JECS ROM Download

[xswrex]

These ECU's use a combination of factors for load according to my tuner. Some of these factors are, MAF sensor g/s. Throttle position and maybe some others.

I was in my car yesterday when it got tuned and the Load Values are all numbers with decimals, not real numbers like 50,60,70 etc.

Hitokiri just used a multiplier that resulted to some sensible numbers. Maybe you can help by posting some load numbers? then we can find the multiplier!

[STi6]

Yes he did find numbers that look very correct. I don't have a clue as to what the correct formula is, I just got the answer I mentioned in my previous post when I posed the question to the tuner.

Also that fuel map looks pretty standard to me, we'd have to find the Ignition timing map aswell to say for sure.

[Hitokiri]

well, I found what is definitely an ingition timing map, but it doesn't make much sense to me. It looks alright although kind of a hack job tune, the idle portion is all wrong however. This map has the car idling with more 20 degrees timing which is wrong. I converted some of the ec**K maps that they have on their site for the 99-00 EU and japanese ecus to see what to expect and they much more normal from what I have seen on stock denso programs.

I try and post the ignition map later tonight. another thing thats weird is there seems to be a ignition correcton map of sorts in there. As if this car had active ignition timing a la denso ECUs. The timing map in question is also repeated exactly in different parts of the rom, which is weird. I would expect also there to be low and high det fuel maps in there. I've been looking for boost targets and WG maps with no success as well.

[STi6]

Does anyone have any other maps besides the one posted here. I can then write a program to compare the two and mapping addresses should stick out.

[STi6]

I notice there is some stuff going on from 0x1b2d up to 0x1b4b.
Don't know what, maybe usefull though later.

[Hitokiri]

ok I threw some more maps I found up there.

There are for sure way more in there as I haven't started playing with 2 byte data in there. I can't seem to find the axis scaling for the boost and WG maps, but it was cool to see that the map data for the boost target and WG target maps seems to use the same data conversion from hex as the Denso maps. I am almost 100% sure that those maps are right.

STi6, the data you saw at 0x1b2d seems to be axis information for the map which follows it. You can see this map in my pic below in the lower right with the steps in the data. The axis information seems to go 0-255 and 0-240 on this map. I didn't put it on there as Im not sure what it is..

The map directly above that I named "Main Ignition Map21" is a little confusing. I am not sure what we are looking at there. I though it might be some kind of ingition learning, but I'm not sure about that at all. Disassembly with show the truth.

[STi6]

Here is some kind of 2Byte map, looks a bit weird so maybe I got it wrong, but there is definitly some pattern.

Row #0246D
Col #0248D
Data #024AD

[NoCtrl]

Can someone with IDA post a disassembly?
I shure would like to see it

[STi6]

Can someone with IDA post a disassembly?
I shure would like to see it

[NoCtrl]

Thanks, but sorry, (that file extracted to a 144MB text file.. )
Theres no opcodes in there..
What I would like to see is something like this:

Code: Select all

adress: Data:           Decoded instructions:
------  -------------   ----------------------
0x3000  0xA193,0x0080   LDUB   R1,@(0x0080,R3)
0x3004  0x80C1          ADDI   R0,0xC1
0x3006  0x0001          SUBV   R0,R1
0x3008  0xB080,0x0005   BEQZ   R0,0x0005


(This is output code from my script at a random choosen adress)
With output like this I can check my script for opcode errors,
and I can start on definitions for the maps, and other data arrays..

[xswrex]

i did a simple approach, search for the hex load/rpm values that appear in the addresses i posted before
LOAD @ 0x136F
RPM @ 0x137F

well what do you know....exactly the same are here (and nowhere else)
LOAD @ 0x0820
RPM @ 0x835

now there should be some maps around that region, and yes it seems that before 0x0820 are at least 5x256bytes blocks with ignition?? related data.

as a side note, these axis data being only in these 2 places makes me think that they are shared for ignition/fuel maps. It makes sense to me anyway....

[STi6]

Thanks, but sorry, (that file extracted to a 144MB text file.. )
Theres no opcodes in there..
What I would like to see is something like this:

Code: Select all

adress: Data:           Decoded instructions:
------  -------------   ----------------------
0x3000  0xA193,0x0080   LDUB   R1,@(0x0080,R3)
0x3004  0x80C1          ADDI   R0,0xC1
0x3006  0x0001          SUBV   R0,R1
0x3008  0xB080,0x0005   BEQZ   R0,0x0005


(This is output code from my script at a random choosen adress)
With output like this I can check my script for opcode errors,
and I can start on definitions for the maps, and other data arrays..

I will check, this is what IDA gave me when I dissasemled. If anyone can tell me how to get the correct data in IDA, pls tell.

[STi6]

i did a simple approach, search for the hex load/rpm values that appear in the addresses i posted before
LOAD @ 0x136F
RPM @ 0x137F

well what do you know....exactly the same are here (and nowhere else)
LOAD @ 0x0820
RPM @ 0x835

now there should be some maps around that region, and yes it seems that before 0x0820 are at least 5x256bytes blocks with ignition?? related data.

as a side note, these axis data being only in these 2 places makes me think that they are shared for ignition/fuel maps. It makes sense to me anyway....

I also think so, there are 2 axis, but you use the same ones for different positions of data.

[Hitokiri]

I have seen those two sets of 16 position axis. There is a set of axis above the fuel map I showed. I used them on the map. The other set of 16 position axis was above that funky stepped map as I explained before.

If you are looking for axis, try to find the 8 position axis for the boost and WG maps.

[STi6]

I've been doing some investigation into the chip that the ECU uses, manufactured by Renesas (prev Mitsubishi).

It's general consensus that it belongs to the M32R family. Do you guys think the chip will only have 131072 bytes of RAM or more? My question is because the M32R chips all seem to have more than that, however I found some M16C chips that have the correct 131072 bytes / 128kb size.

Some suspects are the M30800FC and above numbered models. I'm trying to get some hex instruction sets to make a connection and get some replies from the ECU. Any would be help appreciated.