back and forth for a year now with someone that was supposed to send me one, but it never seems to happen!
Thread Starter
Evolving Member
Joined: Nov 2007
Posts: 153
Likes: 2
From: East Europe
ROMID 4015 @ 11000
ROMVER 01 @ 11002
so either
<internalidaddress>2fefa</internalidaddress>
<internalidstring>DM4015</internalidstring>
or
<internalidaddress>11000</internalidaddress>
<internalidhex>401501</internalidhex>
<scaling name="ECU ID" units="units" toexpr="x" frexpr="x" format="%06x" min="0" max="1e+08" inc="1" storagetype="int24" endian="big"/>
<table name="ECU ID" category="Misc" address="11000" type="1D" scaling="ECU ID"/>
ROMVER 01 @ 11002
so either
<internalidaddress>2fefa</internalidaddress>
<internalidstring>DM4015</internalidstring>
or
<internalidaddress>11000</internalidaddress>
<internalidhex>401501</internalidhex>
<scaling name="ECU ID" units="units" toexpr="x" frexpr="x" format="%06x" min="0" max="1e+08" inc="1" storagetype="int24" endian="big"/>
<table name="ECU ID" category="Misc" address="11000" type="1D" scaling="ECU ID"/>
How do you know that is the romid?
Very curious is that i used the exactly the same 2 romid when testing the writing.
But i think this is not good, because i have 3 different files which are very different (evo7, evo8, ralliart) and the difference between them is more that 60% of the file, but they have the same internal ID, so i can open them all with this definition, which is not right.
Last edited by sba; Feb 11, 2010 at 03:19 AM.
Registered User
Joined: Nov 2007
Posts: 1,507
Likes: 2
From: Trinidad
i have used the evoscan ayc pump function to change my AYC fluid in th trunk. thats just normal evoscan.
this is exciting if we can actually get into these ECUs, any success with the IXs?
if you guys need any feedback from a JDM IX let me know
(i got a 1.3U cable though - i need to upgrade).
ideally i would like AYC off and the ACD tuned
this is exciting if we can actually get into these ECUs, any success with the IXs?
if you guys need any feedback from a JDM IX let me know
(i got a 1.3U cable though - i need to upgrade). ideally i would like AYC off and the ACD tuned
Table B1-B3 appear to be the ramp rate listed in bar of the pump control.
Snow is 2 bar idle
Tarmac is 4 bar
and I thought Gravel was 4 bar or so, but it could be the 59 value (5.9 bar I would presume).
The table listed as Table BIG is going to application versus speed on the Y and probably RPM on the X. Those zeros are the fully open spot during a launch and then the immediate 100% application pressure that likes to break center diffs and T-cases.
I would suggest downloading the GEMS ADC manual as well as the Motec for some better descriptions.
Snow is 2 bar idle
Tarmac is 4 bar
and I thought Gravel was 4 bar or so, but it could be the 59 value (5.9 bar I would presume).
The table listed as Table BIG is going to application versus speed on the Y and probably RPM on the X. Those zeros are the fully open spot during a launch and then the immediate 100% application pressure that likes to break center diffs and T-cases.
I would suggest downloading the GEMS ADC manual as well as the Motec for some better descriptions.
Registered User
Joined: Nov 2007
Posts: 1,507
Likes: 2
From: Trinidad
Table B1-B3 appear to be the ramp rate listed in bar of the pump control.
Snow is 2 bar idle
Tarmac is 4 bar
and I thought Gravel was 4 bar or so, but it could be the 59 value (5.9 bar I would presume).
The table listed as Table BIG is going to application versus speed on the Y and probably RPM on the X. Those zeros are the fully open spot during a launch and then the immediate 100% application pressure that likes to break center diffs and T-cases.
I would suggest downloading the GEMS ADC manual as well as the Motec for some better descriptions.
Snow is 2 bar idle
Tarmac is 4 bar
and I thought Gravel was 4 bar or so, but it could be the 59 value (5.9 bar I would presume).
The table listed as Table BIG is going to application versus speed on the Y and probably RPM on the X. Those zeros are the fully open spot during a launch and then the immediate 100% application pressure that likes to break center diffs and T-cases.
I would suggest downloading the GEMS ADC manual as well as the Motec for some better descriptions.
link?
will we eventually be able to do our own acd reflashes like how Gruppe-S does?
This is so ridiculously sick. My new house-mate has an OP2.0. I'm very willing to pull my IX rom if someone can give me instructions (since I have no experience with OP2.0).
http://www.gems.co.uk/?content=pages...ontrol-systems
http://www.motec.com.au/mdc/mdcoverview/
Looking at the other tables they are maybe versus slip angle? One would be longitudinal and the other might lateral vs steering wheel position? Not sure on them.
http://www.motec.com.au/mdc/mdcoverview/
Looking at the other tables they are maybe versus slip angle? One would be longitudinal and the other might lateral vs steering wheel position? Not sure on them.
