Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: Using AUD interface to read the memory contents


Guru

Status: Offline
Posts: 2338
Date:
RE: Using AUD interface to read the memory contents


OK gents,

Here is the next obvious problem. There is an occasional character drop from the serial line without a clear reason for buffer overflow or anything. Below you can se a record that has only 21 characters the rest information is just for checksum calculation. The same happens every 2-3000 rows. Any ideas of how to overcome that with this large data transmission volumes without a need to write a full communication front end to the windows?

Flowcontrol is none in Tera Terminal and running only 19.2k Maybe that could help - but I am not sure how reliable the async line is with this amount of data.


S30900028C1032FF0640E122902140165025566454221E1EE1E1
S30900028C1428003C00F0229021402040060027110F0FF0F0
S30900028C184800800B0219021402472012811386182827D0
S30900028C1C01F30C0C402290214028124312124471BFBF4040
S30900028C207DB00520F6229021403212517653252120909F6F6
S30900028C24FF0880328B2290214036255812850628274748B8B


__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 2338
Date:

Added an additional wait to com port writing procedure and managed to download a code with all the checksums matching. Anyhow without having a synchronous serial protocol I would not trust the com port capture a lot - or otherwise the speed needs to be very low. Currently with all the timeouts it takes 8hours (EDIT-noticed that I had double downloaded most of the code so its not really this bad) for me to get the initial code uploaded to the PC even though I dont send the 0xFFFFFFFF dwords over the serial line at all. Or am I missing something ?

Anyhow come to think something else...

The user mode kernel source code and completely assembled .bin comes as part of FDT package, so all we need to do is just download that into RAM using AUD and then ensure that there is a jump from vector 2 and 4 into that code. Execute AUD RST and thats it. That code is so small that it can be put as a string variable permanently into the sh7086 or propeller code. When using the FDT in user mode we get the FLASH contents out just in seconds using Renesas protocol B which is quarateed to work.

Here is the directory with sh7052 microkernel codes if interested ... (including also some flash erasing tools etc.)
http://macmadigan.no-ip.com/Public/ECU/7052_ukernels/
All this comes part of freeware download of the FDT programming tool from Renesas page so I guess there is no copyright issues putting it out to public.

As I have the Busa K6 USA ECU code now succesfully uploaded to my PC I am not planning to do anything for this faster mehod to get the flash contents, at least fow a while. First priority is now to do some dissassembling and map finding to see if we can easily enough find the maps without having a proper full debugging tool. At some point propably may build the bike emulator just to verify the map change results - but to identify the maps we really need some dissassembling work to happen.

The other thing I am suggesting is to verify if the sh7052 based SV1000, Busa and Z1000 codes are close enough for doing the dissassembly as a joint effort ? The hardware looks somewhat different, but I would guess that the port definitions and majority of the software to be alike as it its most likely in Densos interest to have a fully parametrized structure to have code and skills reusability.



-- Edited by PetriK at 10:04, 2007-11-24

-- Edited by PetriK at 14:04, 2007-11-24

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 2338
Date:

Just to close up this, here you are with piccies about the devices used as introduced in the beginning of this thread.

AUD interface 1

AUD interface 2

More detailed pictures inluding the other side of the vero board and the full renesas hew workspace (c source code for interface) can be found here:

http://macmadigan.no-ip.com/Public/ECU/AUDinterface/

The renesas device used can be found here:
www.renesas.com/rsk  then find 7086 on the opening page. That comes with the LCD, E8 programmer and full software development environment.

-- Edited by PetriK at 20:22, 2007-11-24

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 963
Date:

Bozo (or PetriK?) could someone post or send me the Propeller code for the AUD interface so I can post it?

Thanks

__________________


Guru

Status: Offline
Posts: 2338
Date:

Propeller code coming over email to. Maybe you can put that up on behalf of bozo and keep it updated when there is development for that ... I already put it up (with permission from Bozo) on our local discussion group, but Propeller is not really avail nor even known over here.

Linked C-code for Renesas RSK updated with the proper last longword reading procedure which was missing earlier.

Will try to get both PIC code and hw interface description that is used also for Z1000. Last time we discussed he said he is able to read the code, but was unsure about the bit/byte order.

Bozo - what is the latest update ? I really must say that the Propeller code you created is quite elegant and also would like to thank you and say that I would never have been this ready without your propeller work.



-- Edited by PetriK at 21:36, 2007-11-26

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 963
Date:
Propeller review


The opposite is true over here; Can't find the Renasas while the propeller is easily available and cheap.


