Go Back   Club NA-T Forums Turbo Boost HP Car >
Tuning Electronics
> Stock ECU's
Register FAQ Locate Members! Members List Calendar Mark Forums Read

Stock ECU's Discussion of stock ECU and Hacks



Reply
 
Thread Tools Display Modes

Old 01-14-2008, 01:57 PM   #31
noekiyu
in vacuum
 
Join Date: Jan 2008
Posts: 2
Trader Ratings: (0)
Hi. I drive a Corolla Xrs with a 2zz engine. I would like to reflash my ECU to lower lift RPM crosswover, and tune it in general, but the ECU is locked . My alternative is to buy a 1000$ Apexi PFC or a $1500 Hydra. Apexi, and the Hydra ecu are stand alone ECU's but that seems like a lot of money just to tune a car. It's been said on 9thgencorolla.com that is is impossible to crack the toyota ECU.

I don't know much about programming, and integrated circuits, but I am willing to learn.

Could you point me in the right direction as to what I need to learn to reprogram my ECU? I want to learn from scratch. I'm willing to learn VB C++, to read books , read tutorials, or anything that will help me learn. Ill can even buy some expensive equipment as long as the price doesn't exceed 1000$
Offline:   Reply With Quote

Old 01-14-2008, 05:09 PM   #32
IS300GTE
3 Six Speeds
 
Join Date: Oct 2005
Location: MD
Posts: 6
Trader Ratings: (0)
What's your contact info?

I didn't see it on any of the sites


Quote:
Originally Posted by JMR_AW11
They say a little knowledge can be dangerous...

You really need to get some design experience before spouting your spurious claims.

The Toyota ECU (made by Denso) contains a fairly basic MCU chip and it isn't that hard to crack if you have the experience and correct mindset.

It's just an ancient 8 bit MCU with zero security features. It does have a unique instruction set and there is very little info available on the chip. I hacked it the hard way. No datasheet or instruction set, just me and the chip in a room. (I hacked the 42pin version first)
I've cracked it and so have Techtom. I'm not so sure Kashi has fully cracked it as his web info has a few errors. It's NOT a piggyback crack, the hardware allows full control over the factory code and maps just like the guys who wrote the original ROM code.

Here is a general overview into how to make a single 64pin MCU ECU reprogrammable. It's just an overview.

1) The original 64pin MCU chip in the ECU contains all the program code and
maps within the chip.

2) This MCU chip can also be run in 'external memory mode'

3) The first step is to get the internal code/maps out of the MCU chip (so you can put it in the external memory)

4) Once you have this you design a board that uses the original MCU chip
reconfigured for external memory mode.

5) Here's where it gets tricky. When you put the MCU chip in external
memory mode it reassigns some of its 64 pins into multiplexed address lines and data
lines and R/W lines (to allow it to access the external memory) This means it LOSES the previous
ECU functions assoc with those pins. Those reassigned port pins used to provide
control lines for control of I/O devices in the ECU and sometimes for vital comms to other chips in the ECU.

Also there are internal MCU latch/control registers that get lost in ext memory mode and you have to recreate these in external hardware or the ECU will not run correctly.

You have to know what needs replacing and also how to recreate and address it such that the ECU hardware functions 100% as stock. I do all this with a special programmable logic chip.

6) This board then replaces the original MCU chip by plugging into the same connections as the original MCU but the ECU doesn't realise any difference and it will run exactly as standard (until you start
altering the program code/mapping)

So the basic reprog ROM board that replaces the original MCU chip will contain:

1) The original MCU chip in ext mem mode.
2) An external memory chip (FLASH/EPROM?) with all the code/maps
3) A custom logic chip that provides the multiplexing for
addressing the ext memory and ALSO the lost port pin functionality and ALSO
some associated MCU registers (and latches) that get lost when in ext mem mode.


I already told you guys this info and it's already on your forum.

Yet you still remain in the dark....





I hacked the Denso MCU a long time ago.

The above board runs the original factory code that is inside the original ECU.

If I leave the code stock (apart from a couple of essential byte changes to swap the mode and ensure the ROM checksum is OK) then the ECU runs exactly as stock.

It's possible to alter anything in the original program or the mapping.

I've done this and had the ECU independently tested in an MR2 turbo and also a MR2 with a V6 conversion (board fitted to a V6 ECU with V6 ROM code)

These ECUs also support high speed datalogging. This is a hidden feature in all Denso ECUs, presumambly it was used during ECU development and allows access to all ECU parameters in real time with up to 200 data requests a second (data is 16 bit so gives really good resolution on rpm, EFI, ign timing etc)

This was demonstrated at the same time as the tests above on the turbo and V6.

