• ray ban uk
  • cheap jordan shoes
  • toms outlet
  • ray ban
  • cheap uggs
  • nike air max
  • ray ban outlet
  • fut coins
  • Christian Louboutin Outlet
  • louis vuitton outlet
  • ray ban
  • Custom iphone cases
  • LV
  • new balance
  • coach outlet
  • michael kors outlet
  • louis vuitton outlet
  • oakley sunglasses outlet
  • monster beats
  • nike
  • ray ban outlet
  • Ducati ECU Tuning Resources
    Ducati Monster Forum

    powered by:

    August 22, 2014, 01:36:07 PM *
    Welcome, Guest. Please login or register.

    Login with username, password and session length
    News: Notification Email Issues-No Registration with MSN network mail addresses
     
      Home   Forum   Help Search Login Register  




    Pages: 1 [2] 3 4   Go Down
      Print  
    Author Topic: Ducati ECU Tuning Resources  (Read 15567 times)
    accludetuner
    Jennifer Connelly's boobs give me a raging
    Full Member
    ***
    Offline Offline

    Posts: 190


    I AM NOT A MONSTER!


    WWW
    « Reply #15 on: September 22, 2011, 10:25:52 PM »

    I'm trying to find info on the distinct ECU "families." Like the sbk's are all in one "family" with the 996 being the one real oddball. Anyone have a good refernece on all the different families of duc ECUs?

    Also, anyone interested in helping with the site? Moderator or something like that? Maybe give some input on site setup before it goes live?
    Logged

    I can fit massive amounts of meat in my mouth!

    My 748/916/996/998 SBK parts for sale!
    Speeddog
    West Valley Flatlander
    Flounder-Administrator
    Hero Member
    *****
    Offline Offline

    Posts: 9720


    '02 MS4 . '98 M750 . '99 Cagiva G.C.


    « Reply #16 on: September 23, 2011, 08:00:51 AM »

    If you Google "ducati ecu models", you'll find some good info.

    Like this:

    http://www.ducati.ms/forums/11-ducati-motorcycle-chat/60175-model-ecu-list.html
    Logged

    - - - - - Valley Desmo Service - - - - -
    Reseda, CA

    (951) 640-8908

    "The problem with internet quotes is that you can't always depend on their accuracy" - Abraham Lincoln, 1864
    adduncan101
    New Member
    *
    Offline Offline

    Posts: 25



    « Reply #17 on: September 27, 2011, 08:40:48 AM »

    accludetuner,
    This is something I really loved about my sporty. There are not as many easy ECU mods for these scoots. There is a dude by the name of "Rico" on the XL Forum that is a wiz with the HD units, he helped me a ton. I have a Daytona TC88 module in the Sporty and it is easily programed with the TC88 software. There has to be an easy hack for the Ducs. Please let me know if I can help.
    Logged

    ----DC NATIVE----2010 M1100s, 2004 HD Sportster1200, 2001 VW GTI VR6
    CDawg
    Hero Member
    *****
    Offline Offline

    Posts: 1459

    S4RS


    « Reply #18 on: September 28, 2011, 05:54:22 AM »

    <bookmark>  popcorn
    Logged
    greenmonster
    Hero Member
    *****
    Offline Offline

    Posts: 772


    « Reply #19 on: September 29, 2011, 03:38:25 AM »

    Not much f free out there I think.
    Takes a lot of time & skill to crack ECU`s, maybe not surpricing few are giving the knowledge away.

    Here is one, though, f 1.6:
    http://ftp.pwp.att.net/w/a/wayneorwig/utils.html#ecuedit

    I think the best way of getting info is having something to share, info the tuners could use in exchange f their knowledge.
    You must also consider ECU tuning/modifying is a part of their business.
    « Last Edit: September 29, 2011, 03:40:06 AM by greenmonster » Logged

    accludetuner
    Jennifer Connelly's boobs give me a raging
    Full Member
    ***
    Offline Offline

    Posts: 190


    I AM NOT A MONSTER!


