Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: Capturing a bin, when the dealer does a reflash?


Member

Status: Offline
Posts: 15
Date:
Capturing a bin, when the dealer does a reflash?


I've been toying with the idea of hacking an arctic cat 2 stroke ecu for a while now, after finding this place and doing a lot of reading, I need a stock file to start working with.

I have acess to the dealer re-flash software/hardware, and it would seem to me that it is easier (and way cheaper) to grab the file as its going down the wire to the ecu, than reverse engineer the ecu (and risk destroying one or two in the process).

The dealer reflash "tool" is a windows program, and a cable that plugs into the 9 pin serial port, ecu, a 12v battery, and what I assume is a dongle of some sort, it may just be a series of jumpers I haven't cut it apart.

The connector for the dongle has 12 pins 7 of them go to the serial port (pins 1,2,3,5,7,8 and the outer housing of the serial connector, with the negative battery lead also tied to pin 8)  the remaining terminals go to the ecu.

 

First question, am I on the righ path here?

What software and/or hardware would you reccomend?



__________________


Member

Status: Offline
Posts: 15
Date:

At least someone is looking lol.

Does any one recommend a serial port monitor prog to use, or avoid? Or will that idea not work?

__________________


Senior Member

Status: Offline
Posts: 350
Date:

Depends on what the tool sends/adds and how its sent. Serial? K-Line? CAN?
What ECU is it? Pictures? What is the ECU pinout? Wich pins do dealer tool connect to? Etc. Etc. Pictures of the dealer tool setup?
Got any documentation or specifications for the dealer tool? Wich models do it work on?

What model and year is the snowmobile? Wiring diagram?

If its a Denso ECU its probably easier to read it via AUD hole and seal it back up.
If you are gonna sniff the lines it will not only contain the file. Commands etc. So hard to know what is firmware and not.
You wont know until you try.

Do you have any software to tune the file?
Can you get any files from the dealer tool? What is the name of the tool?
Is there any other commersial solutions to flash/tune Arctic Catīs?



__________________


Member

Status: Offline
Posts: 15
Date:

Thanks for the answers.  This will probabally be pretty long winded, sorry in advance.  I'm actually more interested in hacking the 4 stroke turbo ecu first, but it isn't very often I flash 2 stroke ecu's so I was going to get what I could first, then come back to it when I can.

The dealer tool will work on both the denso ecu used on the four stroke sleds, and the koukosan ecu used on the two strokes (using different harnesses to plug into the different ecu's). here is a link to info on the 2 stroke ecu:
http://ecuhacking.activeboard.com/t49452329/something-different-kokusan-denki-2-stroke-efi-ecu/

The dealer tool is a windows program that requires you to enter the serial number, and mileage of the machine, the part number of the ecu, and the service bulletin number that is the reason for the flash being required. It then verifies with arctic cats server that everything is ok, erases the ecu and flashes the new tune.  If somthing happens and the flash doesn't work properly you have to call the factory and have them un lock the serial number at their end so you can try again.

As of right now there is no publicly available software for either 4 stroke or 2 stroke ecu tuning, there are a handfull of compainies selling tunes for the turbo 4 stroke, but nothing at all for the 2 strokes.

I'd like to eventually be able to both.

I'm attaching pictures of the cable used on the 4 stroke ecu (its the same denso used on bikes)

It uses "magic black box" with a 12 pin connector, the serial port on the computer, 2 battery clips for power, a 26 pin connector (ecu 2) and 34 pin connector (ecu 1).


from the serial connector pins 1,2,3,5,7,8 and the outer housing run to the "magic black box" connector, with pin 8 hooked to the battery negative clip as well

From ecu2 (26p)
pin 1 to the battery negative clip
pin 14 to "magic black box" and to ecu1 pin 32

From ecu1 (34p)
pin 14 to the battery negative clip
pin 17 to "magic black box"
pin 29 to "magic black box"
pin 30 to "magic black box"
pin 32 to "magic black box" and to ecu2 pin 14
From the snowmobile wire harness diagram:
ecu2 (26p)
pin 1 ECU ground
pin 14 sensor power 5v

From ecu1 (34p)
pin 14 +b power for self shut off circuit
pin 17 ignition switch signal
pin 29 empty
pin 30 empty
pin 32 empty


hope this makes some sense....
The complete pin out

connector #1 34 pin
1mag coil
2pto coil
3water temp warn light
4mag injector #1
5pto injector #1
6main relay
7 
8headlight relay
9fuel pump relay
10mag injector #2
11check engine
12shift forward relay
13 
14B+ power for self shutoff
15air bypass valve
16throttle axle switch
17igniton switch signal
18 
19shift reverse relay
20speed sensor
21pto injector #2
22 
23 
24 
25reverse beeper
26ecu gnd
27ecu gnd
28starter relay
29 
30 
31diag
32 
33 
34 
  
  
connector #2 26 pin
1ecu gnd
2crank sensor -
3cam sensor +
4Shift switch
5 
6knock sensor
7sm1a (ISC)
8power source
9crank sensor +
10 
11o2 sig
12sm2a (ISC)
13sm1b (ISC)
145v sensor power
15tps -
16manifolt temp +
17water temp +
18ambient air pressure signal
19sm2b(ISC)
20sensor gnd
21tach op
22Ecu comunication (dash)
23 
24manifold pressire sig
25oil pressure switch
26waste gate

connectors1.jpg

connectors3.jpg



__________________


Senior Member

Status: Offline
Posts: 350
Date:

If i understand, you just want a stock file to start disassembling and trying to make a definition for starters?

If the Denso is something like Suzuki you just read it via AUD and program with FTDI-USB cable.
So if AUD port is not disabled and working that is probably the easiest/fastest way to go, IF processor is 7052/7054. (Saw 7052 somewhere)
If above is correct dealer tool can not read Denso at least, only erase and write a file.

If you want to sniff the lines its RX and TX you need. I would connect on ECU side.
But even when you get the trace how you would determine what is firmware, kernels, commands without having a stock file to compare with the trace.
Maybe if you get the trace from a gsxr read with a available stock file and figure out the structure that way. You wont know until you test.biggrin
But i will be much easier to read it via AUD.

Made a post in Kokusan thread you posted above.

Can you post Wiring diagram and ECU pinout for snowmobile in question from manual if there are any.
Do you have any ecuīs to test on? Denso would be your best bet but identifying programming pins will be hard without opening one up.
But looking at Busa programming pins they look very alike your interface harness.

That would make:
29 Green - TX (34p)
30 Yellow - RX (34p)
32 Red - FWE (34p)
14 Black - MD (34p) 



-- Edited by Twice on Thursday 29th of November 2012 03:39:00 PM

__________________


Member

Status: Offline
Posts: 15
Date:

This thread has gone a little off topic lol If you don't mind answering my 4 stroke (denso ecu) questions in here I'll put any info I have on the kokusan ecu in the other thread.

Yes, I'd like a stock file to start disassembling and trying to make a definition for starters. Since the engines are built by suzuki, and the ecu's are bought by arctic cat, from suzuki, I was hoping much of the info on here would transfer over.

I have a 4 stroke denso ecu here, from a non turbocharged engine (they are much easier to find, and less expensive to damage while learning) and have it open enough to find the AUD pads. plan on hooking it to an arduino, but my hands are a little shaky to be comfortable soldering leads to all those pads if I don't have to, any suggestions?

I've powered it up, and have 5 volts between pads 1 and 2.

 

here is a wire diagram of the ecu I have cut open

https://dl.dropbox.com/u/91506814/1100%20wire%20diagram.pdf



-- Edited by krom on Friday 30th of November 2012 03:44:36 AM

__________________


Senior Member

Status: Offline
Posts: 350
Date:

Already cutted a hole down to aud? Take some photos and upload! biggrin

Start soldering man! +5V between aud 1 & 2 sounds good.
Computer flatcable or other small cable works good, just presolder wire tips before soldering to port.
Arduino and Parallax are proven to work, you have more info about them in AUD-thread.
http://ecuhacking.activeboard.com/t14206571/using-aud-interface-to-read-the-memory-contents/

Is the non-turbo ecu physically same as the turbo one? Or is it a different kind of Denso?
You got a sled you can plug the test ecu into and test run after a reflash if you get the file out?
Is there any immobilizers on the sleds? Or can you switch ecuīs without reprogramming keys?



