JECS ROM Download

[NoCtrl]

you can try this, who knows it might not be encrypted

This one my be interesting.

32bit instructions will always start at adresses ending with xxx0,xxx4,xxx8,xxxc and they have msb=1
16bit instr can start at xxx0,xxx2,xxx4,xxx6,xxx8,xxxa,xxxc,xxxe.
Because of this theres a special NOP to fill inn holes before a 32bit. This NOP is F000

So, a search for F000 gives plenty matches with the next 32 bit word have msb set.

Now, theres a need for a disassembler...
Anyone else looking at this?

[west_minist]

you can try this, who knows it might not be encrypted

How did you get this? Is it an ECUTek flash for a 99/00?

[xswrex]

you can try this, who knows it might not be encrypted

How did you get this? Is it an ECUTek flash for a 99/00?

i took the rom posted above and "processed" it a bit, how this is done i cannot say.....
the ecu id is 0x16 0x04 0x69 0x06 0x05, that makes it a JDM P1 ag340.
I dont know if it is modified or not

[STi6]

you can try this, who knows it might not be encrypted

This one my be interesting.

32bit instructions will always start at adresses ending with xxx0,xxx4,xxx8,xxxc and they have msb=1
16bit instr can start at xxx0,xxx2,xxx4,xxx6,xxx8,xxxa,xxxc,xxxe.
Because of this theres a special NOP to fill inn holes before a 32bit. This NOP is F000

So, a search for F000 gives plenty matches with the next 32 bit word have msb set.

Now, theres a need for a disassembler...
Anyone else looking at this?

I compared the file to a Denso ecu file in a disassembler. I see what you mean by the F000, but surely the values that we want to view/edit will only be 8 or 16 bit?

[NoCtrl]

I compared the file to a Denso ecu file in a disassembler. I see what you mean by the F000, but surely the values that we want to view/edit will only be 8 or 16 bit?

heh, I want to see the code

I have not looked at the Denso dumps/ECUs at all,.. ..yet...,
so I dont know how similar processors used in later Denso ECUs are..

I commented on the F000 NOP instruction because:
- mybe confirm m32 processors in JECS ECUs
- mybe confirm a valid uncoded dump
..and after looking at the file, there must be a processor that are close to the m32, but I dont know how close yet..

Do you have/know of a disassembler that can disassemble this file?

[cboles]

IDA Pro Advanced works fine with M32R. I've used it on Mitsubishis.

Colby

[NoCtrl]

[quote="cboles"]IDA Pro Advanced works fine with M32R. I've used it on Mitsubishis.
/quote]

Advanced is priced to 639EUR/875USD..

So, there are no alternatives..??

[cboles]

not really that i've seen. i broke down and spent the $875.

[NoCtrl]

I have started on a python script, with a optimistic goal of disassemble the m32 processor instructions.
I have some spare time now, and doing this mostly as a learning experience.
I havent done any programming in 10 years, and never anything in python, so things move slowly forwards.
If I can get it usable/working I will publish it..

[STi6]

The software dissasemler I use is W32Dasm. It's not hard to get a hold of.
*edit*
I've realised that disassembling these roms with a normal Win32 80x86 dissasemler is pretty much useless, since they are made to run on a MR32 processor

[Hitokiri]

There are obvious maps in this file, but nothing that screams ignition and fuel maps like I have seen in denso ecus

there seems to be some 8x8 and some 16x16 maps int ehre for sure.

[west_minist]

There are obvious maps in this file, but nothing that screams ignition and fuel maps like I have seen in denso ecus

there seems to be some 8x8 and some 16x16 maps int ehre for sure.

Hey Hitokiri, what are you using to view the file?

[xswrex]

this looks like a main fuel map
LOAD @ 0x136f
RPM @ 0x137f
AFR @ 0x138f

[Hitokiri]

xswrex I agree

I am not sure of the conversions I used. RPM seems to be right in the normal *50 conversion. Load is unsure at this point as we cannot be sure what these ecus use for load. I know I have a engine load parameter that shows up in my ecuexplorer that is 0-100% so I simply did [value]*2 to get data that looked good for that scaling.

The data conversion was a guess too keeping the convention of the ecuedit tools with: 14.7*(128/[value]) seemed to be simple enough and give good results.

Here is the map in question:

[STi6]

These ECU's use a combination of factors for load according to my tuner. Some of these factors are, MAF sensor g/s. Throttle position and maybe some others.

I was in my car yesterday when it got tuned and the Load Values are all numbers with decimals, not real numbers like 50,60,70 etc.