NefMoto > Technical > Reverse Engineering > Nissan Patrol Y61 - Zexel ECU
Pages: [1]
« previous next »
Author Topic: Nissan Patrol Y61 - Zexel ECU  (Read 1395 times)
apoc
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 5
« on: October 02, 2023, 10:56:03 PM »
Hi all,

Already learned loads on this forum!
Have a 2003 Nissan Patrol with a Zexel ECU, looks like an EDC15V (or EDC15M) clone. Rotary VP44 pump.
Trying my hand at disassembly, but can't confirm which chip is the main CPU to use for IDA. It's the same model as the EDC15V - Both an SCL4410-v4 Bosch chip (square 68pin PLCC), and a Siemens / Infineon C166/C167 looking one, but unsure of the exact model.
Is anyone familiar? Going to try and get the IROM from the ECU soon.
Have remapped using WinOLS, but would like to learn some disassembly, this ECU seems simple enough. Am fairly proficient with code & logic flow.

Any pointers / help would be very much appreciated Smiley
Cheers!
Logged
prj
Hero Member
*****

Karma: +915/-428
Offline Offline

Posts: 5845
« Reply #1 on: October 03, 2023, 06:08:23 AM »
Nothing to talk about until you pull the file.

Also the ECU in the photo is not an EDC15, it's a MSA15 with OTP chips.
EDC15 came with 29F400 flash (later 29F800) and is port flashable.
« Last Edit: October 03, 2023, 06:10:10 AM by prj » Logged
PM's will not be answered, so don't even try.
Log your car properly.
apoc
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 5
« Reply #2 on: October 03, 2023, 03:15:11 PM »
Thanks, I've attached the 256K (merged) bin file here. Also did a ROM dump via the consult port, but not sure if it's the IROM or just some of the immobiliser memory as its blank up to 3FFF. Once I can figure out which chip is the main MCU, I'll give it a go to dump it manually via the ECU. Couldn't get Minimon to connect via consult with lots of messing with settings.
ECU had OTP chips on it (AMD 27C010) on it originally. I replaced with AM29F010B to tune via WinOLS.

Maybe its more like an MSA15 ECU then?

Appreciate the reply by the way!
Logged
apoc
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 5
« Reply #3 on: October 03, 2023, 03:26:37 PM »
It appears the EDC15M is a OTP-style chip arrangement too. Might be similar!
Waiting for another ECU so I can make a schematic, and check what the pins on the SCL4410-v4 go to. A hunch and some searching hints me toward it being an 80515 or something, either to merge the odd/even binaries before the C16x processor can use it, but unsure. Possibly someone with MSA15 knowledge knows how they work.
Logged
prj
Hero Member
*****

Karma: +915/-428
Offline Offline

Posts: 5845
« Reply #4 on: October 03, 2023, 10:26:55 PM »
Quote from: apoc on October 03, 2023, 03:26:37 PM
It appears the EDC15M is a OTP-style chip arrangement too. Might be similar!
Waiting for another ECU so I can make a schematic, and check what the pins on the SCL4410-v4 go to. A hunch and some searching hints me toward it being an 80515 or something, either to merge the odd/even binaries before the C16x processor can use it, but unsure. Possibly someone with MSA15 knowledge knows how they work.

Dude this ECU has nothing to do with EDC15. Nip that shit in the bud.
Just because it uses similar automotive processor of the era does not mean anything.
Stop repeating this ridiculous assumption.

CPU can be a 80C196 variant or something completely different. I did not look at the code.
Also your 256k merged file - post the separate files as well. Did you just add them one after another or interleave the odd and even bytes?

If it's odd/even then it's 100% not a 8051 (80C515/80C535) variant, they can't read 16 bit, reads are 8 bit only.
« Last Edit: October 03, 2023, 10:30:37 PM by prj » Logged
PM's will not be answered, so don't even try.
Log your car properly.
apoc
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 5
« Reply #5 on: October 04, 2023, 01:44:24 AM »
Thanks - I assumed it might be similar because Zexel license the Bosch vp44 pump and made copies, assumed because the layout looked quite similar they might have copied other bits under license to make it all work together. I’ll stop saying so!

Will post both files shortly, I had to interleave them to make the full 256K.
Logged
apoc
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 5
« Reply #6 on: October 04, 2023, 02:08:09 AM »
Attached
Logged
prj
Hero Member
*****

Karma: +915/-428
Offline Offline

Posts: 5845
« Reply #7 on: October 04, 2023, 02:35:13 AM »
Quote from: apoc on October 04, 2023, 01:44:24 AM
Thanks - I assumed it might be similar because Zexel license the Bosch vp44 pump and made copies, assumed because the layout looked quite similar they might have copied other bits under license to make it all work together. I’ll stop saying so!
Assumption is the mother of all fuckups.
Quote
Will post both files shortly, I had to interleave them to make the full 256K.
In this case check if the processor is a 80C196 variant. It's 100% a 16 bit MCU, not a 8 bit one. 80C515/80C535 are 8 bit MCU's (8051 derivatives).
It can also be something completely different.

Again, I did not look at the files and I do not intend to, sorry.
Logged
PM's will not be answered, so don't even try.
Log your car properly.
Pages: [1]
  Print  
« previous next »
 
Jump to:  

Navigation
Personal Tools
  • May 05, 2024, 02:54:19 PM
  • Welcome, Guest. Please login or register.
    Did you miss your activation email?

    Login with username, password and session length
Search
 
Advanced Search
About Disclaimer
All Rights Reserved 2010 Nefarious Motosports
Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.029 seconds with 16 queries. (Pretty URLs adds 0.004s, 0q)