Here is Bozo's Propeller AUD interface code

PropellerAudexample.txt

Presentation1.jpg

137_3713b.jpg

Propeller

-- Edited by RidgeRacer at 23:36, 2007-11-26

__________________


Guru

Status: Offline
Posts: 2338
Date:
RE: Using AUD interface to read the memory contents


Here you are also a working program for PIC 16F628 that was used for reading the Z1000 ecu with an AUD connector. The interface includes 74HC245 as described by Renesas/Hitachi (already erlier in this thread). At this stage no more detailed schematics is avail, but this should be quite self explanatory.

http://macmadigan.no-ip.com/Public/ECU/16F628.txt

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 2338
Date:

Here you are with a link to PIC based AUD interface schematics by a local hacker that was used when reading z1000 ecu.

http://www.fotopankki.fi/1234567/kuva/1382187697506225

http://www.fotopankki.fi/1234567/kuva/1382261979718656

Aud interface

-- Edited by PetriK at 15:08, 2007-11-30

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Newbie

Status: Offline
Posts: 3
Date:

Hi everyone, great info here.  I was wondering, is there any reason why a PC parallel port isn't used as the interface to the AUD?  AFAIK the parallel port can do 5v ttl and to talk to it would be quite trivial.  Am I missing something here?

__________________


Guru

Status: Offline
Posts: 963
Date:

I can't think of any reason why you could not use the printer port from a hardware perspective. Actually back in the day I used to use LPT ports for stuff all the time. I think the last time was Java app running a relay controller for a pan tilt motor drive on a home made remote controlled webcam in '95.

I guess its a software issue and a matter of go with what you know. I don't know off the top of my head the procedure for configuring the printer port as half 4 bits input and 4 bits output. Actually now that I think of it the enhanced LPT is bi-directional but can you even do a mixed half in half out or would you have to use some control lines like busy and ack? In the time it would take me to figure  out what the control register io addresses were and how to configure them or if there was an existing function or method in Visual C++ or visual Basic for that I can write the entire program needed for my little controller chip. And yes I can do some simple file i/o and build an s19 record but not as fast as I can double click on my telnet program and select capture file. And then there is the whole issue WinXP not surrendering the port when you want it.


I guess if I was a guy who wrote code for PC platforms all day I might have gone the PC printer port route but given I play with little microcontrollers all the time I went the other way

__________________


Guru

Status: Offline
Posts: 2338
Date:

A good point.

My reasons for serial interfacing was much more practical. The only PC that has a parallel port is my server.

Reading the flash with AUD is not really timing critical so a even a windows program should work if you have a spare parallel port.

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Newbie

Status: Offline
Posts: 3
Date:

Sounds like no real hurdles with the parallel; indeed for me it'd be easiers to get some code together than, say, get the parallax chip.  As soon as I get my hands on a ecu I'll try it.

Thanks both for your comments.
Cheers.

__________________


Newbie

Status: Offline
Posts: 3
Date:

With which Software can i read out the ECU with parallax Propeller interface?
With the original FDT Software from renesas???? Or did you mean with the Propeller Software?
Thanks

-- Edited by Chris at 14:02, 2008-08-26

__________________


Guru

Status: Offline
Posts: 963
Date:

The FDT software is a serial program that is only used to program the CPU using a serial line.

To read using the AUD port you have to write your own propeller software routine.

Here is the connection and software I use with the BasicStamp2 (available from Radio Shack) but it should be adaptable for other parallax products.

AUD to BS2 wiring diagram

BS2 AUD Read program

The program outputs the data as text formatted as a motorola S record. You will need some kind of Terminal program with capture to grab the text and turn it into a file.

__________________


Newbie

Status: Offline
Posts: 3
Date:

Can you sent me your mail adress (I have a few questions) and did you have mail adress from Bozo?
Is it difficult to write this software?

Does your BS2 Software runs under the Parallax Software or how can i understand it?

Is this file for the propeller Controller?
PropellerAudexample.txt

I think i need a Software for the propeller Board and a Software that runs under windows or a other System. Correct?

If i use the renesas rsk7086, can i use the renesas fdt software to read out the ecu? Or is it the same that i must write my own software for this interface?

Thanks
Chris



-- Edited by Chris at 21:28, 2008-08-26

-- Edited by Chris at 21:32, 2008-08-26

__________________


Guru

Status: Offline
Posts: 963
Date:

I don't have Bozo's address and haven't seen him around here for awhile.