You guys might think you are blazing a trail but it's already been done.
(first by Techtom and then kashi? and myself)
Offline:   Reply With Quote

Old 01-14-2008, 05:26 PM   #33
noekiyu
in vacuum
 
Join Date: Jan 2008
Posts: 2
Trader Ratings: (0)
My name is evan c.

My email is noekiyu@yahoo.com

. Thanks~!
Offline:   Reply With Quote

Old 01-15-2008, 03:55 AM   #34
Brutus FullThrottle
in vacuum
 
Brutus FullThrottle's Avatar
 
Join Date: Nov 2007
Location: France
Posts: 8
Trader Ratings: (0)
Quote:
Originally Posted by noekiyu
Hi. I drive a Corolla Xrs with a 2zz engine. I would like to reflash my ECU to lower lift RPM crosswover, and tune it in general, but the ECU is locked . My alternative is to buy a 1000$ Apexi PFC or a $1500 Hydra. Apexi, and the Hydra ecu are stand alone ECU's but that seems like a lot of money just to tune a car. It's been said on 9thgencorolla.com that is is impossible to crack the toyota ECU.

I don't know much about programming, and integrated circuits, but I am willing to learn.

Could you point me in the right direction as to what I need to learn to reprogram my ECU? I want to learn from scratch. I'm willing to learn VB C++, to read books , read tutorials, or anything that will help me learn. Ill can even buy some expensive equipment as long as the price doesn't exceed 1000$
You have to get a good knowledge of microcontrollers, a fair level in digital electronics and a strong level in assembly programming to reprogram this.


Or, you can try to get in touch with JMR_AW11 who already have done this.
Let him know about your needs, that should be interesting for his development of his future product.
Offline:   Reply With Quote

Old 01-15-2008, 08:27 AM   #35
IS300GTE
3 Six Speeds
 
Join Date: Oct 2005
Location: MD
Posts: 6
Trader Ratings: (0)
Hi Evan,

I'm actually looking for Sean's (Jmr) contact info

I may get with you later though




Quote:
Originally Posted by noekiyu
My name is evan c.

My email is noekiyu@yahoo.com

. Thanks~!
Offline:   Reply With Quote

42-pin "D151801" 7MGTE "Knock" Processor
Old 01-24-2008, 07:15 PM   #36
apath_e
in vacuum
 
Join Date: Nov 2007
Posts: 10
Trader Ratings: (0)
Exclamation 42-pin "D151801" 7MGTE "Knock" Processor

Ahhh... after MUCH probing of this 42-pin "Knock" MCU...
(and finding that the 42 pin pinout in the toyota.kgbconsulting wiki doesn't apply to the 7M ECU)

Yeah, I know it's only the Knock Retard MCU - but, without "having enough experience" - it's a friggin start!

BTW: It's A Fujitsu MCU - 4.19Mhz
Offline:   Reply With Quote

Old 01-28-2008, 07:35 PM   #37
Dramon
NA-T Guru
 
Join Date: Aug 2005
Location: ...
Posts: 1,393
Trader Ratings: (0)
Quote:
Originally Posted by apath_e View Post
Ahhh... after MUCH probing of this 42-pin "Knock" MCU...
(and finding that the 42 pin pinout in the toyota.kgbconsulting wiki doesn't apply to the 7M ECU)

Yeah, I know it's only the Knock Retard MCU - but, without "having enough experience" - it's a friggin start!

BTW: It's A Fujitsu MCU - 4.19Mhz
How'd you find that and figure that out?
Offline:   Reply With Quote

Old 01-30-2008, 10:41 AM   #38
Brutus FullThrottle
in vacuum
 
Brutus FullThrottle's Avatar
 
Join Date: Nov 2007
Location: France
Posts: 8
Trader Ratings: (0)
I'm getting a little disapointed by this topic...
Looks like everybody is waiting for someone to make it and give all the infos...
Offline:   Reply With Quote

Old 01-30-2008, 09:24 PM   #39
NoLongerA13BFan
in vacuum
 
Join Date: Oct 2007
Location: knoxville, tn
Posts: 22
Trader Ratings: (1)
Quote:
Originally Posted by Brutus FullThrottle View Post
I'm getting a little disapointed by this topic...
Looks like everybody is waiting for someone to make it and give all the infos...
I would love a chipped stock ECU like my old DSM but I have no useful information and I am pretty useless when it comes do processors and the like.
I can weld stuff if that will help get this going
Offline:   Reply With Quote

Old 01-31-2008, 03:08 PM   #40
JMR_AW11
in vacuum
 
Join Date: Nov 2007
Location: UK
Posts: 8
Trader Ratings: (0)
Quote:
Originally Posted by Brutus FullThrottle View Post
You have to get a good knowledge of microcontrollers, a fair level in digital electronics and a strong level in assembly programming to reprogram this.


