The Great ECU Hack Project

[SilentShout]

Greetings All

First off Im not sure if this is the correct section to post in but feel free to move it if need be.

Ill get straight to the point:

For too long have we Aussies suffered the difficulties of Tuning the factory ecu's in our beloved Opels, wether it be sending the ecu over the globe, or minimal support from professional tuners.

I plan to change that around. I will hack the ecu and pass on my knowledge and help to anyone else so our little machines can ascend to the next level :swg:

The vehicle of choice is the Trusty Red Baron!! (Barina SRI)


The project will take place over 3 stages:

Stage 1: Gather the tools nessesary to interface with the ecu and Obtain the Bin file off the ecu *Completed*

Stage 2: Dissassemble the binary file from the ecu and creat a definition file (hacked binary file) that outlines all the parameters and maps found on the ecu (MAF map, o2 map, etc etc) *This stage will be the longest and most tiring* *In Progress*

Stage 3: Change parameters and flash the car ecu to test changes.


A few things to note:
For stage 3 I will attempt to change small parameters such as idle speed and rev limit to test its working.

I understand there is a massive risk to brick the ecu without taking proper precaution so all nessesary precautions will be taken, Do not attempt this without knowledge of what your doing, I do not take responsibility for any damage you may do to your vehicle by copying what I do.

I have PM'd the famous Warren G from Corsa-c.co.uk to see if he can lend a hand at all and hopefully shorten stage 2, just waiting to hear back from him.

I will update this post when I have come across anything new etc.

Watch this space and hopefully I will be able to bring you the Opel community what you need :thumbs:

~ The Silent Shout

[SilentShout]

Update:

I have the Binary File!!!!

5241

Interestingly enough I was able to interface with the ECU under the Astra G Simtec 71.1 ( I believe it is the same architecture as the Simtec 70 Found in the Barina SRI)

And feast your eyes on what the ECU sees:

5242

Messy Huh :) now comes the fun part

[dutchy]

You should actually do a before dyno run so you can see exactly what difference it has made.

[SilentShout]

Small Update:

Managed to Identify 42 potential maps, I say potential as they only look like they could be maps, still need to determin if they are maps or if they are useless.

Also no help from Warren G which is understandable as tuning files are a close guarded secret as tuners count on them for revenue.

He did offer to come to australia if there were enough people interested in a remap, if in the future we ever wanted to take advantage of that.

My work continues, Ill keep you posted guys :)

[chris_r]

Here's an idea. Get on to guy 27 and see if he'll let you dump the binary from the Corsa SRi he got from Pete. From memory, the ECU was flashed with a different tune. Compare that file to yours and you may be able to find where the map is.

As for WarrenG, he does some really awesome work. Especially dropping a Z19DTH into a Corsa C, that's just f***ing nuts. Would love for him to come to Australia, but if he were doing tunes for everyone, he'd have to do a grand tour of the country just about.

[SilentShout]

The problem with some aftermarket tunes is most of the time they are locked by the creator, aparrently this is one technique Warren G tried out when he first started. I will definitly ask him though. wouldnt hurt to try


Having a bit of a win though, Spoke to the guys over at pcmhacking.com and found out the whole mask id of $11 is incorrect, dont know why the car is saying that.

The file that I can pull and edit looks like the "Cal segment" or the values and data that the car uses to adjust how the car runs etc.

Traditionally the entire bin includes the software that runs the car too, this is only the values that the software needs making it a bit safer to tune :)

also a user by the name of antus suggested where he believed the ignition and fuel maps were located so i will have a look at them when I get home and compare to see if it corrisponds to one of the 42 maps i have listed.

Its a start :)

[SilentShout]

Huge UPDATE:

Unfortunately no progress on my particular ecu, havnt had a chance to check those ignition and fuel map addresses yet (been working stupid hours :( )

I have however recieved information on a variaty of other ecus that have possibly been hacked already and would now like to share my discovery with you all

Feast your eyes:

www.chip-tuner.hu/original_ecu_files/files/Opel

These are the original files however I believe these have all been Hacked and by that I mean all the tables and addresses of specific items such as rev limiter, fuel, ignition etc has already been identified and saved.

I will download a few and check them hopefully when i get home (pretty tired :( )

Your welcome Opelaus. :rum:

[sooty]

Good work trying something new, be good to see how far you can get with this.

[SilentShout]

Haha hoping to get far with this.

On the other hand I notice you have a scoob, did you know theres already a program that has mapped your scoob and mitsubishi ecus?? Google openecu.org (name might have changed since I checked it last, havnt tuned a scoobi since my yester years :P )

[mickos]

Winols and alientech ECM titanium are readable & versatile tunable programs to suit opels

[sooty]

Haha hoping to get far with this.

On the other hand I notice you have a scoob, did you know theres already a program that has mapped your scoob and mitsubishi ecus?? Google openecu.org (name might have changed since I checked it last, havnt tuned a scoobi since my yester years :P )

Yeah, my ecu is unlocked and tuned through romraider. Soooo much easier tuning subies compared to opels, if you can get it to a similar level, you'll be onto a winner

Sent from my C6603 using Tapatalk

[mickos]

Evo, Subie, Nissan, Honda ecus are very accessible
Helps tuning with wideband afr readings too on rom raider

[SilentShout]

Im using winols at the moment. Where the learning curve is that nothing is handed on a s8lver platter :( ive used the haltech software and various others (apexi fc etc) and in them you click on fuel map, it goes to the fuel table. Wjnols, you load the cal/bin file, its just a bunch of code, gg have fun.

Im trying though, its a painful process :(

[SilentShout]

Progress :D

http://www.pcmhacking.net/forums/download/file.php?id=8395

[Raisin]

That's awesome man! I'd love to dive into ECUs oneday. :D

[mickos]

I did a lot of experimenting with the whole winols debarkle ages ago, managed to get the EDS maps off then open in winols even changing EDS maps and overlaying them as different stage tunes showing the different stage graphs
I purchased two tools claiming read/write ODBII abilities, none worked

Check out alientech mate for a much better program to map the car

[Leinad78]

Hello guys,

my name is Daniel and i´m from germany, working mainly on BMW engines. My girfriend owns a 2003 Astra with the Z18XE engine and on my search for Damos files i found this thread.

I´m really curious to see if there is already some progress at this type of research and if there is help needed :)

kind regards
Daniel

[SilentShout]

progress is slow but good news and that is Ive solved the checksum correction with the car.

Tiny bit of theory, when you make a change to the ecu coding, the checksum needs to change to reflect the changes. if it doesnt the car knows the ecu has been tampered with and bricks itself.

Its so opel can try and ensure no one touches their ecus.

:deadhorse: Screw you opel, Ive beaten you on this round :) now to start populating the tables.

Next challenge is to interpret the data and see if i can populate the x and y axis of the maps,


Quick question, anyone know what the rev limiter is on the SRI??
is it 6300 or some random number like 6341 or something?

[Leinad78]

Did you wrote your own checksum tool or did you find an existing one? The first would be impressive :)

[SilentShout]

I have a checksum calculator which i have yet to test, Currently i am testing the one from EVC the company that makes winols. May or may not have aquired it from sources but its for testing purposes only as my end goal is to create an XDF file for use in TunerPro which is a free to use program and it has a much more traditional user interface when tuning cars. Next goal will be to create or obtain an ADX file which will allow TunerPro to interface with and tune the car in real time, that however i cant confirm as im not sure the Siemens has the capabilities for that. I know it can certainly be flashed while stationary but if it works it means you will be able to take the car to a test and tune night or tune on a private property with a mate at the wheel.

This is further down the track though.

I have also contacted several companies who claim they have access to tuned files that they sell online, One company in particular writes Damos AL2 files for people and mentions the Corsa SRI which im pretty excited about however we will see what sort of cost they come up with for their services.

I have the Hex address for the checksum location as well as what looks to be injection maps and 2x ignition timing maps (possibly one for low load and one for high load)
The trick will be trying to discover how Simens write their code and where they place the x&y axis data (before the table, in the table or after the table)

[Leinad78]

Siemens uses, at least at the MS4* series ecus, a separate area in the calibration file to set the axis descriptions. Its not as easy as at bosch ecu where the axis and mapsize can easily be found in front of the map. I´m working with TunerPro too, very nice software.5639

which company did you contact? OLSX.be? Damos file will be ~300€, but its worth every cent if its the correct softwareversion you have.

Could you upload the file you´re working with? I had no luck downloading it at my girlfriends ecu and i´m really curious to take at look at it :)

[SilentShout]

Ooo that looks nice, which files are they??

The ones i experimented with in tunerpro were for a holden commodore, Being OBD1 its much easier to find everything.

I understand what you mean about the axis data being located somewhere else away from the map, I was hoping it wasnt going to be that way after i heard rumors that Siemens operate that way, but it was confirmed when ive been through every "potential map" that Winols has found and there doesnt seem to be any axis data around the maps.

With the help of the folks over at pcmhacking.net i can confirm the .bin file is a cal segment, aka its the data the ecu uses to calculate what the engine needs.

They also believe they have found the Injection table and 2x Ignition tables.

Addresses they provided are:
Injection table at 44BB
Spark tables at 3B93 and 3CB6

Checksum is 16 bit at 5EE0

Im not sure i can upload the file on this site, poita is uploading files other than pictures allowed?

the website who im hoping to write the damos is www.chiptuning-files.biz

They emailed back asking for the original file which i cant provide until im at home as im currently at work.

I also have available an Astra G 1.8l file (auto but i believe it doesnt matter)
I havnt had a chance to compare the 2 yet but that was my next step as the astra g is 90kw and the corsa c sri is 92kw so there is hopefully a difference in tune :)


UPDATE: I believe you can download my original file from the PCMhacking.net site without signing up for it.

Ive copied the link below.

Let me know how you go as you may have more experience in hexadecimal than me.

[URL="http://pcmhacking.net/forums/download/file.php?id=8145[/URL]

[Leinad78]

Information

The selected attachment does not exist anymore.

rename the extension of the bin file to *.pdf and upload it here ;) Thats working flawless.

I´m working on MS42 and MS43, used at BMW straight 6 engines. I was really lucky as there was one damos file flying on the net, but it was combined with a different softwareversion which gave slightly offsets at some maps. So it was more finding the correct software and re-translate them to german. The damos files seem to be done in german and the one for MS43 was machine-translated to english which was done a bit the ugly way and i needed to spend weeks finding and checking the uncommon abbreviations.

Right now i have made good progress and i see the need for disassembling by IDAPro, which honestly gives me headache. I know there are 3 people who already did the disassebly, but they aren´t giving usefull information on how to to that exactly. So i´m a bit stuck at the moment.

[SilentShout]

Someone on the forums over at PCMhacking.net has helped out and written up a very detailed and helpful how to when finding maps.

http://www.pcmhacking.net/forums/viewtopic.php?f=17&t=3929&p=49343#p49343

Worth a read if anyone is interested if doing something similar.
Leinad78 how did you go getting the bin file off the link in my previous post?

[Leinad78]

There is no attachment in the link you´ve posted ;) Thats why i´d like you to upload it here as pdf.

[SilentShout]

Tried attaching it but its not working, says "Not a valid image file"

here is a link to the DL without trying to Hyperlink it, copy and paste will work :) hopefully

http://pcmhacking.net/forums/download/file.php?id=8145

[Leinad78]

Got it, i think i needed to register ;)

I gave a bit of input (at least i hope so) where to find axis descriptions in the other forum ;) Don´t know if i should post it here, too?

[SilentShout]

Ahh thank you so very much it was quite helpful. Still relatively new to hex etc but I am understanding it a bit more each day.

After i finish my work ill have a fiddle around and hopefully come up with something.

Maybe comparing the Astra G file and the SRI file will show me a bit more information.
Leinad78

Do you know if the Simtec 70 ecu was similar if not the same??

I found some information on a different forum (subbed to loads of forums to help out with this one)

this is the info they provided:

RPM Limiter - C0E5 & C20C
MAF Linearisation in kg/h - CBBA
Spark 1 - D7F8
Spark 2 - E3FC
Spark 3 - E4BC

RPM Scale - C41A
Airflow Scale in kg/h - C43C

C0E5 & C20C are RPM Limiters in 16 bit LoHi with correct factor.

C0E6 & C20D - RPM Limiters in 8 bit. Single value - factor 32; offset 0

You must change both limiters. If not the car will still limit the RPM at 6500.

C0E5 - RPM Red line start
C20C - RPM Limiter

RPM is here 00C20D , 00C214 , 00C0E6 ( 8 bit ) faktor 32

I cant confirm as im at work atm, thoughts?

[Leinad78]

Well, the rpm conversion of 32 is similar to the one from MS43. That sounds reasonable.

However, as your file is only 24kb i see no chance to find maps at C***h or D***h?!

I think i found the MAF table ;) Its located at 0x15A8 and its 16x16 (16bit). The x axis has no description and the y-axis has 4 possible descriptions which are hard to decide. Option 1 starts at 0x1071 1x16 (8bit), Option 2 is located at 0x126B 1x16 (8bit), Option 3 starts at 0x128B 1x16 (8bit) and the last one is at 0x136F 1x16 (8bit).

Funny how similar those maps are :)

That engine doesn´t have camshaft phase shifting? It has a electronic throttle i think? What kind of emissions equippment does it have? I tend to think it has somekind of switchable intake manifold?!

Just by the looks the aera around 0x3120-3280 should deal with knock.

Well, the rpm conversion of 32 is similar to the one from MS43. That sounds reasonable.

However, as your file is only 24kb i see no chance to find maps at C***h or D***h?!

I think i found the MAF table ;) Its located at 0x15A8 and its 16x16 (16bit). The x axis has no description and the y-axis has 4 possible descriptions which are hard to decide. Option 1 starts at 0x1071 1x16 (8bit), Option 2 is located at 0x126B 1x16 (8bit), Option 3 starts at 0x128B 1x16 (8bit) and the last one is at 0x136F 1x16 (8bit).

Funny how similar those maps are :)

That engine doesn´t have camshaft phase shifting? It has a electronic throttle i think? What kind of emissions equippment does it have? I tend to think it has somekind of switchable intake manifold?!

Just by the looks the aera around 0x3120-3280 should deal with knock.

There are some nice rpm scalars in 16bit starting at 0xC3C :ihih:

Heres an ols file and the mappack with all the axis descriptors ;)

http://www59.zippyshare.com/v/O0jNyGR1/file.html
http://www59.zippyshare.com/v/TfcJGPmq/file.html

[Raisin]

Keep posting guys, I'm enjoying reading this, even if most of it is going over my head haha. I'd love to tinker with this kind of stuff oneday.

Just a small input that may be of no use to you. I had always thought the slight power difference from 90kw to 92kw was when using 95 and 98 octane where the engine is able to detect and advance the timing on the higher octane without knock. I don't know if this is true, but that's what I was told before.

[SilentShout]

The car doesnt have any variable cam timing, there are roumors about it having an intake that switches from long runners to short runners at a certain rpm however im not sure they have that. would explain why around 3500rpm the car sort of livens up though.

Im going to start making an xdf with the data you have provided as well as the data from the other forum :)

[Raisin]

The car doesnt have any variable cam timing, there are roumors about it having an intake that switches from long runners to short runners at a certain rpm however im not sure they have that. would explain why around 3500rpm the car sort of livens up though.

Im going to start making an xdf with the data you have provided as well as the data from the other forum :)

Sorry, I didn't mean cam timing. I was talking about spark timing/advance.

[SilentShout]

Sorry, I didn't mean cam timing. I was talking about spark timing/advance.
I was replying to the post before sorry i should have quoted it :) he asked about cam phase shifting which i think hes talking about variable cam timing.

[Raisin]

I was replying to the post before sorry i should have quoted it :) he asked about cam phase shifting which i think hes talking about variable cam timing.

Oh lol, the confusion is too damn high. :rofl1:

[Leinad78]

Keep posting guys, I'm enjoying reading this, even if most of it is going over my head haha. I'd love to tinker with this kind of stuff oneday.

Just a small input that may be of no use to you. I had always thought the slight power difference from 90kw to 92kw was when using 95 and 98 octane where the engine is able to detect and advance the timing on the higher octane without knock. I don't know if this is true, but that's what I was told before.

I tend to think there are 98octane and 91octane maps regardless the power difference. If the engine doesn´t have camshaft phase shifting its pretty likely they reduced power by decreasing ignition advance, yes. If you have that kind of file, please upload it :) I assume the engine has at least one knock sensor?

Heres what maps and line descriptors i found until this morning. Hundreds more inside that file :ninja:

5648

Yes, variable camshaft timing was the word i was looking for :)


there are roumors about it having an intake that switches from long runners to short runners at a certain rpm however im not sure they have that. would explain why around 3500rpm the car sort of livens up though.


I´ve disconnected that vacuum line when i modified my girlfriends car to LPG, so its no rumour. Unfortunally i haven´t found a way to read her ecu. Security access denied at some tools. Will try it with MPPS later the day.

[SilentShout]

what car does your gilrfriend have??

i have what you would know as the Corsa C SRI 1.8L and the tool I used was a Galletto1260 clone and it worked no problems as it is able to communicate using the KWP2000 protocol which is what the car uses.

I was entering data into Tunerpro for the MAF map etc and slowly attempting an XDF file and then boom, "Tunerpro has stopped working" or loosely translated to "You are gonna feel pretty foolish if you didnt save your work" :(

Back to the start.

[Raisin]

I tend to think there are 98octane and 91octane maps regardless the power difference. If the engine doesn´t have camshaft phase shifting its pretty likely they reduced power by decreasing ignition advance, yes. If you have that kind of file, please upload it :) I assume the engine has at least one knock sensor?


I have the same car as SilentShout, just the 2005 facelifted model, but I don't think they changed anything engine wise.

[Leinad78]

what car does your gilrfriend have??


Its a 2002 Opel Astra G 1.8 16V 125HP

I tried KWP2000+, Galletto 1260 and none worked. Will use MPPS later.

Found another few maps.

