32bit Denso SH7052 based ECUs with AUD

RidgeRacer · RidgeRacer

Here is a utility that will generate Enginuity format map definitions in xml from the raw bin file. It uses the map lookup table located at the start of the map section of ECU memory (usually h'28000) bin2xml.zip I've tried it on the new ZX-6, and PetriK K5 busa bin. It worked on both. You will still need t...

PetriK · PetriK

You can find the latest files on the busa project from here: http://macmadigan.no-ip.com/Public/ECU/Enginuity/ This is a backup copy of the working directory from the laptop. The files include: .bin = original binaries from ecu .mot = binaries in motorola s record file format (row level checksu...

sharkbike · sharkbike

Hi boys... i have read an ecu of Z900 and i did made FULL XDF. If anyone need it...contact me. -- Edited by sharkbike on Sunday 28th of January 2018 05:05:34 PM

tipi65 · tipi65

TunerPro MapGenerator perustuu Ridge Racer BIN2XML.EXE koodi -- Edited by tipi65 on Sunday 2nd of March 2014 09:36:44 PM

zo470 · zo470

Hi, I accidentally flash a wrong bin file on this ecu with my KTAG (z1000 file instead of FZ1) , so i have to open it and shearch AUD Port. Read perfectly with Piasini (clone... sorry dear Christian Pasini). Does anyone have the 2D1-8591A-11 (french restricted) or similar EU, US, JP(00, 20, 10) bin fil...

fenugrec · fenugrec

Hi people, I'm working on Nissan ECUs that can be reflashed through OBD2, in my case a QR25DE Denso ECU on a 04 Sentra SpecV (uses an SH7055). I'm more or less cross-posting on another forum (RomRaider), but I wanted to tap into this forum's experience with SH70xx mcus... I know there's been some succes...

aux535 · aux535

Hi guy's How you calculate checksum in mod files. I have read z1000 2005 via plug, modified but can't write cause my tool dont have chk for SH7052 any help please -- Edited by aux535 on Thursday 17th of March 2016 07:19:01 AM

o5i · o5i

Hi, i wanted to ask if there are maybee custom firmware/software that i can flash on the m32r/sh7052 where i can add/remove featueres ecc. like the professional aftermarket ecu (motec ecc...) It would be nice if it is possible to use the ecu on other engines like care engines or maybee a vtwin.. -- Edit...

Swami · Swami

Good day to all.. I have an ecu im trying to write to using FDT so far I have been unable to write to either MCU1 or MCU2 using FDT. regardless of the pinout i am using i constantly get a boot error 15024 both MCU can be read Via AUD can anyone help me with this problem?

Likaibin · Likaibin

what make a good cpu when you look at their specifications?

Mike82 · Mike82

Hi. I have an ECU and i try the reading but i have a problem. I use Ktag interface,i have connected the rainbow cable to the internal CN501. After reading is complete (only sector 0?) An error occurred "checksum not ok". I have a problem on my interface? On the soldering cable? Ffollowed the i...

PetriK · PetriK

Here you are with z1000 binaries, autogenerated xml and also the idc definition file. The original downloaded binary code from the ecu http://www.bikeland.info/petrik/z1000/z1000.bin Autogenerated map definitions for enginuity http://www.bikeland.info/petrik/z1000/z1000.xml IdC f...

clrokr · clrokr

Hey guys, this is about a '07 GSR600, the software is very similar to the '04-'05 GSX-R 600 and the GSX-R 1000 with the 41G00 code. I have identified most of the important maps and map selection routines. I know that the software cuts fuel during deceleration based on throttle position (because you can...

hmilycar · hmilycar

Recently, OBD2TOOL has released a new product Launch ICarScan, it is Launch Icarscan Vci Super Launch X431 Idiag with Any 5 Free Diagnostic Software Full System Diagnostic Scanner for Andriod. Following is the highlights of Icarscan. highlights of Icarscan. 1.Launch latest customized bl...

mika · mika

I search shématic of this ECU. it's Denso 21175-0097 I search flash sérial IN and OUT, FWE and blank flash reset Can you help me ? Thank you

o5i · o5i

Somone knows about doing this? Read AUD and flash using linux? There should bee simple comands to use like cat stdin stdout ecc.... If it works good i want attach my rpi for logging and flashing.. thx -- Edited by o5i on Thursday 3rd of April 2014 08:19:49 AM

settuz · settuz

Hy to everybody!I've recently bougth a kawasaki z750 (2006 model), and I'd like to create a Gear Indicator. The idea is to use a microcontroller (+ 7 segment display) and connect it directly to the ECU. I've looked in a lot of forums trying to find any useful informations, but I didn't find anything.S...

Reidoalc007 · Reidoalc007

hi does anyone have the exact place for the AUD port for the Denso 112100-6790 FZ1 from 2007 i wana read the bin file thanks Amaro

PetriK · PetriK

The AUD connector allows quite simple protocol to read and write to the 7052 processor address space. In e10a (the AUD interface kit) a refenrence is made that only RAM address can be read, anyhow the protocol itself does not limit the address space and it is possible that e10a is limited due to copyrig...

Chap · Chap

Hi all, Just found this board a couple of days ago, been reading a lot, some topics are really nice. Just wondering, reading all the stuff about the AUD port, everyone already tried interfacing the AUD port with an FTDI directly (FTDI FT232/FT245 or better for example FT2232H) ? { an FT232 can be...

kwaka10r · kwaka10r

Has anyone logged the Vcc supply from the ECU? I am interested in how stable this supply is. My guess is it is possibly a band gap linear voltage regulator, similar to the LM317 or LM340 series. There's a picture of an exposed 07 600 ECU recently. I am sure you guys at least know what regulator they are usi...

Motorsports-X · Motorsports-X

I know you guys are doing a very good job of defining maps, but is it possible that we may ever get to see the underlying code ..or instructions? whatever you guys call it.. basically what im talking about is the code the tells the bike to switch from the idle maps to the aphla maps, or from gear 1 map to gea...

RidgeRacer · RidgeRacer

Don sent me a bin from a 06/07 GSXR-600 and I looked at it and could find no maps. From the end of the code around 0x2A00 to 0x3FFFF there were just filler 0xFF. In the code I also found a lot of address refrences to data in the 0x40000-0x5FFFF range. That would bring the flash size upto 384K. In checking the s...

psyche · psyche

Hi there, I am disassembling some bins from 600/750 newer and older bikes. These use the SH7052 and SH7054 CPUs. I have come to a point that i need to find out in the disassembly how the CPU hanldes the outputs of the ECU. Not ignition coils and injectors but STVA, EXCVA, pair valves and stuff like that! I...

bikramjeet_17 · bikramjeet_17

hi I'm a complete rookee in ECU hacking......hence i need alot of help... the following is a Denso ECM for an Indian Car. Our Team is using the engine for a competition where performance is top notch pirority hence i need to hack into the ECM. I wouldn't be able to provide all the info about the ecm hence i h...

RidgeRacer · RidgeRacer

This probably won't happen to most of you but I'm going to document it here so I don't forget the details later. I build USB cables to flash ECUs and of course I test each one by actually flashing an ECU before I ship them. Because I use a different USB cable everytime Windows XP assigns a new COM port number...

PetriK · PetriK

The downloaded code can be found here: http://macmadigan.no-ip.com/Public/ECU/Hayabusa%20K6%20-%2032920-24FK0%20112100-1100%2012V%20NEP074.mot Its a motorola s record format, so you can e.g. use mot2bin to convert it to a binary. I choose to use the S record as it has a checksum for each r...

RidgeRacer · RidgeRacer

I was talking to Don recently about how hard it is to read the disassembled RISC code in IDApro and said something in passing about what we really need is a Simulator. A simulator in this context is a program that runs on your PC and pretends to be the target CPU. You can then load your software, in this case...

psyche · psyche

Hi there! As i don't have the same experience as RR and Petrik i would like some help with SH7052. I am disassembling some code of a SV1000. I know that bozo has done some work but he didn't identified the maps. I have experience with 68HC16 but SH7052 is something new to me. I have disassembled the code but...

davepl · davepl

I just bought a 2010 Range Rover Supercharged Autobiography; all I knew from the literature is that it uses a "Denso Gen 1.5" ECU. That didn't tell me much, so today I pulled apart the ECU, and here's what I found: IC600 R4F70590 - Automotive Flash Memory Architecture: RISC Data Bus: 32 Bit...

Topic		Started By	Replies	Views	Last Post
	STICKY: Enginuity Automatic xml generator for 32 bit Denso (Preview) Here is a utility that will generate Enginuity format map definitions in xml from the raw bin file. It uses the map lookup table located at the start of the map section of ECU memory (usually h'28000) bin2xml.zip I've tried it on the new ZX-6, and PetriK K5 busa bin. It worked on both. You will still need t...	RidgeRacer	39	20852	Oct 22, 2017 by Ron_s
	STICKY: Latest files on the Busa project (Preview) You can find the latest files on the busa project from here: http://macmadigan.no-ip.com/Public/ECU/Enginuity/ This is a backup copy of the working directory from the laptop. The files include: .bin = original binaries from ecu .mot = binaries in motorola s record file format (row level checksu...	PetriK	12	11103	Nov 4, 2008 by smithabusa
	Kawasaki Z900 Full XDF and BIN done ! (Preview) Hi boys... i have read an ecu of Z900 and i did made FULL XDF. If anyone need it...contact me. -- Edited by sharkbike on Sunday 28th of January 2018 05:05:34 PM	sharkbike	1	363	January 29th by coma
	TunerPro XDF file (Preview) TunerPro MapGenerator perustuu Ridge Racer BIN2XML.EXE koodi -- Edited by tipi65 on Sunday 2nd of March 2014 09:36:44 PM	tipi65	1	3303	December 16th by Franco
	FZ1 2D1-8591A-XX (Preview) Hi, I accidentally flash a wrong bin file on this ecu with my KTAG (z1000 file instead of FZ1) , so i have to open it and shearch AUD Port. Read perfectly with Piasini (clone... sorry dear Christian Pasini). Does anyone have the 2D1-8591A-11 (french restricted) or similar EU, US, JP(00, 20, 10) bin fil...	zo470	1	313	November 23rd by coma
	Nissan Consult-II ECU reflashing (Preview) Hi people, I'm working on Nissan ECUs that can be reflashed through OBD2, in my case a QR25DE Denso ECU on a 04 Sentra SpecV (uses an SH7055). I'm more or less cross-posting on another forum (RomRaider), but I wanted to tap into this forum's experience with SH70xx mcus... I know there's been some succes...	fenugrec	13	7699	Aug 13, 2016 by fenugrec
	CHECKSUM (Preview) Hi guy's How you calculate checksum in mod files. I have read z1000 2005 via plug, modified but can't write cause my tool dont have chk for SH7052 any help please -- Edited by aux535 on Thursday 17th of March 2016 07:19:01 AM	aux535	2	1086	Mar 18, 2016 by aux535
	Is there custom Firmware? (Preview) Hi, i wanted to ask if there are maybee custom firmware/software that i can flash on the m32r/sh7052 where i can add/remove featueres ecc. like the professional aftermarket ecu (motec ecc...) It would be nice if it is possible to use the ecu on other engines like care engines or maybee a vtwin.. -- Edit...	o5i	1	1383	Feb 1, 2016 by krom
	problem writing yamaha r6 ecu 13s-8591a-60 (Preview) Good day to all.. I have an ecu im trying to write to using FDT so far I have been unable to write to either MCU1 or MCU2 using FDT. regardless of the pinout i am using i constantly get a boot error 15024 both MCU can be read Via AUD can anyone help me with this problem?	Swami	4	1403	Jan 18, 2016 by Swami
	A good cpu? (Preview) what make a good cpu when you look at their specifications?	Likaibin	0	754	Jan 14, 2016 by Likaibin
	Problem 21175-0016 (kawasaki z750 2004) Reading with Ktag (Preview) Hi. I have an ECU and i try the reading but i have a problem. I use Ktag interface,i have connected the rainbow cable to the internal CN501. After reading is complete (only sector 0?) An error occurred "checksum not ok". I have a problem on my interface? On the soldering cable? Ffollowed the i...	Mike82	6	1510	Dec 29, 2015 by Mike82
	z1000 binaries and xml (Preview) Here you are with z1000 binaries, autogenerated xml and also the idc definition file. The original downloaded binary code from the ecu http://www.bikeland.info/petrik/z1000/z1000.bin Autogenerated map definitions for enginuity http://www.bikeland.info/petrik/z1000/z1000.xml IdC f...	PetriK	10	6348	Dec 24, 2015 by Balojohn
	Deceleration cutoff subroutine (Preview) Hey guys, this is about a '07 GSR600, the software is very similar to the '04-'05 GSX-R 600 and the GSX-R 1000 with the 41G00 code. I have identified most of the important maps and map selection routines. I know that the software cuts fuel during deceleration based on throttle position (because you can...	clrokr	8	2956	Dec 20, 2015 by Yallgotboost
	what do you know about ICarScan VCI X431 IDiag Launch X431 IDiag IDiag X431 Super X431 iDiag Super Auto Diag Scanner For Android iCarScan VCI Launch iCarScan Bluetooth Diagnostic Scanner Launch X431 ICarScan ICarScan Launch ICarScan ICarScan (Preview) Recently, OBD2TOOL has released a new product Launch ICarScan, it is Launch Icarscan Vci Super Launch X431 Idiag with Any 5 Free Diagnostic Software Full System Diagnostic Scanner for Andriod. Following is the highlights of Icarscan. highlights of Icarscan. 1.Launch latest customized bl...	hmilycar	0	1076	Nov 16, 2015 by hmilycar
	ECU Z1000 2008 (Preview) I search shématic of this ECU. it's Denso 21175-0097 I search flash sérial IN and OUT, FWE and blank flash reset Can you help me ? Thank you	mika	12	4292	Oct 22, 2015 by Mike82
	Read/Flash on linux (Preview) Somone knows about doing this? Read AUD and flash using linux? There should bee simple comands to use like cat stdin stdout ecc.... If it works good i want attach my rpi for logging and flashing.. thx -- Edited by o5i on Thursday 3rd of April 2014 08:19:49 AM	o5i	5	1856	Dec 24, 2014 by Twice
	Gear indicator (Preview) Hy to everybody!I've recently bougth a kawasaki z750 (2006 model), and I'd like to create a Gear Indicator. The idea is to use a microcontroller (+ 7 segment display) and connect it directly to the ECU. I've looked in a lot of forums trying to find any useful informations, but I didn't find anything.S...	settuz	11	5423	Feb 26, 2014 by TDMAPP
	Denso 112100-6790 (Preview) hi does anyone have the exact place for the AUD port for the Denso 112100-6790 FZ1 from 2007 i wana read the bin file thanks Amaro	Reidoalc007	0	2003	Oct 31, 2013 by Reidoalc007
	Using AUD interface to read the memory contents ( 1 2 3 4 ) (Preview) The AUD connector allows quite simple protocol to read and write to the 7052 processor address space. In e10a (the AUD interface kit) a refenrence is made that only RAM address can be read, anyhow the protocol itself does not limit the address space and it is possible that e10a is limited due to copyrig...	PetriK	172	68191	Jan 11, 2013 by psyche
	AUD with USB FTDI. AUD JTAG FTDI USB PC (Preview) Hi all, Just found this board a couple of days ago, been reading a lot, some topics are really nice. Just wondering, reading all the stuff about the AUD port, everyone already tried interfacing the AUD port with an FTDI directly (FTDI FT232/FT245 or better for example FT2232H) ? { an FT232 can be...	Chap	11	8504	Oct 14, 2012 by Jochen_145
	Vcc stability for sensors. (Preview) Has anyone logged the Vcc supply from the ECU? I am interested in how stable this supply is. My guess is it is possibly a band gap linear voltage regulator, similar to the LM317 or LM340 series. There's a picture of an exposed 07 600 ECU recently. I am sure you guys at least know what regulator they are usi...	kwaka10r	5	2705	Aug 29, 2012 by kwaka10r
	More than maps (Preview) I know you guys are doing a very good job of defining maps, but is it possible that we may ever get to see the underlying code ..or instructions? whatever you guys call it.. basically what im talking about is the code the tells the bike to switch from the idle maps to the aphla maps, or from gear 1 map to gea...	Motorsports-X	6	2651	Jul 28, 2012 by stocker
	06/07 GSXR 600 appears to use 7054F (Preview) Don sent me a bin from a 06/07 GSXR-600 and I looked at it and could find no maps. From the end of the code around 0x2A00 to 0x3FFFF there were just filler 0xFF. In the code I also found a lot of address refrences to data in the 0x40000-0x5FFFF range. That would bring the flash size upto 384K. In checking the s...	RidgeRacer	8	6974	May 23, 2012 by Twice
	How the CPU handles the outputs? (Preview) Hi there, I am disassembling some bins from 600/750 newer and older bikes. These use the SH7052 and SH7054 CPUs. I have come to a point that i need to find out in the disassembly how the CPU hanldes the outputs of the ECU. Not ignition coils and injectors but STVA, EXCVA, pair valves and stuff like that! I...	psyche	7	2513	Mar 10, 2012 by Twice
	need help regarding Denso ECM (Preview) hi I'm a complete rookee in ECU hacking......hence i need alot of help... the following is a Denso ECM for an Indian Car. Our Team is using the engine for a competition where performance is top notch pirority hence i need to hack into the ECM. I wouldn't be able to provide all the info about the ecm hence i h...	bikramjeet_17	0	2975	Oct 2, 2011 by bikramjeet_17
	Flash Development Toolkit (FDT) software bug (Preview) This probably won't happen to most of you but I'm going to document it here so I don't forget the details later. I build USB cables to flash ECUs and of course I test each one by actually flashing an ECU before I ship them. Because I use a different USB cable everytime Windows XP assigns a new COM port number...	RidgeRacer	14	8714	Apr 16, 2010 by bozo
	Dissassembling and finding the maps ( 1 2 ) (Preview) The downloaded code can be found here: http://macmadigan.no-ip.com/Public/ECU/Hayabusa%20K6%20-%2032920-24FK0%20112100-1100%2012V%20NEP074.mot Its a motorola s record format, so you can e.g. use mot2bin to convert it to a binary. I choose to use the S record as it has a checksum for each r...	PetriK	77	19971	Mar 4, 2010 by psyche
	Free SH7052F Simulator (Preview) I was talking to Don recently about how hard it is to read the disassembled RISC code in IDApro and said something in passing about what we really need is a Simulator. A simulator in this context is a program that runs on your PC and pretends to be the target CPU. You can then load your software, in this case...	RidgeRacer	20	10381	Feb 19, 2010 by wobbler
	Identifying Functions and Maps in SH7052!!! (Preview) Hi there! As i don't have the same experience as RR and Petrik i would like some help with SH7052. I am disassembling some code of a SV1000. I know that bozo has done some work but he didn't identified the maps. I have experience with 68HC16 but SH7052 is something new to me. I have disassembled the code but...	psyche	0	3430	Feb 19, 2010 by psyche
	2010 Range Rover Supercharged (Preview) I just bought a 2010 Range Rover Supercharged Autobiography; all I knew from the literature is that it uses a "Denso Gen 1.5" ECU. That didn't tell me much, so today I pulled apart the ECU, and here's what I found: IC600 R4F70590 - Automotive Flash Memory Architecture: RISC Data Bus: 32 Bit...	davepl	1	3157	Feb 15, 2010 by wobbler
1 2 > Last» \| Page of 2 sorted by