General Anyone still burning EPROM chips?

[DSMPT]

Very interesting! Are those actual dsm ECU’s or from another Mitsu product? (More so curiosity)

Those are JDM Galant VR4 ECUs, but I was using those in my 1g.

 

[Spleen8urLSX]

Those are JDM Galant VR4 ECUs, but I was using those in my 1g.

Just more curiosity, did they get them pretty spot on or did you back them up with a piggy back? (I’m just reliving the glory days at this point don’t mind me )

 

[DSMPT]

Just more curiosity, did they get them pretty spot on or did you back them up with a piggy back? (I’m just reliving the glory days at this point don’t mind me )

In total I got more chips from him and sometimes it was just spot-on (like after the first driving, wow I like it), sometimes it was a bit off from how I wanted and I used piggybacks on that (Anyways the car always had a MAFT and a SAFC and ITC). But please keep in mind that where I live has no access to dyno, so couldn't tell how much exactly different.

I was using Apexi RSM w/ a G-sensor on the streets or a local 1/4 mile track to check the difference, and how I feel the difference while driving. He didn't charge for re-programing until I get satisfied if I pay the shipping. But I live in North America and he was in Japan, so considering the international shipping, I chose to use piggyback to adjust some.

 

[Spleen8urLSX]

So to keep the conversation going, I’ll start for the day by saying Lyme disease blows, but on the plus side it’s given me an excuse to sit down and play around with this. Whether I figure it out for myself or not is to be determined, however I followed the old write up on here for utilizing Tuner Pro and played with it some.

I’m so new to hex editing itself I haven’t determined how to use the editor to turn a 32k file to a 64k file so I can play with the “stock” bin file on Tuner Pro, however I was able to download another “pre set up” xdf file straight from Tuner Pro’s website and open it and play with it.

I do know this isn’t so much code editing and I’m still understanding how it translates but I must say seeing this all laid out it seems pretty similar to playing with ECMLink over the years. Sure the software isn’t as spoonfed but if you have a pretty basic understanding it doesn’t seem too much more complex to me (or that could be autism working in my favor).

Now to be fair several years ago I’d log with Tuner Pro RT so I’m a bit familiar with their platform as is but this is interesting to play with none the less, though I preferred TMO for their direct access screen that let you see exact things like TPS voltage and clear DTC codes. Though that is all for today and can’t get too much further for a while as my car is in a million pieces on shelves, no chip burner or chips, no ostrich, etc. I know that’s just the tip of the ice berg but I could see this starting to make sense.

EDIT: And @bastarddsm I've seen in the past before I left the wonderful world of social media you have pretty much created your own method of logging, but aside from that just curious what is your preferred “pre made” logger when doing this? Only reason I ask is your posts over the years have lead to many good decisions involving NT pistons most would argue is a bad decision so without that I probably wouldn’t be having this conversation today.

 

[talonesi95t]

Hmm, I have a chip stored away from back when 1gdsm I believe was providing them. Unfortunately my car always ran extremely lean and gave up on it. Maybe I should give it another go.

 

[DSMPT]

@Spleen8urLSX
It's in Japanese and not free, and I have no idea if it has been sold in English but maybe you would be interested in the software like in the links below.
(These pages are originally in Japanese and are google-translated. So maybe there is error in translation)
This company (Grid) is active since the late 80s ~ the early 90s and still sell some stuff for ROM tuning.

グリッド・データロガー,GPS,HID,空燃比,ROMライター の ROMチューニング

GPSデータロガー,空燃比,HID,ROMライターと車のチューニング

www-grid-co-jp.translate.goog

バイナリエディタ　マップ作成ツール ロムメーカー

ROMMaker 3D ・最新の国産、外車のECUで利用されている IEEE754 形式対応。・バイト、ワード、IEEE754を常時切り替え。・全モードでバイトオーダー（エンディアン）切り替え。・3種類の画面カラーテーマを切り替え可能。 ROMMaker 3D は、ECUマップ、制御テーブルなどのバイナリデータの 検索、比較、検討、調整、確認を簡単に実現できます。...

mlabo-com.translate.goog

Seems they have a dedicated editor for EVO 1.