5649

[SilentShout]

I have the same car as SilentShout, just the 2005 facelifted model, but I don't think they changed anything engine wise.

the facelift never came with an egr valve, I was unlucky enough to have one being a 2001 :(

[Raisin]

the facelift never came with an egr valve, I was unlucky enough to have one being a 2001 :(

Oh yeah, I remember Shadow110's SRi having an EGR valve. I'm glad mine doesn't have it haha.

[SilentShout]

Heres that MAF map at 0x15A8
http://i1272.photobucket.com/albums/y385/Rick_Anderson/MAF_zps6ef9a771.jpg

[Leinad78]

Is that maf sensor used in other cars/engines as well?

Looking reasonable, doesn´t it? ;)

5650

[SilentShout]

Is that maf sensor used in other cars/engines as well?

Looking reasonable, doesn´t it? ;)

5650

is that picture from the z18xe bin or a different one?

as far as i know the z18xe maf unit was used in the astra G, Corsa c SRI, and i believe the vectra 1.8 aswell but correct me if im wrong here.

[Leinad78]

Thats how the maf tab looks at Siemens MS43, which i definately know is correct.

[DRMAT]

Geez look at you two go!

[Leinad78]

I tried reading the ecu once again via MPPS and that failed, too. It seems all the tools don´t get security access.

[SilentShout]

What program are you using to try and pull the map off the car?

[Leinad78]

KWP2000+, Galletto 1260 and MPPS

[SilentShout]

They sound like the physical cables. Im talking about the software on the computer you are using?

[dutchy]

Geez look at you two go!

yeah, get a room you two ;)

[Leinad78]

They sound like the physical cables. Im talking about the software on the computer you are using?

Well, i use the software that came with the interfaces. They are calles kwp2000+, Galletto1260 and MPPS. I have np problem reading different BMW´s, so it seems to be a problem with the seed key at that car.

Is there anything that needs to be done before readout? any kind of special procedure?

[SilentShout]

I cant recall the name of the software that i use but its not those ones. The procedure i used was to have the car off. Initialise the software then turn the car on to ignition but dont turn it on. Then click the read button and you have the map.

[Leinad78]

Could you have a look what software you used? :)

[SilentShout]

Sorry for the delay ive had no internet for my only 2 days off due to telstra being inbred idiots with cable cutters thinking they have the knowhow to fix something.

Just had a look and the software i used was the galletto 1260 software. I can upload after work to a filehosting site. I was going to ask what year model is your missus' s astra, if i recall after a certain year they became canbus instead of kwp2000 protocol.

Also what cable are you using to interface with the car??


Lastly i had a look at the supposed locations of the rev limiter at addresses 0001CD and 001D1 and the the data comes up as 48167 and 36150. Do i need to change offset and factor values so it looks like the actual rpm limiter??

Im trying to see if that is the rpm limiter so i can enter the data into tuner pro for the xdf

[Leinad78]

Well, its 2002 and i´m using a operational known galletto clone interface. It works at BMWs. The car has k-bus, i can use Op-Com to read the fault memory.

Its pretty likely they have several limiter, soft- and hardlimit maybe they even have gear-dependant nmax limiter. Factor for rpm conversion is likely 32, so your are looking for hex CB or dec ~203 values.

MS43:
5653

[SilentShout]

It shouldnt be the Canbus setup then as i believe they came after 05 or 06.

When im home ill upload the galletto1260 software I used which worked for me and see if you have any luck, Pretty sure the cable I have is a clone too as i picked it up for 20 something dollars however it does say galletto1260 and came with a bunch of software so who knows.

The addresses the "eurotech" fella from the other forum provided are as such:

partial point 1/2
address: 003b93 - 003c52
partial point 2/2
eddress: 003cb7 - 003d76
partial injection 1/1
eddress: 0044bb - 004 573

rpm limiter
eddress: 0001cd, 001d1.

he claims he has confirmed on his car which is the same as my barina as 125cv = 123hp which is what my car is rated at.
I havnt been game enough to test the .bin file he provided yet though.

The Hex at address 001CD (found when looking at it in winols in 8bit view) says 203 or CB, To view the actual RPM limit in Decimal format (eg 6300 for 6300rpm limit) do i change the factor to 32?

Also which version of winols are you using?? test version or the normal one? also did you have the checksum file for opels?? i have it if you want it :) ols238 i think its called.

EDIT: this one http://www.evc.de/en/product/ols/plugins_detail.asp?cksName=OLS238

EDIT #2: I right clicked properties and set the factor to 32 and it came up as 6496 in decimal (Possibly 6496rpm), does it sound about right?? makes sence if this is as you say a hard limit, gonna check the other address now.

EDIT #3: the address 001D1 comes up as 6592 so maybe thats the hard limit. Ill test using my scantool and rev the car to the limiter and see what the max reading comes up as on rpm.

[SilentShout]

Found out how to enter factors into tuner pro, heres the addresses for those rpm limiters im guessing one is hard and one is soft so i have entered them as such with the correct factor. I also loaded the eurotech forum user from the other forums base read mod rpm file as a compare bin in tuner pro and this is what it came up as. From this im guessing he has a 7200rpm soft limit and 7300rpm hard limit.

Thoughts? :) http://tapatalk.imageshack.com/v2/15/01/18/93168ab09dd886e6bcbd5eddcc1b4ba9.jpg

[Leinad78]

Both sound pretty reasonable :)

Good find and progress :)

TunerPro is so much fun if you get used to it :boorny:

[SilentShout]

currently trying to use it to make an xdf file for future use :)

Im going to try and enter the MAF data and find out how to get tuner pro to refference other areas for x and y data as i believe it can do it.

Im thinking the 16x1 RPM table you found will be the one used for all the 16x16 maps? ill try it and see how i go.

im also trying to find a tutorial on entering the checksum into tuner pro as the only way to recalculate it currently is in winols.

Alright Leinad78 just want to confirm something with you.

If im changing the RPM limit both soft and hard at the two addresses i enter the modified RPM divided by the factor (in this case 32)

Eg. original soft limit is 203 (6496rpm) and hard limit is 206 (6592rpm)

If i change soft limit to 224 (7168rpm) and hard limit to 227 (7264rpm) to reflect that other dudes modified rpm limit is that the correct way to do it?

if so im going to change it and then upload to the car tomorrow morning :) wish me luck

[Leinad78]

Yes, that would be the way.

I may have another way to calculate checksum ;) I just need a few files to verify

Alright, should work ;)

http://www50.zippyshare.com/v/DqpU9FvH/file.html

As there are several 16x1 axis descripters, there is no chance to say that one fits all 16x* maps. Thats to simple of a thought. We need to cross-reference which axis description is 16bit and which is 8 bit. then we need to find the correct offsets and factors for the descriptors and last but not least the ones for the maps themselfe.

You can give each axis descriptor a unique name and reference them to the different maps.

5654

[SilentShout]

happy to provide any files needed.

Im playing around with that MAF file and using the RPM scalar 16x1 that you found it fits, so not ill try creating tables for the 4 16x1 possible y data that you found :)

also going to change the limiter in the morning and give it a try, wish me luck. ill either have a 7200rpm limiter or a bricked car.

Added the 16x1 16bit rpm scalar as a seperate table and then had the maf reference it as it was the only 16x1 16bit rpm table you found which fits perfectly no offets etc. However i wasnt sure which option to enter for the Y data. Ive put them all into table form so its easier to view. Which do you think it might be? Im hunting around to try and find what units they might be in e.g kg/h or something similar. http://tapatalk.imageshack.com/v2/15/01/18/0b2892b584b067866abbc36cd4e4dd64.jpg

[Leinad78]

Don´t waste to much effort in thinking about that maf table. Its nothing we can or need to tweak, its just somekind of conversion the ecu uses to calculate mass flow. The acutal changes, like if your having your car boosted, will be taken at the injection and ignition maps.

That particular map was just out of curiosity :) That map only needs to be changed if you actually are changing the maf to a bigger version, which is pretty unlikely in the current status of tune ;)

[SilentShout]

Don´t waste to much effort in thinking about that maf table. Its nothing we can or need to tweak, its just somekind of conversion the ecu uses to calculate mass flow. The acutal changes, like if your having your car boosted, will be taken at the injection and ignition maps.

That particular map was just out of curiosity :) That map only needs to be changed if you actually are changing the maf to a bigger version, which is pretty unlikely in the current status of tune ;)
Ahh that makes sence. Shouldnt need to touch it even when boosting it. I thought it was something else.

Should I start to look into those partial maps? (partial injection 1/1 eddress: 0044bb - 004573) <==== taken from the other forum

[Leinad78]

Well, i´d start with using your file as basic input into WinOLS and use STRG+I to import the following file: ecu vectra 18 b simtec 71.bin

If WinOLS argues that 30% of the file is different, ignore that warning and compare both files. They seem to work really well and we can see huge differencies. Every bigger colorized part will be a map...

Happy searching :D

[SilentShout]

why do you think there would be so many differences between the files though?? both are very similar if not the same engines if i recall? ill give it a shot at home though :) dont have the vectra file on me and no way to transfer from the work computer to my laptop.

[Leinad78]

Well, i don´t know why GM uses so many differencies. Its just what i learned looking at BMW files. There are, sometimes, really massive changes done. Biggest changes of all i´ve seen is by comparing a 2002 E46 330 which has the same ECU as an Alpina B3S with 3.4L engine. ~80% differencies in the whole 512kb file and at least 60% in the 64kb calibration file.

56615660

[SilentShout]

Using winols i looked at the ignition table provided by the euro tune dude and it lines up with a 12x16 8bit map that winols discovered based on "looks"

I entered the data into tunerpro and used the 12x1 rpm scalar you found, bit of fiddling with priorities etc and this is what it looks like:
http://tapatalk.imageshack.com/v2/15/01/19/1d8217fb7dd0f917e71d05c675329fdf.jpg

The other dude said its a partial map which if what i found on the internet is correct partial maps are closed loop maps when the car is running in closed loop mode.

Im trying to work out how opel like to display their data wether it is ° before top dead center (iirc thats the most common) just doesnt make sence to have the ignition sparking at 170° btdc at 700rpm halfway up the 16x side of the table (yet to find out what that is but im guessing it has something to do with the 16x1 MAF data you found around that maf map.

[Leinad78]

Try using "0.375*X-23.625" in the conversion tab of that map ;)

I think the y-axis is rpm and x-axis is load. Values in the map are °btdc

[SilentShout]

No matter how i rearrange the data its not making sence. In this example which is closer to the map in winols in the high rpm x (possibly high maf load) along the 6500rpm line down the bottom it jumps at column #10 from 121 to 131 then back to 121 then 112 :S might have something to do with being partial ignition timing (closed loop) ive tried to add colour to help visualise the map.
http://tapatalk.imageshack.com/v2/15/01/19/e236a8692ab2bd67e53a2c37935314df.jpg

Kk ill try that now. Posted before i saw your post.

[Leinad78]

that map is twisted... lowest value is at lowest rpm and highest flow-rate... gimme a second to think about that.

Alright, i was wrong... Y-axis is mass-airflow and x-axis needs to be rpm.

Looking a bit odd compared to MS43, maybe we can flip that entire map.

[SilentShout]

Tapatalk crashed before i replied.

Edit: boom, making the y axis rpm and all of a sudden the whole map makes sence -.-

Cheers for that. Using that formular you provided makes mid to high load at 500rpm the table reckons it will ignite 13° after top dead center. I assume this is to prevent knock??
Also not to sound dumb (but it will) where did you get the factors and offsets for the equasion from??

I did a search on it and the most helpful yet not helpful resource i found was from a dude on youtube called vagecumap who does winols tutorials. He only provides factors and offsets for VW diesel cars :(

Attached a pic of the table:
http://tapatalk.imageshack.com/v2/15/01/19/ec2697f94cc685b5f134b424cb9f50e6.jpg

[Leinad78]

Its been an good guess ;)

Its the factors my MS43 is using and as some maps look so much similar, it actually was a guess by having a look at how my unmodified maps look.

Think thats not to off?

5663


Now lets find the airflow-descriptor. We are looking for a 12x1 map and i think its 16bit for higher resolution.

Alright, think i have it..

Reference the y-axis to position 0xBB0, 16bit, LSB first,

just like this one, but with different adress.

5664

Conversion will be "X*0.021195"

[SilentShout]

Heres what it came up with. Flipped the axis back around so x is rpm again.

http://tapatalk.imageshack.com/v2/15/01/19/a5c9becf8612921cc2660fd494f6279e.jpg

I cant get the pretty colours to work anymore. Just comes up all light blue if i do.

[Leinad78]

Set "Use low range" to minus 20 and "Use high range" to 40.

I think the airflow conversion may be slightly off, 540kg/h seems to be a bit high for that low power engine.

Can one measure live data at that ecu? If so, can you log/measure the highest airflow value the ecu will recognize under full-load?

[SilentShout]

Its not that underpowered of an engine and it wouldnt surprise me considering the optimum exhaust size for the most high rpm gain on this car is 2.5"

The z18xe seems to respond well to breathing mods with some in the uk reaching 160-180hp naturally aspirated :)

Btw colours work now. Had to close and reopen tuner pro though so it may be a glitch.

Heres the result
http://tapatalk.imageshack.com/v2/15/01/19/958cbf9c1594761dbc2643dd84a5e3d1.jpg

Id also like to take the time to thank you for all your help btw :) it is greatly appreciated and i only hope i can help you out with the astra.

[Leinad78]

Don´t get me wrong, everything below 300hp is underpowered ;)

My engine produces 240hp and has a airflow at max of ~600kg/h with entries up to 700 in the maps.

thats why i don´t think a 130hp engine will have a airflow in the region of 500kg/h.


I´m really impressed by the results and steep progress so far, looking very good and you´re learning really fast :thumbs:

[SilentShout]

Im proud to say i have a knack for picking things up fast :) doesnt mean im a pro though, but Im always happy to learn.

Could it be possible that the data is put there by the manufacturer just in case? i know alot of people who turbocharge the Corsa C 1.8L use the factory MAF sensor as its fine to do so.

A basic turbo kit sees around 190hp with the highest turbo kit available for it puts output at 260hp all of which use the factory sensor and factory ecu with a remap.

Also how would i go about testing the output? i have an obd2 handreader which i think shows live data from the MAF sensor, ill have to try it and let you know.

Im guessing i have someone rev the car to redline and see what data it puts out (hopefully in kg/h) or if its in a different unit of measurement i convert it to kg/h.


What car do you drive out of curiosity?

My old car was a JDM S15 SpecR which was tuned by HKS in japan before it was brought over. Ate everything on the road as was the sexiest beast i have ever seen ;)

sold it due to unemployment for a long period of time, the car was on its last legs when it left me. Imports cost alot to maintain and upkeep. :(

[Leinad78]

I´m driving a 2002 E46 convertible with the 3L engine. I´m currently working on turbocharging the engine and as its equipped with an automatic gearbox, its really difficult to not kill the transmission.

The conversion may work or may be false, i can´t guaranty it. You´ll will come to a point and it will happen soon, where you won´t get more results, thats the point when you need to disassemble the file. IDa Pro is the best tool to do so, you´ll rip out your hair until you find a start at it, but except buying a damos file, thats the only way to get correlation between the maps, their meaning and the axis descriptors.

If you come to the point wanting to buy a damos file, do not try to fool the seller by tellimg him you have a valid version of winols ;) Tell them you work with ASAP2Demo and you don´t need and want WinOLS as ASAP2Demo is freeware ;) That will probably may save you trouble ;)


One more thing: I don´t know how many or which temperature sensors the ecus has, at least it will be the intake air temp sensor and i´m confident it is one of these maps:

-0x1486 (16x1)
-0x126B (16x1)
-0x128B (16x1)
-0x136F (16x1)

My best guess would be 0x126B with 0x128B being the axis descriptor in Volts (0.019607843*X) with a lower limit of zero and a higher limit of 5V. Conversion for the map could be 0.75*X-48.0 I thin 0x1486 may be water temp sensor with the same conversion and axis description ;)

[SilentShout]

theres a fair few sensors on the car for temp, Ill try and find out how many sensors the car has.

I have a question though? whats the address on the BMW file for the idle speed control?? from what ive researched its based on coolant temp and if AC is on or off etc.

the current idle speed in the car while its warm is around 700rpm which is quite low imo.

So modified my original bin file in winols to have a raised limiter and exported it as a bin file. Uploaded that bin file to the car
http://tapatalk.imageshack.com/v2/15/01/19/504835605c8640287a4724c54025b99e.jpg

Then this happened :S
http://tapatalk.imageshack.com/v2/15/01/19/9b0aa191cbebf978530c24cb957c60d8.jpg

Thank the stars for google translate :) it says turn the ignition off for 10 seconds.

Did that, car reset fuel pump whirred. The i did a read to test if the ecu was in tact and i hadnt killed it
http://tapatalk.imageshack.com/v2/15/01/19/11704a450f9edfad865b3f1555492d83.jpg

Which it was. Turned the key and hoped for the best and it started :)

Now comes the bad part.... my car still limits at 6400rpm :(

Im putting it down to a few things it could be.

1) winols didnt export the modified file and instead when i hit export it exported the original unmodified bin.

2) the addresses where the aparrent soft and hard limiters are may be part of an rpm table or scalar of sorts although the data around the addresses looks too random to be any sort of table.

I have yet to check the exported file in a hex editor to verify if it exported incorrectly. (probably just going to use the one in tuner pro for now as its easy to use)

The last theory is based on the data from the similar engine that i posted a few pages back (although the addresses in that file didnt match up as the cal file from my car is smaller)
In that data there were 4 rev limit addresses so maybe my car has 4 not just 2.

Time will tell but for now sleep. My brain hurts and all i see is hexadecimal code everywhere [emoji14]

[Leinad78]

This is what the idlespeed regulation looks at MS42.

5665

[SilentShout]

From what i can see it says coolant temp -30, -10, 10, etc etc.

I assume thats in celcius?? from memory engineers measure coolant temp in kelvin so to find -30 ill need to look for "243" followed by "263" etc and that will be temp maps or reference tables.

also once ive finished my work im going to compare my REV mod bin file to the eurotune's (from the other forum) REV mod bin file and see if its still just the 2 addresses changed.

