ECU Editing

[JohnnyT]

I recently purchased a Stage III chip for my Laser and I was wondering if the same chip would work for my friends 93 Eclipse GSX or my other friends 94 Eclipse GST. So what I really want to know is will my chip work in all 1g cars? And what about 2g's?

 

[laserspeeddemon]

First of all, this would be FAR from pirating since the chip is open source coded and not copyrighted. Secondly, TMO was the first to do this for DSMs, then all of a sudden all these other companies were coming out with them with slightly different adjustments, but the base coding were the same.

So what these companies did was copy the code from TMO and then adjusted it to say "It's our own coding." But TMO did the mules work and these other guys just threw the seeds on the ground.

If this was pirating then AEM, HKS, DSMLink, and all these other fuel adjustment companies would be sued by the automobile manufacturers since in order to make a computer that works with the rest of the car, they had to reverse engineer the ECU, FCU, ECM, etc. and then make a software application that works based on the engine control parts coding.

Back on Topic:

Will it work with any other 1g, yes, it will even work with a 1g N/T EPROM ECU (as rare as they are). But the car will run like shit. Depending on how the chip was designed, generically or specifically, will determine how well it works.

 

[JohnnyT]

Well I was looking into my stage 3 chip and when I cache it the hex looks way different than other bins I have, it is in different places and such, am I viewing it wrong? I am using the software that comes with moates? I want to tune the stage 3 to some of my own specs but It looks so different.

 

[Street Surgeon]

First of all, this would be FAR from pirating since the chip is open source coded and not copyrighted. Secondly, TMO was the first to do this for DSMs, then all of a sudden all these other companies were coming out with them with slightly different adjustments, but the base coding were the same.

So what these companies did was copy the code from TMO and then adjusted it to say "It's our own coding." But TMO did the mules work and these other guys just threw the seeds on the ground.

If this was pirating then AEM, HKS, DSMLink, and all these other fuel adjustment companies would be sued by the automobile manufacturers since in order to make a computer that works with the rest of the car, they had to reverse engineer the ECU, FCU, ECM, etc. and then make a software application that works based on the engine control parts coding.

TOTALLY disagree! DSMChips aka Jeff O. has put TONS of time into this to make it useable for all to code their own chips. The OP said he BOUGHT a Stage III chip and Jeff's code is NOT the same as TMO's by a LONG SHOT! TMO may have originally modified the code, but these guys on the yahoo list had to pretty much find EVERYTHING out for themselves! Sure you can use tunerpro but this is not a tunerpro chip that he made, it's one that was already made for him! In the end sure if he made this chip on tunerpro and wanted to give it to his friend that's one thing, but he's talking about piracy.

For AEM to make a computer or any other manufacturer for that matter all they had to do was look at the sensor outputs and have a control unit. They don't have to reverse engineer the original ECM! Why do you think pretty much every AEM box is identical except the plug harness? It's the same computer controlling all the various sensors, all they had to do was see what the input signal was. Plus you can't "sue" for using aftermarket pieces. This argument was not only false but totally off topic.

 

[bling5tatus]

I agree with you ^^

Also, I use linux for my computer's operating system. I have wine (a windows emu) running on it so I can run windows apps (blech, if I so desire)... the makers of wine DID NOT reverse engineer anything to make wine. That would be illegal. They simply tweaked things and developed the software until it worked properly without errors.

 

[JohnnyT]

So does anyone have an answer to my question, and I don't know where the chip came from I got it off of ebay, maybe it is a copy, I don't know. It said it was stage III and I wanted to actually see if it is, but the code looks strange compared to other bins and sites that tell you what hex to change.

 

[bling5tatus]

What other bins have you compared it to?

I'm having a little trouble figuring something out, if anyone could shed any light on this it'd be fantastic. I have evo8 denso injectors. After some research and talking to the guy up at FIC, i learned that the evo8 550cc injectors I have actually have a dead time of 40usec LESS than stock dsm 450s. I don't know how I can program for this in my bin because all the info I've read ADDS dead time on top of the 450cc deadtime... I need to subtract some dead time. Anyone that can help with this please do. I'm not trying to threadjack either, if someone wants to send a PM that's fine... but I was thinking since this thread is about ecu editing I thought it'd be appropriate to ask here.