GRID,Inc. Map Maker ŠÂ‹« CD9A@ƒ_ƒCƒŒƒNƒg”Ì”„ƒy[ƒW

Map Maker ŠÂ‹« CD9A

www-grid-co-jp.translate.goog

 

[steve]

Lets start with the the disassembly (as it existed when released) and then look at the ROM image, and maybe we can relate that to Tunerpro's XDF file.

The E931 software, once you see how the parts relate you can start looking at other versions and make comparisons.

The key file for now is the standard_E931.lst which is the listing output from the assembler. There are a lot of comments to look through but a couple of key things to know.

The code in the ROM images wind up at the high end of the ECU's 64k memory map. At the low end is some internal registers that control how the microprocessor is configured and functions. The there is some RAM memory on chip used for variables and storage.

So the 4 16k blocks of processor address space are (in hexidecimal):
0000-3FFF Hardware registers and RAM
4000-7FFF
8000-BFFF Empty space in most images
C000-FFFF Where the EPROM image resides

The ECU Hardware doesn't decode all of the space so there are overlaps (echos) if you were to try an access some address ranges from code.

Erased bits of a 27XX series EPROM are all 1's (so bytes are 0xFF) and programming them changes the 1 bit to 0's where needed.

6800 family processors have an interrupt jump table in high memory and on reset read the last two bytes of memory as the address to start executing code. If you look at the listing you'll see CEFF as that address (in the E931 code) and if you then look at that address you'll see an instruction to jump to the reset routine at D03E. If you look at that code there you'll see some initialization and then a loop of the four subroutines that make up the main part of the ECU processing.

It runs these loops in order until an external interrupt causes it to handle the interrupt and then continues where it left off. If you look at the table at the end of memory again you'll see what some of the interrupts are and the the start of their handlers.

I'll pause here and let Jane and others comment before I continue.

 

[Jane Hacker]

Lets start with the the disassembly (as it existed when released) and then look at the ROM image, and maybe we can relate that to Tunerpro's XDF file.

The E931 software, once you see how the parts relate you can start looking at other versions and make comparisons.

This is awesome. Wish I had a rundown like it when I was starting out.
Nothing to add yet, looking forward to the continuation.

I think I'll put something together about doing "Real-time" ROM analysis using Ghidra for everyone in a bit.

 

[Spleen8urLSX]

@DSMPT a bit hard for me to translate but from what I can tell their software actually looks extremely user friendly. Probably not something I could ever utilize but extremely interesting none the less, the fact they even have 3d maps for ROM editing is fascinating in itself. I imagine it was pretty big over there in its heyday for the Mitsu community. On a side note I see they are also a LinkECU dealer which has nothing to do with what we’re speaking of but always found it nice they seem to have a presence in Japan. A guy I worked with lived in Japan for a few years and had a shop build an AE86 for him and had it shipped back when he moved back to the states (company owners son, they could definitely afford these antics, don’t get me wrong though good dude). I actually found the car in the storage building when I was locking up the plant for the night and about crapped myself then got the story on it, I was surprised to find it was tuned in Japan on a LinkECU Storm standalone then actually got him set up with a tuner here that put it on flex fuel for him as E85 isn’t available or widely available in Japan.

@steve thank you for that! Definitely makes it a little bit more clear for someone just figuring this out, or should I say attempting to figure this out. I definitely have more playing around to do and might still end up seeking someone out (if that someone even exists) willing to burn me a chip to get me going, however like any other form of engine management I’ve used in the past I still like to have the most thorough understanding of it I can possibly have. I wish more people within the community even using a tuners help would dive a bit deeper into what they have going on, not so much they can tune their own car but at least having a better idea of how the process works in my eyes is a big resource in itself. A good buddy of mine once had his 1g on AEM EMS v2 before switching to a LinkECU g4+, Corey Parrish at Slowmotion motorsports had the car running EXCELLENT on AEM and making real good power (870whp at 45psi on a 6466, things even rowdier now while maintaining full interior and streetability but that’s another story), however not to knock my buddy but he couldn’t even get the thing to datalog, long story short that’s how I learned so much about navigating AEM EMS without having personally used it in my car .

