Page 1 of 2

RX8 Flash Protocol

PostPosted: Thu Jul 20, 2006 7:40 pm
by jblaze
I am really keen to start hacking my Mazda RX8 ecu

Does anyone know what protocol the RX8 uses or how to gain access into the ECU? (It has denso ECU)

PostPosted: Thu Jul 20, 2006 7:41 pm
by Freon
Generally a good way to get started on a new model is to get a spare ECU to Colby. But being a Denso is probably a plus.

PostPosted: Thu Jul 20, 2006 10:59 pm
by YP
just use one of web translators

PostPosted: Wed Sep 06, 2006 11:50 pm
by hcvseik
Progress is being made. As for an affortable hardware on the market, there isn't any yet. Maybe the openport hardware may be modified to interface with its SCI port?

Re: RX8 Flash Protocol

PostPosted: Sat Jun 27, 2009 10:43 pm
by spyder
Check on this link,

This company made a hardware/software to read and reflash the RX-8. Anyone want to decode the rom file with me?

Re: RX8 Flash Protocol

PostPosted: Mon Aug 31, 2009 1:45 pm
by vansickey
Looks like a slight resurrection...
I just think it' might be worth sharing this info.
I've been using Harrison's Flasher with good results, for about a year. I have figured out several maps from my 04MT RX8. I can help with what I've found, but the disassembly isn't something I can do. My maps have been all about trial and error and intuition... and yes, you can make the ECU useless if you're not careful. I think I am on my 27th revision of my maps on my current ecu. I did have one ecu stop responding to flashes at around 100 flashes ( I was working on some lean burning maps), it still worked, I just couldn't make new flashes for it. With all that being said it has been a valuable tool, although the interface isn't the best I've used, it does work, and it's a lot cheaper than Cobb's solution, with the versatility to customise your own maps ( seperate software ) Once you get the unit I will help out with what I can.

Re: RX8 Flash Protocol

PostPosted: Fri Oct 23, 2009 12:37 pm
by otakurx
So a few others and myself have started back up on this. I'm looking for any information already found on this, no reason to re-invent the wheel ya know. Any way, I'm still in the early stages, only got my OpenPort2 on Monday and have been busy with work all week but hoping to make some headway this weekend, even if it's just some discovery work.

Re: RX8 Flash Protocol

PostPosted: Thu Oct 21, 2010 8:22 am
by reddozen
I'd be interested. I think one thing we need is a print out of all the data tables on an access port dump of an untuned ECU, and then dump the same ECU's rom and you can compare the access port dumps to the rom hex or an ASM disassembly to find all the tables.

I'd be nice to get into the S2 RX8's too...

I didn't realize this topic was a year old...

Re: RX8 Flash Protocol

PostPosted: Fri Feb 11, 2011 1:05 pm
by otakurx
Tho I'm not too active on this board, I'm still working on this project when I have time. I've had a chance to play with the Cobb AP for the RX-8 and have all the applications that go with it. I've made headway with the older S1 ROMs and am finishing off the mappings for the newer S1 ROMs but haven't gotten to check out anything with the S2 yet.

Re: RX8 Flash Protocol

PostPosted: Fri Jul 01, 2011 8:21 pm
by drifthappens
Im curious as to what you've gotten on the s1 rx8. I've been looking for something more DIY than the AP (and hopefully a bit cheaper) and the other couple programmers out there.

Re: RX8 Flash Protocol

PostPosted: Tue Aug 16, 2011 10:30 pm
by oltmann
The OpenPort 2.0 can be used to flash the series 1 RX8. I know of a few options.
Mazda's own MMP

I guess MMP is the cheapest, as you can get it with a 72 hour subscription, but I'm not sure you can use it to flash a custom ROM -- looks like some reverse engineering would be needed. MMCFlash is just flashing software, while MazdaEdit provides an editor.

The ROMs disassemble the same way as other SH7055, but Mazda uses lots of FPU instructions so you may need to select SH4 as the proc type in Ida Pro, depending on which version you have. Version 6.1 does a good job with the ROMs I've seen OOTB. I suggest getting these register descriptions

The RAM area is "0xFFFF6000 and Length is 0x7FFF"

If you download a trial of EcuEdit, it can locate most of the tables. You just have to point it to the start of the data section.

I see EcuFlash has an AUD mode? I don't know how that works, but the AUD pins are nicely layed out on the PCB. *shrug* Maybe that would be the free option.

Re: RX8 Flash Protocol

PostPosted: Thu Feb 02, 2012 9:43 am
by oltmann
Well, I'll try asking here, because some smart people read this board occasionally.

As you can see in the picture above, this ecu has a second big chip. It is 132-pin BQFP. I think it is a Moto/Freescale... I've seen MC68332 suggested, but it is hard to tell them apart. Question is, what does it do?

I have been working on producing an XML for the RX-8, and I'm starting to reach a (low) level of competence with disassembly, but I still have no clue on how to figure this out.

Also, I found an RX8 rom online which has a completely different secondary bootloader that uses SCI. Most of them use CAN. Any guesses where it came from?

Re: RX8 Flash Protocol

PostPosted: Mon Feb 06, 2012 8:43 am
by oltmann
Not really my question. I'm working on an XML so one can edit in a free editor. Many tools can find the maps, fix checksums, and flash. This is all well understood. The actual strategies used by the ecu are not well documented anywhere to my knowledge. The Cobb Accesstuner, which is the most popular solution, is very much incomplete and poorly documented. I don't think it has been under development since 2009.

Some info on the peripherals would help me understand the code. Some Renesas marketing mentions the idea of a sub-mcu. Perhaps the second mcu is used for processing the knock signal?

Re: RX8 Flash Protocol

PostPosted: Mon Feb 06, 2012 11:33 am
by Sasha_A80
"Second" MCU is used for throttle control.

Re: RX8 Flash Protocol

PostPosted: Thu Feb 09, 2012 6:10 pm
by oltmann
Thanks! I was hoping you'd respond.