    WWW
    « Reply #20 on: October 04, 2011, 09:47:07 PM »

    Just a quick update for anyone curious....

    I've copied the stock 748 memcal to my laptop and have started dissecting it.

    I also have all the documentation for the MC68HC11 MCU that's within the 16M ECU (and I suspect many other Duc ECUs as well).

    I'm going through and picking apart the bin now and have made some very serious progress. I also found a very incomplete, yet functional XDF for the 16M ECUs (thanks for Desmo over at Speedzilla.com) to allow tuning through TunerPro which I am very familiar with and have used to tune several cars in the past. Using that XDF as a base and my bin file, I've found all the NECESSARY stuff to perform basic tuning on the 16M ECUs. I'm still working on finding other tables and options within the bin to allow for more advanced tuning and to figure out proper datalogging and emulation capabilities.

    The site is basically done, but I'm working on setting it up with all of the knowledge I currently have, as well as all the files, software, documentation, and other things that I have so that once it goes live, it's a great starting point for anyone interested in tuning themselves, or helping out with hacking the Ducs ECUs to expand the community.

    Keep in mind that I'm working on this in my spare time (which is not a lot right now) so it might take some time for me to fill up the site and post it live, but I'd rather it be a solid start that's organized and presentable than a terrible clusterF like most sites.

    Bottom line is that I'm already at a point that I can tune my own Duc with my own computer and since I had all of my old tuning stuff it cost me $0. Now I'm looking to expand the current DIY tuning possibilities for the 16M ECUs and to make the same tuning options available to all of the FI Ducs Smiley
    Logged

    I can fit massive amounts of meat in my mouth!

    My 748/916/996/998 SBK parts for sale!
    accludetuner
    Jennifer Connelly's boobs give me a raging
    Full Member
    ***
    Offline Offline

    Posts: 190


    I AM NOT A MONSTER!


    WWW
    « Reply #21 on: October 05, 2011, 12:25:44 AM »

    Also,

    IF THIS CODE:

    Code:
    A8B0 15 22 10        LA8B0 bclr L0022, #%00010000
    A8B3 13 20 04 15      brclr L0020, #%00000100, LA8CC
    A8B7 14 20 0C        bset L0020, #%00001100
    A8BA 14 0B 10        bset TMR_OCR1d, #%00010000
    A8BD DC 0E            ldD L000E
    A8BF FD 20 E2        stD L20E2
    A8C2 F3 01 B5        addD L01B5
    A8C5 DD 1C            stD TMR_OCR3d
    A8C7 15 20 04        bclr L0020, #%00000100
    A8CA 20 2A            jr LA8F6
    ;
    A8CC B6 01 73        LA8CC ldaA L0173
    A8CF F6 01 C3        ldaB L01C3
    A8D2 3D              mul
    A8D3 8F              xgDX
    A8D4 B6 01 74        ldaA L0174
    A8D7 F6 01 C3        ldaB L01C3
    A8DA 3D              mul
    A8DB 89 20            adcA #$20
    A8DD 16              tAB
    A8DE 3A              aBX
    A8DF 8F              xgDX
    A8E0 FD 01 A7        stD L01A7
    A8E3 F3 20 E4        addD L20E4
    A8E6 DD 1C            stD TMR_OCR3d
    A8E8 DC 0E            ldD L000E
    A8EA B3 20 E4        subD L20E4
    A8ED 1A B3 01 A7      cmpD L01A7
    A8F1 25 03            bcs LA8F6
    A8F3 14 0B 10        bset TMR_OCR1d, #%00010000
    A8F6 7F 01 6F        LA8F6 clr L016F
    A8F9 FC 01 73        ldD L0173
    A8FC FD 01 76        stD L0176
    A8FF B6 01 72        ldaA L0172
    A902 B7 01 75        staA L0175
    A905 B6 20 EA        ldaA L20EA
    A908 B1 01 3C        cmpA L013C
    A90B 26 18            bne LA925
    A90D 14 AC 08        bset L00AC, #%00001000
    A910 13 20 20 06      brclr L0020, #%00100000, LA91A
    A914 15 20 10        bclr L0020, #%00010000
    A917 14 0B 20        bset TMR_OCR1d, #%00100000
    A91A 15 B0 40        LA91A bclr L00B0, #%01000000
    A91D 15 AA 10        bclr L00AA, #%00010000
    A920 BD B5 B8        call LB5B8
    A923 20 1B            jr LA940
    ;

