Pages: 1 2 [3] 4 5
Author Topic: R32 turbo mono-lambda(022906032CN)  (Read 39654 times)
Jim_Coupe
Hero Member
*****

Karma: +16/-12
Offline Offline

Posts: 663



« Reply #30 on: March 03, 2016, 05:59:26 AM »

From wiki.. But every ECU has its own adress for these and the functions can be diffrent aswell on each ECU.. "I think"....

Delete B1
0x3C8BE
0x3C8D0
0x3E832

Original value will be 1A91, to replace with B2 input change to 1891.

Delete B2
0x3C8F0
0x3C902
0x3EA90

Original value will be 1891, to replace with B1 input change to 1A91.[47]

Logged

E85oholic
phila_dot
Hero Member
*****

Karma: +170/-11
Offline Offline

Posts: 1709


« Reply #31 on: March 03, 2016, 07:13:08 AM »

There's alot more to it on wideband ECU's
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Online Online

Posts: 12232


WWW
« Reply #32 on: March 03, 2016, 11:00:22 AM »

But since i dont have the code i cant do anything anyway..

Nobody "has the code"

They use a disassembler and hand code the patch.
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
prj
Hero Member
*****

Karma: +903/-420
Offline Offline

Posts: 5789


« Reply #33 on: March 03, 2016, 11:03:50 AM »

Nobody "has the code"

They use a disassembler and hand code the patch.

Exactly. And this is done per file revision, because the offsets are different, so you can't just copy paste.
The code is a bit different on different ECU's too.
Narrowband and Wideband was already mentioned, but there are differences on Wideband ECU's depending on whether it is C167, ST10 etc.

What needs to be done is not a secret at all - copy Lambda sensor readings and all the fuel trims from one bank to another.
But it takes some effort, and no one is going to sit down and spend that time to do your specific binary for free.

If you can't do it yourself, pay someone to do it.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
sn00k
Sr. Member
****

Karma: +59/-2
Offline Offline

Posts: 277


« Reply #34 on: March 03, 2016, 11:13:26 AM »

jim_coupe: you running the 032CN software?
someone who called me a few weeks back mentioned you.. i think.. if youre from sweden that is..?
shoot me a pm, i might be able to help you out  Grin
Logged
Jim_Coupe
Hero Member
*****

Karma: +16/-12
Offline Offline

Posts: 663



« Reply #35 on: March 04, 2016, 02:29:29 AM »

I have a newer version mine is from BUB engine 8J 2007:  ECU 022906032H

Logged

E85oholic
samy
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 5


« Reply #36 on: November 09, 2016, 08:02:23 AM »

I also got a BUB 8J and still now can't find a way to convert it to mono lambda.

I got the neccessary ram adresses and memory mapping out of a etas a2l project and think they should be correct. Some Variables are stored in ram adresses like 0xFXXXX i cant find any of this in the ida project as this adress space is empty! And then there are the other half of the variables (mostly uninteressting ones) wich are stored in 0X38XXXX wich i find all in the ida project. Sadly all lambda related variables are in the 0xFXXXX area. I tried many different methods to get it to mono. I searched for the lambda regulator variable , for the injection time, all no success as they all lay in the 0xFxxx area wich give me 0 results in ida not one pointer/jump insctruction points in this memory area.
On the older CR167 Ecus i got no problem to find everything in the ida project. But on those ecus the variables are all in the same space not divided in 2 seperate memory locations.

My project constists of the ST10 processor code and the external 29f800 flash code. Maybe i miss something? In the datasheet of the ST10 they mention a very small xram area maybe its stored inside this and i cannot read it?  Did anyone successfully find a solution for the ST10 R32 Ecus and can help me out?

This is my memory map  :

    RESERVED FLASH INTERN 0x0 0x8000
    RESERVED FLASH INTERN 0x18000 0x8000
    RESERVED FLASH INTERN 0x20000 0xB0000
    CODE EPROM EXTERN 0x800000 0xE0000
    DATA EPROM EXTERN 0x8E0000 0x20000
    VARIABLES RAM EXTERN 0x380000 0x6000
    VARIABLES RAM EXTERN 0x386000 0x2000
    VARIABLES RAM EXTERN 0x388000 0x200
 
    As you can see the Variables from 0x38XXXX  are existent but the ones with 0XF000 are not mapped. Maybe i need to convert those Adresses with a offset ?

