Pages: [1]
Author Topic: PRJ's Custom C167 Boost PID  (Read 3245 times)
Maze10
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 6


« on: December 07, 2021, 10:43:32 AM »

Hi everyone,


First of all, a big thank you to all the people who share their knowledge and helping to keep the forum alive.
     
I know I almost don't have any posts in here but I read a lot in the hopes of learning and i hope I can contribute back soon.

This thread concerns the boostcontrol patch created by @prj.


From what I could see on the forum, there are several ways to make a turbo assembly functional but the most interesting is to add the boost control functionality in the me7.1.1 directly.

Hardest option, I know, but seems to be the best

I'll start with what little I know:

There is a @prj thread on this with the github repo link:

http://nefariousmotorsports.com/forum/index.php?topic=19238.0

And another of @gt-innovation concerning the disassembly of the ST10F275:

http://nefariousmotorsports.com/forum/index.php?topic=13073.0title=

  I'll start with the little I figured out:

Starting from scratch and after going through the related topics and spending a month or so of 10hrs / day trying to learn the basics of assembly language, it's still not completely clear to me.

It would be necessary to disassemble the MPC with IDA pro, put the custom code in a scheduled task (20-100ms loop), recompile obj and source file together and then create the corresponding maps in the flash binary.

The problem for me is that I apparently don't have yet the knowledge to do that and I am not familiar with IDA pro.

I asked prj and gt innovation to do it for a sum of money or to guide me a little in this jungle,
but both of them kindly turned me away, telling me that they had neither the time nor the interest to do it ...
To date, I have not found anyone else capable of doing this.
Is there a good soul among you who can help me and give me more details on the subject?

I need to know how to proceed with IDA, I have gone through all the documentation for this software but still unclear for me unfortunately ...

My goal is to figure out how to install this patch but if there is no other solution but to pay for the service I am committed to doing so.
But since we are in a DIY forum, if possible, I would like to learn the procedure for adding patches to my ECU.

No financial interest for me in there, I would like to do it for my personal car.

Any explanation, advice, hint or something similar are welcome.

@prj, @ gt-innovation a big thank in advance if you manage to find the time to answer on how to do that.

Thanks in advance
Best regards
Mo
Logged
Blazius
Hero Member
*****

Karma: +89/-40
Offline Offline

Posts: 1282



« Reply #1 on: December 07, 2021, 07:08:02 PM »

Ive already posted in the thread, as long as you understand some c167 asm it should be doable, also dont bother with st10 or good luck with that. find c167 me7.1.1 if you really want to try this as bonus you might gain wideband too.
Logged
R32Dude
Full Member
***

Karma: +45/-10
Offline Offline

Posts: 248



« Reply #2 on: December 08, 2021, 03:34:28 AM »

So this is for a vr6?  If so, you will be told to not bother on here. Grin Grin Grin

I've done some simple stuff with my ST10 with the mpc. Not interested in turbos though  No need to recompile, look at your modded ida code in the hex window and just patch the mpc binary with hexedit 5. Be sure to also use PRJ,s me7 crc bypass patch as the embedded code is not so easy to correct for crc with the stuff us tyros have.
Why not use a turbo with a manifold pressure servo instead?
Logged
R32Dude
Full Member
***

Karma: +45/-10
Offline Offline

Posts: 248



« Reply #3 on: December 09, 2021, 06:28:41 AM »

Hey mate, you seem desperate so here is how I did a few simple  things with the ST10 in my BUB R32. Perhaps I could have done better, but its not easy when you know jack and the info is scattered.
Not sure what stage you are at so I start from the beginning.
Got a spare ecu. - 022906032CE for BUB with DSG. Its not worth risking original!

Got the CE because I found the A2L file-otherwise its too hard to do anything. Original in car was KG.
Opened case, removed a 6k8 resistor, soldered a 8k2 resistor from some pin on the board to one of 2 leads in a cable,  other lead soldered to ground .Drilled a hole in the case , passed the cable thu the hole to a good quality switch. Now when button is depressed, the ecu pin is grounded via the resistor ecu goes into bootmode when it boots. Switch  and leads must water tight .
Replaced stock ecu with this one. It was not a easy as on youtube.
Figured out how to power only the ecu with the battery disconnected through the fuse box and a 12v power pack. It required a power lead in the harness to be cut and a diode soldered  between the cut ends.
Got a kline dumb cable for ME7EEPROM
Booted in bootmode
Backed up eeprom with patched me7eeprom that works with st10- very important to back this up before any changes are made to flash or mpc. Death codes etc can be removed in a few seconds.
then rebooted and used Galletto cable for backing up flash
rebooted again and used  mpps v13  for  backing up mpc.
So now I had the backups to put back if I screwed up, which I did many times.
Seconds thing to do was IMMO off  on the EEPROM , and upload to the ecu.

From this point Winols 2.24 was used to mod the FLASH and Winols 1.5 was used to correct the CRC.
Galletto used to upload the flash file.
When I felt like playing with the code, I looked at gt-innovation and a few others including prj's python scripts and used the padding with zero's method to loadfin ida.  I dont know python so wrote a vb6 program to load the A2L and output three massive python scripts with all the addresses.  So I had all the variables, constants, enums, maps etc that were in the A2L  loaded with the MPC in IDA. A2L  file is a must otherwise it is too hard for amateurs.
Then I looked at variables like LAMFA and looked at the code, using the C166 family instruction set pdf from the web.  Looked at FR  me7 /9.1  .
Learn what each command near a jump does. Learn how variables or constants are fetched.Learn comparisons.
I couldnt for the life of me use Winold1.5 to CRC correct the MPC so utilised  prj's CRC bypass patch both in the EEPROM and MPC. So now there is no need to CRC correct any code changes.

Software - free off web
I use IDA PRO 6.8 for disasembling mpc.
winols2.24  for changing flash maps
winols 1.5 for correcting crc of the 2.24 exported bin
hexview 5.0 for patching the mpc binary after you make changes with IDA. Copy the hex that changed and paste into a copy of real mpc bin (not padded) file in exact location.
R32logger  to log your cars vital signs. I wrote specifically for this. Again you need the A2L for your ecu. If you cant log fast you are blind.

All cables are cheap Chinese ones.
I also have cheap KESSv2 but it is useless in bootmode. Apparantly needs some parts changed but I cant be bothered as I prefer the other two.
Is this the proper way to muck around with the ecu? Who knows, but it worked for me. Over 60 flashes so far with only one fuck up, when I forgot to check the CRC with winols 1.5.
I'm a bricklayer, learned BASIC donkey's years ago as a hobby, and will never be great at this, but thanks to this forum I got somewhere, so give it time yourself.
I would advise you against doing a turbo. Just get really good altering other codes. If the experts sort of keep away so should we idiots.   The only car I ever turbocharged was with a Malpassi Rising Rate fuel reg and a manifold pressure wastegate. I wish these guys were that simple to do.
Dont believe all the people with turbo VR6 on youtube, many are dickheads who never mention how shit the cars are to drive normally, nor how many miles they do before something blows up. Search forums and you will get older posts of how not so happy people were with vr6 turbo kits
It can be done properly somehow https://www.youtube.com/watch?v=XT8TDfoIPqg  but looks like it might cost a fortune.

Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.018 seconds with 17 queries. (Pretty URLs adds 0s, 0q)