    makes any sense to you, then I could certainly use your help reverse engineering this thing. There's about 8 thousands lines of code to go through and doing it in my spare time will take forever. Plus I've tuned cars before, but that was using existing bin files and existing definitions. This is my first time digging down to the assembly level to make it happen. I've got a decent grip on it, but I'm very slow and have to do a lot of research as I go. Some help commenting out the disassembled file would certainly speed things up!!!
    Logged

    I can fit massive amounts of meat in my mouth!

    My 748/916/996/998 SBK parts for sale!
    CDawg
    Hero Member
    *****
    Offline Offline

    Posts: 1459

    S4RS


    « Reply #22 on: October 05, 2011, 05:17:04 AM »

    Wow!  Cool progress.  Sorry I cannot help as I have no relevant skills.
    Logged
    nicholasv
    New Member
    *
    Offline Offline

    Posts: 39


    « Reply #23 on: December 30, 2011, 11:41:19 PM »

    So I have started to get interested in this as well.  Seems there just isn't any info on hacking the Ducati ECU like in the auto world.

    From looking at Ducatidiag and learning a little bit about the OBD protocols, it looks like its just a matter or learning what Standard PID's are supported on the various ECUs (like RPM, and temp) and what proprietary Magnetti-Marelli or Ducati specific PID's are needed to access everything else.

    I am assuming that Ducatidiag writer is also using OBD to flash the ECU, reset the immobilizer, etc.

    I have mixed feelings about paying €100 for the writer software.  I kinda feel like that should be shared openly (at least the protocol / PIDs etc) and maybe one should ask for a donation for upkeep and development of the software.

    Anyway, I might spend some time on an Android app to do some of this.  Your site would be a great place to share infomation about all this.
    Logged
    HotIce
    Hero Member
    *****
    Online Online

    Posts: 585


    « Reply #24 on: January 01, 2012, 10:11:37 AM »

    I hope you like hacking because the time of doing that starting from zero will account for far more than hundred bucks.
    Unless Syneject M3C ECU sheets will leak (I failed in finding any traces), you have to start from zero.
    First, you have to understand the protocol used to read/write image files within the ECU. Could be KWP2K/ISO, but you don't know.
    If you have something which is already able to read/write, you have to sniff the transaction (serial, CAN, K-line, ... - depending of the HW interface of the tool you have) and see the traffic which is going on.
    This will likely include some sort of "authentication" between the tester and the ECU, probably based on some "seed" passed by the ECU to the tester.
    Once you understand the protocol to read/write, you might want to be very successful in reading the existing images and writing them back, unless you want to run over many bricked ECUs.
    Once you are able to do that, you are at 1/3 of the way.
    Then the joy starts, and you have to be able to reverse engineer the image file, understand what zones are code, and what zones are maps.
    And the maps, there is more than one, so you have to understand which one controls what. You are going to be looking at a very wild Monster otherwise.
    When you are perfectly able to understand which maps are for what, you need to have something which allows you to extract them and edit them easily (as they are a few thousand values arrays).
    Final part, you have to reverse engineer the checksum used by the ECU to validate the image file.

