Recently I bought a new scope and probed around a bit in an effort to find RAM reads and writes, captured some interesting wavefoms that I can only make educated guesses at.
Generated scope trigger pulses in the spare CLBs of the CPLD now to write more VHDL code to be able to hook in 8K of RAM.
w.
Uncleton,
Hooking in 8K of RAM. We may share the same goal.
The MBUS is a pretty neat little world. I better had polish up on my VHDL skills.
I don't believe you can reflash through the J3 port--why not just come in through the 'front door' ? That's how Ford has been doing it for years. The bin files aren't scrambled, although their format has changed since last year, I believe.
Once you read out the EEC, you can use an emulator at the J3, by accessing the data (1st bank) only. We did a lot of hacking/cracking via that method to start with several years ago--and still use inexpensive modules to change between programs rapidly.
I think one could actually 'fool' the Ford factory system with a little effort and edit/flash right through the NGS to the Ford ECU.
Lyndon.
I am sure that you can reflash thru the J3 port as I have seen it done numerous times. There is a company on the web selling different equipment that does this the reflashing but it is expensive.
The Front Door i.e. the OBDII port is secured using the Seed/Key, I have partially figured out how to make bogus keys. Cannot be too hard as Superchips, SCT, HYpertech, Diablo, etc have all figured it out, condsidering you get a blank key you just have to figure out how to cut the key.
The 'inexpensive' chip modules do not reflect the cost to make, I know as I have designed them.
I have spent time learning VHDL and designing a generic VHDL base code and put a RPG thru the security of the Diablo rev 7 chip and the EFI Solutions chip where the tunes can be read and the chips reflashed using other software.
The Diablo chip took 1 week, the EFI Solutions 4 hrs, Motorvation ?? and I saw where they were designed by the same person ( they have the mark of Mr P ) who did not take the time to change his encrytion of the Mbus, but in all fairness it would not have slowed me down by much.
I did not hack into the CPLD code, I just blow it away replacing it with my own which I know how to manipulate and is faster than than at least one out there. I ran comparative computer simulations on both.
I guess I can offer to 'remanufacture' chips.
w.
Uncleton,
Isn't there a Ford/Rotunda tool to flash via J3?
I'm lacking on info on this, but I thought that is what Steeda and Saleen use to reprogram ECUs.
If you would like, I could try to offer some assistance on the seed/key if you could post a couple valid seed/keys and post some "uncracked" data.
I would like to try writing my own CPLD for a commercial J3 adaptor. Which brand do you suggest? I hope there is a brand out there with a socketed CPLD. I haven't heard if Craig Moates got his J3 adaptor up and running yet.
I do not know what Steeda or Saleen use.
I suspect that Ford does not use 'stored' seed/key pairs but use a new seed on request system. Not needing any assistance.
None that I know of have a socketed CPLD. Why do you need a socketed one? The CPLDs used are programmed using JTAG tdi,tdo,tms,tck and a row of holes are usually located on the CMs for this as they are programmed using isp. Be careful tho as signals are standard you will need the appropriate programming cable to match the device manufacturer and may have to swap wires around (mark of mr p agin)
w.
Originally Posted by SVTCobraGuy
Uncleton,
Found a picture of how Steeda flashes. Looks like the Rotunda tool they use is simply an out-of-car OBDII flasher. Nothing special. I'm wrong on them using the J3 port. Their tool interfaces on the main connector of the ECU.
Thanks for the info on the CPLD. I'll stop worrying about the socket.
I'm sidetracked on another endeavor... Do you see any obstacles in reading an Autologic chip with EECSucka-type hardware? I really would like the calibration data contained on this chip.
You can re-flash thru the OBDII port using a J2534 spec box if you have a software package.
Is the Autologic 1,2,4 bank? I have not had any luck reading Autologic chips or Diablo chips with a Sucka. For the Diablo and EFI Solution chips I just blew away their CPLD load and used mine.
To do the same with the Autologic or Superchips Inc chip you have to de-pot them to get at the CPLD re-programming header. Nothing that a blowtorch on the metal can will not take care of.
w.
Uncleton, I believe the Autologic chip can hold up to 4 banks, but my 99 ECU uses two. Not 100% sure though. It is a potted-type chip, black in color, and looks like they cut off the bank select or some sort of programming leads that exited beside the J3 connector on the chip.
But I am confused as to why some J3 adaptors cannot be read via Sucka-type hardware. The computer reads them fine. I'm sure the CPLD code is very "picky though.
Maybe the SPC needs written periodically, otherwise it somehow overflows? Maybe I'll try hooking up a commercial J3 to a 68HC11 and play around.
Early EEC-V non EDIS ( 94-95??) run 2 banks there are probably earlier models tho.
96-98 EEC-V EDIS run 2 banks
99-04 EEC-V Coil-on-plug run 4 banks
Newer 'Flip Chips' have multiples of 4 banks for 2 tune, 4 tunes or even 8 tunes plus permitting access to the stock tune that is flashed into the EEC-V.