As far as resources go, last night in between re watching Stranger Things from the beginning in binge mode (again Lyme disease, not as active as I’d like to be yet insomnia is real with this illness and all these drugs) I happened to discover while the Keydiver guy isn’t actively burning chips and such for people these days he is still indeed out there and keeping his website to date as he even has the copyright updated to 2022. I’m going to be reaching out to him and see if I can get his permission to screen shot his write ups and re post them here, has a lot of good info in regards to things such as dual image maps and whatnot and I’d like to have a back up of that info on here for others to use in the case he finally shuts it down. Again, only with his permission and accrediting his work of course.

EDIT: @Jane Hacker I always manage to be typing these novels at the same time you drop more useful input on us but I’ll just add this here to keep from spamming replies. I must say you make this look too easy! While my understanding of this will never be anything close to the grasp on it you have, that contribution would be absolutely awesome. Thank you for putting that info out there for everyone to use, if I accomplish anything from this it’ll be at least having yet another reference for this stuff available to people in the future.

 

[steve]

This is awesome. Wish I had a rundown like it when I was starting out.

Me too.
When we started out the few people who knew anything weren't talking. It was a revelation when the image format and byte codes looked familiar to 6800 code and at some point we passed the point of entrance to the secret club and began receiving hints and some answers to well framed questions.

@Spleen8urLSX If you talk to Jeff (Keydiver) say hi for me. It's been years since we've talked.

 

[Spleen8urLSX]

@arfbarkyPrime look back in this thread a ways, I believe that is how I stumbled into Todd Day’s page. If you don’t find it there I’ll see if I can dig it back up when I sit down later.

 

[steve]

I posted the link in the other thread....

 

[Spleen8urLSX]

I posted the link in the other thread....

Sorry steve! I’m trying to keep up with not a great signal today, appreciate that

 

[DSMPT]

a bit hard for me to translate

Understand. That's what I thought

On a side note I see they are also a LinkECU dealer which has nothing to do with what we’re speaking of but always found it nice they seem to have a presence in Japan.

Actually there is Link Japan. Recently you find Australian/New Zealand companies often in Japan since they are closer, and they seem to know how to live in Japan which mean they have their customer service/support in Japanese. Because most of Japanese people hesitate to speak English (or don't speak), they are shy hahah. And for a long period of time, everything could be completed within the country, so Japanese people are totally not used to buy something from outside of country. Many people in Japan are interested in the foreign products now, since there are not many options with Japanese companies anymore.

E85 isn’t available or widely available in Japan.

Correct. Recently you can buy it but totally not common.

 

[Spleen8urLSX]

So I've gained a bit more headway on this in the last day with all this extra sit around on my ass time that I've accumulated (however I'm going to ATTEMPT to stop and cut my grass today, we'll see how that pans out).

I was able to load the bin file @steve shared here (big thanks for that one!) to take a good look at the inner workings of how things look in stock form and I found a bin file from 13 years ago over on the other DSM forum for 950cc injectors and a 2g MAF. I've been able to take a bit of time between my 3 year old forcing me to play Super Mario Bros 3 with him and sit and compare the "stock" bin file with the modified one for 950s/2g MAF and see just how they compare on TunerPro.

With what I know of ECMlink and LinkECU this actually made it make A LOT more sense in my eyes. I'm by no means feeling confident yet or do I have a super clear understanding of what I'm working with by any means, and forgive my poor terminology, but I do like how TunerPro shows you what code you're looking at/modifying when using the definition file. With the little bit of headway I have made in a short amount of time I'm thinking now at the minimal burning my own chip with the basics on it I want (injector scaling, MAF compensation, etc) isn't looking so far out of the realm of possibility at this point and I wouldn't be opposed to purchasing a chip burner and some blanks to give it a try once I hit that point that if I do, however I don't know yet if it would be practical to purchase a used Ostrich 2.0 at this point in time as they seem to still be bringing a good dollar amount being they have a big following on other platforms still today and they're no longer made. Moates is still however offering their chip burner at a decent price, I haven't dug deep enough yet but I'm sure a much cheaper and more standard chip burner can be used but the Moates chip burner seems to be set up to play directly with TunerPro which may make it easier.

