Jeff tries to make a hot rod out of a farm truck. '92 Mighty Max

[Jeff V.]

ECUFlash is broken and won't flash these ECUs. All it does is brick them. I'm pretty pissed that Tactrix never bothered to fix it. I sent them a ton of notes, and then send them my ECU after it got bricked. They did some kind of bench reflash to get it going again, but I don't know how they managed that.

So screw those guys. Now I've got the tools to flash it myself. All I need to do now is figure out how to disable the immobilizer, and I should be able to use this to run the truck.

[DCIV]

Okay so basically this just opens up another ecu to the flashable list?


Coop

[Jeff V.]

Yeah. I've finally got my foot in the door. Now I just have to finish forcing it open.

[ChargerX3]

Ok. I’m happy but I’m also bummed. Super happy you have found a way to tap into the 4g eclipse ecu. Now you can adapt it to your truck. Bummed that you will have much better control and resolution to your tune than I. Bummed that I probably won’t get a fix for the stock Montero xml vs the turbo 3s that doesn’t work with my setup.

Either way this I a big breakthrough. I remember you trying to get tactrix to communicate with you. Now you have your own resolution! You can now see how it all communicates? That should greatly cut down on tracing code.

This is a bit in the future but so you think you will be able to develop a protocol that could work for us tactrix guys who may want to flash 4g eclipse ecus’s? Also hit me up when you get to the fuel and timing tables. I know they are more complex but I want to maximize my base tune.

Man, way to stick it out Jeff!

[Jeff V.]

Knowing what needs to be done and actually doing it are two very different things. Once again I'm up against my worst weakness. Writing software. I may just try to dump my ROM into the internal Mitsu format for now. We'll see.

I'm confused. What fix do you need? I thought you were using Chrome on yours?

[ChargerX3]

I am using chrome. I need to dive back into it but I remember trying to flash the 3s rom to my trick and it running weird. You helped me with the montero xml as it had less stuff but we only opened up a couple peripheries like fuel and timing. Was hoping open the rest of it up for further fine tuning. Just wish I had your programming knowledge.

[Jeff V.]

I remember now. Let me know if there are any specific tables you want and I'll try to get an XML for them.

[mjannusch]

Does anyone actually have a working 6G75 in a 3S car at this point? Seems like I see people saying "just throw a 6G75 in it", but haven't seen a successful one yet.

[DCIV]

With mivec? That lenol guy from ny. Rays says his is the nicest.


Coop

[ChargerX3]

[quote=""Jeff V.""]I remember now. Let me know if there are any specific tables you want and I'll try to get an XML for them.[/quote]

Thanks. I’ll dive back in and let you know.

[ChargerX3]

[quote=""mjannusch""]Does anyone actually have a working 6G75 in a 3S car at this point? Seems like I see people saying "just throw a 6G75 in it", but haven't seen a successful one yet.[/quote]

I would have until I put mine in the mighty max. Now I’m going 74 block, with MIVEC heads for my Stealth TT.

[Jeff V.]

I have been beating my head against the security access protocol for 2 days. This is driving me nuts.

The way this works is the ECU sends a code called a seed. It then does some secret math on the seed and calculates a key which it keeps to itself.

The scan tool or reflasher or whatever takes that same seed, and does some math on it, and then sends the calculated key back to the ECU.

If the scan tool key and ECU key match, then the assumption is whomever made the scan tool knows the secret math and is allowed to unlock the ECU.

I have the disassembled ECU code, I have the sample of a successful security event (the Monty Python CANbus sample I posted earlier) and I just cannot figure this out.

This is the meat and potatoes right here:

Code: Select all

ROM_:0006E348
ROM_:0006E348             loc_6E348:                              ; CODE XREF: UDS_Mode27+C4j
ROM_:0006E348                                                     ; UDS_Mode27+108j ...
ROM_:0006E348 A4 BD E4 48                 lduh    R4, @[0x806448] ; Load unsigned halfword
ROM_:0006E34C 12 64                       mul     R2, R4          ; Multiply
ROM_:0006E34E 02 A0                       add     R2, R0          ; Add
ROM_:0006E350 A2 2D E4 4C                 sth     R2, @[0x80644c] ; Store halfword
ROM_:0006E354 A2 BD E4 4A                 lduh    R2, @[0x80644a] ; Load unsigned halfword
ROM_:0006E358 13 62                       mul     R3, R2          ; Multiply
ROM_:0006E35A 03 A1                       add     R3, R1          ; Add
ROM_:0006E35C A3 2D E4 4E                 sth     R3, @[0x80644e] ; Store halfword
ROM_:0006E360 7F 04 F0 00                 bra.s   UDS_Mode27_sendSeed || nop ; Branch

Load a 16 bit value from one memory location. (LDUH)
Multiply it by a value specified earlier in the code. (MUL)
Add another value to it, also taken from earlier in the code. (ADD)
Save it at a new memory location. (STH)
Do it all again for the second 16 bit segment of the key.

This should be simple, but nothing I do gets me even close to the communication sample I have.

[ChargerX3]

Yea a bit over my head. Need another ecu?

[Jeff V.]

No. I just need to walk away from it for a little bit. I'll spend some time working on the immobilizer code. Then I can come back to security access.

I actually am working on the engine too. It's a glacial pace, but things are getting done.

[ChargerX3]

Good. Figured you were having too much fun with the Vette.

[Jeff V.]

I was. I am.

I need to get the damn thing mobile again. If I don't make any meaningful progress with the ECU in the next week or two, I'm going to go back to my original plan of running it on a 3G Eclipse ECU with the 3.5L manifold. Then I'll swap over to the 3.8L stuff at a later date.

[ChargerX3]

Why 3g eclipse over 3s? Wasn’t the 2000 year virtually identical?

[Jeff V.]

Driver electronics for the PWM based radiator fan.

[stealthee]

Brain no worky. PWM?

[aaronatstate]

[quote=""stealthee""]Brain no worky. PWM?[/quote]

My guess is Pulse Width Modulated.