The cut off leads were used to select which tune you wanted to run. I am running a 8 tune chip ( 32 banks ) in my car where I select the tune ( 4 banks at a time )with a 10 position thumbwheel switch. Bounce less switching is almost impossible to do without a register deposit-tranfer approach. Programming of the callibration flash is generally done thru the J3 connector.
Some of the J3 adapters have some kind of security scheme, as I have run into that problem reading chips. I have even designed my own lockout sceme but not tested it yet.
I have used a PIC to read EEC-Vs but the algo for some reason cannot read some of the J3 adapters. I do not see the need to read other J3 adapters as what you read out may not make sense after you load it into another tuning software package.
w.
That makes sense on the banks. Does all the calibration data fit in 1 bank on the newer EEC-Vs (99-04)?
Actually reading the Autologic chip would make sense, if a person had documentation on the actual calibration memory addresses and a decrypted binary from the chip.
Pulled the stock binary out of my L1C EEC-IV. Working on decoding the calibration addresses. Not doing so great, I've only found the firing order.
That's really weird on the J3 lockout. You'd think as long as MRESET and RESET were high, the J3 couldn't detect a "dump" attempt. Unless too many sequential reads or improper timing. Hmmm, stumped.
Most of the callibration values are in Bank1 but there are smaller amounts of values scattered in the other 3 banks....just to keep you hacking.
If the world was a perfect one and all the software hackers hacked the same address for all the callibration values what you say would be correct. So how accurate is the 'documenatation'?
Keep hacking.
I would think that you could make (dream up) and add read encryption. This is what I think Mike has done with the Autologic chip and Patrick has done for Diablow and EFI. A problem with encryption is that it must always work the way you intend or you the EEC may get locked out too.
I was not able to figure out their encryption but I came up with my own encryption scheme which I have not implemented and tested yet.
Alternatively you could just blow away their CPLD code with your new CPLD code and go dump the chip (which is what I did) as the callibration code in the flash memory is now easier to read and should be still be there.
Once you figure that out you then have to tackle and figure out the write encryption before you can reflash the Autologic chip. The EFI chip is encrypted the same way when you get to that stage.
w.
That makes sense on the banks. Does all the calibration data fit in 1 bank on the newer EEC-Vs (99-04)?
Actually reading the Autologic chip would make sense, if a person had documentation on the actual calibration memory addresses and a decrypted binary from the chip.
Pulled the stock binary out of my L1C EEC-IV. Working on decoding the calibration addresses. Not doing so great, I've only found the firing order.
That's really weird on the J3 lockout. You'd think as long as MRESET and RESET were high, the J3 couldn't detect a "dump" attempt. Unless too many sequential reads or improper timing. Hmmm, stumped.
I should probably focus on figuring out the memory addresses for the L1C, rather than playing around with reading the 4-bank Autologic burned for another ECU. But the read encryption is puzzling. I like the strategy of blowing it away.
Actually, the only good documentation I have, is on the A9L. It is very, very difficult to find any details on the memory addresses and calibration strategies. Nothing in SAE, nothing on the Internet, nothing from colleges, etc.
I'm guessing the big guys (Autologic, Diablosport) have had some inside help, or previous job experience, or, are really darn smart.
Craig Moates now has available, a J3 adaptor with a 32pin PLCC FLASH that works will all EECs with a J3. This is great news for the DIY type. He also is selling a nice USB FLASH programmer that will burn the edited binaries to his adaptor (for those who do not have a burner).
Paul Booth supposely is working on software for many calibration strategies, and I assume will sell per ECU code.
Wow, this thread has been dormant for a while. Here's my status....
-Decoded most popular items in most EEC-IV, EEC-V ECUs (Mass-air stuff, timing, etc)
-Planning on using Craig Moates J3 adapter hardware to try my edited binaries
-Paul Booth now has software available....$50 per ECU code...I think
-Further exploring the J3 bus, timing details, maybe my own CPLD
-May play with OBDII stuff soon, PID viewing, reflash
Would love to hear where everyone that has posted is at on their endeavors.
Let's keep 'er going!
any information on the laptop program they used on the shelby car you can share?
1998 Ws6 TA
I take it you've seen it?Very cool huh?
1998WS6, what is your experience level? Do you own an EEC-based vehicle? Have you done any tweaking to it?
never seen it, but it sounds interesting.
I don't have a ford vehicle, just my TA, but like to keep up on the different stuff out there. Might have to get an 03-4 cobra one day.
1998 Ws6 TA
I had saw you posted about Ford tuning software, figured you were a Mustang or Lightning DIYer.
You definitely should get a Cobra. The 03/04's are a blast!
I have about 5-6 cobra computers most of them are the amz1 and the ydh1
\
if any one needs them i sell them for 300 shipped
my phone number is 602 269 8955
these are my personal computers however im at the shop all the time so that is the best place to contact me
i also own a WDS that is the ford flash tool if any one needs me to flash anything
Reply With Quote