Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: CBR250R ECU performance Hack


Newbie

Status: Offline
Posts: 4
Date:
CBR250R ECU performance Hack


I am looking to hack CBR250R and i am new here.. hoping to get help.. thanks



__________________
SKD CBR Rider


Newbie

Status: Offline
Posts: 4
Date:

no one here to help ?? hmm bad

__________________
SKD CBR Rider


Senior Member

Status: Offline
Posts: 121
Date:

Well you need to try it on your own i guess...

__________________


Senior Member

Status: Offline
Posts: 196
Date:

 

  Most of the success on this board has been Suzuki and Kawasaki. If you can get a spare ECU for your bike maybe you could hack it yourself or contract RidgeRacer to give it a shot.

I am curious if the CR250 dirt bike ecu is at all the same. The dirt bike has a special programmer for it.

 Just remember the some ECU's are easier to hack than others.

 

Mark



__________________


Guru

Status: Offline
Posts: 964
Date:

Who manufactures the ECU?

Do you know what processor it is running?



__________________


Newbie

Status: Offline
Posts: 4
Date:

no idea.. have to check and is there a easy way to know



__________________
SKD CBR Rider


Guru

Status: Offline
Posts: 964
Date:

You need to pull the ECU out of the bike. It will have either a sticker or the makers name embossed in the plastic case. Denso is usually a sticker. Mitsubishi has their diamond emblem in the plastic. Keihin usually does both a sticker and their name in the plastic case.

__________________


Member

Status: Offline
Posts: 11
Date:

I just thought I might point out that your bike is carburetted and does not employ an ECU. It has an igniter unit that controls spark only and it is doubtful that there is an eeprom. In other words, I don't think you are going to realize any performance gain from what the members on this site have accomplished. Your best route for a performance upgrade for that model would be an aftermaket high flow exhaust and a carburetter jet kit.  



__________________


Member

Status: Offline
Posts: 7
Date:

Dear All Experts;

Here is Honda CBR250R Fi MCU:

ECU Part Number:
38770-KYJ-971
9019-100927

Producent: KEIHIN

Main MCU mark is:
DF3687FZV
H873687
AJ08985
1040

Its look like Renesas H8/300H Tiny

Sub MCU mark is:
KEIHIN
KT2012SA
036104

Its look like KEIHIN SPECIAL MCU.

I am interesting to read or write Flashing this ECU, but I have no tool for flach it.

Please advice me how to read/write flash memory this ecu!!!

__________________
Asep


Senior Member

Status: Offline
Posts: 350
Date:

Im currently also working on a Keihin ECU.
Have you cut open the ECU to look wich processor it is? Is marking above posted from processor? How many legs?

Also, throw up some photos of the ECU, both sides and connector.
But i can tell you right now there is no easy solution YET.... :)

__________________


Member

Status: Offline
Posts: 7
Date:

Hi Twice;

Yes of course I have done cut inside the ECU; MCU is Renesas H8/300H Tiny Family DF3687XXXFZV (but on renesas only show for DF3687XXXFZK only) its have 64 pins (4x16pins) and the KEIHIN MCU has 100 pins (4x25pins). I unsuccessfully uploading photos here.


__________________
Asep


Member

Status: Offline
Posts: 7
Date:

Additionally there are 10 TestPoint (TP1~TP10) direcly connected to 3687, Do you inetersted too mate?


__________________
Asep


Senior Member

Status: Offline
Posts: 350
Date:

Great, 64-pin. Also had problems finding chip on that numbers for a manual.
Mine had M16C MCU, so you might be in luck with the TuneECU if you have same type of ECU :)
Post up some pictures and send me some high res. and i will look into it for you.
Also had 10 TP on mine, though TP10 was all alone far away from the others on PCB.
Start with continuity trace on TP to MCU pins, so we can see if pinout is more like mine or like other Honda, mine is from Suzuki.

When posting, push quote or advanced editor, then you can "attach" image files.
Also if you could e-mail me the photos would be good since forum shrinks them a bit when uploading.

__________________


Member

Status: Offline
Posts: 7
Date:

Hi mate;

Here is pictures:
HONDA CBR250R KEIHIN ECU-INSIDE-TOP-VIEW
http://a4.sphotos.ak.fbcdn.net/hphotos-ak-ash3/s720x720/545721_2744317617456_1542974983_31892842_1060268017_n.jpg

HONDA CBR250R KEIHIN ECU-INSIDE-BOTTOM-VIEW
http://a5.sphotos.ak.fbcdn.net/hphotos-ak-ash3/s720x720/563495_2744372298823_1542974983_31892914_54684329_n.jpg


__________________
Asep


Member

Status: Offline
Posts: 7
Date:



TP1 ---> PIN9 ---> Vss of MCU 3687
TP2 ---> PIN46 ---> Txd of MCU 3687
TP3 ---> PIN3, 5, 6, 12 ---> AN7, X, VCL, Vcc of MCU 3687
TP4 ---> PIN45 ---> Rxd of MCU 3687
TP5 ---> PIN7 ---> RES of MCU 3687
TP6 ---> PIN14 ---> WKPI of MCU 3687
TP7 ---> PIN44 ---> SCK3 of MCU 3687
TP8 ---> PIN41 ---> P85 of MCU 3687
TP9 ---> PIN35 ---> NMI of MCU 3687
TP11 ---> Other diskrit circuit of 3687 (Undirrect connected to 3687)
TP12 ---> PIN1 of ECU


__________________
Asep


Senior Member

Status: Offline
Posts: 350
Date:

Damn, talk about scattered TP's. I at least had 9 in a row hehe :) Looks like TP is for serial, but double check with manual...

Closest i came to manual is this:
http://documentation.renesas.com/doc/products/mpumcu/rej09b0027_h83687.pdf

Looks like you are out of luck with backdoor like me, looks like you only got serial and parallel. And some kind of protection/login, but its nothing like mine.

So for a test, download TuneEcu and connect to k-line and se if you can connect and get any live data. I could not, but mine is completely different. So your might be more like Triumph etc.

Else its just to start reading the manual and searching for flashing tools. And find a way to bypass protection. Then you are in. :) hehe



__________________


Senior Member

Status: Offline
Posts: 350
Date:

Just checked, MCU is supported for FTDI cable via COM port. But read manual carefully before attempting to connect.
Some Renesas chip's ERASE themselfves when you connect to them, not sure for you chip... M32R/M16C etc. does NOT erase on connect.

So get cicrcuit for serial and to get it into boot mode properly. Then read up on how protection works before attempting to connect anything :)

__________________


Member

Status: Offline
Posts: 7
Date:

Hi Twice,

I read in HW manual, its micon boot mode supported trick too. the tool is BasicMicro what your advice?


__________________
Asep


Senior Member

Status: Offline
Posts: 350
Date:

Dont quite follow you now, from what i see you can probably use FTDI TTL cable and FDT for serial. And some other cable for parallel.

But, you need to figure out how protection works by reading manual and searching. Mine is not like yours. I have a "ID login" with a password.

But look in to you protection, might be easier to get around...
I also have a separate MCU that i think is from Keihin as the one you got, but cannot find documnetation for
any of ours so we are probably out of luck there too....



-- Edited by Twice on Friday 6th of April 2012 06:43:22 PM

__________________


Member

Status: Offline
Posts: 12
Date:

I am not sure if this link is of any help. http://www.renesasrulz.com/thread/3905

I have a similar ecu lying around. I thought they had a 32bit processor.



__________________


Senior Member

Status: Offline
Posts: 350
Date:

That thread suggests its just to put mcu in correct state and setting some pins, no real security?
When looking through the manual fast i think it suggested same thing. Worth a try, might be that easy :)

__________________


Member

Status: Offline
Posts: 7
Date:

HI TWICE

BACKUP CPU IS:
DF3687FZV
H873687
AJ08985
1040

PINS: 64 PINS

RENESAS MCU H8/300H Tiny 3687F FAMILY

MAIN MCU is:
KEIHIN
KT2012SA
036104

PINS: 100 PINS
TEST POINT CONNECTED TO BACKUP MCU 3687 HAVE CONNECTIONS:

TP1 --> Vss
TP2 --> TXD
TP3 --> VCC
TP4 --> RXD
TP5 --> RES
TP6 ---> WKP1
TP7 ---> SCK3
TP8 ---> P85
TP9 ---> NMI

IGNITION IGBT POWERED, FUEL INJECTOR, FUEL PUMP, MIL, SOLENOIDE, ALL POWERED BY KEIHIN KT2012SA CPU, AND ITS KEIHIN CPU HAVE COMMON TIMER BY 3687F CPU WITH 16.000 MHZ CRYSTAL.

AS CONNECTIONS FOLLOWS:

IGBT POWERED BY PIN 99
INJECTOR POWERED BY PIN 68,69,70

I am having E8a emulator from Renesas for emulat memory content of 3687F but Main memory is stored in KEIHIN CPU KT2012SA, do you have advice!!!!!!!!!!



__________________
Asep


Senior Member

Status: Offline
Posts: 350
Date:

Did you get the contents out of the ROM in H8 by debugging with E8a? Section 7 in manual? No map files in H8 ROM contents?
Since the TPīs go to H8 i would think that is the main processor, there is NO documentation for Keihin MCU, not the one in my ECU either...
So if they make their own we never will get that documentation (but they might just have rebranded them). But identify it will be a bitch in that case :)
What model year is the ECU for?

Send me an e-mail, so we can talk a bit.

__________________


Newbie

Status: Offline
Posts: 4
Date:

Y is it becomeing privet asking to send personal email ? do it here and help others too.. I already have a piggiback but prefer to directly do it.

 

Pin 5 is InJ ECU

Pin4 Is ACT

PIN 3 CKP

 



__________________
SKD CBR Rider
wan


Newbie

Status: Offline
Posts: 3
Date:

Hiii twice
Hello.
What are you can find pinout keihin kt2021kr.
Thank you

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard