armchair theory on ecu reflashing

[yariphilia]

lol, as the title states this is purely skeptical... upon discovery of j2534 tools i was wondeering if it was possible to use these to reflash our ecu's and reprogram them with performance in mind. j2534 tools were created with the intention of "universalizing" pc to car ecm communication. tis, which is toyota's technical information service (iirc), would allow your pc to communicate with toyota ecu's. tis is an online database that also includes factory ecu programming. afaik this is common practice used everyday kinda stuff. the skeptical part is... could this process and tools be used to reflash our ecu's with performance fuel maps? much the same way openecu is used to flash subarus and evos. instead of reloading factory settings, could one load their own? as far as ive been able to find out a basic j2534 passthru tool costs around 300 or so and a 2 day subscription to tis is 55. and lastly, one would need to know what they were doing if they got that far lol. honestly i know a days worth of browsing on the subject and am very curious. if anyone (ctscott) has any info on this, im waiting anxiously.

[H3LlIoN]

I'm reading up now on ecu performance programming in hopes of taking a crack at this. Once I get a free saturday, we're going to plug in the yaris to the actual toyota diagnostics laptop, which uses and has access to TIS, to see what we can or cannot change on the yaris. Speaking generally, there is some amount of access allowed to actual toyota techs for playing with different settings and such. The only direct application I have seen is dealer installed power adders where the tech will connect with TIS and download the new maps for the added peripheral. As this would specifically apply to the yaris, and whether or not any changes outside of the commonly available TIS maps is possible, I do not know the answer yet. I'm hoping to find out within a few weeks though...I'm just waiting for my tech buddy to get some free time on a saturday to roll her in and plug her up.

[CTScott]

I have a techstream tool and a copy of the flash file for the 07 Yaris (as there was a TSB update for 07). I have pulled the data file (which is in S record format) into a hex editor and can see the fuel map areas.

I have not yet tried modifying the file to see if I can get it to burn back in. I would suspect that besides the per line checksum, that there is a checksum for the entire image.

I have done some research and have figured out what NEC microcontroller is used in the ECM and I think that the better route to doing a complete reflash will be to just overwrite the fuel map data. This reason that I think this is the better approach is that one would need the 08, 09, or 10 data file (which at this point does not exist) to ensure that the rest of what you are loading into the ECM is compatible with the rest of the systems of the car.

[yariphilia]

ask and you shall receive. its good to know you guys are looking into this. i wasnt sure if this was the route nexus was taking (not sure if he's on here or mi). would be a dream if this ecu was as easy as an evo's

[tgui]

I'm not a Yaris owner, but a Lexus ISF owner. Different worlds but we're after the same goals.

OP & All, I used to own a Subaru STi and was a small part in the open source ECU hacking efforts. I say small part as I was playing catch up for a good portion. Before recently moving onto the Lexus I did write my own ROM editing and logging software. (www.simpletune.org) and combined with my masters in computer science and experience with compilers and reverse engineering I HOPE I can help the Toyota world with ECU reflashing efforts.

My plan was to save up for:

http://tunertools.com/proddetail.asp?prod=DT-M-mfc


... and gain access to the TIS Database of ROMs. From there work through the checksum algo and attempt a flash.


OR there are more low level flashing functions available via JTAG or other chipset recovery modes if you pull the ECU. I'm hoping to get some pics of the chips used on my ECU for this.

Sorry for the lack of direction in this post but I was excited to see discussion SOMEWHERE on the nets ;)

Also, would one of post some Yaris ROMs or whatever the Toyota equivalent is from TIS? I'd like to work on reverse engineering y'alls checksum code with the hopes its similar to whats in my ECU.

Thanks!

[Yaris Hilton]

I can't help with this, but I'm glad to see someone's working on it. I'd expect that there are many commonalities across Toyota's ROMs.

[cdydjded]

CTScott has a Techstream and IS the most knowledgeable member here on this subject. He has been working on exactly this for a while. Problem is obtaining the code which is on lockdown especially after the DBW peddle recalls. Contact him, maybe between both of you something can be figured out.

[tgui]

Originally Posted by cdydjded

CTScott has a Techstream and IS the most knowledgeable member here on this subject. He has been working on exactly this for a while. Problem is obtaining the code which is on lockdown especially after the DBW peddle recalls. Contact him, maybe between both of you something can be figured out.

Thanks, will do.

[severous01]

if anything comes of this (programs, cables, flashes or whatever) i'd like to get into this. specially if it's adjustable from a laptop. i've been wanting and talking about this for a long time.

turn on laptop, run program, hook up to ALDL port and make adjustments...turn car off and back on...ready to role. i'd like to see some timing and fuel maps available as well as some programs that are stepped for modifications...like a header/intake/exhaust program, a premium fuel program and a heavily modified program and such.

[tgui]

Originally Posted by severous01

if anything comes of this (programs, cables, flashes or whatever) i'd like to get into this. specially if it's adjustable from a laptop. i've been wanting and talking about this for a long time.

turn on laptop, run program, hook up to ALDL port and make adjustments...turn car off and back on...ready to role. i'd like to see some timing and fuel maps available as well as some programs that are stepped for modifications...like a header/intake/exhaust program, a premium fuel program and a heavily modified program and such.

From the Suby world, such things at least are possible. Depending on the tools at hand:

Stage 1
- Pull ROM
- Decypher checksum algo
- Modify fuel/timing/etc maps
- Flash changes to ECU.

