Well boys and girls...2014 is the year we finally hacked into one of the older 16bit GSXR-750 ECUs!!! After more than 10 years, we've finally managed to successfully dump the contents of a K3 750 ECU (32920-35FD0). But, the news is bittersweet... This particular model uses a mask-rom CPU that cannot be flashed, but that doesn't necessarily apply to all the 16bit GSXR-750 ECUs out there. With at least 12 different models in the 32920-35Fxx series (that I'm aware of), there's bound to be one that's flashable. So the search is on!!!Next test on the list is Luke111's "notched" 32920-35F40...Kudos to Psyche for the software coding, Rhinoman for the parallel port interface design and Luke111 for helping identify the CPU. I started this new thread because I wanted to limit the discussion specifically to the 16bit GSXR-750 ECUs. There's just too much confusion otherwise.
www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products
Well we're run into some delays getting the 32920-35F40 ECU dumped due to problems with the parallel port BDM interface. Think we're past that now with the development of a new CPU16 Serial Interface.
More details here: http://ecuhacking.activeboard.com/t56737269/cpu16-serial-bdm-interface/
We'll know soon...
Great news from Down Under!!!
The K1 35F40 has been hacked, and it's flashable!!!Still looking for volunteers to help with checking the remaining 35Fxx models...
I have the 35F40 bin file & I have created definitions for romraider to suit. PM me for more info. Looking to share or swap for other 35Fxx & 40fxx bins. I would be more than happy to create definitions to suit. I couldn't have done it without the help from mr_hollywood. Using his usb-bdm adapter & software it took no time at all! Heres a pic of the adapter: It is possible in the future we may be able to flash the ecu through the main harness and notching the ecu won't be necessary. We quickly discovered that the first part of the map was missing. Suzuki (or denso) had set it to disable the data. This is the part of the map that runs the show. It took a few emails back & forth but we managed to change a setting in the ecu to enable the data and then I managed to dump the entire contents. I can also confirm that this ecu is flashable. I spent quite a few hours analyzing the data I got from the ECU with a hex editor. I found the maps quite easily once I figured out to use a colour code for the data - then the tables really stand out. Im using romraider to look at my maps but first I needed to create a definition file to show the tables correctly. I've asked Ridgeracer & psyche to help me with this project as well. Its quite interesting look at what suzuki has done here. For instance, the first place I looked was the ignition timing tables. We still haven't worked out for sure what tables are for what gear so what I have in the screen shots are just an educated guess. I can compare between the 6 ignition maps that the timing is retarded slightly compared to the 5/6 gear map. I notice though timing is practically identical above 50% throttle. so basically the TRE only really works at less than 50% throttle. I do use a TRE on my bike mainly so I can get repeatable results while tuning. I also noticed that the timing advance jumps up a lot at around 3000rpm. I have always had trouble tuning in this area & now I know why. Suzuki could have made the transition smoother. They use common ignition maps for cylinders 1&4 and 2&3. On average the middle cylinders run more advance. They use individual fuel maps for speed density & alpha n. No 2 cylinders are the same either. The table sizes are different between fuelling & ignition. The rpms I have entered so far in the tables are just a guess. We will know what they are exactly after the ecu data has been disassembled. Anyway, here's some screen shots attached"
-- Edited by luke111 on Saturday 8th of March 2014 10:42:09 PM
-- Edited by luke111 on Saturday 8th of March 2014 10:45:33 PM
-- Edited by luke111 on Saturday 8th of March 2014 10:46:11 PM
Great post Luke!!!
The 32920-35F30 is next on the list.
Should know in about a week...
Luke and Psyche are looking into that...
Finding the flashable ECUs for the K1-K3 seems to be a hit-and-miss thing. There doesn't seem to be any logic to it. So far, we've seen '30's and 'D0's that aren't flashable, and '40's and '39FD0's (from the 600) that are. Looks like you just have to try each one...
In the meantime, I've been working of a front-end for the CPU16 mini-BDM. This allows offloading some of the more complex (model specific) tasks to the PC. Here's a screen shot:
UPDATE: Development of the mini-BDM front-end has been put on hold indefinitely. All future development work on these ECUs will use the OBD-II (K-line) port...
The K1-K3 GSX-R 600/750 ECUs go K-Line...
