Well... it's definitely there.

So not only is there a calibrationshop ID which needs to be altered to go into flashing mode, but there is also a Mode10/85 counter (Mode10 is generic init, 10/85 is programming session request)

I tested it out, with ECUFlash at least it gets incremented every time the ECU is told to go into a programming session.

It looks like it can be reset, but without knowing what a factory counter looks like its kinda pointless at this stage.

Interestingly enough, Mode21+C0 (Which is Coding Counter request from MUTIII) doesn't actually reference the right memory variable, it returns the string one byte AFTER the counter..

Anyway's the ECU has a Serial EEPROM Chip in it - which is used to STORE things like VIN/Variant Coding and obviously the flash counter when the ECU's power is removed...

Pretty cool stuff..

FWIW - my bench ECU is upto 0x49, and tomorrow I might connect to my car ECU to see what its up to

Cheers
D

 

Great find man!

 

Cool.

And for those who don't understand Hexadecimal, 0x49 = 73. That is a lot of flashes.

 

Yeah, but wait for the counter in tephra's on-road ECU!

Rich

 

maybe we shouldnt have this online where MMSA can see?

 

What happens when the count reaches 0xFF?

 

it loops over..

 

So this means that there IS a way to find out if someone has actually flashed its rom, right?
Would it help to have a stock new car to see what the flash counter actually shows?
I will get my car (EDM) in a few weeks. After that I could report.

IMHO the best trick to always have the factory setting would be to read the current value before flashing, flash the new rom and then reset the counter to the old value. But I fear this would involve additional tools/steps when flashing a rom.

 

yeah it would be nice to see what the value is for a virgin ecu.

and if people are interested I can probably write a program to reset it to whatever.

but i dont think this is the process mitsu use to invalidate warranty

because this counter is also incremented when mitsu update the ECU using MUTIII

 

Correct. But I fear that if the counter is much higher than the number of ECU updates this could be an indicator for hacking/mapping attempts.
Anyway as you wrote MUTIII reads the wrong value so it seems no Mitsu technican would be able to read the current value.

BTW. in some data sheet for the M32182F8 I read that the system is rated for only 100 flashes. I know that the ECU actually uses another CPU but don't know how much flashes are possible with that ECU board. Do you or anyone else have much more than 100 already?

 

100 is the recommended.

same thing for CT9A...

but we had people with 1000's of writes..

so yeh, im sure its fine..

I will see what how many writes my real ECU has... later

 

Good info, thanks for finding this! I wonder what my counter is up to...

 

interesting. Would also be curious to see a before and after flash count of the Cobb AP being unmarried. I thought Cobb mentioned this counter BUT when flashed back to stock, it also flashed the original flash count back as well....

 

I can't wait to see what my car's ecu is at. I'll wait until after this tuning session tomorrow but I've been street tuning for about a month now...

 

I'd imagine mine is at least twice that, I've been flashing my ECU an average of 5x a week the last couple months. Some days 10+.

:-/