Or, you can try to get in touch with JMR_AW11 who already have done this.
Let him know about your needs, that should be interesting for his development of his future product.

Hi BFT.

I'm not really looking at other Toyota ECUs at the moment (just MR2)

BTW I have recently sold that modded MR2 turbo ECU pictured earlier to someone and they have been using it for a few weeks now. (over 600miles and counting)

It's running the factory code at the moment and the owner reports the car runs 100% as stock in all weathers.

I've also given him the datalogging interface GUI so he can log all ECU parameters in real time.

eg rpm, TPS, ignition timing, knock corrections, EFI duty, speed, air temp, coolant temp, ISC valve position, boost guage, AFM, load, economy guage in mpg, open/closed loop indicator etc etc.

The MR2 ECU has a hidden (16bit) data port inside allowing high speed access to ECU data in real time and this feature is included in the add on board. This is not to be confused with the crude OBD datastream available from 1992+ Toyotas.

The internal data port allows the user to choose what data to monitor and allows up to 200 requests a second. This allows a really fluid data display!

Other things that can be logged are the internal error codes and the status for stuff like the TVIS and TVSV and fuel trim data (closed loop corrections)

These old ECUs are quite versatile despite being 15 years old!

The modded ECU can be 'chipped' via a laptop and a firmware uploader program so a revised ECU program could be uploaded by the user. It takes about 1 minute to erase the old program and upload the new one via a laptop.

eg revised rev limit, speed limit, fuel or ignition mapping or TVIS/TVSV or factory fuel cut map.

I'm hoping to start selling these once the initial road testing proves OK.
Offline:   Reply With Quote

Old 01-31-2008, 05:38 PM   #41
Brutus FullThrottle
in vacuum
 
Brutus FullThrottle's Avatar
 
Join Date: Nov 2007
Location: France
Posts: 8
Trader Ratings: (0)
Quote:
Originally Posted by JMR_AW11 View Post
Hi BFT.

I'm not really looking at other Toyota ECUs at the moment (just MR2)
Don't forget that the Celica ST185 uses the same ECU the MR2 turbo has!

If you plan on doing NA mk2 MR2 as well, it is the same between the Celica ST182 and MR2 mk2 rev1 (160hp), and also the same between the Celica ST202 and MR2 mk2 rev 2 (176hp).

Last edited by Brutus FullThrottle : 01-31-2008 at 05:40 PM.
Offline:   Reply With Quote

Old 02-16-2008, 11:38 PM   #42
IS300GTE
3 Six Speeds
 
Join Date: Oct 2005
Location: MD
Posts: 6
Trader Ratings: (0)
Does anyone have a link to Kashi's page?

Brutus, anything?
Offline:   Reply With Quote

Old 02-20-2008, 04:43 AM   #43
Brutus FullThrottle
in vacuum
 
Brutus FullThrottle's Avatar
 
Join Date: Nov 2007
Location: France
Posts: 8
Trader Ratings: (0)
Quote:
Originally Posted by IS300GTE View Post
Does anyone have a link to Kashi's page?
http://www.kaele.com/~kashima/car/index-e.html

Quote:
Originally Posted by IS300GTE View Post
Brutus, anything?
Yes, I've breadboarded the 42 pin D151801 and I'm able to put it in external memory mode.

I'm missing a "fast" (well... better than mine,at least) oscilloscope to check I can put it in the correct mode for reading it's ROM.
Offline:   Reply With Quote

Old 02-28-2008, 09:11 PM   #44
IS300GTE
3 Six Speeds
 
Join Date: Oct 2005
Location: MD
Posts: 6
Trader Ratings: (0)
Brutus,

Can you PM me your email address?



Quote:
Originally Posted by Brutus FullThrottle View Post
http://www.kaele.com/~kashima/car/index-e.html



Yes, I've breadboarded the 42 pin D151801 and I'm able to put it in external memory mode.

