68HC(9)16 Bootloader!

Developer topics relating to software that reflashes or modifes ECU code and data

Moderator: Freon

68HC(9)16 Bootloader!

Postby psyche » Sat Nov 07, 2009 6:11 pm

Hi there,

i have a Suzuki TL1000R bike which uses a 16bit Denso ECU. Till now at the tlzone forum we have recognised the MCU which is a 68HC916R1 variant and i have programmed an app for the PD BDM cable to read and write the ecu from the BDM port. On my bike i have the moded ecu with modded maps, we haven't found all of them yet but we are progressing, and it runs really good!

I am writing to this forum because i trying to find a way to reflash the ecu from the main connectors. I have read that the early Subaru uses some kind of bootloader to do that. Here is what i have till now:

There are 2 serial communication ports from the cpu to the main connectors. These are SCIA and SCIB. Both use a mux circuit for one wire communication.

SCIB is used for communication between the ECU and the Dashboard. This transmits useful data to the Dash and if i ground a pin from the ECU i can see trouble codes in the Dashboard. I can even set the TPS sensor in this mode. This is a standard to all the Suzuki bikes.

SCIA has a mux circuit that i mentioned before and the pin at the main connector doesn't connect anywhere. The circuit has all the components. So it is functioning. I used a FT232 TTL dongle set at different baudrates but i can't get any data. It is like it is waiting for a wake up signal or a command. I have to tell you that Suzuki implemented the OBDII protocol to bikes produced after mine, so it isn't OBDII.
Is there a possibility that my ECU has a bootloader? If yes how can i search for it's wake up command? If not can i program a bootloader in the firmware? I have the firmware and the map data saved at different files. I have used IDA pro 5.1 to disassemble the firmware but i am not an expert, so maybe i have done mistakes. I can't even find code for the pin that i ground to get the trouble codes to the dash, so maybe my disassembled file is wrong.

I am asking for your help because you have experience in the Subaru 68HC16 ECU. There are friends that help me in this too and one of them posts here as Rhinoman. He has done some marvelous work on the Suzuki car ECUs!

Please if you can help us in that project. I have learned many from this project and i want to learn more. Everyday i live, I learn more!

This file contains the firmware and the map data as is in the MCU. The start is at $1000.
(48 KiB) Downloaded 776 times
Posts: 5
Joined: Sat Nov 07, 2009 5:20 pm
Location: Greece

Re: 68HC(9)16 Bootloader!

Postby Rhinoman » Thu May 20, 2010 1:12 am

What I found is that if the bootloader is present then the reset vector will point to the bootloader code. If the FCCP pin is not grounded then the code will jump to the beginning of the main code. Analysing the reset vectors from your hex file shows that it jumps directly to the main code, its still possible that it can jump from there to a bootloader, you need to analyse the first part of the main code. You ECU differs from those that I've looked at because you have a 68HC916R which has no TPU and hence no TPU Flash memory.

Just to add to the above, I have determined that the bootloader used in some Suzuki ECUs uses the protocol published here:

http://translate.google.co.uk/translate ... n%26sa%3DG

I haven't fully disassembled it so far but I have found the 'S' message structure and another 'M' message which so far is unknown and may just be an initialisation command. The ECU checks the 'FCCP' pin on power up to determine whether or not to execute the bootloader. Before executing the jump to the kernel the bootloader checks the second and third bytes of the kernel to validate it, this seems to tally with the source code published by Colby for the Subaru HC16 kernel. Also the bootloader is located in TPU EEPROM which also tallies with the Subaru.
Posts: 27
Joined: Thu Jan 11, 2007 3:53 am
Location: High Wycombe, UK

Return to Reflashing Software

Who is online

Users browsing this forum: No registered users and 1 guest