Also I'm trying to keep from making this TunerPro specific but it does seem to be the easiest to use when dealing in this, don't let that defer you from input on other methods as I'm finding with this there's more than one way to skin a cat when it comes to EPROM chip burning, but figured I'd drop that to give an update on where I'm at with it. I do really like the idea that burning a basic chip doesn't seem far out of the realm of possibility and while I might get my head ripped off by someone for saying it here in the year 2022. I'm NOT opposed to dusting off the good ol' SAFC to back it up if need be at least until I get more into the inner workings of it. That and with a datalogger, the wideband, and @coltboostin 's help with the WOT side of things I used to be able to make the car run pretty well before moving on to more modern tech. I'm thinking if I can get the basics down I might be able to get to the point I can dig deeper and not need anything to back it up and make the car run well just burning a chip but we will see, I'd be happy just getting to the point to where I can burn something basic, or in the least get someone to do it while I at least have done my homework to have a good understanding of how it's working.

I'll leave the floor open for others at this point and may get into working on this some more this afternoon but for now it's time to ATTEMPT to be a productive member of society today.

 

[steve]

The next thing I wanted to introduce was the relationship between the code listing, the ROM image, and TunerPro XDF files.

As was mentioned earlier, there are ROM images out there of various sizes, that's typically a byproduct of the size of the EPROM that held them. These chips can hold from 2KB to 64KB in a pin compatible form.

Since the CPU expects a table at the top of the address space the space the EPROM addresses work down from the top (0xFFFF) so bigger EPROMs start at lower addresses as the chips storage gets bigger. However when you program the chip you want the software to wind up at the same places in the CPU's memory so you have to pad the extra unused space at the beginning of the EPROM or start programming the chip with an offset from the beginning. This offset comes into play when you talk about TunerPro and when you compare the location of some bits in the ROM vs where it actually gets accessed in the CPU's address space.

Since the typical DSM ECU software fits into the top 16K of the CPUs memory map (0xC000-0xFFFF) but the EPROM chip starts at 0x0000 the offset is the difference between the two. When you have a larger EPROM chip the offset decreases to keep the bits in the same place when you're done.

You must be logged in to view this image or video.

The ROM on the right is a 16K image and the one of the left a 32K. The contents are the same but there is a 0x4000 byte offset between the two.

Looking that the two same files but at the very end of both you'll see the interrupt vector table and that the difference in the locations of both is the same offset.

You must be logged in to view this image or video.

So where do all these extra 0xFFs come from? If you've been digesting the prior posts you'll know.

 

[Spleen8urLSX]

I’m probably entirely wrong as I think I may have hit a brick wall here, but I’m under the impression the 0xFFs are populating to make up the difference between a 32x file and 64x file, essentially filling in the gap in a way? I’m wrong and all of you that understand this stuff are laughing now, right?

 

[Jane Hacker]

I’m probably entirely wrong as I think I may have hit a brick wall here, but I’m under the impression the 0xFFs are populating to make up the difference between a 32x file and 64x file, essentially filling in the gap in a way? I’m wrong and all of you that understand this stuff are laughing now, right?

First, be kind to yourself!

Basically, yes, it is "filler". Two concepts may help put it all together.
One is mapping. The CPU has a 64k "field" it can address. It "maps" components to different areas of this field. 0x0000 to 0x003F are mapped to data registers. 0x0040-0x0056 is internal battery backed RAM, 0x0057-0x01BF is internal RAM.

Here's the fun part, the external EPROM is 32k, mapped to the top of the 64k field. So 0x8000-0xFFFF. If we want the address the code uses to line up, we have to act like there is all the other stuff before it still.

It gets a little more complicated...
The second concept is external ROM vs internal ROM. The binaries we are used to seeing are external (32k) however the internal ROM is smaller, and maps from 0xD000-0xFFFF.

Because EPROMs are expensive, they are a stop-gap between development (easy swaping out an EPROM) and final production (non-EPROM ECUs, the ROM is in most cases "masked" into the CPU die). So they had to fit the code and data into the size of the internal ROM so that it would fit when they went to single-chip. So they pad the ROM!

Of course, this is from the perspective of a Mitsubishi engineer back in the day, we can use the whole external EPROM to do our bidding.

Hope that makes sense!

 

[Spleen8urLSX]

Two concepts may help put it all together.
One is mapping. The CPU has a 64k "field" it can address. It "maps" components to different areas of this field. 0x0000 to 0x003F are mapped to data registers. 0x0040-0x0056 is internal battery backed RAM, 0x0057-0x01BF is internal RAM.

