Support for tiburons

Announcements, dicussion about any topic that would have broad interest to the forum members

Moderator: Freon

Postby TiburonRaven » Tue Oct 03, 2006 12:45 pm

i don't even know do i need to ask if i missed something:) so having an obd2 diagnostics cable and kwp2000 program i can download my flash too? and uploading?
TiburonRaven
 
Posts: 9
Joined: Mon May 08, 2006 2:29 pm

Postby TiburonRaven » Tue Oct 03, 2006 1:31 pm

is there maybe a damos file or plugin for hyundai for any program out there ready?

12x16 timing maps?
TiburonRaven
 
Posts: 9
Joined: Mon May 08, 2006 2:29 pm

Postby pewp » Tue Oct 03, 2006 2:35 pm

what do we need to pull the info off the ecu?

all i got is the elmscan hardware.
pewp
 
Posts: 7
Joined: Mon May 08, 2006 8:00 am
Location: ChicagoLand, IL

Postby dzignr_tastz » Thu Oct 12, 2006 12:40 pm

Alright. So Pewp and I now have the ROM and can view the HEX code. Now what? Is there a nice tutorial somewhere that will help explain what we're looking for, so we can attempt to contribute in some way?

And Freon... you've got a YM. :wink:
dzignr_tastz
 
Posts: 2
Joined: Thu Oct 12, 2006 7:26 am
Location: Western NC

Postby Freon » Thu Oct 12, 2006 2:22 pm

You can browse around and look for patterns and likely find a few 3D maps. I use Ecuedit. Put it in 1byte and 2byte modes, scroll up and down, change the "row length" if you spot anything. I was able to find a small handful of maps, like what I assume is the main timing map, but nothing terribly useful so far.

Here's what the timing map looks like:
http://freon.shackspace.com/car/ecu%20a ... ronign.png

If I change the row length to 12, it looks even more obvious.

I tried to disassemble it but no dice. I'm not sure the processors I'm trying to use are correct (Siemens C166, C167, etc), but I'm not terribly skilled at disassembly to begin with.
Freon
 
Posts: 700
Joined: Thu Nov 17, 2005 5:50 pm
Location: Indianapolis, IN

Postby dzignr_tastz » Fri Oct 13, 2006 5:32 am

Well that's easy enough... but I suppose I'm trying to take it to the next level.

I've been studying some of the maps (and the HEX data and XML code) from your BIN and description file you posted up on NT.com, and even noticed that you apparently wrote a basic description file for that timing map. I'm just trying to determine from what I currently have to look at how you did that, and how you decided exactly where it started and ended?

I'm assuming this is the "disassembly" portion of it? Forgive me if I'm way off base, but I'm a noob to all this...

Also - could you post up that defs file, so I can look at it as well?

Another thing (adding to this as I go along - LOL). I'm assuming that setting it to 12 rows (as suggested) is where you came up with the 12x16 map? Just guessing as when I do so, that's the data block dimensions of the gradient in question.

If I'm correct on this theory, take a look at 0A953 on an 8 row, 1 bit setup. It looks like there are 8 consecutive (and similar) 8x8 maps there (although I have no clue what they may be.
dzignr_tastz
 
Posts: 2
Joined: Thu Oct 12, 2006 7:26 am
Location: Western NC

Postby mac11 » Fri Oct 13, 2006 8:16 am

Can someone send me what we have so far?

I am assuming this is from pewps v6 ecu? Do we have one for an i4 yet?
mac11
 
Posts: 3
Joined: Fri Oct 13, 2006 8:14 am
Location: chicagoland

Postby SLY » Fri Oct 13, 2006 11:06 am

USe the demo version of winols. It can be found at www.evc.de

From winols, open up the bin file that is posted.

The software will automatically detect possible maps. Make sure to enable the "Statistical Map Search" function from the config window.

Double click on the possible map address posted in this thread (9D4C)- you will see a nice 3d timing graph.

Problem, I still have not figured out how to make sense of the axis values.

Question : How do I do a rom dump on the HYUNDAI ECUs. What is the software/hardware needed.
SLY
 
Posts: 1
Joined: Sun May 14, 2006 9:53 pm

Postby mac11 » Mon Oct 16, 2006 5:33 am

thanks sly. i didnt see the files posted up. I didn't realize i had HTML turned off by default in my profile.
mac11
 
Posts: 3
Joined: Fri Oct 13, 2006 8:14 am
Location: chicagoland

Postby mac11 » Mon Oct 16, 2006 6:18 am

and the 2 labeled axis are just the memory location and the value stored there.
mac11
 
Posts: 3
Joined: Fri Oct 13, 2006 8:14 am
Location: chicagoland

Postby TiburonRaven » Fri Oct 20, 2006 1:01 pm

Freon i'm pretty sure the processor is C176CR although i'm not inclined in reverse engineering, it's what Colby told me earlier. anyways i have a full version of WinOLS, and i have a new i4 file , that was given to me by ukrainian guys, who pulled the ecu dump. i don't know what did they do to download it , but they left alone the tries to correct it for the client. so i have the unmodified version.
http://www.napkinripcord.com/ecuroms/5WY1689.ORI
thanks for pewp for hosting
TiburonRaven
 
Posts: 9
Joined: Mon May 08, 2006 2:29 pm

Postby pewp » Mon Jan 15, 2007 7:24 am

anyone heard from cboles on this? i sent a PM to him a few weeks ago asking about the ecu i sent him with no responses.
pewp
 
Posts: 7
Joined: Mon May 08, 2006 8:00 am
Location: ChicagoLand, IL

Postby DrivingTibNaked » Sun Feb 25, 2007 7:42 pm

bump
DrivingTibNaked
 
Posts: 2
Joined: Fri Feb 23, 2007 4:11 pm
Location: Fort Jackson, SC

Postby DrivingTibNaked » Tue Mar 20, 2007 2:17 am

So what's the name of the program you have to upload to the flash before downloading?
DrivingTibNaked
 
Posts: 2
Joined: Fri Feb 23, 2007 4:11 pm
Location: Fort Jackson, SC

Postby salex » Tue Mar 20, 2007 3:48 am

Since this ECU has a separate memmory chip, it is easy to read/write the contents once you have removed the chip.
Most tuners solder an adaptor so that you can remove the chip easily and make alterations to your program.

This is how they've managed to read eprom contents.
Reading/flashing through OBD is described in the KWP2000 protocol. But each ecu model/software revision/brand has its own seed keys, so it takes a while before they are unlocked.

Denso Ecus do not store their contents into a separate chip, so we can only program them through OBD or try on-board flashing utilities which require serious electronic skills (ie Colby).

I am not really sure if the openport cables can support kwp2000 or kwp2000 over CAN, so we might be needing new tools.
salex
 
Posts: 72
Joined: Wed Jun 21, 2006 2:30 pm
Location: Greece

PreviousNext

Return to General Discussion

Who is online

Users browsing this forum: No registered users and 16 guests

cron