[Leinad78]

The Axis description is most likely at 0x14FE (6x1) 8bit with conversion X*0.75-48 ;)

[SilentShout]

Trying to do a comparison between my modified rpm file and the rpm file from the other dude and found something interesting

http://tapatalk.imageshack.com/v2/15/01/20/5816fb7c9b30184f4e6025a670f867fa.jpg

Im not sure if this means theres a change or not.

The only other difference i found apart from the 2 rev limit addresses which i already changed was the 16bit checksum address here

http://tapatalk.imageshack.com/v2/15/01/20/60f8dc159fd2cdb847f13ee7f11e8c89.jpg

Could it be the checksum correction i have is incorrect meaning the car ignores the changes to the rpm limiter?? I thought if it was incorrect the car doesnt start

Also ive tried using the table to find map locations or pointers and i think i need to do more research as its a little bit beyond my knowledge :(
http://pcmhacking.net/forums/download/file.php?id=9856

[Leinad78]

It shouldn´t start with an checksum error. I´m not shure if the adresses he gave you are correct and sufficient.

Just get rid off those statistical maps. they don´t help in any way.

[SilentShout]

Thats what i thought. maybe his car doesnt have a 7300rpm rev limit as ive changed the addresses he provided which seem to be correct. and there arent any other differences between the files other than those addresses and the checksum (apart from that grey area as above, im not sure if thats a difference or not)

Where did you get the conversion for the coolant temps? its coming up as -30, -09, 00, 20, 60, 90. Does that sound about right?

Im going to try it converting from kelvin and see how it goes.

Yeah your formula seems to be correct. i wonder what the original units they measure in. Maybe Fahrenheit?

[Leinad78]

Its the same factor as in my BMW. Its sounds pretty good i think.

put your mouse over "Org" next to "*1", it will show you if there is a difference.

Well, those sensors are resistance based and so they change their resistance by changing the temperature. The Ecu just measures the voltage before and after the sensor and uses the formula to calculate the temp. We call it Zweipunktkalibrierung, i don´t know what its called in english

[SilentShout]

in that case there was a difference in the first picture in the post above,

http://tapatalk.imageshack.com/v2/15/01/20/5816fb7c9b30184f4e6025a670f867fa.jpg

that should all be 255 like the surrounding code but theres a difference along it.

I thought that code was useless though and not sure of the relevance of it.

[Leinad78]

Hehe :rolleyes5:
Just move your mouse over those bars on the very right side, right-click and choose ascii ;) Then you will see where that file comes from ;) :devil:

[GUN16V]

My head hurts... lol

[SilentShout]

Hehe :rolleyes5:
Just move your mouse over those bars on the very right side, right-click and choose ascii ;) Then you will see where that file comes from ;) [emoji317]
Lol it says EVC.EVC.

Evc make winols. How did that end up in his map?? Is that area just useless code that you can change to anything? [emoji14]

It would explain the difference in the checksum aswell. But still doesnt explain why my car still redlines at 6400rpm :(

[Leinad78]

EVC not only makes Winols, they also do tunes ;)

I tend to think that guy doesn´t really know what he´s talking about and just copies some code.

FF`d areas are normally not used by the ecu and can therefore be manipulated like EVC did it in this case.

[SilentShout]

That makes sence :) although what doesnt make sence is that there are only the 2 addresses changed for the rev limiter. So either hes telling porkies or something with my file is wrong.

do you think i should chance it and flash his file to my car??

Also out of curiosity, is this what a full dissassembled file looks like?

http://www.diy-efi.org/gmecm/papers/anht_hac.pdf

if it is its much easier to read for me than hex :)

[Leinad78]

That would be easier for all of us ;)

a disassembled file looks much more like this:

http://abload.de/thumb/tempcompsub_35b7c_proa6k21.png (http://abload.de/image.php?img=tempcompsub_35b7c_proa6k21.png)

It just contains hundreds of these code snipets, just without any logical reference ;)

So will just get the left side of the picture and find the right side on your on. On every fu**** sub-code

[SilentShout]

Found some interesting things while trying to learn how to disassemble,

Found an information sheet with a list of a bunch of ecu's and their processors.

http://www.dimsport.com/ftpsito/pdf/New%20Trasdata%20-%20ECU%20application%20list.pdf

In there i found the siemens simtec 76 which may have a similar processor to the simtec 71 and 70 etc.
Using that information i found a data sheet on the ST10C167 processor found inside that ecu.

http://pdf.datasheetcatalog.com/datasheet/SGSThomsonMicroelectronics/mXsquyr.pdf

Im hoping to learn more about how this information can help me, i believe how easy it is disassembling a binary comes from knowing what architecture the binary file is written around in the first place.

Theres plenty of BMW's listed in that first link too so hopefully it helps you out aswell with your BMW :)

[chris_r]

In there i found the siemens simtec 76 which may have a similar processor to the simtec 71 and 70 etc.
Using that information i found a data sheet on the ST10C167 processor found inside that ecu.

Wouldn't surprise me, the 76 is used on the Z18XER engines in the Astra H and the Cruze. Main differences there are the XER uses VVT and full CANBUS.

[SilentShout]

chris_r you wouldnt by any chance *cough* have or will be opening up your z18xe ecu to *cough* check out the part numbers on the processor chips? *cough*

You know in the interest of science :)

[Leinad78]

My ecu uses Infineon SAK-C167CR-LM processor. I just haven´t found a way to start with IDA.

[SilentShout]

I think ive narrowed it down to 2 processors it could be,
As chris said the simtec 76 was canbus and reading through the data sheet it specifically states it has support for CAN 2.0 meaning chances are its not the same processor in the simtec 71.

Looking at the other models i can tell you the processor will be from the ST10 family made by STMicroelectronics

2 possible models are the ST10F166 or the ST10F163

The 163 says up to 1999 so im thinking it may be the 166 but hopefully its enough information to look into disassembling using IDA however they only have intel processors in their dropdown lists.

The quest continues.

Dont know if this is helpful to you Leinad78

http://www.infineon.com/dgdl/ap082701.pdf?fileId=db3a304412b407950112b41ab7d12b 7c&ack=t

Aparrently infineon have their own disassembler for the C167 series of processors, but it all looks like mud to me :(

Also found this link but not sure its helpful either

http://nefariousmotorsports.com/forum/index.php?topic=359.0title=

They mention the infineon in there too

[chris_r]

chris_r you wouldnt by any chance *cough* have or will be opening up your z18xe ecu to *cough* check out the part numbers on the processor chips? *cough*

You know in the interest of science :)
I have both the Corsa and Astra Z18 ECUs, so I could probably open up the Astra one in the name of research.

[Leinad78]

Save the time and effort, http://www.youtube.com/watch?v=4ENJ5L_-pDA

You won´t see anything usefull.

[SilentShout]

Haha figured that :( quick question? I found three possible 16x12 maps right next to each other. It seems significant to me but i cant find any info on what a 16x12 map might be. I tried to use the correction from the spark table we already found but it doesnt work so im thinking prehaps it may be 3 fuel maps? For different fuel types?

Just wondering if your bmw file has anything similar.

[Leinad78]

What position are the maps located at?

[SilentShout]

Start addresses at 0x238C, 0x250C and 0x268C respectively all maps are 16x12 16bit (to get it to display correctly in tunerpro i had to make them 12x16 instead). Not much difference between them. Heres an example of the first one:
http://tapatalk.imageshack.com/v2/15/01/28/59deec95c8d266cfd8729c0e32fb6308.jpg

[Leinad78]

Ah, the 3 i mentioned in the other forum earlier...

Will have a look at them later.

(edit)
Well, they aren´t similar to anything at BMW files, but due to their size it can only be ignition or injection.

[SilentShout]

What is the conversion they have for the bmw injection tables? :) the spark conversion doesnt work so im guessing they are injection tables.

[Leinad78]

Its x*0.005333

Try using "x*0.015625" at the maf table :) output will be kg/h air massflow

[SilentShout]

This is the first 16x12 table out of the three that were next to each other, this is using the conversion X*0.005333, the only part of this table i dont get is there are zeros at the very start, so it cant be injection as there would have to be some sort of fuel value otherwise the engine wont run, all three tables have 0's in the beginning and "65535" as their highest values. Ill keep looking for more maps and might come back to this one as i cant tell what it is :(

http://tapatalk.imageshack.com/v2/15/01/30/e8b559e39efccdb0efb7acdf753c30ae.jpg

Also finding a whole bunch of maps thrown together. Theres an 8x8 map followed right after by a 12x16 map. Thinking the 8x8 may be a calibration map of sorts and the 12x16 an injection map but have yet to sort the conversion. Just getting all the data into tuner pro and then going from there for now

[sskustomz]

Ignition curve?


Sent from my iPhone using Tapatalk

[SilentShout]

Ignition curve?

That was my second thought but the correction applied to an already known Partial ignition table didnt work so it cant be ignition sadly.

[Leinad78]

It does have an electronic throttle?

It may be somekind of torque calculation or airflow calculation.

There even must be an Alpha/n table somewhere thats used when the maf is disconnected.

[SilentShout]

It does have an electronic throttle?