__________________


Member

Status: Offline
Posts: 15
Date:

ecu.jpgExternally the ecu's are the same, and the connectors are the same. I assume the hardware is different because the turbo uses more inputs/outputs (2 more injectors, waste gate, bov, knock sensor)

I was given 2 ecu's to cut apart and experiment with because the show runability problems when installed on a machine. and I'm pretty sure I knocked off a cap or resistor when I was peeling back the potting (any tricks to deal with that stuff?)

You can freely switch ecu's from sled to sled without problem (assuming both are either turbo, or non turbo)



__________________
BPJ


Member

Status: Offline
Posts: 8
Date:

krom wrote:


I was given 2 ecu's to cut apart and experiment with because the show runability problems when installed on a machine. and I'm pretty sure I knocked off a cap or resistor when I was peeling back the potting (any tricks to deal with that stuff?)


 

A friend fold me to try Methylene Chloride but it can also take the writting off the PCD. I haven't got around to giving it a go yet though.



__________________


Senior Member

Status: Offline
Posts: 350
Date:

Now itīs starting to get interesting hehe. Lets hope it rolls out the file nicely!

Lets hope the cap not has anything to do with power supply or communications. Just to power up and try to read.
If you still got the cap you can try to resolder it or a new one, but if ecu is scrapped now you at least know where the port is.
And can clean this one off to processor and trace programming pins if my guesses are wrong :)

One thing you can check also, in attached picture is it remains of silicone or scratched the board?
The light green foreground is GND and can not be cut/scrathed so its broken circuit if you know what i mean. (Just put a solder bridge if cut)

Green and Brown wire, are they GND? You will probably only need 17 and 35, main power and ground. Then let the arduino rip!



-- Edited by Twice on Saturday 1st of December 2012 09:30:22 AM

Attachments
__________________


Member

Status: Offline
Posts: 15
Date:

In that picture the green wire is the 5v sensor power out from the ecu (using it as a way to know the ecu is powered up), red is +12v black is GND (pins 17 and 35)

I was un able to get anything from that ecu. Not sure if it was any good to begin with, or if I destroyed it digging at the potting. Luckily I had a second one that I first verified worked to run a machine.

I was able to read the rom to a 736k .mot file. opening it in notpad this is first line:

S21400000000000400FFFFAFA000000400FFFFAFA049

 

and this is the last line:

S21403FFF030323533534E44300000FFFFFFFFFFFF20

 



-- Edited by krom on Friday 14th of December 2012 12:35:48 PM

__________________


Senior Member

Status: Offline
Posts: 350
Date:

Looks good and checksum matches according to mot2bin. Bin files in your e-mail.
File states Denso # 32920-49X10, hope its correct :)

Dont know if bin2xml work on this or if amount of 3D maps are just low for sledīs?
Have no idea but CVT probably cancel out many gear specific maps you find in bikes?

Now the hard part comes...

__________________


Guru

Status: Offline
Posts: 1247
Date:

Is this a turbocharged Suzuki engine in the sled? I seem to remember the .bin being available for a turbocharged Suzuki based engine for an arctic cat somewhere.

__________________


Member

Status: Offline
Posts: 15
Date:

This is the N/A suzuki engine, I was going to start with it, and work up to the turbo. Any chance you remember where you saw the .bin for the turbo?

__________________


Senior Member

Status: Offline
Posts: 144
Date:

Hey krom,

send me an email. I have some arctic cat bins, turbo and NA. I am making a definition file for the turbo at the moment so i might be able to help you.

Cheers

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Newbie

Status: Offline
Posts: 1
Date:

Hi there.


New member here.

Was anybody actually successful in flashing a 1100 turbo ecu?
Thx

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard