RX8 Flash Protocol

User topics relating to software that reflashes or modifes ECU code and data

Moderator: Freon

RX8 Flash Protocol

Postby jblaze » Thu Jul 20, 2006 7:40 pm

I am really keen to start hacking my Mazda RX8 ecu

Does anyone know what protocol the RX8 uses or how to gain access into the ECU? (It has denso ECU)
Posts: 8
Joined: Mon Jul 17, 2006 3:22 pm

Postby Freon » Thu Jul 20, 2006 7:41 pm

Generally a good way to get started on a new model is to get a spare ECU to Colby. But being a Denso is probably a plus.
Posts: 700
Joined: Thu Nov 17, 2005 5:50 pm
Location: Indianapolis, IN

Postby YP » Thu Jul 20, 2006 10:59 pm

just use one of web translators

User avatar
Posts: 35
Joined: Sun Feb 05, 2006 7:41 am

Postby hcvseik » Wed Sep 06, 2006 11:50 pm

Progress is being made. As for an affortable hardware on the market, there isn't any yet. Maybe the openport hardware may be modified to interface with its SCI port?

Posts: 3
Joined: Fri Jul 14, 2006 10:18 pm

Re: RX8 Flash Protocol

Postby spyder » Sat Jun 27, 2009 10:43 pm

Check on this link,


This company made a hardware/software to read and reflash the RX-8. Anyone want to decode the rom file with me?
Posts: 17
Joined: Thu Mar 15, 2007 9:07 pm

Re: RX8 Flash Protocol

Postby vansickey » Mon Aug 31, 2009 1:45 pm

Looks like a slight resurrection...
I just think it' might be worth sharing this info.
I've been using Harrison's Flasher with good results, for about a year. I have figured out several maps from my 04MT RX8. I can help with what I've found, but the disassembly isn't something I can do. My maps have been all about trial and error and intuition... and yes, you can make the ECU useless if you're not careful. I think I am on my 27th revision of my maps on my current ecu. I did have one ecu stop responding to flashes at around 100 flashes ( I was working on some lean burning maps), it still worked, I just couldn't make new flashes for it. With all that being said it has been a valuable tool, although the interface isn't the best I've used, it does work, and it's a lot cheaper than Cobb's solution, with the versatility to customise your own maps ( seperate software ) Once you get the unit I will help out with what I can.
Posts: 5
Joined: Wed Jul 30, 2008 10:22 am

Re: RX8 Flash Protocol

Postby otakurx » Fri Oct 23, 2009 12:37 pm

So a few others and myself have started back up on this. I'm looking for any information already found on this, no reason to re-invent the wheel ya know. Any way, I'm still in the early stages, only got my OpenPort2 on Monday and have been busy with work all week but hoping to make some headway this weekend, even if it's just some discovery work.
Posts: 9
Joined: Fri Oct 02, 2009 6:15 am

Re: RX8 Flash Protocol

Postby reddozen » Thu Oct 21, 2010 8:22 am

I'd be interested. I think one thing we need is a print out of all the data tables on an access port dump of an untuned ECU, and then dump the same ECU's rom and you can compare the access port dumps to the rom hex or an ASM disassembly to find all the tables.

I'd be nice to get into the S2 RX8's too...

I didn't realize this topic was a year old...
Posts: 1
Joined: Thu Oct 21, 2010 8:15 am

Re: RX8 Flash Protocol

Postby otakurx » Fri Feb 11, 2011 1:05 pm

Tho I'm not too active on this board, I'm still working on this project when I have time. I've had a chance to play with the Cobb AP for the RX-8 and have all the applications that go with it. I've made headway with the older S1 ROMs and am finishing off the mappings for the newer S1 ROMs but haven't gotten to check out anything with the S2 yet.
Posts: 9
Joined: Fri Oct 02, 2009 6:15 am

Re: RX8 Flash Protocol

Postby drifthappens » Fri Jul 01, 2011 8:21 pm

Im curious as to what you've gotten on the s1 rx8. I've been looking for something more DIY than the AP (and hopefully a bit cheaper) and the other couple programmers out there.
Posts: 1
Joined: Fri Jul 01, 2011 8:17 pm

Re: RX8 Flash Protocol

Postby oltmann » Tue Aug 16, 2011 10:30 pm

The OpenPort 2.0 can be used to flash the series 1 RX8. I know of a few options.
Mazda's own MMP

I guess MMP is the cheapest, as you can get it with a 72 hour subscription, but I'm not sure you can use it to flash a custom ROM -- looks like some reverse engineering would be needed. MMCFlash is just flashing software, while MazdaEdit provides an editor.

The ROMs disassemble the same way as other SH7055, but Mazda uses lots of FPU instructions so you may need to select SH4 as the proc type in Ida Pro, depending on which version you have. Version 6.1 does a good job with the ROMs I've seen OOTB. I suggest getting these register descriptions http://www.romraider.com/forum/viewtopic.php?f=25&t=5825

The RAM area is "0xFFFF6000 and Length is 0x7FFF"

If you download a trial of EcuEdit, it can locate most of the tables. You just have to point it to the start of the data section.

I see EcuFlash has an AUD mode? I don't know how that works, but the AUD pins are nicely layed out on the PCB. *shrug* Maybe that would be the free option.
Posts: 5
Joined: Tue Aug 16, 2011 9:45 pm

Re: RX8 Flash Protocol

Postby oltmann » Thu Feb 02, 2012 9:43 am

Well, I'll try asking here, because some smart people read this board occasionally.

As you can see in the picture above, this ecu has a second big chip. It is 132-pin BQFP. I think it is a Moto/Freescale... I've seen MC68332 suggested, but it is hard to tell them apart. Question is, what does it do?

I have been working on producing an XML for the RX-8, and I'm starting to reach a (low) level of competence with disassembly, but I still have no clue on how to figure this out.

Also, I found an RX8 rom online which has a completely different secondary bootloader that uses SCI. Most of them use CAN. Any guesses where it came from?
Posts: 5
Joined: Tue Aug 16, 2011 9:45 pm

Re: RX8 Flash Protocol

Postby oltmann » Mon Feb 06, 2012 8:43 am

Not really my question. I'm working on an XML so one can edit in a free editor. Many tools can find the maps, fix checksums, and flash. This is all well understood. The actual strategies used by the ecu are not well documented anywhere to my knowledge. The Cobb Accesstuner, which is the most popular solution, is very much incomplete and poorly documented. I don't think it has been under development since 2009.

Some info on the peripherals would help me understand the code. Some Renesas marketing mentions the idea of a sub-mcu. Perhaps the second mcu is used for processing the knock signal?
Posts: 5
Joined: Tue Aug 16, 2011 9:45 pm

Re: RX8 Flash Protocol

Postby Sasha_A80 » Mon Feb 06, 2012 11:33 am

"Second" MCU is used for throttle control.
Posts: 102
Joined: Sun Aug 31, 2008 3:04 am
Location: Saratov, Russia

Re: RX8 Flash Protocol

Postby oltmann » Thu Feb 09, 2012 6:10 pm

Thanks! I was hoping you'd respond.
Posts: 5
Joined: Tue Aug 16, 2011 9:45 pm


Return to Reflashing Software

Who is online

Users browsing this forum: No registered users and 2 guests