|
k0mpresd
|
 |
« Reply #30 on: November 24, 2012, 07:24:02 PM »
|
|
|
|
|
|
|
|
Logged
|
|
|
|
|
k0mpresd
|
|
« Reply #31 on: November 24, 2012, 07:31:43 PM »
|
|
|
I've found what I take to be maps and am beginning to disassemble, but haven't been able to spend much time on it, unfortunately. Maybe over the holidays...
where do your maps start? i havent looked at the tcu dump i posted in a while but from what i remember it looked like all the maps were pretty near the end of the code. some of them had bosch 8 bit axis definitions in front. |
|
|
|
|
Logged
|
|
|
|
|
AARDQ
|
|
« Reply #32 on: November 24, 2012, 09:10:40 PM »
|
|
|
where do your maps start? i havent looked at the tcu dump i posted in a while but from what i remember it looked like all the maps were pretty near the end of the code. some of them had bosch 8 bit axis definitions in front.
Yes, exactly. Most of them start about 2/3 of the way through. Like this one at 63F26. Sure looks like torque (or maybe airflow) vs. RPM. |
|
|
|
|
Logged
|
|
|
|
|
AARDQ
|
|
« Reply #33 on: December 01, 2012, 12:40:04 PM »
|
|
|
Based on the Freescale/Motorola 68376 (extension of 68020) so there's some hope for this. TouCan (printed on CPU) is reference to a built-in CAN controller.
|
|
|
|
|
Logged
|
|
|
|
|
k0mpresd
|
|
« Reply #34 on: December 01, 2012, 12:48:04 PM »
|
|
|
it has bdm as well.
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #35 on: December 01, 2012, 01:29:47 PM »
|
|
|
So the next thing is to disassemble the binary and see how it works.
What would help would be a tracing of the pins to the main processor.
If that could be gotten down that'd help a lot.
The CAN messages we already now - because of the spec on the ECU side.
If that can be read, one can see how the values are used.
|
|
|
|
|
Logged
|
|
|
|
|
AARDQ
|
|
« Reply #36 on: December 01, 2012, 05:37:39 PM »
|
|
|
So the next thing is to disassemble the binary and see how it works.
What would help would be a tracing of the pins to the main processor.
If that could be gotten down that'd help a lot.
The CAN messages we already now - because of the spec on the ECU side.
If that can be read, one can see how the values are used.
I'm going to pick a spare up off of fleabay and start playing. Unfortunately the exact match for the one in my car is pricey. May just learn with a cheaper version and transfer knowledge to the in-car TCU once I'm confident I mostly know what I'm doing. Seems like there's not much knowldege out there on interchangeability. I want to keep traction/stability control so need to be careful with that aspect. I've downloaded CodeWarrier (thinking that it would be better than Ida Pro in this instance -- any views on that?). As soon as I can get the stupid registration that didn't work resolved... |
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #37 on: December 02, 2012, 01:37:59 AM »
|
|
|
I think IDA will be much better...
|
|
|
|
|
Logged
|
|
|
|
|
AARDQ
|
|
« Reply #38 on: December 05, 2012, 09:01:44 AM »
|
|
|
Ida (5.X, anyway) using the 68330 definition file... chokes on the TouCan module making it difficult (for me anyway -- noob alert) to find the proper entry point for what we're really interested in. A way around that seems to be to run it through the HCS12 definition file (the sub model with RAM, ROM and EEPROM). The CAN instructions associated with TouCan show up even if most of the rest of it is wrong and show the correct entry point for use with the (correct) 68330 definition file at 4000h. All of the labels show up properly using the HCS12 definition file also. (Which, now that I think about it, I haven't been able to achieve using the 68330 definition file, so could be that 4000h is wrong and off slightly.)
Trivia: the file posted by k0mpressed in the other thread is from a W8-powered car.
The processor is definitely a 68376; ZC439616CFT16 is listed in a product-change announcement for the part on the Freescale site.
Just posting in case anybody else is interested.
Editing the above crap info lest anybody waste time trying to duplicate, it looks like the correct entry point is (may be?) 0x412h. Not sure why TBL lookup instructions don't seem to be used, since they are 'new' to the 6833x series. Or maybe I just don;t know what I'm looking at (a definite possibility).
|
|
|
|
« Last Edit: January 09, 2013, 03:39:21 PM by AARDQ »
|
Logged
|
|
|
|
|
AARDQ
|
|
« Reply #39 on: February 17, 2013, 09:46:09 AM »
|
|
|
As it turns out, the Nefmoto flash software can connect with the TCU, address 0x02. I had never noticed that the address is selectable from the KWP2000 Settings page.
The software won't negotiate timing properly and some precondition isn't met (among other things?) and so won't read the flash, though.
Anybody able to provide guidance?
Log attached.
On the bench, K is pin 88, power to pins 26 and 55 (switched) and ground pin 34. Cable connections as usual.
|
|
|
|
« Last Edit: February 17, 2013, 09:51:00 AM by AARDQ »
|
Logged
|
|
|
|
|
neuro
|
|
« Reply #40 on: March 28, 2013, 06:52:34 PM »
|
|
|
audi a6 c5 2001 original tcu dump. I wish i could tune it
|
|
|
|
|
Logged
|
|
|
|
ratherb1
Full Member
Karma: +5/-5
 Offline
Posts: 115
|
|
« Reply #41 on: April 04, 2013, 11:57:56 AM »
|
|
|
audi a6 c5 2001 original tcu dump. I wish i could tune it
This would be so great if someone could tune it ....... How did you pull it? |
|
|
|
|
Logged
|
-ROMIE
|
|
|
S4dizzle219
Jr. Member
Karma: +0/-0
Offline
Posts: 33
|
|
« Reply #42 on: April 26, 2013, 08:28:02 PM »
|
|
|
So is this a working tcu tune or are tree any? If I could get my shift times down my car would e incredible and I'm not a fan of the cookie cutter tubes offered. Did connectivity ever get figured out here
|
|
|
|
|
Logged
|
4 rings to rule them all!
|
|
|
|
AARDQ
|
|
« Reply #43 on: April 28, 2013, 08:14:18 AM »
|
|
|
So is this a working tcu tune or are tree any? If I could get my shift times down my car would e incredible and I'm not a fan of the cookie cutter tubes offered. Did connectivity ever get figured out here
Haven't worked on it in a while -- decided to convert to 6MT. Sorry. |
|
|
|
|
Logged
|
|
|
|
Mantis
Jr. Member
Karma: +0/-0
Offline
Posts: 36
|
|
« Reply #44 on: April 29, 2013, 02:24:57 PM »
|
|
|
I have had a TCU with TIP file on it sitting on my desk for 4years, mine is a soldered version, if anyone thinks it could be of use, I will try to dump the file
|
|
|
|
|
Logged
|
|
|
|
|
