Members Login
Username 
 
Password 
    Remember Me  
ECU hacking -> ECU hacking -> CBR250R ECU performance Hack
Post Info TOPIC: CBR250R ECU performance Hack
saikamaldoss


Newbie

Status: Offline
Posts: 4
Date:
CBR250R ECU performance Hack
Permalink  

I am looking to hack CBR250R and i am new here.. hoping to get help.. thanks



__________________
SKD CBR Rider
saikamaldoss


Newbie

Status: Offline
Posts: 4
Date:
Permalink  

no one here to help ?? hmm bad

__________________
SKD CBR Rider
Carry


Senior Member

Status: Offline
Posts: 121
Date:
Permalink  

Well you need to try it on your own i guess...

__________________
Busa Quick


Senior Member

Status: Offline
Posts: 196
Date:
Permalink  

 

  Most of the success on this board has been Suzuki and Kawasaki. If you can get a spare ECU for your bike maybe you could hack it yourself or contract RidgeRacer to give it a shot.

I am curious if the CR250 dirt bike ecu is at all the same. The dirt bike has a special programmer for it.

 Just remember the some ECU's are easier to hack than others.

 

Mark



__________________
RidgeRacer


Guru

Status: Offline
Posts: 964
Date:
Permalink  

Who manufactures the ECU?

Do you know what processor it is running?



__________________
saikamaldoss


Newbie

Status: Offline
Posts: 4
Date:
Permalink  

no idea.. have to check and is there a easy way to know



__________________
SKD CBR Rider
RidgeRacer


Guru

Status: Offline
Posts: 964
Date:
Permalink  

You need to pull the ECU out of the bike. It will have either a sticker or the makers name embossed in the plastic case. Denso is usually a sticker. Mitsubishi has their diamond emblem in the plastic. Keihin usually does both a sticker and their name in the plastic case.

__________________
Stuntman180


Member

Status: Offline
Posts: 11
Date:
Permalink  

I just thought I might point out that your bike is carburetted and does not employ an ECU. It has an igniter unit that controls spark only and it is doubtful that there is an eeprom. In other words, I don't think you are going to realize any performance gain from what the members on this site have accomplished. Your best route for a performance upgrade for that model would be an aftermaket high flow exhaust and a carburetter jet kit.  



__________________
asep0078


Member

Status: Offline
Posts: 7
Date:
Permalink  

Dear All Experts;

Here is Honda CBR250R Fi MCU:

ECU Part Number:
38770-KYJ-971
9019-100927

Producent: KEIHIN

Main MCU mark is:
DF3687FZV
H873687
AJ08985
1040

Its look like Renesas H8/300H Tiny

Sub MCU mark is:
KEIHIN
KT2012SA
036104

Its look like KEIHIN SPECIAL MCU.

I am interesting to read or write Flashing this ECU, but I have no tool for flach it.

Please advice me how to read/write flash memory this ecu!!!

__________________
Asep
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

Im currently also working on a Keihin ECU.
Have you cut open the ECU to look wich processor it is? Is marking above posted from processor? How many legs?

Also, throw up some photos of the ECU, both sides and connector.
But i can tell you right now there is no easy solution YET.... :)

__________________
asep0078


Member

Status: Offline
Posts: 7
Date:
Permalink  

Hi Twice;

Yes of course I have done cut inside the ECU; MCU is Renesas H8/300H Tiny Family DF3687XXXFZV (but on renesas only show for DF3687XXXFZK only) its have 64 pins (4x16pins) and the KEIHIN MCU has 100 pins (4x25pins). I unsuccessfully uploading photos here.


__________________
Asep
asep0078


Member

Status: Offline
Posts: 7
Date:
Permalink  

Additionally there are 10 TestPoint (TP1~TP10) direcly connected to 3687, Do you inetersted too mate?


__________________
Asep
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

Great, 64-pin. Also had problems finding chip on that numbers for a manual.
Mine had M16C MCU, so you might be in luck with the TuneECU if you have same type of ECU :)
Post up some pictures and send me some high res. and i will look into it for you.
Also had 10 TP on mine, though TP10 was all alone far away from the others on PCB.
Start with continuity trace on TP to MCU pins, so we can see if pinout is more like mine or like other Honda, mine is from Suzuki.

When posting, push quote or advanced editor, then you can "attach" image files.
Also if you could e-mail me the photos would be good since forum shrinks them a bit when uploading.

__________________
asep0078


Member

Status: Offline
Posts: 7
Date:
Permalink  

Hi mate;

Here is pictures:
HONDA CBR250R KEIHIN ECU-INSIDE-TOP-VIEW
http://a4.sphotos.ak.fbcdn.net/hphotos-ak-ash3/s720x720/545721_2744317617456_1542974983_31892842_1060268017_n.jpg

HONDA CBR250R KEIHIN ECU-INSIDE-BOTTOM-VIEW
http://a5.sphotos.ak.fbcdn.net/hphotos-ak-ash3/s720x720/563495_2744372298823_1542974983_31892914_54684329_n.jpg


__________________
Asep
asep0078


Member

Status: Offline
Posts: 7
Date:
Permalink  



TP1 ---> PIN9 ---> Vss of MCU 3687
TP2 ---> PIN46 ---> Txd of MCU 3687
TP3 ---> PIN3, 5, 6, 12 ---> AN7, X, VCL, Vcc of MCU 3687
TP4 ---> PIN45 ---> Rxd of MCU 3687
TP5 ---> PIN7 ---> RES of MCU 3687
TP6 ---> PIN14 ---> WKPI of MCU 3687
TP7 ---> PIN44 ---> SCK3 of MCU 3687
TP8 ---> PIN41 ---> P85 of MCU 3687
TP9 ---> PIN35 ---> NMI of MCU 3687
TP11 ---> Other diskrit circuit of 3687 (Undirrect connected to 3687)
TP12 ---> PIN1 of ECU


__________________
Asep
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

Damn, talk about scattered TP's. I at least had 9 in a row hehe :) Looks like TP is for serial, but double check with manual...

