I came across this link today when doing some research..

http://kaele.com/~kashima/car/evo/index.html

The ECU is from an earlier Evolution, but it clearly states the programming protocol and the CPU in this ECU is similar to the Evo8..

I think it also shows a data dump process for extracting the data from the ECU.. (But the translation isn't too good)

I thought this might be of some interest to some of you electronics gurus..

Anyone who can make some sense of this PLEASE CONTACT ME.. I was only able to get a rudmentary translation of the Japanese, some of it sounded like gibberish after translating.

The ECU appears to be a EVO 6 or 7..

What is important however is the data rate, the diagnostic connector wiring, and the trigger code to put the ECU into programming mode..

 

I have additional relevent information but this is what I have to start with.. this could be the key to being able to reflash our own ECU..

 

Now that would be worth it's weight in gold!

 

I'm hoping this pans out a bit.. I would need a spare OE ECU to test this though..

 

You may need a body guard after this. There will be some seriously pissed off tuners out there.

 

Nah I think he will be ok, there is a differnce in being able to flash you own ecu and being able to tune. What it will hurt is throught the mail type flashes. Even then the person may not know what he is getting into.

 

Slightly OT, sorry, but has anyone got 2 ECU's working on the same car yet?

 

Well, I am a Gov't employee who has "offically peered from the roof top" while the President was voting...

 

MJ .. thanks for the find .. note the red lettered warnings .. the flash rom can only survive 100 read/writes he's argument is who needs 100 read/write to get a working ECU ..

also mentioned is you need to make the comm cable and software to be able to hack the ecu .. he also cautioned the wrong info sent will erase the rom data also .. not careful and you end up with a dead ecu .. .. not as easy as you think ..

 

Yep.. I'm fully aware of it. .Fortunately if you wipe it, it goes into a programming mode where you can rewrite it..

But that was also surprising is the 100 writes limit.. I suspect that may not apply to newer flash roms though since they have amuch greater lifespan of the flash roms from 99..

What I really want is to initially be able to extract the rom data and disassemble it.. I know the MCU its running, I know the instruction set.. I'm curious to see what the code and data does.

 

Although its offtopic, its a good point.. As far as I can tell, the Immobilizer gets data from the ECU which means the Immobilizer itself gets programmed for the ECU.. then the ECU gets a signal from the Immobilizer whether or not to "Start up"

I'm wondering if there is a way to "Disconnect" the immobiliser wire and it effectively disables it.. but I'm the wrong person to answer this, and this is the wrong thread.

 

http://www.dlpdesign.com/dlptxrx-v12-ds.pdf

Turns out that the MCU has some sort of JTAG which should be able to be programmed with the above device (USB to TTL-Serial adapter)