WillItBoost
Newbie
Karma: +2/-0
 Offline
Posts: 14
|
 |
« on: March 01, 2024, 05:50:09 PM »
|
|
|
I need a couple of aftermarket ECU's for some project cars and engine swaps. I've been using older Delco ECU's in the past with modified firmware but I'm looking for something a little more capable.
Why the ME7.4.4?
They are the cheapest OEM ECU available ($50 shipped, new) with no apparent limit in availability (alibaba/aliexpress/ebay/amazon).
New ECU connectors and looms are available just as readily ($50 shipped, 3plugs with labeled wiring/pigtails included).
End goal?
Real time tunable ECU with loom for under $100. GUI front end for tuning/logging.
VAG-KKL or similar interface for PC connection
Speed Density preferred but MAF isn't a deal-breaker.
The bare minimum:
Remove all IMMO code and any CANbus dependencies usually required to keep the ECU happy.
Remove any security/seed/key code to make flashing easy.
Identify all maps, RAM variables and tables.
Real time tunable - Depending on RAM availability, copy a target map to RAM to allow changes in real time. If we're short on RAM, we can always add FRAM to the motherboard and map it into the address space (as done in the older Delco ECU's for real time tuning)
Qualifications:
My day job is working with 8bit and 32bit assembly on various CPU families and reverse engineering hardware and firmware. I have no experience with the C167 but glancing over the instruction set, it's nothing too out of the ordinary. Some experience with Windows GUI/CPP programming. I've got a chassis dyno in the shed and have a bit of experience with tuning.
Where I'm at:
I've ordered a K-tag, VAG-KKL, 2 new ME744's (chinese manufactured), and one used ME744(German manufactured). I'm waiting on a quote for the ECU connectors with a 2meter loom so I can bench test full I/O, injectors, spark, etc. K-tag and ecu's should arrive in around 2 weeks.
I've found multiple flash dumps online but as these are all missing the CPU's boot-rom, there's not a lot of work I can do in IDA until I get hold of the ECU. Unless someone here has a Ktag and ME744 they could dump the bootrom/flash/eeprom out of?
The hard parts:
Identifying functions - There's some great tools in this forum to help with this, hopefully 360trev's ME7RomTool will help here.
Identifying RAM Variables - reversing the diagnostics protocol the ECU usually uses will help find the basics. Finding RAM references from the various functions will fill in the gaps.
Reverse engineering the CC650 Knock IC ASIC. To make good use of the hardware we really need a full understanding of how to tune the center freq and bandwidth.
Map out all available IO - I've read in some threads here that the narrowband input is wideband compatible (0-5v). The SpeedDensity thread is interesting too.
So that's the plan! I'll keep you updated with any progress. If anyone has a dump of the bootrom, or info on functions, memory maps, variable addresses, CC650, the bosch comms protocol or anything else that could make this project easier please send it over!
|
|
|
|
|
Logged
|
|
|
|
|
overspeed
|
|
« Reply #1 on: March 02, 2024, 06:25:25 AM »
|
|
|
Why not ME7.5.10 wich has lot of A2l floating around and can be write by OBD with a bunch os tools ?
|
|
|
|
|
Logged
|
|
|
|
d3irb
Full Member
Karma: +134/-1
 Online
Posts: 195
|
|
« Reply #2 on: March 03, 2024, 01:48:54 PM »
|
|
|
I'd strongly recommend you start with a slightly newer ECU for this, because you can get an A2L (all RAM and calibration variables) a leaked ELF with DWARF (all function symbols), or in some cases all source code. Also newer ECUs generally offer much higher flexibility in terms of knock calibration so you don't need to reverse the sensor acquisition and could probably just calibrate the knock model.
CAN with CCP/XCP, your own patched UDS handlers, or custom-handler based logging like prj's infamous tool will be significantly faster and better for logging and live tuning than KWP serial, even with DDLI hacks (ME7Logger/APR) or McMess.
On the flip side with a newer ECU comes more complexity in number of maps and overall control model, but I'd rather have more complex models to short circuit than be stuck tediously reversing map addresses any day of the week. Just an idea, if you are serious about trying to make your own software.
If you aren't serious about trying to make your own software, you could also just find a hardware/software version of ME7 that is already properly defined and you're set, no RE work needed, just edit the calibration. I think Marty, nameless_, and many others have used ME7 as standalone in the past on all kinds of cars using just calibration changes.
|
|
|
|
« Last Edit: March 03, 2024, 02:58:43 PM by d3irb »
|
Logged
|
|
|
|
|
BlackT
|
|
« Reply #3 on: March 03, 2024, 02:15:53 PM »
|
|
|
You will lose too much time.
Time=money
That only worth if you have too many cars to install those ECUs
Be ready to spent a year for get it working right. ME7 is torque based ECU, and that gives a lot of mindblowing problems when you want to make standalone ECU
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #4 on: March 04, 2024, 02:08:22 AM »
|
|
|
Or just flash ME7.1 with the Bosch MS4 stuff.
It talks CCP, the A2L came with the software if you can dig it out.
After that it is possible to use CCP for both live tuning and data logging.
|
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
|
« Reply #5 on: March 05, 2024, 03:43:41 AM »
|
|
|
Or just flash ME7.1 with the Bosch MS4 stuff.
Where can I find it? Which ME7.1 is compatible with MS4? |
|
|
|
|
Logged
|
|
|
|
|
|
|
|
WillItBoost
Newbie
Karma: +2/-0
Offline
Posts: 14
|
|
« Reply #8 on: March 09, 2024, 04:13:41 PM »
|
|
|
Thanks for the input guys, you've given me a fair bit to consider.
I was leaning towards the 7.4.4 mainly due to price and availability (~$35 brand new, with $50 brand new looms available too). Newer ECU's have a better selection of decompilers/debugging/compilers but over here (Australia) they're not all that common or cheap. I'll look into the 7.5.10, if it's more suitable then I'll probably go with that instead. There's a dozen secondhand units overseas for about the same price as a 7.4.4 plus shipping. Thanks for the suggestion!
I've found an A2L file for this ecu and it's largely all mapped out in terms of maps and ram variables. That should make tuning and replacing functions a little easier.
Time=Money, I completely agree but at the same time this is a hobby and we (mostly) never get back what we pour into a hobby so I'm not too worried about this taking longer than expected.
A complete recode vs just tuning the maps... I've been reading up about the torque based strategy these use and it's looking like there will be a lot of back and forward through different maps during tuning. Not ideal, especially with the limited RAM and the requirement of real time tuning. I'm leaning towards a full re-write of the code, just simple speed density.
I've read conflicting specs about the internal ram. The datasheets suggest 2k SRAM, 2k XRAM. Some forums suggest 64kbytes or even as much as 128kbytes of SRAM hidden away in there. I guess I won't know until I get an ECU here and code up a read/write test throughout the full memory map to see what is inside.
The Delco I'm using now is pretty basic, speed density, a dozen maps. It shouldn't take too long to port that code over once the basic IO's are all reversed. The Delco is slow, has limited resolution on injection and timing control, no knock support and is batch fire with a single spark output (dizzy). Even just getting this Delco code running on a newer CPU (with hardware division), 60-2 trigger wheel support, sequential injection, coil on plug etc I'll be happy. Add in a nice GUI front end for real time tuning and it'll be a pretty handy cheap aftermarket setup.
The Keil C166 IDE has a few nice examples for C167 CPU's including a simple monitor to read/write IO and read ADC values. That should make RE of the port IO a lot faster though I suspect a few analog signals are going through the Knock IC. Once I have the port address of the IC it shouldn't be too hard to reverse the Init code for the knock variables and the ADC channels.
|
|
|
|
|
Logged
|
|
|
|
WillItBoost
Newbie
Karma: +2/-0
Offline
Posts: 14
|
|
« Reply #9 on: March 13, 2024, 09:21:04 PM »
|
|
|
The first ME7.4.4 ECU arrived (From Lithuania), connected up the Ktag, dumped the MCU boot rom, Flash and EEPROM. The Flash file says Checksum error in Ktag and is only 286kbytes instead of the 512kbytes. I'm not sure if its the Ktag clone or the ECU or something else. How does Ktag know the location of the external flash?