Closest i came to manual is this:
http://documentation.renesas.com/doc/products/mpumcu/rej09b0027_h83687.pdf

Looks like you are out of luck with backdoor like me, looks like you only got serial and parallel. And some kind of protection/login, but its nothing like mine.

So for a test, download TuneEcu and connect to k-line and se if you can connect and get any live data. I could not, but mine is completely different. So your might be more like Triumph etc.

Else its just to start reading the manual and searching for flashing tools. And find a way to bypass protection. Then you are in. :) hehe



__________________
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

Just checked, MCU is supported for FTDI cable via COM port. But read manual carefully before attempting to connect.
Some Renesas chip's ERASE themselfves when you connect to them, not sure for you chip... M32R/M16C etc. does NOT erase on connect.

So get cicrcuit for serial and to get it into boot mode properly. Then read up on how protection works before attempting to connect anything :)

__________________
asep0078


Member

Status: Offline
Posts: 7
Date:
Permalink  

Hi Twice,

I read in HW manual, its micon boot mode supported trick too. the tool is BasicMicro what your advice?


__________________
Asep
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

Dont quite follow you now, from what i see you can probably use FTDI TTL cable and FDT for serial. And some other cable for parallel.

But, you need to figure out how protection works by reading manual and searching. Mine is not like yours. I have a "ID login" with a password.

But look in to you protection, might be easier to get around...
I also have a separate MCU that i think is from Keihin as the one you got, but cannot find documnetation for
any of ours so we are probably out of luck there too....



-- Edited by Twice on Friday 6th of April 2012 06:43:22 PM

__________________
jay woo


Member

Status: Offline
Posts: 12
Date:
Permalink  

I am not sure if this link is of any help. http://www.renesasrulz.com/thread/3905

I have a similar ecu lying around. I thought they had a 32bit processor.



__________________
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

That thread suggests its just to put mcu in correct state and setting some pins, no real security?
When looking through the manual fast i think it suggested same thing. Worth a try, might be that easy :)

__________________
asep0078


Member

Status: Offline
Posts: 7
Date:
Permalink  

HI TWICE

BACKUP CPU IS:
DF3687FZV
H873687
AJ08985
1040

PINS: 64 PINS

RENESAS MCU H8/300H Tiny 3687F FAMILY

MAIN MCU is:
KEIHIN
KT2012SA
036104

PINS: 100 PINS
TEST POINT CONNECTED TO BACKUP MCU 3687 HAVE CONNECTIONS:

TP1 --> Vss
TP2 --> TXD
TP3 --> VCC
TP4 --> RXD
TP5 --> RES
TP6 ---> WKP1
TP7 ---> SCK3
TP8 ---> P85
TP9 ---> NMI

IGNITION IGBT POWERED, FUEL INJECTOR, FUEL PUMP, MIL, SOLENOIDE, ALL POWERED BY KEIHIN KT2012SA CPU, AND ITS KEIHIN CPU HAVE COMMON TIMER BY 3687F CPU WITH 16.000 MHZ CRYSTAL.

AS CONNECTIONS FOLLOWS:

IGBT POWERED BY PIN 99
INJECTOR POWERED BY PIN 68,69,70

I am having E8a emulator from Renesas for emulat memory content of 3687F but Main memory is stored in KEIHIN CPU KT2012SA, do you have advice!!!!!!!!!!



__________________
Asep
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

Did you get the contents out of the ROM in H8 by debugging with E8a? Section 7 in manual? No map files in H8 ROM contents?
Since the TPīs go to H8 i would think that is the main processor, there is NO documentation for Keihin MCU, not the one in my ECU either...
So if they make their own we never will get that documentation (but they might just have rebranded them). But identify it will be a bitch in that case :)
What model year is the ECU for?

Send me an e-mail, so we can talk a bit.

__________________
saikamaldoss


Newbie

Status: Offline
Posts: 4
Date:
Permalink  

Y is it becomeing privet asking to send personal email ? do it here and help others too.. I already have a piggiback but prefer to directly do it.

 

Pin 5 is InJ ECU

Pin4 Is ACT

PIN 3 CKP

 



__________________
SKD CBR Rider
wan


Member

Status: Offline
Posts: 5
Date:
Permalink  

Hiii twice
Hello.
What are you can find pinout keihin kt2021kr.
Thank you

__________________
jpauloguino


Newbie

Status: Offline
Posts: 1
Date:
Permalink  


Can anyone read the cbr250 file? could you pass me which software did it? In Brazil we have bi-fuel bikes that Tipi's software doesn't read. They use ecu Keihin KT2021KR. Can someone help me?

__________________
wan


Member

Status: Offline
Posts: 5
Date:
Permalink  

Hello. 

Same. my mcu is kt2021 kr.  The problem of keihin mcu is not have datasheet on internet. But if you next time know it please inform to me. 

Thank you. 


-- Edited by wan on Friday 11th of October 2019 05:29:14 AM



-- Edited by wan on Friday 11th of October 2019 06:23:55 AM

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.
ECU hacking -> ECU hacking -> CBR250R ECU performance Hack
Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse 		Powered by ActiveBoard