I'm missing a "fast" (well... better than mine,at least) oscilloscope to check I can put it in the correct mode for reading it's ROM.
Offline:   Reply With Quote

denso mcu
Old 03-04-2008, 05:55 AM   #45
apath_e
in vacuum
 
Join Date: Nov 2007
Posts: 10
Trader Ratings: (0)
Talking denso mcu

Quote:
Originally Posted by Dramon View Post
How'd you find that and figure that out?
going through LOTS and LOTS of datasheets..
the really f***ed thing about it is; after I found the correct datasheet,
just on a whim, I googled "denso knock" - and came across the PATENT for the knock control system, which lists the chip name, type, system breakdown, and use.
it was on free patent search.

This was after a couple weeks of going through datasheets, one by one....


Still no datasheet on the main controller.

I'm hoping to be able to find some more information on it. I'm thinking that hopefully, that main mcu could be dumped and replaced with a slightly more modern mcu that would easily allow flash programming.
It seems to be feasable - the code in the mcu would just have to be ported to the new mcu - not that difficult of a task once the pins are figured out and the rom is dumped!

JMR_AW11:
In my not-so-infinite wisdom, I finally understand the point of the logic controller... just a question about it tho.. if you're switching back and forth between the eprom and control lines, and the processor runs at 12mhz, aren't you now forcing it to run at 6-8mhz? (I know it's not a 1:1 ratio of eprom reading vs control lines)

Also, I figured out the problem (for the MK3 ecu) with Kashi's board - the pinouts of the mcu are different - and i'm assuming the instruction set would be different as well!
Offline:   Reply With Quote

Old 03-06-2008, 05:55 AM   #46
JMR_AW11
in vacuum
 
Join Date: Nov 2007
Location: UK
Posts: 8
Trader Ratings: (0)
Quote:
Originally Posted by apath_e View Post
going through LOTS and LOTS of datasheets..
the really f***ed thing about it is; after I found the correct datasheet,
just on a whim, I googled "denso knock" - and came across the PATENT for the knock control system, which lists the chip name, type, system breakdown, and use.
it was on free patent search.

This was after a couple weeks of going through datasheets, one by one....


Still no datasheet on the main controller.

I'm hoping to be able to find some more information on it. I'm thinking that hopefully, that main mcu could be dumped and replaced with a slightly more modern mcu that would easily allow flash programming.
It seems to be feasable - the code in the mcu would just have to be ported to the new mcu - not that difficult of a task once the pins are figured out and the rom is dumped!

JMR_AW11:
In my not-so-infinite wisdom, I finally understand the point of the logic controller... just a question about it tho.. if you're switching back and forth between the eprom and control lines, and the processor runs at 12mhz, aren't you now forcing it to run at 6-8mhz? (I know it's not a 1:1 ratio of eprom reading vs control lines)

Also, I figured out the problem (for the MK3 ecu) with Kashi's board - the pinouts of the mcu are different - and i'm assuming the instruction set would be different as well!
The MCU is clocked at 12MHz but the core runs at 2MHz.

In external memory mode the chip dedicates 16 lines to address and data multiplexing and it stays that way all the time so no speed penalty.

Other pins also get swapped to provide support for the multiplexing.

The pins on the chip that get sacrificed in external memory mode have to be recreated in external hardware or the ECU can't function.

This requires a LOT of extra registers, ports, latches etc etc.

Heres an image of an old Mines ECU from a mk2 MR2 turbo. This uses the same 64pin SDIP MCU chip as the older Supra (7433 series)

You can see how much extra circuitry they needed to create to make up the lost pins when in external memory mode. The whole green circuit board is their new daughterboard and it sits over the existing ECU circuit board with a modified ECU lid.
Count the number of chips they needed on this board! You can see the big Toyota/Denso MCU chip next to the blue ribbon connector.

I do all this extra circuitry in a modern programmable chip and the circuit for what is onside the chip takes up 9 pages of design.

Techtom boards are similar. they use a small but powerful programmable chip to hold all that external circuitry. It's the little square PLCC chip in the PLCC socket.


It's not an easy task to chip these ECUs. I didn't intend to offend you when I suggested you give up because IMO you would need to spend AGES learning stuff about old school MCU chips (so would anyone else ) and I suggest it isn't worth the time unless like me you already knew this stuff from years ago.



Last edited by JMR_AW11 : 03-06-2008 at 09:39 AM.
Offline:   Reply With Quote

Old 05-07-2008, 04:15 AM   #47
Dramon
NA-T Guru
 
Join Date: Aug 2005
Location: ...
Posts: 1,393
Trader Ratings: (0)
http://www.planetsoarer.com/ecu/ecu.htm

Found this too another dude in aussieland that did the v8.
Offline:   Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -4. The time now is 11:58 AM.


Sponsors: Boston Colocation + Boston VPS