That is the write software for Bozo's propeller setup. There should be some software that lets you program the propeller that comes with it. I did it a different way so I can't say for sure.

I know the BS2 parts I use are available in Germany as I helped another guy there read his GSXR1000.

What bike is your ECU off of?

I don't know anything about the rsk7086.

__________________


Guru

Status: Offline
Posts: 2338
Date:

rsk7086 is a sample kit from renesas, a 7086 processor on an experimental board. Very similiar processor to sh 7052 - but you still can not use the FDT to read, you really need to go via AUD interface - if sh7052.

I initially wrote a software using rsk7086 avail from glyn.de to read the stuff via AUD, similar to Propeller and PIC based software. Propably the Propeller will be easier way to go - unless you want to learh sh7052 inside out where rsk7086 helps a lot.

Please re-read this thread and you should figure out what is needed more in detail - bearing in mind that on this thread 3 different ways of reading the code using AUD is mentioned (rsh7086, PIC and Propeller).

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Newbie

Status: Offline
Posts: 3
Date:

And with which Terminal Software can i grab the Date from the Propeller Board or BS2 Board?
With Terminal Program did you mean a USB Trace to capture the data from the AUD Board.


From the BS2 Software
' send ascii chars to pc as part of s19 record
DEBUG HEX D28 ,HEX D24 ,HEX D20 ,HEX D16 ,HEX D12 ,HEX D8 ,HEX D4 ,HEX D0
RETURN


Thanks
CHris

__________________


Guru

Status: Offline
Posts: 2338
Date:

Almost any terminal progam should be able to do screen capture. My choise was Teraterm.

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 12:19:32 PM

__________________


Guru

Status: Offline
Posts: 2338
Date:

Maybe a timing issue in reading the AUD bus. Its almost an year ago since played with AUD so dont anymore recall exactly, but you should build into the code that you use for reading some error checking for read timing errors.

Alternatively if this is not a sh7052 ecu then you may have a different access size for that rom area. That may cause also problems like that.

I recall having problems particularly setting the port direction and the processor not responding quickly enough. Ended up a wiring a separate input and separate output ports. But used renesas sh70xx series processor card with C-coded program for reading so with BS2 you may have different problem.




__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 963
Date:

How did you wire it up?  Do you have a schematic you could post?

Shooting from the hip I wonder if you have a floating control line? Some of the ECUs have internal pull up resistors while others require you to drive the line to the required state. If you left the line unconnected thinking it was tied internally then it could float back and forth between states taking it in and out of AUD mode.

Did you pull up pin 10?  (AUDmode)





__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 12:19:25 PM

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 12:19:14 PM

__________________


Guru

Status: Offline
Posts: 963
Date:

Did you only post part of it in Capture 2 because it looks a little short, only up to 0x0000FFFF.

What is this out of?

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 12:19:06 PM

__________________


Guru

Status: Offline
Posts: 963
Date:

Once you get it loaded up in IDA do a search for text "32920" and you should find the ECU number off the sticker as an ascii string near the end of the ROM. Also if you find the map index table you can use the utility I wrote to auto define all the maps as an Enginuity XML



__________________


Guru

Status: Offline
Posts: 2338
Date:

You can also read the ecu version using the serial protocol, i.e. gaugedata monitor .

Have not yet implemented that to ECUeditor, but not a big deal to at some point to write the code that reads the ecu reference code e.g a number BB34????.

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 58
Date:

any updates on this? Im trying to read a map off a 06/07 gsxr ecu. I have a bs2 with the code ready. Is there anything else I should know.

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 12:18:23 PM

__________________


Veteran Member

Status: Offline
Posts: 58
Date:

ffaspector wrote:

 

jayknight wrote:

any updates on this? Im trying to read a map off a 06/07 gsxr ecu. I have a bs2 with the code ready. Is there anything else I should know.




 



I think everything you need is in this thread. The BS2 code worked great for me. Just make sure you have good power to the ECU and that you know which way the AUD ports read (mine were right-to-left). Good luck.

 



are the ecu connectors facing you or away from you?

 



__________________


Newbie

Status: Offline
Posts: 2
Date:

How can i read the flash with the stock file? What's the easier method?I'm expert on hw, but not with c language and firmw!Thanks

__________________
t5r


Member

Status: Offline
Posts: 11
Date:

Will this BS2 AUD read program work, or will it have  some errors?

__________________


Newbie

Status: Offline
Posts: 1
Date:

I tried to read AUD Propoller the flash of a 32920-41g50 but I pulled out the wrong data.
I repeated the same information every 0x3FFF, the same data read at the address 0x4000 0x0000 are the same.
The contents of the flash ends at 0x0c2f, some 'little.
Why? What's wrong?

__________________


Newbie

Status: Offline
Posts: 2
Date:

Hey guys, I know this thread is old, but hopefully someone is still watching *fingers crossed*

I'm trying to read a rom off of the TCM of my subaru using the AUD ports. It has a SH7055 chip, which I hope is similar enough to the 7052, I'm still about knee deep in the hardware manual. I have a propeller chip and have the program loaded already, the problem I have is connecting wires to the AUD ports on the TCM. Does some one have an idea where I could source a connector to connect to these itti bitti ports (pictured). I've tried Radio Shack, and there is a Fry's about an hour away that I may try as well.

I did try to solder single wire strands from a larger guage wire, but kept getting an error when running the propeller chip, the same one I get when it's not connected to anything, so I believe I have a connection issue.

Thanks
Ben

EDIT: Nevermind, instead of using solid core wire, I used strand wire out of a ribbon cable- still getting an error code from hyperterminal though.

Start...

00000000, error


and then the program stops, tried playing with the baud rate of the serial terminal, and changing the start address in the SPIN program to no avail, guess I have some more reading to do.



-- Edited by subarutech77 on Thursday 17th of February 2011 05:55:38 AM

Attachments
__________________


Newbie

Status: Offline
Posts: 4
Date:

subarutech77 wrote:

Hey guys, I know this thread is old, but hopefully someone is still watching *fingers crossed*

I'm trying to read a rom off of the TCM of my subaru using the AUD ports. It has a SH7055 chip, which I hope is similar enough to the 7052, I'm still about knee deep in the hardware manual. I have a propeller chip and have the program loaded already, the problem I have is connecting wires to the AUD ports on the TCM. Does some one have an idea where I could source a connector to connect to these itti bitti ports (pictured). I've tried Radio Shack, and there is a Fry's about an hour away that I may try as well.

I did try to solder single wire strands from a larger guage wire, but kept getting an error when running the propeller chip, the same one I get when it's not connected to anything, so I believe I have a connection issue.

Thanks
Ben

EDIT: Nevermind, instead of using solid core wire, I used strand wire out of a ribbon cable- still getting an error code from hyperterminal though.

Start...

00000000, error


and then the program stops, tried playing with the baud rate of the serial terminal, and changing the start address in the SPIN program to no avail, guess I have some more reading to do.



-- Edited by subarutech77 on Thursday 17th of February 2011 05:55:38 AM


 I am getting the same result with the same chip - is there something different between the 7052 and 7055?



__________________


Guru

Status: Offline
Posts: 963
Date:

Who makes the ECU you are trying to get into? What is the vehicle?

It is possible the AUD port has been disabled in the software. In the motorcycle ECUs manufactured by Denso they were nice enough (or careless?) to leave the AUD port enabled so we could upload the binary.

Other manufacturers may have disabled the AUD port to keep people like us out.

I'm not saying give up. But if you are confident you are doing everything correctly and you get absolutely now reaction from the port then this might be a possibility.



__________________


Newbie

Status: Offline
Posts: 2
Date:

RidgeRacer wrote:

Who makes the ECU you are trying to get into? What is the vehicle?

It is possible the AUD port has been disabled in the software. In the motorcycle ECUs manufactured by Denso they were nice enough (or careless?) to leave the AUD port enabled so we could upload the binary.

Other manufacturers may have disabled the AUD port to keep people like us out.

I'm not saying give up. But if you are confident you are doing everything correctly and you get absolutely now reaction from the port then this might be a possibility.


 I believe it is a Denso unit, 05 Forester XT. I believe that this is the case in this situation. I may have a few milliseconds before the software disables the AUD ports after a hard reset. I have not had the time lately to try and catch it though on a scope to be sure.

 

I have also attempted to use your BS2 method and program, to no avail as of yet. I should be able to get it back on the bench here soon. Would you be willing to answer some questions I have of your program?

Thanks for the reply!



__________________


Newbie

Status: Offline
Posts: 4
Date:

Does the AUD become available if you go into boot mode?

__________________


Guru

Status: Offline
Posts: 963
Date:

k25lol wrote:

Does the AUD become available if you go into boot mode?