We've known for a while that some of the K1-K3 GSX-R 600/750 ECUs were flashable, but until now there was no way to tell unless you notched the ECU and used a mini-BDM interface to read it out. Well, that has finally changed... All the ECUs we've tested have an ISO9141 K-Line interface, and the flashable ECUs have a bootloader that will answer you back...
We tested this cheap ($10) ISO9141 USB to OBD interface on a 39FD0 and it worked perfectly: http://www.tmart.com/Car-Diagnostics...le_p88581.html
You will need to make an adaptor cable to connect the OBD, ECU and regulated 12v power supply together, but it's a lot easier than notching. After a short hiatus, I've fully disassembled the bootloader protocol, and can now upload and execute code on the ECU. I've successfully tested code to dump the ECU, and am currently working on code to erase and flash...
For more info drop me an email at firstname.lastname@example.org
Here's what the adapter cable looks like:
And for anyone looking for a TTL to K-Line ISO9141 interface, I've successfully tested this one:
It's been a long, long time coming, but we finally have an inexpensive flash tool for the K1-K3 GSX-R 600 and 750s. This program will allow you to read the 3 flash rom modules (into a 96k bin file), the BE flash and the MCU control registers.
There are still a few bugs with this initial release and you can only flash ROM module 1 ($10000-$17FFF) where the maps reside, but it's a good start...
Many thanks to all those who have helped make this happen!!!
Just finished testing and packaging version 3.1 of the flash tool...It can dump the whole 96k of ECU rom in just over a minute, and re-flash a 32k module in about a minute and a half...
You can get a copy here:
And here's a screen shot:
Just completed an ADC viewing utility that should help us link ECU sensor signals to the ADC registers across the different ECU models. There is one version for the K1 model (with 2 registers muxed x4) and another version for the K2-K3 (with one register muxed x8)...
The utility uploads directly to the ECU via ODB-II and displays the "Unsigned Left-Justified" contents of the eight 68HC916R3 ADC registers at $FF730-3F in real-time.
I've also created a new web site where I'll be storing future posts. You can find it here:
Here's a screen shot of the K2-K3 version:
Yes, that's my email and thanks for the kind offer!!! The more information we can collect, the better...
That would be great... Thanks Carry!!!
Hi guys,Here's a little OBD2 (K-line) utility that will allow you to read or reset the ECU NV Ram (Yoshbox / Teka) settings to factory default...Here's what the program looks like:
You can download a copy here (instructions included):
Currently working on the code for disabling the STVA & STP FI errors (thanks the amazing work done on the instrument cluster protocol by JoE over on TLZone).Looking for anyone who's removed (or disconnected) their STVs and has a working OBD2(K-line) setup to help with testing...
Hi guys,For those interested in building an OBD adaptor, I've just posted draft instructions on "Making a better K1-K3 GSXR OBD adaptor cable.doc". You can find a copy of the instructions here:https://sites.google.com/site/mrholl...ader-utilitiesI expect to have the final version uploaded later this week.Here's a peek at what the interface looks like...
Successfully completed prototype testing yesterday on an in-harness OBD adaptor that would remain permanently connected to your ECU. This would allow for running bootloader utilities or the Flash Tool without having to remove the ECU. The design uses key switches to avoid accidental closing of the switches during normal operation and does not require cutting into the harness in any way.
Not sure whether this will work on the GSX-R 600 because the STCU uses the same K-line pin as the VAG-COM OBD2 interface.
Here's a sneak peek:
Here's a pic of the in-harness OBD hookup for reflashing:
I've also started testing of a WiFi interface:
No, the K-Line is not used during normal operation (except on the 600s that use it to control the STCU). Getting the ECU to transmit OBD2 engine & sensor status is one of the things on my development roadmap, but I haven't had much time to work on it this past season. Ideally, I'd like to use an ELM327 to transmit to a datalogger via WiFi.
You should bear in mind that not all the 2000-2003 ECUs are flashable and you can't tell which are, just by looking at them. You have to test the unit to find out.
Also, the engine won't run during BDM, so that won't be much use to you for datalogging. Feel free to drop me an email at email@example.com if you want to discuss further.
For anyone using a recent version of RomRaider, I created the "RRcheck" utility to check for (and correct) "Static" declaration incompatibilities in XML files that cause the ECU binary file to become corrupted. You can find a copy here:
And here's a pic: