NefMoto

Technical => Tuning => Topic started by: k0mpresd on February 07, 2016, 11:58:07 AM


Title: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: k0mpresd on February 07, 2016, 11:58:07 AM
anyone have tips to finding Nm limiters or other helpful maps in Aisin AL1000 gearbox?

attached data portion from frf file > bin.

regards.

Title: Re: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: cherry on January 03, 2021, 05:00:30 PM
Old thread, but does anyone know what is the torque limit from AL1000 0C8927750H 1885? It´s for 2012 Touareg with CASA engine 176kw 550NM. Attached Winols FRF -> BIN file, it´s data part only.

Title: Re: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: cherry on January 03, 2021, 09:17:11 PM
In fact blocks in FRF for these TCU are not crypted, so it "should" be possible to modify FRF/ODX, calculate checksum (OLS817) and flash it with standard tools.

Does anyone know if these tcu have some kind of protection / RSA which tuning tools bypass before writing calibration? TCU is outside from gearbox and very cheap at ebay. Someone knows what is inside?

Title: Re: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: cherry on January 20, 2021, 11:37:42 AM
If anyone needs pinout for table test...

Title: Re: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: cherry on October 29, 2021, 02:43:30 PM
Since i was asked in PM about these tcu controllers. There is a SH7058 in AL750 and SH7059 in AL1000. SH7058 can be read even with some Fgtech clone or i think with some other clone tools for these mcu. I bought xprog from eldb with authorization for these Renesas SuperH: http://www.eldb.eu/index.php?route=product/product&path=35&product_id=87 There is also a pinout online for AL750. To make it short, it was waste of money, support is not existant, i think SH7059 will never work. Anyway SGO from AL750 (some does not exist, e.g. the Q7 BTR from a friend) and FRF from AL1000 can be unpacked straight forward since they are not compressed or crypted, checksum can be done with OLS817. Signing from SGO / ODX is also no problem because it´s only the checksum result. Some newer AL1000 tcu has compressed FRF, this will make it a little bit more complicated. Anyway did not found informations about AISIN maps, my friend lost his driver license, so for now i canceled this...

Title: Re: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: kpematop on August 09, 2022, 06:00:56 AM
Does anyone has damos for 0C8/AL1000?
Many cables supports now virtual read/writing but no good damos ...

Title: Re: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: cstl3722 on May 13, 2024, 07:31:54 PM
Quote from: cherry on October 29, 2021, 02:43:30 PM
Since i was asked in PM about these tcu controllers. There is a SH7058 in AL750 and SH7059 in AL1000. SH7058 can be read even with some Fgtech clone or i think with some other clone tools for these mcu. I bought xprog from eldb with authorization for these Renesas SuperH: http://www.eldb.eu/index.php?route=product/product&path=35&product_id=87 There is also a pinout online for AL750. To make it short, it was waste of money, support is not existant, i think SH7059 will never work. Anyway SGO from AL750 (some does not exist, e.g. the Q7 BTR from a friend) and FRF from AL1000 can be unpacked straight forward since they are not compressed or crypted, checksum can be done with OLS817. Signing from SGO / ODX is also no problem because it´s only the checksum result. Some newer AL1000 tcu has compressed FRF, this will make it a little bit more complicated. Anyway did not found informations about AISIN maps, my friend lost his driver license, so for now i canceled this...

On a decoded AL1000 FRF does someone know how to figure the start address of each datablock ? In this case we have 01 and 02 as SOURCE-START-ADDRESS

         
Code:
<DATABLOCKS>
            <DATABLOCK ID="EMEM_0C8927750CF3376.DB_0ERASEDATA" TYPE="ERASE">
              <SHORT-NAME>DB_0ERASEDATA</SHORT-NAME>
              <LONG-NAME>0 ERASE DATA</LONG-NAME>
              <FLASHDATA-REF ID-REF="EMEM_0C8927750CF3376.FD_0ERASEDATA"/>
              <SEGMENTS>
                <SEGMENT ID="EMEM_0C8927750CF3376.DB_0ERASEDATA.SEG_0ERASEDATA">
                  <SHORT-NAME>SEG_0ERASEDATA</SHORT-NAME>
                  <LONG-NAME>0 ERASE DATA</LONG-NAME>
                  <SOURCE-START-ADDRESS>01</SOURCE-START-ADDRESS>
                  <UNCOMPRESSED-SIZE>1048576</UNCOMPRESSED-SIZE>
                </SEGMENT>
              </SEGMENTS>
            </DATABLOCK>

Title: Re: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: IamwhoIam on May 14, 2024, 12:21:20 AM
I'm sure the god Laborde will soon chime on here to try to sell you a map pack that contains no torque limiters LOL

Title: Re: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: gt-innovation on May 14, 2024, 10:59:05 AM
Quote from: IamwhoIam on May 14, 2024, 12:21:20 AM
I'm sure the god Laborde will soon chime on here to try to sell you a map pack that contains no torque limiters LOL

 :D :D :D :D :D ;D ;D ;D ;D

Title: Re: Any hints to find Nm limiter in Aisin AL1000 gearboxes?
Post by: dikidera on May 14, 2024, 11:21:42 AM
Just for funsies I loaded the file in the main post in IDA. I have more experience with SH2 now and makes some things easier, but my method of reverse engineering is to view the code and data the way the ECU sees it. I lay it out in the memory regions where I need them.

In my opinion you need a full dump (full no missing bytes) of the main SH2 rom, and any external memories. Then you can stitch an IDB and start reverse engineering. Of course this is a general approach I would personally take, unless there are some internal documents which give you an edge.



Powered by SMF 1.1.21 | SMF © 2015, Simple Machines