Regards
« Last Edit: November 09, 2016, 08:07:29 AM by samy » Logged
Jim_Coupe
Hero Member
*****

Karma: +16/-12
Offline Offline

Posts: 663



« Reply #37 on: November 10, 2016, 10:46:58 AM »

Intressting work there... I would like to help and work to find out more about these ECUĀ“s but I have been to busy lateley.. sucks*
Logged

E85oholic
turbojohan
Full Member
***

Karma: +5/-0
Offline Offline

Posts: 185


« Reply #38 on: November 13, 2016, 02:07:09 AM »

I'm building a 8J BUB turbo ATM. When get the hardware done i let you know if i Can get it working.


Verzonden vanaf mijn iPhone met Tapatalk
Logged
jameswalker
Jr. Member
**

Karma: +3/-0
Offline Offline

Posts: 39


« Reply #39 on: January 11, 2017, 05:18:41 PM »

I'm building a 8J BUB turbo ATM. When get the hardware done i let you know if i Can get it working.


Verzonden vanaf mijn iPhone met Tapatalk

With which ECU software version?
Logged
turbojohan
Full Member
***

Karma: +5/-0
Offline Offline

Posts: 185


« Reply #40 on: January 15, 2017, 12:23:23 PM »

022906032HJ 384450
Logged
nubcake
Sr. Member
****

Karma: +53/-4
Offline Offline

Posts: 401


« Reply #41 on: January 23, 2017, 06:05:04 AM »

I also got a BUB 8J and still now can't find a way to convert it to mono lambda.

I got the neccessary ram adresses and memory mapping out of a etas a2l project and think they should be correct. Some Variables are stored in ram adresses like 0xFXXXX i cant find any of this in the ida project as this adress space is empty! And then there are the other half of the variables (mostly uninteressting ones) wich are stored in 0X38XXXX wich i find all in the ida project. Sadly all lambda related variables are in the 0xFXXXX area. I tried many different methods to get it to mono. I searched for the lambda regulator variable , for the injection time, all no success as they all lay in the 0xFxxx area wich give me 0 results in ida not one pointer/jump insctruction points in this memory area.
On the older CR167 Ecus i got no problem to find everything in the ida project. But on those ecus the variables are all in the same space not divided in 2 seperate memory locations.

My project constists of the ST10 processor code and the external 29f800 flash code. Maybe i miss something? In the datasheet of the ST10 they mention a very small xram area maybe its stored inside this and i cannot read it?  Did anyone successfully find a solution for the ST10 R32 Ecus and can help me out?

This is my memory map  :

    RESERVED FLASH INTERN 0x0 0x8000
    RESERVED FLASH INTERN 0x18000 0x8000
    RESERVED FLASH INTERN 0x20000 0xB0000
    CODE EPROM EXTERN 0x800000 0xE0000
    DATA EPROM EXTERN 0x8E0000 0x20000
    VARIABLES RAM EXTERN 0x380000 0x6000
    VARIABLES RAM EXTERN 0x386000 0x2000
    VARIABLES RAM EXTERN 0x388000 0x200
 
    As you can see the Variables from 0x38XXXX  are existent but the ones with 0XF000 are not mapped. Maybe i need to convert those Adresses with a offset ?

Regards

Very late reply, but better late than never, huh. Wink
Your memory map lacks the XRAM which is located exactly in the 0xFxxxx region. Look up ST10 documentation or spend some extra time with that A2L. Also you need to set up default DPPs differently for the ST10. Search for DPP writes in the code to figure it out.
Logged
Carsinc
Sr. Member
****

Karma: +17/-2
Offline Offline

Posts: 447


« Reply #42 on: February 04, 2017, 09:50:24 PM »

Haha this is a good thread, I feel PRJ is the wizard of oz. I think he is behind
so much of whats out there is not even funny.
Logged
samy
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 5


« Reply #43 on: March 10, 2017, 06:47:18 PM »

Very late reply, but better late than never, huh. Wink
Your memory map lacks the XRAM which is located exactly in the 0xFxxxx region. Look up ST10 documentation or spend some extra time with that A2L. Also you need to set up default DPPs differently for the ST10. Search for DPP writes in the code to figure it out.


The problem is that the st10 documentation doesnt fit to the a2l memory map. Or atleast i dont find the link between them.
Logged
rotax
Newbie
*

Karma: +10/-0
Offline Offline

Posts: 22


« Reply #44 on: March 11, 2017, 06:31:15 AM »


The problem is that the st10 documentation doesnt fit to the a2l memory map. Or atleast i dont find the link between them.

A hardware solution where you mod the ecu to send the same analog signal to both wb a/d inputs would do the trick as well. Although the sw mod is nicer but the result would be the same.

« Last Edit: March 11, 2017, 06:33:36 AM by rotax » Logged
Pages: 1 2 [3] 4 5
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.046 seconds with 17 queries. (Pretty URLs adds 0s, 0q)