    Or, you can bribe some Chinese/Taiwanese at Synerject and get the specs  Grin

    http://www.synerject.com/contacts.html
    « Last Edit: January 01, 2012, 10:14:41 AM by HotIce » Logged
    HotIce
    Hero Member
    *****
    Online Online

    Posts: 585


    « Reply #25 on: January 01, 2012, 10:29:33 AM »

    Also,

    IF THIS CODE:

    Code:
    A8B0 15 22 10        LA8B0 bclr L0022, #%00010000
    A8B3 13 20 04 15     brclr L0020, #%00000100, LA8CC
    A8B7 14 20 0C         bset L0020, #%00001100
    A8BA 14 0B 10         bset TMR_OCR1d, #%00010000
    A8BD DC 0E           ldD L000E
    A8BF FD 20 E2         stD L20E2
    A8C2 F3 01 B5         addD L01B5
    A8C5 DD 1C           stD TMR_OCR3d
    A8C7 15 20 04         bclr L0020, #%00000100
    A8CA 20 2A           jr LA8F6
    ;
    A8CC B6 01 73        LA8CC ldaA L0173
    A8CF F6 01 C3         ldaB L01C3
    A8D2 3D               mul
    A8D3 8F               xgDX
    A8D4 B6 01 74         ldaA L0174
    A8D7 F6 01 C3         ldaB L01C3
    A8DA 3D               mul
    A8DB 89 20           adcA #$20
    A8DD 16               tAB
    A8DE 3A               aBX
    A8DF 8F               xgDX
    A8E0 FD 01 A7         stD L01A7
    A8E3 F3 20 E4         addD L20E4
    A8E6 DD 1C           stD TMR_OCR3d
    A8E8 DC 0E           ldD L000E
    A8EA B3 20 E4         subD L20E4
    A8ED 1A B3 01 A7     cmpD L01A7
    A8F1 25 03           bcs LA8F6
    A8F3 14 0B 10         bset TMR_OCR1d, #%00010000
    A8F6 7F 01 6F        LA8F6 clr L016F
    A8F9 FC 01 73         ldD L0173
    A8FC FD 01 76         stD L0176
    A8FF B6 01 72         ldaA L0172
    A902 B7 01 75         staA L0175
    A905 B6 20 EA         ldaA L20EA
    A908 B1 01 3C         cmpA L013C
    A90B 26 18           bne LA925
    A90D 14 AC 08         bset L00AC, #%00001000
    A910 13 20 20 06     brclr L0020, #%00100000, LA91A
    A914 15 20 10         bclr L0020, #%00010000
    A917 14 0B 20         bset TMR_OCR1d, #%00100000
    A91A 15 B0 40        LA91A bclr L00B0, #%01000000
    A91D 15 AA 10         bclr L00AA, #%00010000
    A920 BD B5 B8         call LB5B8
    A923 20 1B           jr LA940
    ;

    makes any sense to you, then I could certainly use your help reverse engineering this thing. There's about 8 thousands lines of code to go through and doing it in my spare time will take forever. Plus I've tuned cars before, but that was using existing bin files and existing definitions. This is my first time digging down to the assembly level to make it happen. I've got a decent grip on it, but I'm very slow and have to do a lot of research as I go. Some help commenting out the disassembled file would certainly speed things up!!!

    Here's the S12X manual, which should be is the main CPU within the M3C ECU:

    http://www.freescale.com/files/microcontrollers/doc/ref_manual/S12XCPUV1.pdf

    « Last Edit: January 01, 2012, 01:29:10 PM by HotIce » Logged
    accludetuner
    Jennifer Connelly's boobs give me a raging
    Full Member
    ***
    Offline Offline

    Posts: 190


    I AM NOT A MONSTER!


    WWW
    « Reply #26 on: January 01, 2012, 03:04:49 PM »

    I hope you like hacking because the time of doing that starting from zero will account for far more than hundred bucks.
    Unless Syneject M3C ECU sheets will leak (I failed in finding any traces), you have to start from zero.
    First, you have to understand the protocol used to read/write image files within the ECU. Could be KWP2K/ISO, but you don't know.
    If you have something which is already able to read/write, you have to sniff the transaction (serial, CAN, K-line, ... - depending of the HW interface of the tool you have) and see the traffic which is going on.
    This will likely include some sort of "authentication" between the tester and the ECU, probably based on some "seed" passed by the ECU to the tester.
    Once you understand the protocol to read/write, you might want to be very successful in reading the existing images and writing them back, unless you want to run over many bricked ECUs.
    Once you are able to do that, you are at 1/3 of the way.
    Then the joy starts, and you have to be able to reverse engineer the image file, understand what zones are code, and what zones are maps.
    And the maps, there is more than one, so you have to understand which one controls what. You are going to be looking at a very wild Monster otherwise.
    When you are perfectly able to understand which maps are for what, you need to have something which allows you to extract them and edit them easily (as they are a few thousand values arrays).
    Final part, you have to reverse engineer the checksum used by the ECU to validate the image file.

    Or, you can bribe some Chinese/Taiwanese at Synerject and get the specs  Grin

    http://www.synerject.com/contacts.html



    ALL good info and that's the point of the site......to get a COMMUNITY EFFORT in making all of this stuff work.



    I don't have anything on M3C's but does this give you an idea of what I'm working with for my 16M from my 748?

    From the full 8k lines of assembly code I posted above, I was able to figure out enough to make a definition file for use with TunerPro. The bin has no checksum so I got lucky with that. Here's my VERY BASIC, yet functional bin file being edited in action It's FAR from complete, but it is to a point that you can tune with it Smiley





    Here's the same table thrown into a spreadsheet and a chart made for it:





    And this is both of the charts side by side. The spreadsheet is primitive but it's the same data and there are several ways to manipulate it:


    « Last Edit: January 01, 2012, 03:12:18 PM by accludetuner » Logged

    I can fit massive amounts of meat in my mouth!

    My 748/916/996/998 SBK parts for sale!
    HotIce
    Hero Member
    *****
    Online Online

    Posts: 585


    « Reply #27 on: January 01, 2012, 03:16:36 PM »

    Did you try to upload your map?
    Because, that's where the check-sum comes into place. It seems really strange that any firmware of that kind, allows you to drop an image into Flash/EPROM without any kind of validation. If not for anti-tempering, only for simple data verification.
    Just to be clear, check-sum is not encryption, but validation, so the fact you can look at clear-text data does not mean that you will be able to push your edited image into the ECU (without compiling the proper check-sum field into the image file).

    Logged
    accludetuner
    Jennifer Connelly's boobs give me a raging
    Full Member
    ***
    Offline Offline

    Posts: 190


    I AM NOT A MONSTER!


    WWW
    « Reply #28 on: January 01, 2012, 03:20:54 PM »

    I have burned the stock bin to another chip, re-read that new chip to the computer, and then compared it against the original bin file and there were no conflicts. That's telling me no checksum. Again, this is for my 10+ year old ECU and the newer ones may be (and probably are) different.
    Logged

    I can fit massive amounts of meat in my mouth!

    My 748/916/996/998 SBK parts for sale!
    nicholasv
    New Member
    *
    Offline Offline

    Posts: 39


    « Reply #29 on: January 01, 2012, 03:33:22 PM »

    So right now I am most interested in the last generation, IAW5AM.

    It looks like from tools (DucatiDiag, TuneECU, TuneBoy, Rexx ECU)
    reading and writing the flash can be done via OBD commands.

    I am very curious if anyone knows how these guys (especially the free tools) figured out what OBD PIDs and formats to use for various things.

    From what I can tell from DucatiDiag, the MM IAW uses a proprietary mode 21 for most of the behavior.
    So besides just trying every number you can and trying to reverse engineer things, I am hoping there is something quicker.  
    Logged
    Pages: 1 [2] 3 4   Go Up
      Print  
     
    Jump to:  


    Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2013, Simple Machines Valid XHTML 1.0! Valid CSS!
    SimplePortal 2.1.1