Anyway onto the Bootrom. It is 32kbytes in size and decompiles fine in Ida. The issue is I cannot modify the BootROM, flashing a blank file passes in Ktag but the contents are unchanged. I suspect it could be MaskROM in the C167 which really throws a spanner in the works... It could just be Ktag unable to rewrite the bootrom even though it says it can.
The BootROM does eventually jump to the external Flash and this may be ok if we can relocate the interrupt vector into the External Flash or SRAM areas. I recall reading the vector table can be relocated.
I'll connect up a FTDI and try get minimon running on the C167 and have a poke around in there.
My Chinese ME7.4.4 arrives tomorrow. I'm curious to see if there are any differences in the PCB, MCU and boot roms.
|
|
|
|
|
Logged
|
|
|
|
d3irb
Full Member
Karma: +134/-1
Online
Posts: 195
|
|
« Reply #10 on: March 13, 2024, 10:36:24 PM »
|
|
|
Yes, the so-called "MCU" aka Mask ROM aka onboard OTP is, indeed, not reprogrammable. You can definitely hack around this if you're building your own thing from scratch.
But, you just discovering this raises some questions in my mind... you are also aware of the port expander and how it works? It seems like you haven't dug all the way into ME7 before deciding to use it. I'm questioning your approach more the more I read, honestly - porting another OEM firmware across seems both overly ambitious and probably not efficient time wise, for a lot of reasons.
I've been interested in the idea of building a full standalone ECU software for cheap OEM ECUs for years, but there's a lot more to it than meets the eye, and it's so hard to actually follow through with this kind of idea when the shiny working OEM software is sitting right there. I'd really love to see an open source ECU firmware (RusEFI type thing) running on OEM hardware, but unfortunately the OEM hardware is always quite complicated and uses some undocumented hardware or another that becomes a very thorny RE effort to understand. I think the RusEFI folks were looking at some point at some unbelievably cursed Russian OEM ECUs which use Chinese knockoff STM32s (Artery, Nations, etc...) to repurpose, but that's the most work I've really seen in that direction.
|
|
|
|
|
Logged
|
|
|
|
WillItBoost
Newbie
Karma: +2/-0
Offline
Posts: 14
|
|
« Reply #11 on: March 16, 2024, 01:57:08 PM »
|
|
|
The port expander, as in the ASIC comprised of the knock IC and extra ADC channels? I don't think I'd consider that a port expander unless there's something else i've missed? Otherwise the design is fairly simple, MCU, Flash, RAM, Injector drivers, Coil Drivers, H-bridge drivers, a couple of op-amps for analog signal buffering/filtering/scaling.
You are right in that I am not familiar with the ME7 but that isn't really important if I'm just using it as a 'dev board' and coding my own firmware.
The K-tag was faulty, the K-line should be 12v logic but it was not being pulled up which is why it was very flakey trying to connect and maintain a connection. A 10k pullup to 12v on the K-line did the trick. It's more or less useless though as whatever I try flash must include the ME7 checksums which I don't want or need so I'll need to make my own software to upload to the flash.
I need to read up more on the Buscon and address mapping registers in the C167 otherwise I think I'm on the right path.
I've coded up a small console app to send stage1 and stage2 bootloaders and I'm finally running my own code on the ECU. Next up is mapping in the SRAM and Flash and then onto reverse engineering the IO and ADC channels. My connectors and loom are arriving tomorrow and i'll set up lamps and potentiometers to help decode the IO.
also, how do I attach images/files to my messages?
|
|
|
|
|
Logged
|
|
|
|
|
|
WillItBoost
Newbie
Karma: +2/-0
Offline
Posts: 14
|
|
« Reply #13 on: March 16, 2024, 03:26:43 PM »
|
|
|
Thanks for the link! That is really interesting!!!
So the generic port's of the main C167 can't be read or written to directly? There's no point me tracing the IO from MCU to injector driver for example?
I can't find any reference to a second CPU / Expander / co-processor in any of the infineon datahseets. Is it a custom addition for Bosch?
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #14 on: March 16, 2024, 03:48:50 PM »
|
|
|
On ME7.5/ME7.1 etc there are 2x C167 on the board.
|
|
|
|
|
Logged
|
|
|
|
|
