Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: 32920-35Fxx (16bit GSXR-750) ECU finally hacked...


Veteran Member

Status: Offline
Posts: 63
Date:
32920-35Fxx (16bit GSXR-750) ECU finally hacked...


Well boys and girls...

2014 is the year we finally hacked into one of the older 16bit GSXR-750 ECUs!!!

After more than 10 years, we've finally managed to successfully dump the contents of a K3 750 ECU (32920-35FD0). But, the news is bittersweet... This particular model uses a mask-rom CPU that cannot be flashed, but that doesn't necessarily apply to all the 16bit GSXR-750 ECUs out there. With at least 12 different models in the 32920-35Fxx series(that I'm aware of), there's bound to be one that's flashable.So the search is on!!!

Next test on the list is Luke111's "notched" 32920-35F40...

Kudos to Psyche for the software coding, Rhinoman for the parallel port interface design and Luke111 for helping identify the CPU. I started this new thread because I wanted to limit the discussion specifically to the 16bit GSXR-750 ECUs. There's just too much confusion otherwise.

Related discussions:

http://ecuhacking.activeboard.com/t42634345/anyone-done-gsxr-6007501000-00-02-16-bit-having-problems/

http://ecuhacking.activeboard.com/forum.spark?aBID=99460&p=3&topicID=46860770



__________________


Guru

Status: Offline
Posts: 1233
Date:

Good work, its a shame that you are not able to write to the MCU...

__________________

site_logo_small.png

www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products



Veteran Member

Status: Offline
Posts: 63
Date:

Well we're run into some delays getting the 32920-35F40 ECU dumped due to problems with the parallel port BDM interface. Think we're past that now with the development of a new CPU16 SerialInterface.

More details here: http://ecuhacking.activeboard.com/t56737269/cpu16-serial-bdm-interface/

We'll know soon...



__________________


Veteran Member

Status: Offline
Posts: 63
Date:

Great news from Down Under!!!

The K1 35F40 has been hacked, and it's flashable!!!
Still looking for volunteers to help with checking the remaining 35Fxx models...

Cheers!



__________________


Member

Status: Offline
Posts: 21
Date:

I have the 35F40 bin file & I have created definitions for romraider to suit.
PM me for more info.
Looking to share or swap for other 35Fxx & 40fxx bins. I would be more than happy to create definitions to suit.

I couldn't have done it without the help from mr_hollywood.
Using his usb-bdm adapter & software it took no time at all!

Heres a pic of the adapter:
IMAG0175_zps6cd2b022.jpg
It is possible in the future we may be able to flash the ecu through the main harness and notching the ecu won't be necessary.

We quickly discovered that the first part of the map was missing. Suzuki (or denso) had set it to disable the data. This is the part of the map that runs the show. It took a few emails back & forth but we managed to change a setting in the ecu to enable the data and then I managed to dump the entire contents.
I can also confirm that this ecu is flashable.

I spent quite a few hours analyzing the data I got from the ECU with a hex editor. I found the maps quite easily once I figured out to use a colour code for the data - then the tables really stand out.
Im using romraider to look at my maps but first I needed to create a definition file to show the tables correctly.

I've asked Ridgeracer & psyche to help me with this project as well.

Its quite interesting look at what suzuki has done here. For instance, the first place I looked was the ignition timing tables.
We still haven't worked out for sure what tables are for what gear so what I have in the screen shots are just an educated guess. I can compare between the 6 ignition maps that the timing is retarded slightly compared to the 5/6 gear map. I notice though timing is practically identical above 50% throttle. so basically the TRE only really works at less than 50% throttle. I do use a TRE on my bike mainly so I can get repeatable results while tuning. I also noticed that the timing advance jumps up a lot at around 3000rpm. I have always had trouble tuning in this area & now I know why. Suzuki could have made the transition smoother.
They use common ignition maps for cylinders 1&4 and 2&3. On average the middle cylinders run more advance.
They use individual fuel maps for speed density & alpha n. No 2 cylinders are the same either.
The table sizes are different between fuelling & ignition. The rpms I have entered so far in the tables are just a guess. We will know what they are exactly after the ecu data has been disassembled.