 In boot mode the internal address bus is reconfigured so that cpu runs the boot kernel instead of the flash rom. The flash rom is not accessiable, at least not at the normal addresses. Now if you scanned the entire 4 gigabyte address space you might find it but that would take 262,144 hours.

Read the chapter in the data sheet on flashing rom for details.



__________________


Newbie

Status: Offline
Posts: 4
Date:

Is there any hope for help with the 7055?

__________________


Member

Status: Offline
Posts: 20
Date:

ok so I have decided to give this a bash. Just to see if I can do it with my limited electronics knowledge. I will need LOTS of help and guidance, so please bare with me.
Firstly, the tool needed - looking at the following product, please tell me if I'm on the right track :

http://www.apelectronics.co.za/Main.asp?D=%7BA7CF1FBB%2D7E15%2D47E4%2DB682%2DB46D7B446219%7D&PageType=Product&SKU=AP28803&CategoryID=228

So with this, I will need to program a chip to be able to read from the AUD port of the ECU ? Correct ?
Which ECU's am I limited to ? Only the K6 upwards ? Or will I be able to read from a K4 GSXR 1000 aswell (if it uses the same ECU) ?
Thanks in advance....

__________________


Member

Status: Offline
Posts: 19
Date:

Hey everybody,

after haveing a look at a Denso Diesel ECU with SH7058S Renesas controler flashed by a  professional flash tool, it seems that this tool uses also AUD connection for reading and writing ..

Does someone knows, if it is possible to use the same way like it is written here, to flash a Renesas SH7058S controler ?

Does the Renesas free FDT software supports reading and writing the controler ?

AFAIK SHBootMode will be supported by FDT for the SH7058S, but this is serial and only writing.

I found connection pads like it is displayed here on my ECU, but  I got two time 13 pads instate of 12..

How to know, were to connect the serial connection of SHBootmode interface or the AUD interface if it works on the Diesel ECU

 

Thanks for any help or hints

BR Jochen



Attachments
__________________


Veteran Member

Status: Offline
Posts: 54
Date:

I smell a clone tool in that pic ....lol...

Is it yours



__________________

cjsducati@hotmail.co.uk

 



Member

Status: Offline
Posts: 19
Date:

possible... but I donīt know.

I got this foto in a Subaru forum, form a guy, who let his Diesel been remapped.

 

Of cause it is not mine, I am looking for a "hobby"-tool like it is discribed here. Thatīs why I am here.

 

It looks like that AUD works on the Diesel ECU too, flashing should be possible via SHBootmode, like you can find here in the forum too.

So hopefully I just need to put things together to have a workable flasher for the DENSO ECU smile

BR



__________________


Senior Member

Status: Offline
Posts: 350
Date:

Took a quick look in the SH7058S Hardware Manual, it uses AUD so you should be able to read it with a Parallax Board etc. But, keep in mind you need to make a definition file to be able to change anything.

What car is the ecu from?



-- Edited by Twice on Sunday 11th of March 2012 12:29:35 AM

__________________


Member

Status: Offline
Posts: 19
Date:

The ECU is from a MY2010 Subaru Impreza Diesel.

I got the manual of the Renesas SH7058S and will check the pins. I allready got some got hints from other opensource forums, so I am very confindet to find the right pinning.

Deffinition of the dump is not a problem, I worked on it an think I got the most interesting maps allready.
Dumps are posted in openecu.org forum allready.

AFAIK IMMO code ist not part of the flash. There is an external chip for this on the ECU.
I donīt know if it is possible to reatch this chip also via AUD, but I donīt expact..
Glade, if it is possible

In my case, reading and wirting is "the problem"
BR

__________________


Senior Member

Status: Offline
Posts: 350
Date:

I have only done reading via AUD, that only to get a hold of the stock .bin file. Dont know how to write with AUD.
On gsxr writing is done via serial interface, check if Renesas FDT works with your chip. Then atleast you dont have to open ECU and solder AUD for writing...

__________________


Newbie

Status: Offline
Posts: 2
Date:

Hey, I need some help.  I am messing around with an "03 Busa and trying to read out the AUD port.  I set it up with the BS2 and RR code.  I fired up Terra and it started spewing, I was stoked.  But then I look at the code and it doesn't look good.  Can anyone help.



Attachments
__________________


Senior Member

Status: Offline
Posts: 179
Date:

Hi Did you ever connected to the ECU flash program?
Looks like it is deleted.



__________________

http://motorsport-brix.de/

«First  <  1 2 3 4  >  Last»  | Page of 4  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard