openecu.org

Finaly I get the ECU of the Lancer EVO X to work on.....

and in 10 min. we done the reading....

See the picture of the ecu below connect to Serial Suite Piasiniengineering.

Christian Piasini
R&D Piasiniengineering

And then... ?

FrSTi wrote:And then... ?

and then he'll wants a lot of euro...

DarkECU wrote:

FrSTi wrote:And then... ?

and then he'll wants a lot of euro...

That's not the right place to advert

Any new developements here. I would love to be able to tune my evo x in the near future. What software did you use to read/writee from the ECU?

here is Evo-X Euro rom

i've just looked it for a small time and found some maps fast

<map name="Timing Map High Octane" type="3" active="1" help="" class="Timing" map_struct="" level="0">
<rows count="23" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="22" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data count="1" offset="#5590B" storagetype="int8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc="" inc="1" incb="5" incdata="0" incdatab="0" inc_dir="1" order="rc" color_dir="1"/>
</map>

<map name="Timing Map Low Octane" type="3" active="1" help="" class="Timing" map_struct="" level="0">
<rows count="23" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="22" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data count="1" offset="#55B0D" storagetype="int8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc="" inc="1" incb="5" incdata="0" incdatab="0" inc_dir="1" order="rc" color_dir="1"/>
</map>

<map name="VVT" type="3" active="1" help="" class="Mivec" map_struct="" level="0">
<rows count="24" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="21" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data scaling="Evo32_data_VVT_Angle" count="1" offset="#5D7F7" order="rc" color_dir="1"/>
</map>

<map name="VVT2" type="3" active="1" help="" class="Mivec" map_struct="" level="0">
<rows count="24" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="21" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data scaling="Evo32_data_VVT_Angle" count="1" offset="#5D9F7" order="rc" color_dir="1"/>
</map>

<map name="VVT3" type="3" active="1" help="" class="Mivec" map_struct="" level="0">
<rows count="24" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="21" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data scaling="Evo32_data_VVT_Angle" count="1" offset="#5DBF7" order="rc" color_dir="1"/>
</map>

<map name="VVT4" type="3" active="1" help="" class="Mivec" map_struct="" level="0">
<rows count="24" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="21" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data scaling="Evo32_data_VVT_Angle" count="1" offset="#5DDF7" order="rc" color_dir="1"/>
</map>

<map name="Fuel Map Low Octane1" type="3" active="1" help="" class="Fuel" map_struct="" level="0">
<rows count="21" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="16" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data scaling="Evo32_axis_AFR" count="1" offset="#55027" storagetype="uint8" order="cr" color_dir="1"/>
</map>

<map name="Fuel Map High Octane" type="3" active="1" help="" class="Fuel" map_struct="" level="0">
<rows count="21" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="16" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data scaling="Evo32_axis_AFR" count="1" offset="#5517F" storagetype="uint8" order="cr" color_dir="1"/>
</map>

<map name="Fuel Map Low Octane" type="3" active="1" help="" class="Fuel" map_struct="" level="0">
<rows count="21" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="16" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data scaling="Evo32_axis_AFR" count="1" offset="#552D7" storagetype="uint8" order="cr" color_dir="1"/>
</map>

<map name="Fuel Map High Octane1" type="3" active="1" help="" class="Fuel" map_struct="" level="0">
<rows count="16" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<cols count="21" offset="#0" storagetype="uint8" func_2val="[value]" func_val2="[value]" format="%.2f" metric="" caption="" desc=""/>
<data count="1" offset="#5542F" storagetype="uint8" func_2val="14.7/([value] / 128)" func_val2="[value]" format="%.2f" metric="" caption="" desc="" inc="1" incb="5" incdata="0" incdatab="0" inc_dir="1" order="rc" color_dir="1"/>
</map>

Got an XML file yet

fuel rpm offset: 60946
fuel load offset: 60876
ign rpm offset: 609D8
ign load offset 60A0C
mivec load offset: 60dde
mivec rpm offset: 6104a

What MCU is it? I want to disassemble the ROM, but can't find an entry point so far by using a guess of M32R variants.

Entry point seems to be 0, but I can't work out the memory mapping yet or which M32R to use to get the right instructions...

"The EIT vector entry is located at the beginning of the internal ROM/extended external areas. The branch instruction
for jumping to the start address of each EIT event processing handler is written here. Note that it is the branch
instruction and not the jump address itself that is written here."

The first bytes are actual code, not a vector... change it to code and you can start to disassemble the code. I'm moving house in 48 hours and have boxes everywhere, wish I could play more.

What chip is this based on?

M32176 appears as text in the ROM, but the 32176 is only 512k flash ROM whereas this image is 1024k.

I see a nice map at A62D5, maybe can be the read sequence...


Below the picture of the MCU



Best regards


Christian Piasini
R&D Piasiniengineering

I see a nice map at A62D5, maybe can be the read sequence...

lol I guess this ROM is one of yours...