It may be somekind of torque calculation or airflow calculation.

There even must be an Alpha/n table somewhere thats used when the maf is disconnected.

It does have an electronic throttle body as well as the car does run without the MAF as ive done it before when i had a faulty one so you might be right on the mark with that.

Im finding some wierd maps that winols didnt pick up (not that i trust its auto finding abilities)

There looks to be an 8x16 8bit map at 0x4605 which looks very readable without any conversions (lowest number being 56 and highest being 150)

Also winols found two 4x8 maps one after the other but one thing i noticed is theres a third 4x8 map directly after them thats an exact copy of the second 4x8 map :S could the ecu have redundant data hiding in there or maybe the map is refferenced elsewhere.

If only i could understand how the maps are referencing their x and y axis data this would be alot easier. I cant for the life of me understand that chart on the other forum that the MS41 people (or MS42 i cant remember) are using to find the axis data out.

EDIT: Scratch that the 8x16 map looks to be two 8x8 maps side by side.

Im finding alot of tiny maps all over the place, EG two 6x6 maps both with the lowest value of 0 and the highest value of 255 with the numbers in the center changed about

Heres a screen cap: http://i1272.photobucket.com/albums/y385/Rick_Anderson/lots%20of%20small%20maps_zpswpphx3u8.jpg

So many tiny files :(

Siemens, why you so complicated for :sad:

[Leinad78]

I may have found a map that is relevant to throttle response ;)

Its 16x12 at 0x1C1C 16bit and x*0.001831

It pretty much looks like BMW map, even though the max values are a bit low.

Heres a link to a friends google drive who hosts all the files and damos for BMW. I´m shure it`ll help.

*.s28 files can be opened with free software ASAP2Demo

[SilentShout]

Ah that makes sence as there is a noticable delay when pressing the accelerator pedal to when the car picks up, No idea why they would impliment a delay at all but i know this delay can be flashed out as others in the uk and germany have done it.

Cant see a link but ill google it and see what i find. :)

[Leinad78]

Sorry, forgot the link :D

https://drive.google.com/folderview?id=0BwfSP3VCFa9TVUt1YkJlZUN6cmc&usp=sharing


So, there will at least be a pretty big map that compares measured MAF values with an preset to see if the maf is off. If its off, it´ll will probably throw a fault lamp and will switch to an alpha/n map.

At BMW the diagnosis map is 16x16 and the actual alpha/n map is 8x12, it´ll tell the ecu directly the injection time. Next to them there is another map that calculates the airflow for other things, like ignition timing, that map is 8x8.

[SilentShout]

Quick question as you may know more about it than me.

I was looking around the Address 0x0DD9 in 8bit format, and i found a bunch of rising patterns (usually indicative of a map) however the interesting part is the data doesnt seem to indicate a whole map so im possibly thinking they may be axis data?

The interesting part was that each of these patterns was followed by a "008"

Some of the patterns would literally count up like 001, 002, 003, 004 etc. and then others will count for an example:000, 024, 038, 044, 060, 008, 000, 001, 002, (its a bad example but you get the idea)

in your experience what would this usually indicate??

Many thanks in advance for your help btw :)

also i downloaded the MS43 files and i couldnt get it to work, so im going to try the MS42 files and see how i go from there.

EDIT: Scratch That I read your post in the other forum on PCMhacking and you said the 008 is a reference to the size of the map and that the maps are 2d so they are most likely axis data :)

Time to do some hunting around.

[SilentShout]

Found this while searching how to find maps,

http://bmweditor.com/Home/Product

May be of use to you :)

[Leinad78]

I´m a direct and the only competitor to that company when it comes to MS42 and MS43. Of course they have a much more shiny product, but its also much more limited as we rely on the maps these guys put into the program. I´m almost updating my xdfs every week and instead of 400€, my software is absolutely free :)

I´m currently covering ~5times the maps then BMW Editor does :)

[SilentShout]

Its nice to find someone else with such similar goals :)

Im doing it all for free because i want the learning experiance and so that the tuning for these cars opens right up.

Unless you pour money into the ecu most people settle on the whole "exhaust, rims, floormats etc,"

With the hardest part of the car tackeled hopefully the world will see many more insain z18xe powered cars :)

[SilentShout]

Update: Ive finallly grasped an idea on how the people with the MS41 and MS41.5 ecu's have been finding the correlation between maps and axis data, And sadly it doesnt work with the maps from my Bin, ive checked before and after the map for any sort of pointer that would indicate where it gets its information from, Ive also tried looking around the axis data from that whole section of axis data we discovered with nothing found either. Ive tried looking for hex values that relate to the map addresses and vice versa and found nothing.

im trying to look for information on how the MS43 and MS42 ecu's look for axis data but im finding very little information. Maybe the Simtec series ecu's work in the same way hopefully.

[Leinad78]

I´m afraid it can only be found by disassembling the file :(

[SilentShout]

All good, I have had some success disassembling the file using the ST10 processor information from STMicroelectronics, Now that I know where the axis descriptors are and some maps ill be able to hunt around the area and see if theres any indication of where it points and go from there. Sadly ill have to do it at home though as i dont have IDApro on my laptop with me.

Ill let you know what I find :)

in the mean time im thinking of putting all the axis descriptors into Tunerpro so they are there and easier to read then see what the values are, hopefully it will give some sort of indication as to what the axis is (rpm, Kg/h etc) and go from there :)

[Leinad78]

Sounds reasonable :)

Keep in mind you need the full flash file in order to disassemble it

[SilentShout]

Yeah which i cant get that easily off this car sadly :(

I was looking Through some of the maps that winols was picking up and spotted this one. It thinks the whole thing is an 8x12 16bit map but if you look at the values the map decreases and then increases. Im thinking possibly its a map with the axis values before the map itself?

http://tapatalk.imageshack.com/v2/15/02/03/aa8a39761cf34dc534045886848edf93.jpg

Putting it into tuner pro makes it easier to see.

http://tapatalk.imageshack.com/v2/15/02/04/27893ac97390ea43addd3158a7e09001.jpg

[Leinad78]

Well, i have to admit some of those statistical maps don´t look bad when only Siemens option is active ;)

[SilentShout]

Looking through some more data and im finding some tables with what looks to be one of the axis values much like you found with the MAF table.

Heres an example. Looks to be an 8x12 16bit map.

The map starts at 1B1C but before that theres 16 addresses that increment up like a 16x1 table. That one starts at 1AFC

The result looks like this:

http://tapatalk.imageshack.com/v2/15/02/04/3b5587a46267d9ac4972333622347b70.jpg


I assume ill need some sort of conversion to make it readable.

Ive also asked for help on the ecuedit forums as they seem to have alot of folks who have dissassembled by hand before.

Hoping they can shed some light on what the method of looking up on the axis data might be.

[Leinad78]

Well, if thats axis data, wheres the entries for the y-axis?

[SilentShout]

There was none that i could see before the x axis data was just 0s and after the map looks to be random code but at some stage tonight im going to investigate it further.

[SilentShout]

So i tried importing the astra G bin file to see if it would bring up any differences, and its a mess.

http://tapatalk.imageshack.com/v2/15/02/06/eb7462ae64f2f66c7ae7920a90f160ab.jpg

No luck with that or finding axis data :( hit a wall, feels bad man.

[Leinad78]

Well, it does look pretty identical, at least identical enough so the differencies may be because of differencies in the region, engine or car itself. Are the main maps at the same position?

Not wanting to frustrate you, but i don´t think there will be any way to find the axis without disassembling :(

[SilentShout]

i was playing around and found something interesting. The partial throttle ignition map at 0x3CB7 is an 8bit 12x16 map according to winols. I looked at the data before it as i read somewhere that axis pointers are in 16bit aparrently.

Looking at it in 16bit hex shows the value 2830. I put that into a converter that converts decimal to hex thinking "what if the ecu looks at the hex value as a decimal value and uses that to find an address"

2830 as a decimal to hex becomes b0e.

sitting at address 0x0B0E is a 16x1 axis descriptor that doesnt look to be rpm but something else. It may be correct.

However looking at the data before that and after the map the only thing that comes up is DD4 which leads to nothing (actually leads to part way through a 6x1 map that is literally 000, 001, 002, 003, 004, 005)

So it may be something or it may be just complete coincidence however i will play with some different maps and see what i come up with .

[Leinad78]

That one map really looked good :) But what about 0x4AA8 for example? ;)

I may have found some guys that are familiar with Siemens ecu disassembly (these ms41 guys) and hopefully they´ll help me getting started with ida. I sense some steep progress :)

[SilentShout]

Hopefully that will be helpful. I read more into disassembling and as you said to make it work you need the complete flash from the car including the programming area too.

Sadly i dont think theres a way to do that with the simtec 7x series ecu's or at least no one has tried it.

Winols says that map is a 5x10 (maybe 6x10 dont have the laptop on me so cant remember) what might that be for?

Whenever i search in google a map size to try and find other maps that look the same, nothing usable comes up sadly. I need to look more into interpreting the map data to tell what the map is for which will hopefully help a bit.

