The Great ECU Hack Project

[Leinad78]

EVC not only makes Winols, they also do tunes

I tend to think that guy doesn´t really know what he´s talking about and just copies some code.

FF`d areas are normally not used by the ecu and can therefore be manipulated like EVC did it in this case.

[SilentShout]

That makes sence although what doesnt make sence is that there are only the 2 addresses changed for the rev limiter. So either hes telling porkies or something with my file is wrong.

do you think i should chance it and flash his file to my car??

Also out of curiosity, is this what a full dissassembled file looks like?

http://www.diy-efi.org/gmecm/papers/anht_hac.pdf

if it is its much easier to read for me than hex

[Leinad78]

That would be easier for all of us

a disassembled file looks much more like this:



It just contains hundreds of these code snipets, just without any logical reference

So will just get the left side of the picture and find the right side on your on. On every fu**** sub-code

[SilentShout]

Found some interesting things while trying to learn how to disassemble,

Found an information sheet with a list of a bunch of ecu's and their processors.

http://www.dimsport.com/ftpsito/pdf/...ion%20list.pdf

In there i found the siemens simtec 76 which may have a similar processor to the simtec 71 and 70 etc.
Using that information i found a data sheet on the ST10C167 processor found inside that ecu.

http://pdf.datasheetcatalog.com/data...cs/mXsquyr.pdf

Im hoping to learn more about how this information can help me, i believe how easy it is disassembling a binary comes from knowing what architecture the binary file is written around in the first place.

Theres plenty of BMW's listed in that first link too so hopefully it helps you out aswell with your BMW

[chris_r]

In there i found the siemens simtec 76 which may have a similar processor to the simtec 71 and 70 etc.
Using that information i found a data sheet on the ST10C167 processor found inside that ecu.

Wouldn't surprise me, the 76 is used on the Z18XER engines in the Astra H and the Cruze. Main differences there are the XER uses VVT and full CANBUS.

[SilentShout]

@chris_r you wouldnt by any chance *cough* have or will be opening up your z18xe ecu to *cough* check out the part numbers on the processor chips? *cough*

You know in the interest of science

[Leinad78]

My ecu uses Infineon SAK-C167CR-LM processor. I just haven´t found a way to start with IDA.

[SilentShout]

I think ive narrowed it down to 2 processors it could be,
As chris said the simtec 76 was canbus and reading through the data sheet it specifically states it has support for CAN 2.0 meaning chances are its not the same processor in the simtec 71.

Looking at the other models i can tell you the processor will be from the ST10 family made by STMicroelectronics

2 possible models are the ST10F166 or the ST10F163

The 163 says up to 1999 so im thinking it may be the 166 but hopefully its enough information to look into disassembling using IDA however they only have intel processors in their dropdown lists.

The quest continues.

Dont know if this is helpful to you @Leinad78

http://www.infineon.com/dgdl/ap08270...b7d12b7c&ack=t

Aparrently infineon have their own disassembler for the C167 series of processors, but it all looks like mud to me

Also found this link but not sure its helpful either

http://nefariousmotorsports.com/foru...ic=359.0title=

They mention the infineon in there too

[chris_r]

@chris_r you wouldnt by any chance *cough* have or will be opening up your z18xe ecu to *cough* check out the part numbers on the processor chips? *cough*

You know in the interest of science

I have both the Corsa and Astra Z18 ECUs, so I could probably open up the Astra one in the name of research.

[Leinad78]

Save the time and effort, http://www.youtube.com/watch?v=4ENJ5L_-pDA

You won´t see anything usefull.