(IF) we can get stage 1 working then...
Stage 2:
- Pull RAM from executing cars to identify space where no routines ever write.
- Push fuel/timing maps to empty spaces in RAM
- Write simple routine in ROM to identify if we want to reference RAM.
- If so adjust fuel/timing/etc maps to point to space in RAM where dynamic tables are written.
- While driving update RAM tables with new data. Think live tuning.

Easier said than done of course

[Nexus1155]

Mmmmm I don't care to get into a big discussion at the moment. I always beleive that Benchflashing is the way to go all the time if it is a possibility.

NEC makes a flasher PG-FP5 that is said to flash all NEC chips proprietary or not. This is probably as low of a communication you are going to get unless you decide to take the MCU off of the board itself, but that in itself is a waste if you do not have an adapter to put it into a programmer.

Regardless, me and CTScott conversed on this topic. There is a pinout on the board where the PG-FP5 was originally used to program the chip and it was not sealed off. Alot of companies disable communication through this means by shorting out a circuit after it has been programmed, but only someone who has the device will be able to find that out in the long run. And yes, the PG-FP5 does program .S files as the one CTScott has.

There are many whatif's could'bes and howcome's flashing this ECU brings about, but it will happen once someone who has the time and money can get to it. I would dive more into it, but I don't have $600 to blow on an NEC only device to just "test" if it works. It is a risk and I might do it if I come into some cash to have another toy, but not this moment when I have to pay rent every month for the garage :(

[cdydjded]

Originally Posted by severous01

if anything comes of this (programs, cables, flashes or whatever) i'd like to get into this. specially if it's adjustable from a laptop. i've been wanting and talking about this for a long time.

turn on laptop, run program, hook up to ALDL port and make adjustments...turn car off and back on...ready to role. i'd like to see some timing and fuel maps available as well as some programs that are stepped for modifications...like a header/intake/exhaust program, a premium fuel program and a heavily modified program and such.

BTW something is available: http://www.dezod.com/pd-allan.cfm

Does everything you want & more. It more than most people here are willing to spend but it an available option.......

[CTScott]

Originally Posted by Nexus1155

Mmmmm I don't care to get into a big discussion at the moment. I always beleive that Benchflashing is the way to go all the time if it is a possibility.

NEC makes a flasher PG-FP5 that is said to flash all NEC chips proprietary or not. This is probably as low of a communication you are going to get unless you decide to take the MCU off of the board itself, but that in itself is a waste if you do not have an adapter to put it into a programmer.

Regardless, me and CTScott conversed on this topic. There is a pinout on the board where the PG-FP5 was originally used to program the chip and it was not sealed off. Alot of companies disable communication through this means by shorting out a circuit after it has been programmed, but only someone who has the device will be able to find that out in the long run. And yes, the PG-FP5 does program .S files as the one CTScott has.

There are many whatif's could'bes and howcome's flashing this ECU brings about, but it will happen once someone who has the time and money can get to it. I would dive more into it, but I don't have $600 to blow on an NEC only device to just "test" if it works. It is a risk and I might do it if I come into some cash to have another toy, but not this moment when I have to pay rent every month for the garage :(

I have been trying to track someone down who owns a PG-FP5. I don't want to drop the coin for one until I know whether or not Toyota had read protected the NEC microcontroller.

[tgui]

Originally Posted by Nexus1155

Mmmmm I don't care to get into a big discussion at the moment. I always beleive that Benchflashing is the way to go all the time if it is a possibility.

NEC makes a flasher PG-FP5 that is said to flash all NEC chips proprietary or not. This is probably as low of a communication you are going to get unless you decide to take the MCU off of the board itself, but that in itself is a waste if you do not have an adapter to put it into a programmer.

Regardless, me and CTScott conversed on this topic. There is a pinout on the board where the PG-FP5 was originally used to program the chip and it was not sealed off. Alot of companies disable communication through this means by shorting out a circuit after it has been programmed, but only someone who has the device will be able to find that out in the long run. And yes, the PG-FP5 does program .S files as the one CTScott has.

There are many whatif's could'bes and howcome's flashing this ECU brings about, but it will happen once someone who has the time and money can get to it. I would dive more into it, but I don't have $600 to blow on an NEC only device to just "test" if it works. It is a risk and I might do it if I come into some cash to have another toy, but not this moment when I have to pay rent every month for the garage :(

Setup a donations thread. I've seen/contributed to something like this in the past. I would assume there would be quite a large population of people willing to donate $20.

[Nexus1155]

Same CTScott, I am about to toss some CL Ads up to search around as well.

Even Hellion told me to ask Garm to front for it. I can't ask anyone else to give me money to take the risk on something like this. If it did not work, then the people who donated would be upset. Plus I do not even accept money from my parents unless I am in an unrealistic predicament.

I'll tell you what, if I can find someone who wants to buy my JL Audio setup, I will put up a portion of that towards the programmer instead of buying a 1911.

[cdydjded]

Originally Posted by CTScott

I have been trying to track someone down who owns a PG-FP5. I don't want to drop the coin for one until I know whether or not Toyota had read protected the NEC microcontroller.

Is this what we need?

http://www.futureelectronics.com/en/...PG-FP5-EA.aspx

[Nexus1155]

Yup thats it, that website states the previous model of the FP4 in the same description, but I think the FP5 is the newest model? Or they're introducing the FP6, I haven't been on the NEC website in a bit

[cdydjded]

Well lets do like "tgui" says, a donation thread. Ill do $20 bucks. We have 18715 members here. If we could get .5% (94 members) to do $20 bucks each that would be $1880. Enough for the unit itself & some left over for miscellaneous expenses.