Anyway, here's some screen shots attached"


-- Edited by luke111 on Saturday 8th of March 2014 10:42:09 PM



-- Edited by luke111 on Saturday 8th of March 2014 10:45:33 PM



-- Edited by luke111 on Saturday 8th of March 2014 10:46:11 PM



-- Edited by luke111 on Saturday 8th of March 2014 10:48:08 PM

Attachments
__________________


Veteran Member

Status: Offline
Posts: 63
Date:

Great post Luke!!!

The 32920-35F30 is next on the list.

Should know in about a week...



__________________


Senior Member

Status: Offline
Posts: 116
Date:

Hi,

Is there any info about flashing thru main harness possibilities?

__________________


Veteran Member

Status: Offline
Posts: 63
Date:

Hi Carry,

Luke and Psyche are looking into that...

Finding theflashable ECUs for the K1-K3 seems to be a hit-and-miss thing. There doesn't seem to be any logic to it. So far, we've seen '30's and'D0's that aren't flashable, and '40's and '39FD0's (from the 600) that are. Looks like you just have totry each one...

Inthe meantime, I've been working of a front-end for the CPU16 mini-BDM. Thisallows offloading some of the more complex (model specific) tasks to the PC. Here's a screen shot:

UPDATE: Development of the mini-BDM front-end has been put on hold indefinitely. All future development work on these ECUswill use the OBD-II (K-line) port...



-- Edited by mr_hollywood on Saturday 17th of January 2015 07:02:03 PM

__________________


Senior Member

Status: Offline
Posts: 116
Date:

Looks promising! I sent Luke and Shark few info from K1-K3 bikes that i have, i hope that would help:) Looking forword for good news:)

__________________


Veteran Member

Status: Offline
Posts: 63
Date:
GSXR 16bit ECUs go OBD-II (K-Line)...


The K1-K3 GSX-R 600/750 ECUs go K-Line...

We've known for a while that some of the K1-K3 GSX-R 600/750 ECUs were flashable, but until now there was no way to tell unless you notched the ECU and used a mini-BDM interface to read it out. Well, that has finally changed... All the ECUs we've tested have an ISO9141 K-Line interface, and the flashable ECUs have a bootloader that will answer you back...

We tested this cheap ($10) ISO9141 USB to OBD interface on a 39FD0 and it worked perfectly:
http://www.tmart.com/Car-Diagnostics...le_p88581.html

You will need to make an adaptor cable to connect the OBD, ECU and regulated 12v power supply together, but it's a lot easier than notching.

After a short hiatus, I've fully disassembled the bootloader protocol, and can now upload and execute code on the ECU. I've successfully tested code to dump the ECU, and am currently working on code to erase and flash...

For more info drop me an email at mr_hollywood@cogeco.ca

Here's what the adapter cable looks like:

GSXR%2016bit%20K-Line%20%28OBD2%29%20adaptor.jpg

And for anyone looking for a TTL to K-Line ISO9141 interface, I've successfully tested this one:

TTL%20to%20OBD%20ISO9141%20interface.jpg





-- Edited by mr_hollywood on Sunday 18th of January 2015 10:50:31 PM

__________________


Veteran Member

Status: Offline
Posts: 63
Date:
32920-35Fxx (16bit GSXR-750) ECU finally hacked...


It's been a long, long time coming, but we finally have an inexpensive flash tool for the K1-K3 GSX-R 600 and 750s. This program will allow you to read the 3 flash rom modules (into a 96k bin file), the BE flash and the MCU control registers.

There are still a few bugs with this initial release and you can only flash ROM module 1 ($10000-$17FFF) where the maps reside, but it's a good start...


Many thanks to all those who have helped make this happen!!!



-- Edited by mr_hollywood on Tuesday 12th of January 2016 05:08:15 AM

__________________


Veteran Member

Status: Offline
Posts: 63
Date:
GSX-R 16bit ECU Flash tool v3.1...


Just finished testing and packaging version 3.1 of the flash tool...
Itcan dump the whole 96k of ECU rom in just overa minute, and re-flash a 32k module in about a minute and a half...

You can get a copy here:

https://sites.google.com/site/mrhollywoodk3/home/obd-bootloader-utilities

And here's a screen shot:

Flash%20tool%20v3.1a.jpg



-- Edited by mr_hollywood on Saturday 17th of January 2015 06:52:14 PM

__________________


Veteran Member

Status: Offline
Posts: 63
Date:
GSX-R 16bit ECU ADC viewer...


Just completedan ADC viewing utility that should help us linkECU sensor signals to the ADC registers across the different ECU models. There is one version for the K1 model (with 2 registers muxed x4) and another version for the K2-K3 (with one register muxed x8)...

The utility uploads directly to the ECU via ODB-II anddisplays the "Unsigned Left-Justified" contents of the eight 68HC916R3 ADC registersat $FF730-3F in real-time.

I've also created a new web sitewhere I'll be storing future posts. You can find it here:

https://sites.google.com/site/mrhollywoodk3

Here's a screen shot of the K2-K3 version:

ADC2view1.1.jpg



-- Edited by mr_hollywood on Saturday 17th of January 2015 06:56:34 PM

__________________


Veteran Member

Status: Offline
Posts: 73
Date:
RE: 32920-35Fxx (16bit GSXR-750) ECU finally hacked...


Really good work !

if you want i can give you few readout, my some ecu that you don't have
i done in the past for those ecus HC16 Suzuki K1/K2/k3

is this your email : mr_hollywood@cogeco.ca ?

best regards


Christian Piasini
R&D Piasiniengineering



__________________
Christian Piasini


Veteran Member

Status: Offline
Posts: 63
Date:

Hi Christian,

Yes, that's my email and thanks for the kind offer!!! The more information we can collect, the better...



__________________


Veteran Member

Status: Offline
Posts: 63
Date:
32920-35Fxx (16bit GSXR-750) NV RAM hacked...


Hey guys,

We finally hacked into 16bit GSX-RNV Ram (the 3-wire serial EEPROM) where the Yoshbox / Teka settings are stored. Seeing as these values modify the fuel maps stored inECU flash ROM, we cannow reset them via OBD2so that any new mapsdeveloped are universal for all bikes with that ECU...

Here's a peek at what's in there:
https://docs.google.com/viewer?a=v&p...Njk5ZjkxNGJiNQ


Enjoy!!!



__________________


Senior Member

Status: Offline
Posts: 116
Date:
RE: 32920-35Fxx (16bit GSXR-750) ECU finally hacked...


Hi,

I will send you few ECUs from 1000 and 600 for readout and testing. We tried them without any luck in case of flashability so far. I hope you would use them well:) Will contact you via e-mail soon for the adress:)

__________________


Veteran Member

Status: Offline
Posts: 63
Date:

That would be great... Thanks Carry!!!



__________________


Veteran Member

Status: Offline
Posts: 63
Date:
GSXR 16bit ECU NV Ram format tool...


Hi guys,

Here's a little OBD2 (K-line) utility that will allow you to read or reset the ECU NV Ram (Yoshbox / Teka) settings to factory default...

Here's what the program looks like:

NVRam%20utility.jpg

You can download a copy here (instructions included):

https://sites.google.com/site/mrholl...ity%20v1.0.zip



Enjoy!!!



__________________


Veteran Member

Status: Offline
Posts: 63
Date:
GSXR 16bit ECU - Disabling STVA & STP FI errors...


Hi guys,

Currently working on the code for disabling the STVA & STP FI errors (thanks the amazing work done on the instrument cluster protocol by JoE over on TLZone).
Looking for anyone who's removed (or disconnected) their STVs and has a working OBD2(K-line) setup to help with testing...