 

[architechnik]

As far as the placement for HEX code, it should be based on pointers. Each command will have a preceding address that determines what it will be referencing.

If they are out of order, the company or person who made it may be using "security by obscurity." They have rearranged the order to make it difficult to follow. Web designers do this a lot to avoid other people highjacking their code.

Especially because there is more room on newer chips than the originals, 'goto' commands and various other internal referencing can be done to ensure the code cannot be changed easily - making the novice buy a new chip every time.

Try arranging all the preceding codes (the first portion in each line) into numerical order. If it still doesn't make sense, look for the codes that are referencing other lines. If you don't want to deal with it, then don't.

 

[laserspeeddemon]

TOTALLY disagree! DSMChips aka Jeff O. has put TONS of time into this to make it useable for all to code their own chips. The OP said he BOUGHT a Stage III chip and Jeff's code is NOT the same as TMO's by a LONG SHOT! TMO may have originally modified the code, but these guys on the yahoo list had to pretty much find EVERYTHING out for themselves! Sure you can use tunerpro but this is not a tunerpro chip that he made, it's one that was already made for him! In the end sure if he made this chip on tunerpro and wanted to give it to his friend that's one thing, but he's talking about piracy.

For AEM to make a computer or any other manufacturer for that matter all they had to do was look at the sensor outputs and have a control unit. They don't have to reverse engineer the original ECM! Why do you think pretty much every AEM box is identical except the plug harness? It's the same computer controlling all the various sensors, all they had to do was see what the input signal was. Plus you can't "sue" for using aftermarket pieces. This argument was not only false but totally off topic.

I agree with you ^^

Also, I use linux for my computer's operating system. I have wine (a windows emu) running on it so I can run windows apps (blech, if I so desire)... the makers of wine DID NOT reverse engineer anything to make wine. That would be illegal. They simply tweaked things and developed the software until it worked properly without errors.

Actually, I haven't used the chips from DSMChips. I have experience with one TMO chip and a handful of ebay ones. So I won't argue against that. I actually didn't even work on it, someone else did and they showed me what they found he showed me his lab at work and how it works, I really didn't care because at the time I wasn't intrested plus he was a Honda guy, this was a few years ago. The OP never said he had a chip from DSMChips. Regarding reverse engineering the ECM, the SRT-4 community had limited options for while when it came to tuning because of this issue and as far as I know the Solitce GXP and Sky Redline still are at a loss for tuning options.

 

[laserspeeddemon]

I bounced around the links a little. I didn't get far before I realized the complexity of the discussion. Perhaps I should bow out, before I make myself look like any bigger then the ass I already have.

 

[bling5tatus]

I REALLY wish (in one hand) that someone had the "security feature" code from the original tmo chips. That is one of the features I want to add to my eprom the most. The possibilities of someone popping up and saying "I have it," are slim to none though.

Also, does anyone have an idea about my question at the top of this page? Steve?

 

[architechnik]

I bounced around the links a little. I didn't get far before I realized the complexity of the discussion. Perhaps I should bow out, before I make myself look like any bigger then the ass I already have.

Hey, we all do sometimes! HEX CODE R0X0rz!

I REALLY wish (in one hand) that someone had the "security feature" code from the original tmo chips.

What kind of security feature are you talking about? Is it like a kill switch feature where you have to tap morse code on your clutch pedal to start the car?

And sorry, I don't know about reducing... Let me get back to you, though. If I can verify the differences in addition, it should work backwards as long as it's not already at the lowest setting. Then it would actually take changing the multiplier - a little more difficult to track down.

 

[architechnik]

According to one site, at addresses "7CE7" through "7CED" you'll find the stock map at "A9 58 30 23 1B 17 13"

If you wanted to add 200 microseconds of deadtime, you would add 8 to each of the values on the map, since 200 / 24 = 8.

If you want to subtract 40 microsecs, you would subtract (40/24) or roughly 2
It's not exact, but if that's what you're going for... "A7 56 2E 21 19 15 11" is what you would switch it to.

 

[bling5tatus]

I see, I am no hex expert (yet)... what you said about changing the multiplier makes sense though. Yes, the morse code clutch pedal thing was what I was talking about. I believe the cel blinks too to tell you when to press the pedal.

 

[laserspeeddemon]

I have the chip for it, if you can direct me to someone in my area that has the equipment to read it, I gladly let him use it.

 

[bling5tatus]

Thank you guys... I didn't see your reply last night telling me the proper deadtime sizing.... I did figure out that I was incrementing the values incorrectly in the ds-map editor. I was using pageup and pagedown instead of the kp_plus and kp_minus (the plus/minus by your row of number keys will not work)... Anyway, I got it figured out for now.

And about the TMO chip... even if someone had the code from it I wouldn't know how to find the exact security feature code and locations. It'd have to be done by someone with more disassembly experience. I'm actually not trying to mess with the stock "maf" chip too much anyway since I will be using sd as soon as I get an o2 bung welded into my uicp for my gm-iat. Good looking out though. Those injectors I have are really unique from what I've seen. Even on dsmlinkwiki.com they're the ONLY injectors that have a negative deadtime when compared to stockers... everything else they list has MORE deadtime. I guess this is a good thing though since they're fast.

For the record, they aren't 550's. They're considered ND-560s or Denso 560s... and they're salmon colored injectors that come stock on a lancer evo8.

 

[laserspeeddemon]

Yep, the EVOs have 560cc. I had some with 8 miles on them and traded them for some R/C 550s, since the VPC has a 550 chip.

On a side note, what is the purpose of using the 02 sensor in the UICP? I'm just curious.

 

[architechnik]

He's just using the bung for the IAT (Intake Air Temperature) sensor to do the whole MAP setup, eliminating the traditional MAF.

I'm gonna wait until I do some major upgrades before I start working on that... wanna make sure everything else is in perfect running order prior.

 

[bling5tatus]

Well the guys at the local exhaust shop just gave me the bung... I'm gonna go outside here shortly and install it and the sd harness and the modified stock aircan (blocked off the maf plug and all the screw holes that hold the old maf in there) I made. I will be back, hopefully, with good news. I bought the car with a tial bov (some of you may know there is no possible way to recirculate this one) and this should solve any problems with running rich between shifts.

 

[bling5tatus]

According to one site, at addresses "7CE7" through "7CED" you'll find the stock map at "A9 58 30 23 1B 17 13"

If you wanted to add 200 microseconds of deadtime, you would add 8 to each of the values on the map, since 200 / 24 = 8.

If you want to subtract 40 microsecs, you would subtract (40/24) or roughly 2
It's not exact, but if that's what you're going for... "A7 56 2E 21 19 15 11" is what you would switch it to.

edit: on second thought you are right... I want to use the sd bin though... my logger will not connect (PDyno).

 

[timloomis]

Just go to the dsm-ecu group on yahoo. They have all the files you will need and some guides on how to use them. Then download a hex editor or tunerpro and your all set to make your own chips. You really need to read an understand the code yourself though instead of just copying chips. That's why people blow crap up when they go ems or dsmlink. Just pointing and clicking when they have no clue on what it does to the engine.

 

[bling5tatus]

Yo yo yo... slow down buddy. I've been reading dsm-ecu for a while now... and do not consider myself a complete noob.

 

[steve]

First of all, this would be FAR from pirating since the chip is open source coded and not copyrighted. Secondly, TMO was the first to do this for DSMs, then all of a sudden all these other companies were coming out with them with slightly different adjustments, but the base coding were the same.

So what these companies did was copy the code from TMO and then adjusted it to say "It's our own coding." But TMO did the mules work and these other guys just threw the seeds on the ground.

Where do people get this crap?

Nothing here is open source. I'm sure Mitsubishi owns the copyright for the software in their ECUs. To the best of my knowledge they haven't granted anyone rights to the code much less made it open source.

I can't speak to how much Todd Day of TMO might have or not shared with Tom and Dave at ECU tuning but I do know that none of us in the dsm-ecu group stole code from TMO and the work there didn't start until years after TMO stopped selling chips. The effort involved by people in that group in reverse engineering was substantial and covered things that TMO never did. People didn't just copy the TMO code and make adjustments. We had to do the Mules work from scratch.

I see that Cory and Bling also are trying to set the record straight. Thanks guys!

It said it was stage III and I wanted to actually see if it is, but the code looks strange compared to other bins and sites that tell you what hex to change.

Several things could be wrong. You could have read it in and used the wrong offset. It could be a bootleg TMO chip and have been moved in memory from the stock code.

The ECU has 64k of address space. The original EPROMS were 27128 parts providing 16kBytes of memory and connected in a way to make it start at 0xc000 so the software is located at 0xc000 to 0xffff in the ECU address space. Later ECUs used 27256 chips but only used and addressed the top half. If you read the chip in with a EPROM programmer they are read in starting at the first location being 0x0000. On a 16k image you have to add 0xc000 to the address to get it's real location in memory, a 32k image is "offset" 0x8000. Most of the EPROM editing pages your find incorrectly refer to addresses from the start of the EPROM and not the actual memory locations. That's because Jeff and crew weren't CS majors and were figuring out the CPU architecture and the code at the same time.

I'm having a little trouble figuring something out, if anyone could shed any light on this it'd be fantastic. I have evo8 denso injectors. After some research and talking to the guy up at FIC, i learned that the evo8 550cc injectors I have actually have a dead time of 40usec LESS than stock dsm 450s. I don't know how I can program for this in my bin because all the info I've read ADDS dead time on top of the 450cc deadtime... I need to subtract some dead time. Anyone that can help with this please do. I'm not trying to threadjack either, if someone wants to send a PM that's fine... but I was thinking since this thread is about ecu editing I thought it'd be appropriate to ask here.

According to one site, at addresses "7CE7" through "7CED" you'll find the stock map at "A9 58 30 23 1B 17 13"

If you wanted to add 200 microseconds of deadtime, you would add 8 to each of the values on the map, since 200 / 24 = 8.

If you want to subtract 40 microsecs, you would subtract (40/24) or roughly 2
It's not exact, but if that's what you're going for... "A7 56 2E 21 19 15 11" is what you would switch it to.

Correct. Find the deadtime map and subtract 2 from each value. That removes 48us from the stock deadtime value for each of the voltages in the map. -48uS was the best I could come with for the EVO VIII injectors back when they first showed up. That number came from me.

In the E931 code the deadtime map is at 0xfce7 to 0xfced. I haven't looked at the SD images to see if it's the same. You should be able to search for the stock values given above to find it.

 

[bling5tatus]

Word... yeah I got my deadtimes figured out, but I used the dsmap editor to do it. I was fooling with the hex editor when the mas was still on my car. You guys would not believe how much better my car sounds with no safc2/1gmas sorcery going on.

Steve - I was pondering the idea of just searching through the bin for strings of code that were already known. I know they must still exist even if they have been relocated somewhere else. It was discussed earlier in this thread that multipliers could be modified in the code. Let's say a multiplier was changed for the deadtime, that would change the string to something else correct? And I'm guessing you would not be able to search for it. I am not worried about this too much, but it'd be good knowledge any how.

I am going to pick up my laptop tomorrow and wire in my lc-1 wb sensor/controller directly to the ecu's o2 sensor line.

Also, what car did eprom #EA02 come out of? That is the number stamped on the sticker on the eprom chip I removed from the socket on my ecu. Everything I have seen is either E931 or E932 (fwd I believe).

Editing your own eproms is like a poor man's stand alone, everyone remember that.

 

[steve]

Yes, if somebody changed the code such that their was a different factor involved then the values in the maps would be dofferent. I'm not aware of anybody doing that for injector deadtime to the turbo code. I have seen NT chips where the deadtime were in other units than 24 uS. IIRC they were half that.

On the ECUs that I know or could read from pictures I list the software version on the third line at http://simon.chi.il.us/ECU/ECUID.html

EA02 was used on 1993 AT ECUs and also in 94 for California AT ECUs.

Steve

 

[architechnik]

I'll add to the list: I pulled the EB21 out of a '94 MT California (produced 10/93)

Steve, it looks like the link is broken. I'm piecing together an XDF file, but it's taking more time than I would like. It feels like I'm starting about where some of these other people were...
Do you guys know of a list of what the hex equivalents are for the different commands?