Here's the fun part, the external EPROM is 32k, mapped to the top of the 64k field. So 0x8000-0xFFFF. If we want the addresses the code uses to line up, we have to act like there is all the other stuff before it still.

It gets a little more complicated...
The second concept is external ROM vs internal ROM. The binaries we are used to seeing are external (32k) however the internal ROM is smaller, and maps from 0xD000-0xFFFF.

That clears it up quite a bit actually! Thank you for that break down.

As for how it's coming along now, thanks to a user on the other DSM forum that went by the username "90GS" for posting a few bin and xdf files 13 years ago that are somehow still good today and made great examples to look at as they had things like 2g MAF compensation, NLTS, stutterbox, etc already set up, along with the fantastic example steve posted here. That user has not been active there since 2011 so I imagine they are out of the DSM game by now but I still thank them for that. Ironically @CrackedDSM was involved in that very post a little later on and had some great insight so several years later I thank you for that.

With that being said I have something to start with and I'm going to attempt a few sample tunes that may work for me.

Unfortunately, upon going ECMlink a few years I sold off my logging cable to another local DSM'er in the area and I'm no longer on Facebook to find out whether or not he still has it though I may be able to get into contact with him to see if I can buy it back as I do believe he has moved to ECMLink.

I had been using an old Palm cable with a null modem adapter and Keyspan adapter to log in the past when I was controlling fuel with only the SAFC and logging with TMO logger. I have read posts in regards to people using the ECMLink V3 cable to log with other software, I do believe this is said to work with Tuner Pro RT but have not read of anyone using it with TMO. While in this learning process I have started to really like Tuner Pro for ROM editing I was never a big fan of their logger and would prefer not to use it if I can help it.

Also I see Evoscan offers a logging cable for earlier Mitsu products that is ALDL to USB but don't know if the baud rate would be proper to play with anything mentioned. They also claim Evoscan is compatible with our earlier 90-94 ECU's utilizing that cable but I have never personally heard of anyone logging a 1g with Evoscan and no offense to them, but from what I have seen of it, I'm not a fan and it isn't for me, though I do know many are using it and like it on Evo's and 2g's.

Chances are I will be buying their cable if I can confirm it will work, picking up another ECMLink cable, or making my own.

Also in regards to TMO datalogger, I do indeed have it here on my laptop. I plan to back it up as it could very well be one of the few digital copies left in existence for all I know and even as old as it is it still is not dated and is a fantastic datalogger.

I remember reading some time ago that Todd Day was okay with the software being distributed for free once he stopped offering it for sale. So with that being said, once I determine a way to do so, I will also be sharing it here so anyone who wants to use it will have access to it and can offer any help to anyone looking to use it. However there's some here who are still around who I know are very familiar with it as well and probably know a thing or two more about it than me but great tool despite being old.

So there's my novel for today. At this point I'm going to sit down in downtime and create "sample" tunes while I start to read of the burning process, what chips to buy, etc. I look forward to keep hearing from you guys on this as we have a pretty good thread going here. Never in a million years did I think I'd get this kind of feedback on this, let alone as positive as it has been, so thanks for that.

Biggest problem I'm running into now is the car itself is in a million pieces on shelves and quite a ways off from needing an ECU with me physically unable to work on it right now.

 

[Spleen8urLSX]

So I'm bored sitting in the hospital so thought I'd update here.

Playing around I put together what SHOULD be something I can burn to a chip and technically run in my ECU. I used one of the modified bin files I found and worked off of that but it was based on the same stock E931 bin steve had shared here that I also got to play around with.

This I set up for 560cc injectors and a 2g MAF, I took a little timing out of what was the stock timing table as when my car was on just an SAFC by itself it would knock some up top unless I ran a gallon of 110 octane race gas to every 4 gallons of 93 octane pump gas (9:1 compression non turbo pistons), so in theory taking some out might combat that if not I could take a bit more out.

Again this is just playing around a little bit but from what I can gather I could take this altered code and burn it to a chip at this point and it SHOULD run or am I wrong there? Attached is what I came up with if anyone cares to take a look:

You must be logged in to view this image or video.

 

[miliman13]

Updates !