Using my previous method to try and find axis data unfortunately only works for 1 axis on the maps ive tried. Theres a few maps that have 0's before them and a few maps that look like they have the axis data inside them (like previously posted. theres a line of data goes down before the map data which is going up)

fingers crossed the people familiar with the siemens disassembly can help out.

[SilentShout]

Found a huge axis map of sorts at address 0x15AC 16bit

Looks to be 254x1?? does that sound right?

I cant find any info on the internet about it. A few people keep talking about 255 being the highest value in 8bit or something.
Could also be something to do with the MAF sensor prehaps?

[Leinad78]

0x15A8 16bit 16x16 Factor 0.015625

MAF conversion table, unit mg/stroke

[SilentShout]

I tried seeing if it was a table but then i put it into tuner pro as a 254x1 and its linear from the first to the last entry.

best way to describe it is it doesnt come up as values that rise etc like a traditional map.

Ill take a pic of it.

[SilentShout]

Heres when its put into tuner pro
http://tapatalk.imageshack.com/v2/15/02/09/1f59546f14a37aa214895a31683737d9.jpg

And here it is in winols. Ignoring the fail map detection by winols you can see that unlike a normal 16x16 map when the numbers rise and then suddenly fall after 16 addresses it keeps going up and up.

http://tapatalk.imageshack.com/v2/15/02/09/a5cd932f364f5f427f2b3faa978c8670.jpg

Adding the extra data from address at 15A8 would mean its exactly 256 bytes long.

Here it is as a 16x16 map but i think it might be a 2d map maybe.

http://tapatalk.imageshack.com/v2/15/02/09/1aa8b06732ddf9ac1e66331eb89fd91a.jpg

[SilentShout]

To add to my previous post you are most likely right about it being 16x16. I cant find any information on what a maf conversion table actually does though. Might help me if i knew what it was before i assumed it was a 256x1 map :(

[Leinad78]

No one revealed what that map is actually doing or what the axis descriptions are.

[SilentShout]

I managed to get a proper .bin file from a vectra B with the z18xe aswell.

This one looks much better than that bogus x18xe file from the PCM forums, (had a difference of 90 something percent)

This one only has 23% difference and all the major maps are changed and some of the RPM axis tables are changed too. Ill look into it further and upload the file to the PCM forums so you can download it too if you want :)

[Leinad78]

Awesome :)

[SilentShout]

Quick question, have you heard of a UK company called DC-Chiptuning.co.uk???

They PM'd me on another forum and said they offer a tuned file for my car. When i asked what they offer they said 80pounds for either a stage 1 or stage 2 tune.

I asked whats changed in each tune (RON98 fuel, timing advance etc) and all they replied with was "stage 1 is more power, stage 2 is even more power"

Im thinking its dodgy, what are your thoughts?

also uploading the bin file to the other forum soon.

[Leinad78]

Well, sounds like they sell already tuned files without knowing what they do ;) If you can afford it, it may be a way to find differencies and therefore maps. But without knowing what "they" did, it may be hard.

[SilentShout]

Quick question.

How does one determine the difference between spark tables??

I have the 2 spark tables up (ones at 3B93 & 3CB7 both 8bit)

Im trying to see if maybe one is used for WOT or open loop and the other is used for closed loop/part throttle.

One looks to be more defined whereas the other looks like a big chunk of it is 40.1 BTDC.

thoughts?

Ill screenshot when i get home so so you can see what i mean.

Also on the BMW files, do they have a 2d map for WOT fuel??? I heard rumors that WOT fueling is done linearly similar to the RPM Axis maps

[Leinad78]

I´ll try to attach something

5715

[dutchy]

1.2.5 Anti - jerk correction ( IGA_AJ ) ???!!! I'm pretty sure that is not in a Bosch me 1.5.5 ;)

[SilentShout]

Wow that document is full on. Still unsure what it contains but im guessing its the conversions for various ignition parameters. How did you get a hold of such a document :) thank you for that ill have to study it a bit.

[Leinad78]

I got them a few weeks back from those ms41 guys.

http://www37.zippyshare.com/v/aWtDTQtU/file.html

[Leinad78]

Started disassembling yesterday and my head hurts :) Unbelievable stuff...

5760

[faneca]

Kudos to you guys on this, i dont even know what im looking at lol

[SilentShout]

Started disassembling yesterday and my head hurts :) Unbelievable stuff...

5760
Very nice. I assume thats for the MS43. Hope it all goes well amd maybe even provides insight as to how it references axis data.

I know to properly disassemble you need the full flash file off the car. Not just the cal file as i have from the sri.

How did you manage to grab the full file from the ms43? :)

[Leinad78]

Full Flash from MS43 is pretty easy. You need to get the ecu into boot-mode by forcing a pin at the flash to ground while the ecu is woken up. Once its in boot-mode, you can read it via Galletto.

Unfortunally i found out the referencing of axis description :( Its all in the code. Without proper disassembling or having an a2L/Damos file, you have no chance to find out :(

[SilentShout]

damn, Guess i should start hunting around for people who will supply the Damos file :(

Im not sure my car is able to be put into boot mode as i couldnt find anything on the internet about the Corsa C or even the Astra with the 1.8.

Is there a link to instructions? happy to give it a go. Much easier to find someone able to read a full bin read than just the cal segment.

in the meantime im just going to keep hunting around on the cal segment to see what comes up.

All i need to find is WOT fuel and ignition tables as Part throttle (closed loop) tables for spark and fuel have already been located and shouldnt need to be touched that much for a forced induction setup.

Alternatively I can save up for the AEM FIC6 which not only controls fueling but it also can retard the ignition. Good for boost, but crap for NA applications as you need to advance the timing for more power.

[Leinad78]

Did you ask at OLS.be if they have a Damos? Be sure to tell them you will use it with free ASAP2demo software instead of WinOLS, so you don´t have a validated customer number.

Forcing MS42/43 into boot-mode is only doable as the Galletto software supports another ecu with the same processor and flash. If you don´t have the exact same setup, boot-mode won´t work.

As the chips are bonded directly, i don´t see big chances to identify them

[ZakhooiTM]

How's the progress of this project ?
If you need the complete binary, I could send it to you.

Hard bricking these ECUs are luckily almost imposible (unlike the Delco HSFI 2.x used in Z14/Z16XE/SE engines)
The worst that could happen is that you cannot reprogram it anymore via the 3rd party reprogrammers, however via the Tech 2 or MDI it can be recovered.
If the need is be, I could make a PC with teamviewer where you can test it on an ECU of mine :)

[ZakhooiTM]

Hmm, no response.. okay.

I've been doing some digging and as the Z18XE and Z22XE share the same ECU and use the same firmware platform.
I've compared the 2, they look very alike only the places where they are are somewhat different.

Now I said that the Simtec 71 uses sort of a platform, this means that the firmware the ECU runs is very much the same from engine to engine or version.
You can test this just by uploading the Z22XE dump into the Z18XE and look with the tech 2, you will see then that you can only get into the ECU if you select the Omega B with a Z22XE.
Or even with a ELM327 should be enough to query the engine model that is programmed in.

But anyway, I was comparing the 2 and this looks quite similar, don't know what it is but maybe to do with fuel ? :
5901

Here are the files I used, be sure if you test that you got the SIE 0116004500
5900

I'm just beginning with this kind of stuff, normally fix these ECU's and reprogram them with Opel's own software :)

[DRMAT]

SilentShout should be around, he must have just missed this reply.

[SilentShout]

Yeah cheers for that. Tapashit isnt updating on my phone properly and works been a bitch with school holidays. :(

Pretty sure the ecu may be different. Its certainly not the same code as that. Ill have to check it out when im on my desktop comp again.

Sent from my SM-N910G using Tapatalk

[ZakhooiTM]

If you got a other SIE number, just let me know, have a pile of these ECUs so yours will be there too and they dont differ that much

ECU of the Z22XE/Y22XE/Z18XE and Z18XEL share the same ECU, only the software is different.
Heck it even looks that the only difference lays in that 24KB we can extract from it, if I program a ECU as Z22XE and then write the Z18XE BIN to it, it wil start and run like a Z18XE.
If I upload the Z22XE engine wont start, it's too different

[SilentShout]

Hoping this image works:

http://pcmhacking.net/forums/download/file.php?id=8144

The SIE im pretty sure is 09115113 for the SRI ecu's

[ZakhooiTM]

That number is the partnumber / calibration ID
The ECU hardware ID, from looking at the image, is SIE 0116004000. So it would be incompatible with my file.
Will look tonight for a similiar ECU with the same SIE number and program it with your VIN.

The possible SIE numbers for the Z22XE/Z18XE/Z18XE1/Z18XEL are :
SIE 0116004000
SIE 0116004300
SIE 0116004500
SIE 0116102000

[SilentShout]

UPDATE: I have made contact with Lenaid78 (cant remember how to spell it) and he is still helping me with the disassembly.

Big thank you to ZakhooiTM for providing the 256kb file for disassembly. Turns out the 24kb flash file is located within the 256kb so i was looking at it all wrong :)

I have also discovered that it seems to be disassembling rather well using the C166 processor found in alot (i mean alot) of BMW siemens ecu's

I will hopefully have more to report at a later date.

For now my goal is to find all the nessesary maps for adding boost, then dig deeper and find the areas that control things like throttle response (poor on the sri), DTC's etc.

[Leinad78]

pretty straight forward: Daniel backwards + the year of birth ;)

Unfortunally time is so much limited right now, i´ll try to find some spare time this week to start fiddling with the registers.

[SilentShout]

ah that makes much more sence now :) haha

And thats all good, i understand time is a constraint as its the same on my end. Work is soaking up so much time i havnt even drained the fluids in my car yet :(

[DHarry]

would love to learn a bit about chip tuning

[Leinad78]

We all would :) Unfortunally we need to find out the map layout first.

Interesting thing is, as there are tuned files, there must be some kind of map description.

[Raisin]

I have been playing around and reading up to start on the Bosch ME 1.5.5 ECU for my Astra Sri Turbo. I think I have a valid OLS file, but it appears to be all in German. [emoji14]

Sent from my ONE A2005 using Tapatalk

[DHarry]

I just need to ask, is the Opel Astra ECU opennable, and with what tool? It looks to me like those ECUs meant to never be oppened

[Leinad78]

I have been playing around and reading up to start on the Bosch ME 1.5.5 ECU for my Astra Sri Turbo. I think I have a valid OLS file, but it appears to be all in German. [emoji14]

Sent from my ONE A2005 using Tapatalk

Perfect language :ihih:

[Raisin]

Perfect language :ihih:

Haha, it just makes my life harder. I've been too busy to sit down and start translating and seeing if I can make any sense of it all. Hopefully a bit closer to Christmas when I have time off from work I'll be able to get started.

[Leinad78]

Haha, it just makes my life harder. I've been too busy to sit down and start translating and seeing if I can make any sense of it all. Hopefully a bit closer to Christmas when I have time off from work I'll be able to get started.

If you have specific questions, don´t hesitate to ask ;)

[Raisin]

If you have specific questions, don´t hesitate to ask ;)
Thanks, I will keep that in mind!

Sent from my ONE A2005 using Tapatalk

[ulf91]

The car doesnt have any variable cam timing, there are roumors about it having an intake that switches from long runners to short runners at a certain rpm however im not sure they have that. would explain why around 3500rpm the car sort of livens up though.

Hello guys.

I'm from germany and driving an Astra G OPC 2.0 16V with X20XER and Siemens Simtec70 ECU.

First of all I can give you my bin.
Second I can absolutely confirm that my car has a switchable intake manifold. I also have the map for this.
In my case it switches from long intake to short intake @ 2528 rpm.

I can also give you a tuned file! I compared it with my original one and found a lot of differences in multiple maps!


I need help with finding a map called "Schliesszeitkennfeld" in german. Wordly translated "Closing Time map".
In the Z20LET with Bosch ME1.5.5 the map looks like this:

6105

Of course it is factorized:

- map is inverted with factor 0,1 and precision 3
- y-axis in volt with factor 0,0681 and precision 4
- x-axis in rpm with factor 40
- everything in 8-bit

I need this map in my Simtec but i cant find it anywhere! So help is greatly appreciated!

Additionally I found a map. Could this be the lambda map? It looks a little bit like one...

6106


This is one map being greatly changed in the tuned file. I dont know which map that is...
I hope you can help me.

6107


Here is an example on how many maps are changed in the tuned file! I think this is a good help!

6108

Best regards

[faneca]

Raisin

[Raisin]

Raisin

Thanks.

Mine uses the Bosch ME 1.5.5 ECU so it's completely different.

[ulf91]

SilentShout Leinad78

[Raisin]

SilentShout Leinad78

I'm not sure where they are. Hopefully one of them will swing back around soon. :)

[sskustomz]

Silent shout is in hospitality, Tis the season to be crazy busy

[SilentShout]

Im back. Well somewhat.

Today is my last day at work, and then i will have time to work on the Barina.

Turns out the only way to get anytime off in hospitality is to quit your job. :lol:

Ill have to go back through all the threads etc that ive missed out on over the months when im home. but just an update, im still alive and kicking :)

[Raisin]

Im back. Well somewhat.

Today is my last day at work, and then i will have time to work on the Barina.

Turns out the only way to get anytime off in hospitality is to quit your job. :lol:

Ill have to go back through all the threads etc that ive missed out on over the months when im home. but just an update, im still alive and kicking :)

Oh, you quit? Do you have another job lined up or what's the plan?

[SilentShout]

sadly no other job lined up yet. Looking and applying which is always fun however my poor decision to quit at a poor time of year meant i am able to keep my sanity as my job was doing my head in very badly.

:(

[Raisin]

sadly no other job lined up yet. Looking and applying which is always fun however my poor decision to quit at a poor time of year meant i am able to keep my sanity as my job was doing my head in very badly.

:(

Ah that's a bummer, but sometimes you just gotta leave.

[Brando47]

Hey guys, remember reading this thread as it was happening and it all went over my head. Been getting into the idea of tuning myself a bit lately and remembered this so dug it back up but it seems to have reached a dead end. The amount of work you guys are willing to put into this for anyone to use just astounds me! No progress?

[chris_r]

Hey guys, remember reading this thread as it was happening and it all went over my head. Been getting into the idea of tuning myself a bit lately and remembered this so dug it back up but it seems to have reached a dead end. The amount of work you guys are willing to put into this for anyone to use just astounds me! No progress?
I think SilentShout has decided to go with an AEM FIC6 piggyback ECU for his turbo build, so this thread has gone a bit quiet.

[DryftKult]

I've still been sussing out a few things, I want to tear the 1.4mpi ecu open and compare it to the delco 808 ecu's from the camira and commodore, not sure if the sb 1.4 delco is an 808 but they sure look simillar from the outside, if they are the same or at least use similar components then the delcohacking kit might be able to be used to unlock them and make them real time tuneable.

[SilentShout]

I think SilentShout has decided to go with an AEM FIC6 piggyback ECU for his turbo build, so this thread has gone a bit quiet.

I ended up going with the AEM as it will provide me with a large amount of headroom if I decide to go further with the build, the factory ecu can only cope with so much.

The reason I stopped with hacking the ecu was due to reaching a wall, The way a normal ecu works is it might have the x and y axis of a particular map e.g. an injector map, located at the start of the binary file.

So for an example x might be RPM and y might be Load or MAF input. All of the RPM data is in one location and the MAF data is in another location. Usually the z axis (which is the actual table data) will have whats known as a header. This is data that will point to the x and y axis location so you know what the map is.

Our ecu is designed in a way that this doesn't exist. The headders for particular maps are located in a different part of the ecu that needs to be stitched to the front of the file. This has been done by leinad78, that is where my knowledge ends though. As you literally need to dissect the specific arguments, pointers etc that make the ecu work.

I have reached out to a few friends in IT however its beyond their knowledge aswell so hence the roadblock :(


tl:dr as an example. there are roughly 50 or so RPM tables in the one area, 1 of them is responsible for the idle speed in relation to coolent temp, 49 are not.
Without a reference from the ECU to which one does what, its all a guessing game.

49 chances to ruin the car :)

I still revisit it every now an then, and little things have been discovered like rev limiter, however I tried to change it and its still limited to approx. 6300 meaning there is another area of the hex file that the ecu references for the rev limiter.

Once I find somewhere to host the files im happy to put all our findings up for others to grab and see if they can do anything with.
Anyone know of such sites?

[Brando47]

All sounds like such a giant guessing game, very easy to understand why you might give it up in favour of a standalone or piggyback in this case. I usually just use dropbox for file hosting kinda stuff cause it's so easy to share links, or I think google drive is very similar. Not sure if that helps

[SilentShout]

sweet ill see what I can find and make a google drive thingie when I can.

about 4 months ago one of my HDD's died and it was the one with most of my programs, games and tuning files on it. I believe I backed up to one of the laptops but ill have to check when I can find the charger.

I havnt given up on it, just whats left is well beyond me. the AEM FIC will allow me to do what I want without trying to hack the ecu in the first place. It will also give me more control with the ability to tune on the fly rather than reflash every time I need to make a change. Ill also be able to monitor afr readings and log afr readings against fuel, ignition and MAF maps to make sure the car will run safely and reliably. :)

[pd-xc-72464118]

... there are rumours about it having an intake that switches from long runners to short runners at a certain RPM ...

Is that the TwinPort you're thinking about? That's no rumor, that's fact on the Z14XEP at least :)

[SilentShout]

Yeah i think some z18xe engines came out with the same system but i can confirm mine does not have the variable intake runners

Sent from my SM-N910G using Tapatalk

[pd-xc-72464118]

Hey guys, remember reading this thread as it was happening and it all went over my head. Been getting into the idea of tuning myself a bit lately and remembered this so dug it back up but it seems to have reached a dead end. The amount of work you guys are willing to put into this for anyone to use just astounds me! No progress?

I've only just found this myself. Also impressed by how much work the guys were putting in. Did anything public ever manifest itself from this effort? Perhaps a wiki or github reference to some of their findings/resources/tips? I'd consider contributing to a team effort along these lines if such a project got any legs.

That said, what are the goals of ECU remapping? Just performance? I'm a tad more interested in economy myself but hopefully the two goals could be combined, along with others.