Motronic Tuning

[Vili 17]

Been searching the internet the whole day.. Head is quite empty at the moment, but I'll try to focus for a couple sentences.

 

Has anyone reprogrammed Motronic ML1.3 from XU9J4Z or MP3.2 from XU10J4?

 

I know it's possible to tune both of them real-time with emulator such as Ostrich 2.0 or equivalent. I also know that you would need software to handle the data and convert it to more readable form. There are both commercial and freeware options on the market.

 

All that is somewhat clear for me.

 

Problem is that information in ECUs chip is, from what I've understood, always at different locations in each application. And also the form changes. There are very good translation files for some BMW motronics to operate in TunerPro program. The BMWs use the same 1.3 ecu as peugeot, but these files aren't much of use??

 

Has anybody successfully hacked into original ecus? PeterT makes custom chips. What kind of system does he or anyone else use?

 

.bin files and everything else connected to this matter are more than welcome!

[richsmells 2]

This thread discussed this a while ago: CLICKY

[RossD 43]

Maps are indeed stored in different locations for seemingly the same ECU's - The Bosch ones I've been playing with recently have different locations for the same ECU but a slightly different software version! Check out chiptuners.org, there are some good tutorials on their forum there. And someone there will probably be able to supply you with the EEPROM dumps you need. Once you get into it you can start to spot maps in the code quite easily. Using something like WinOLS demo and viewing in 2D mode......

Edited October 1, 2009 by RossD

[DrSarty 90 1 Cars]

I hope this is an interesting question.

 

Why does it appear that OE/Manufacturers' ECU mapping and coding systems are difficult to access? What I mean is have they done it purposefully? Do the ECU manufacturers use either an old or a deliberately difficult to access coding and burning system to write the maps and place them onto the chip?

 

Logic tells me that they do, e.g. Bosch etc, because in effect they are attempting to protect their product and perhaps are obliged by agreement with the car manufacturer to protect their code too.

 

Just wondered what people think about this as there has to be logical and probably simple reason?

[RossD 43]

Not really, the latest ECU's are putting more and more safeguards in place though. Remember it's not just the ECU maps in these files, it is the complete software package needed for the ECU to control the engine. (The equivelent of your PC, with an OS and software, all in one file). It will be written in a proprietry language on the Bosch systems and then assembled when put into the hardware in the ECU.

When most 'reverse-engineers' (i.e. Hackers!) create do their stuff, i.e. a copy protection hack on a file on your PC so you can play the latest games without a CD for example, they will most probably disassemble the files and return it to pretty much the program code it was written in, make the changes and then recompile it. With ECU's, you cant do this - you have to work with the assembled file, which is why it is so hard to do.

 

If you were feeling very clever, you can use something like IDA-pro which is a very good disassembler and you'd be able to reverse engineer the software in the ECU. The trouble is you'd need a good emulator, which just dont exist outside of the Bosch R+D labs!

[kyepan 291]

we have similar analysis tools at work to take memory dumps from phones, they spot specific signitures in the memory, amd even look what instructions are being sent to the processor at the time, this can then be linked back to a specific function or line of code.

[RossD 43]

Indeed. It's pretty easy to identify the maps within the memory dump for an ECU if you know what you are looking for. Certainly within most Bosch ECU's, there is a descriptor before each map, i.e the size and axis descriptors. Find these and soon after you'll find a map. If you know basically how the ECU works, the descriptors and the shape of the map, you'll be able to identify what the particular map is.

For example, the Bosch EDC15C ecu, as found in the original HDi engines are IQ (Injection Quantity) based. The EDC16C (Later HDi's) are 'Torque Based' and so the maps will 'look' different if you plotted them in 3D. The way each map in each ECU type interacts with the other is also pretty different.

 

Petrol ECU's are a different kettle of fish again - and the latest genreations are most definatly different to the previous ones being discussed here. Most OE ECU's are several multitudes different (i.e more complex and state of the art) compared to even the most expensive aftermarket systems.

 

Anyway I'm way off topic here so I'll finish.....!

Edited October 2, 2009 by RossD

[welshpug 1,622]

so what does this mean to JB with his Bosch Motronic MP3.1 / 3.2 or even 7.0 system?