__________________


Veteran Member

Status: Offline
Posts: 63
Date:
A better GSXR OBD adaptor...


Hi guys,

For those interested in building an OBD adaptor, I've just posted draft instructions on "Making a better K1-K3 GSXR OBD adaptor cable.doc". You can find a copy of the instructions here:

https://sites.google.com/site/mrholl...ader-utilities

I expect to have the final version uploaded later this week.

Here's a peek at what the interface looks like...

GSXR%2016bit%20K-Line%20better%20%28OBD2%29%20adaptor.jpg

Enjoy!!!



__________________


Veteran Member

Status: Offline
Posts: 63
Date:
An in-harness 16bit GSXR OBD adaptor...


Successfully completed prototype testing yesterday on an in-harness OBD adaptor that would remain permanently connected to your ECU. This would allow for running bootloader utilities or the Flash Tool without having to remove the ECU. The design uses key switches to avoid accidental closing of the switches during normal operation and does not require cutting into the harness in any way.

Not sure whether this will work on the GSX-R 600 because the STCU uses the same K-line pin as the VAG-COM OBD2 interface.

Here's a sneak peek:

In-harness%20OBD%20adaptor.jpg



__________________


Veteran Member

Status: Offline
Posts: 63
Date:
K1-K3 16bit GSXR ECU reflashing / hacking


Hi guys,

Here's a pic of the in-harness OBD hookup for reflashing:

In%20harness%20OBD2.JPG

I've also started testing of a WiFi interface:

WiFi%20OBD.JPG

Cheers!!!



__________________


Newbie

Status: Offline
Posts: 1
Date:
RE: 32920-35Fxx (16bit GSXR-750) ECU finally hacked...


Great work on this Mr H!

A quick question if I may. Is the K-Line in use during normal operation? IE, can it be used for datalogging purposes?

Background: I race a GSXR 750 SRAD EFI, and now coming up to the last batch of modifications which include engine tuning. I have de-potted the original SRAD ECU to find it to be none programmable and no separate socketable EPROM. At this point aftermarket ECM was the next logical thing, but nothing really fitted the bill for what I wanted. Either features, packaging or price wise. Now I had always considered an ECM swap, but the later gen stuff seemed a bit too much for my needs. The K1/2 fits perfectly. 20 gets an ECM, 30 gets another harness with the new connectors and I'm good to go!

The reason I'm asking about data streams is so I can pipe it into my DIY data logger. If I can grab everything without notching, great. Otherwise I will hardwire in the BDM port direct to the logger to access the RAM variables.

Regards

-Gavin

__________________


Veteran Member

Status: Offline
Posts: 63
Date:
2000-2003 GSXR (16bit) ECU...


Hi Gavin,

No, the K-Line is not used during normal operation (except on the 600s that use it to control the STCU). Getting the ECU to transmit OBD2 engine & sensor status is one of the things on my development roadmap, but I haven't had much time to work on it this past season. Ideally, I'd like to use an ELM327 to transmit to a datalogger via WiFi.

You should bear in mind that not all the 2000-2003 ECUs are flashable and you can't tell which are, just by looking at them. You have to test the unit to find out.

Also, the engine won't run during BDM, so that won't be much use to you for datalogging. Feel free to drop me an email at mr_hollywood@cogeco.ca if you want to discuss further.

Regards,



__________________


Veteran Member

Status: Offline
Posts: 63
Date:
RomRaider corrupting ECU binary...


Hi guys,

For anyone using a recent version of RomRaider, I created the "RRcheck" utility to check for (and correct) "Static" declaration incompatibilities in XML files that cause the ECU binary file to become corrupted. You can find a copy here:

https://sites.google.com/site/mrhollywoodk3/home/ecu-definitions


And here's a pic:

RRcheck.jpg

Merry Christmas!!!



-- Edited by mr_hollywood on Monday 28th of December 2015 03:15:22 AM

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard