EEC-V Calibration Memory Structure

[SVTCobraGuy]

Hi,

First off, I'm new to this board and think all of the information and resources are excellent and very helpful!! Hope I can contribute as well.

Am wanting to learn about my vehicle's EEC-V.

Here's my main question:
The calibration area of memory that holds all of the tables.... How does one get a map of which addresses hold what data and more on the workings of all of this?

Does anyone have good details on interfacing external
memory onto the J3 port to override the factory flash with new calibration tables? I have a 99 EEC-V ECU out
of a Mustang that I wish to decode.

Thanks!

[Screamn03]

I'm in the same boat with you with my '03 Cobra. I wanna know how the ford stuff works, not just pay somebody for a tune and pray they know what they're doing. Calling all experts.
-Mike

[SVTCobraGuy]

It is tough to get any data. I thought about getting the Flash over OBDII specs and starting from there.

I would also guess Ford has a program that you can enter (with enough money), that gives you access to their ECU data for the purposes of development.

Nice to know others are active in this same endeavor.
Let's keep after it!

[Screamn03]

If you go to motorcrafts website you can purchase the software to program the computer, all you need is a "SAE J2534 pass-thru device":
http://www.motorcraftservice.com/vdi...p;menuIndex=11
I wonder if we can then edit the file before it is sent to the computer. I got the idea from here:
http://www.moates.net/phpforum/viewtopic.php?t=42
I don't really have any backround in programing or anything so I'm kinda lost but I am willing to learn.
-Mike

[SVTCobraGuy]

Didn't realize Ford/Motorcraft offered access to their data for that cheap. That's a good find. I don't know if Ford seriously encrypts their files and then decrypts them in their software before being sent over J2534. If this Ford program allowed retrieval of the current calibration data in the EEC, this would be very powerful.

But, with knowledge of J2534, the encryption could easily be figured out (assuming we're legally allowed to do this?).

The problem is, encryption/file formats aside, is that it is still necessary to find out for EEC processor X, that the rev-limiter is stored at memory location Y in format Z. This is where I can't seem to get anymore information.

I might just buy this access package ($25 is very little) to find out its workings. If someone can get the memory locations for the EEC-Vs, we're there!

I can easily write software for a pass-thru adapter on the market. We just need them memory maps!

[Screamn03]

It looks like a pain in the ass to figure out the maps. I was just looking at the bin out of my camaro through a hex editor and it looks random to me. I don't know if we can find that information published on the net because it seems to me that it's all you really need to be able to modify it. SCT and Diablo aren't going to release that info. So the question I have is how do you get a map of all the tables in the computer. Crap, that's the same question you have . Now what? I have to take a computer class or something.

[Screamn03]

OK I found this:

I guess we need a assembler/disassembler to get the tables but it looks like step one is to figure out what processor we have? ??? :huh2:

[Screamn03]

I downloaded this hex editor for free:
http://www.download.com/HexEditor/30...ml?tag=lst-0-1
Is this looking at the "code"? or is there some other way to view a .bin file. Like I said I'm looking at the bin out of my Camaro right now, just trying to get a feel for it.

[Screamn03]

This is cool:
http://www.datarescue.com/idabase/

[Screamn03]

There is some '03 Cobra info hidden in this thread, mainly about where the spark maps are:

2003 Cobra Mustang spark_base_table
-------------------------------------------------------------------
addr: 010EAE size: 9x11 type: 1 Unsigned Byte

10EAE 40 43 45 46 48 49 50 50 50 50 50
10EB9 27 30 34 38 40 43 43 44 44 45 45
10EC4 17 19 29 34 37 38 39 40 41 41 42
10ECF 15 16 17 24 27 29 30 32 33 33 32
10EDA 10 11 16 22 25 26 28 30 31 31 29
10EE5 8 9 14 20 23 25 27 27 28 28 27
10EF0 6 7 12 18 22 23 25 26 26 27 25
10EFB 4 5 10 16 19 20 22 23 24 25 24
10F06 2 3 8 14 17 18 20 21 22 23 22


Rows by Load Factor
-------------------------------------------------------------------
addr: 010DAE size: 6x2 type: 2 Unsigned Bytes

10DAE 1.99996948242188 8
10DB2 1.5 8
10DB6 0.5 3
10DBA 0.350006103515625 2
10DBE 0.1500244140625 0
10DC2 0 0

Col by RPM
-------------------------------------------------------------------
addr: 010DEE size: 7x2 type: 2 Unsigned Bytes

10DEE 16383.75 10
10DF2 6500 10
10DF6 5000 9
10DFA 4000 8
10DFE 1000 2
10E02 500 0
10E06 0 0

[SVTCobraGuy]

So 03EBZ06 might be able to help out?

Well, I'm going to have to break down and buy the Motorcraft software and a pass-thru device. Can't stand the suspense! hahaha. Hopefully, I can get a Ford BIN file for my car that's not encrypted. Then, I can try hex editing the file to figure out the maps. That's a good find on the Cobra map. I'll start working on the software, if we can ensure individual memory locations can be written to the EEC-V over OBDII, we could try the spark table change on your 03 Cobra.

And if all heck breaks loose on the OBDII end, we could always just stick to the J3 service port and an add-on chip that could be flashed from a PC. Our basic goal is to just be able to program our cars, ourselves.

Either way, the first step, is to crack the memory locations.

Hopefully, this Ford software doesn't have a time limit, as I see their website sells by terms.

[jfunk]

The programming software ford offers is for flashing your vechical with the original bin file. It probable doesn't work with a modified bin or read the bin in the vehical. There was a new law(EPA) that forced vehical manufactures to offer the ability for customers to flash there vehicals back to the original bin file.
I have been looking for info on hacking into the EEC-V for a while but haven't come up with too much. I have a ford calibration CD that has a lot of bin files in it but this does me no good unless I can hack into the EEC-V. Hacking in through the J3 port would be the easiest(most direct) if you have the right equipment like a data analyzer, which I don't.
Thats why, if I can find the time, I'am going to try force my way in through the OBDII port. I'm going to write some software that will try to unlock the EEC-V and record any valid seed/key pairs. Then maybe the Key generation alogorthm can be figured out.

[Screamn03]

So 03EBZ06 might be able to help out?

This I don't know, he seems to know alot. I'll email him.

As far as the terms that you buy I don't know what that means. I was thinking that once you had the software on you computer you have it and the terms applied only to access to updated bins, but that is just speculation. I'm sure that Ford made it as difficult as possible to use there software as a tool to mess with their computer.

As far as flashing through the J3 or OBDII port of course I would prefer the OBDII port but I don't know what is involved in getting that accomplished. Is it alot easier to go throught the J3? What would we need to do that?

FYI I have a Diablo Predator and also have a Diablo Delta chip. Is there some sort of "sniffer" that I could plug inbetween the Predator and the Car so we can see what it does? Almost like a datalog of what it is doing?

Also is the processor in the EEC-V a Motorola MPC555?
http://www.freescale.com/webapp/sps/...odeId=01M98648

[jfunk]

Is it alot easier to go throught the J3? What would we need to do that?

Since ford used a special EEPROM getting the data through the J3 port isn't as straight foward as it would be on like a GM. In order to program the EEPROM you would have to sniff the 30 I/O pins on the EEPROM at the same time and figure out the write and read sequences. The easiest way would be with a data analyzer. Or get creative and program an FPGA/CPLD or a microcontroller to do it.

Also is the processor in the EEC-V a Motorola MPC555?
http://www.freescale.com/webapp/sps/...odeId=01M98648

The early EEC-V used an INTEL processor (8061?).
At some point they switched to motorola's MPC509.
The MPC555 (BlackOak) is in 2004 and Up. They might be in some 2003's also. The EEC-V that have the black Oak processor use the CAN protocol instead of the PWM
for OBDII and they don't have the J3 port.

[jfunk]

FYI I have a Diablo Predator and also have a Diablo Delta chip. Is there some sort of "sniffer" that I could plug inbetween the Predator and the Car so we can see what it does? Almost like a datalog of what it is doing?

The ELM320 can monitor OBDII traffic and display it on a program like hyper terminal.
[ftp]http://www.elmelectronics.com/connect.html#ELM320[/ftp]
Since the preditor knows the algorithm to get the key you could monitor the bus and watch for the seeds sent from the EEC-V and the keys sent by the preditor. Once the algorithm is figured out you can unlock the EEC-V and have full read/write access to the EEC-V with out the preditor.

[Screamn03]

The ELM320 can monitor OBDII traffic and display it on a program like hyper terminal.
http://www.elmelectronics.com/connect.html#ELM320
Since the preditor knows the algorithm to get the key you could monitor the bus and watch for the seeds sent from the EEC-V and the keys sent by the preditor. Once the algorithm is figured out you can unlock the EEC-V and have full read/write access to the EEC-V with out the preditor.

Sweet, looks like I have my first project. I'm gonna get some OBDII ends and try to make it plug and play. Thanks for the link.

[SVTCobraGuy]

I am definitely getting one of those ELM ICs. Thanks for the info jfunk.

Screamn03, how does your Predator work? Do you adjust whatever (fuel trims, spark), and then connect and re-flash? Or does it adjust in real-time? I think you guys are onto something about cracking the OBDII security code with a sniffer. With the Predator, if it adjusted in real-time, you could probably sniff the addresses and commands pretty easily. And until the security code was deciphered, you could probably just use the Predator to unlock the ECU for you. hehe, thanks Predator.

Jfunk, regarding the J3 port...
I have done some research on the old EEC-IVs, don't know if it is the same for EEC-Vs. The J3 memory bus (at least on EEC-IV), was unique as it had the ability to read the next data byte by simply clocking, rather than the typical memory access sequence. This was accomplished with synchronized, but discrete counter registers between the CPU and memory. This allowed for really quick reads (no wasted clock cycles on putting the memory addresses up). I'll have to do some homework on the J3 on EEC-Vs, assume close or identical to EEC-IV. You're right, since it is multiplexed, it needs decoded, and the most common method, is a CPLD. But, with a CPLD, standard parallel memory can be used, no need for special memory.

I am decent at hardware and programming, but not so great at finding good info. I guess basically, if someone can round up good info, I could make the hardware/software happen.

[SVTCobraGuy]

Post-script...
Does anyone have the info on how the security protocol on the Ford OBDII flashing is supposed to work? Like a generic description?

[Screamn03]

Screamn03, how does your Predator work? Do you adjust whatever (fuel trims, spark), and then connect and re-flash? Or does it adjust in real-time? I think you guys are onto something about cracking the OBDII security code with a sniffer. With the Predator, if it adjusted in real-time, you could probably sniff the addresses and commands pretty easily. And until the security code was deciphered, you could probably just use the Predator to unlock the ECU for you. hehe, thanks Predator.

You make adjustments and then reflash back to the PCM, the only real time it does is data logging.

The Cobra Predator allows the end user to adjust the following parameters:

Dual timing adjustment points (2000-4000 RPM / 4000-7000 RPM)
Timing table (+10% / -40%)
Dual fuel adjustment points (2000-4000 RPM / 4000-7000 RPM)
Fuel table (+40% / -15%)
Idle (+/- 20%)
On/Off switch for Traction Control
Rev Limiter
Re-Calibrate Speedometer for Gear and Tire Size Changes
Cooling Fan ON/OFF Temperatures
Rear Oxygen sensor disable (use for off-road vehicles only)
Disable EGR (use for off-road vehicles only)
Adjust at what rpm the shift light comes on

I don't know how it determines how to adjust fuel and timing. I'm gonna get that IC and get started on making a sniffer. I know the process it uses to establish communication with the computer is wierd. It involves cycling the key and waiting.

More info on the Predator that I have:
http://www.diablosport.com/U7142.php

What I hate is that I can't adjust the fuel curve at independent points, I can only adjust 2-4K by X% and 4-7K by X%. Same with timing. Pretty weak IMO.

[Screamn03]

Are you guys able to download this? I don't know if AOL will allow it. Just wanted to check.
http://hometown.aol.com/tranzam777/AL9_Hack.pdf