Ducati ECU Tuning Resources

[accludetuner]

I'm trying to find info on the distinct ECU "families." Like the sbk's are all in one "family" with the 996 being the one real oddball. Anyone have a good refernece on all the different families of duc ECUs?

Also, anyone interested in helping with the site? Moderator or something like that? Maybe give some input on site setup before it goes live?

[Speeddog]

If you Google "ducati ecu models", you'll find some good info.

Like this:

http://www.ducati.ms/forums/11-ducati-motorcycle-chat/60175-model-ecu-list.html

[adduncan101]

accludetuner,
This is something I really loved about my sporty. There are not as many easy ECU mods for these scoots. There is a dude by the name of "Rico" on the XL Forum that is a wiz with the HD units, he helped me a ton. I have a Daytona TC88 module in the Sporty and it is easily programed with the TC88 software. There has to be an easy hack for the Ducs. Please let me know if I can help.

[CDawg]

<bookmark> 

[greenmonster]

Not much f free out there I think.
Takes a lot of time & skill to crack ECU`s, maybe not surpricing few are giving the knowledge away.

Here is one, though, f 1.6:
http://ftp.pwp.att.net/w/a/wayneorwig/utils.html#ecuedit

I think the best way of getting info is having something to share, info the tuners could use in exchange f their knowledge.
You must also consider ECU tuning/modifying is a part of their business.

[accludetuner]

Just a quick update for anyone curious....

I've copied the stock 748 memcal to my laptop and have started dissecting it.

I also have all the documentation for the MC68HC11 MCU that's within the 16M ECU (and I suspect many other Duc ECUs as well).

I'm going through and picking apart the bin now and have made some very serious progress. I also found a very incomplete, yet functional XDF for the 16M ECUs (thanks for Desmo over at Speedzilla.com) to allow tuning through TunerPro which I am very familiar with and have used to tune several cars in the past. Using that XDF as a base and my bin file, I've found all the NECESSARY stuff to perform basic tuning on the 16M ECUs. I'm still working on finding other tables and options within the bin to allow for more advanced tuning and to figure out proper datalogging and emulation capabilities.

The site is basically done, but I'm working on setting it up with all of the knowledge I currently have, as well as all the files, software, documentation, and other things that I have so that once it goes live, it's a great starting point for anyone interested in tuning themselves, or helping out with hacking the Ducs ECUs to expand the community.

Keep in mind that I'm working on this in my spare time (which is not a lot right now) so it might take some time for me to fill up the site and post it live, but I'd rather it be a solid start that's organized and presentable than a terrible clusterF like most sites.

Bottom line is that I'm already at a point that I can tune my own Duc with my own computer and since I had all of my old tuning stuff it cost me $0. Now I'm looking to expand the current DIY tuning possibilities for the 16M ECUs and to make the same tuning options available to all of the FI Ducs

[accludetuner]

Also,

IF THIS CODE:

Code:

A8B0 15 22 10        LA8B0 bclr L0022, #%00010000
A8B3 13 20 04 15      brclr L0020, #%00000100, LA8CC
A8B7 14 20 0C        bset L0020, #%00001100
A8BA 14 0B 10        bset TMR_OCR1d, #%00010000
A8BD DC 0E            ldD L000E
A8BF FD 20 E2        stD L20E2
A8C2 F3 01 B5        addD L01B5
A8C5 DD 1C            stD TMR_OCR3d
A8C7 15 20 04        bclr L0020, #%00000100
A8CA 20 2A            jr LA8F6
;
A8CC B6 01 73        LA8CC ldaA L0173
A8CF F6 01 C3        ldaB L01C3
A8D2 3D              mul
A8D3 8F              xgDX
A8D4 B6 01 74        ldaA L0174
A8D7 F6 01 C3        ldaB L01C3
A8DA 3D              mul
A8DB 89 20            adcA #$20
A8DD 16              tAB
A8DE 3A              aBX
A8DF 8F              xgDX
A8E0 FD 01 A7        stD L01A7
A8E3 F3 20 E4        addD L20E4
A8E6 DD 1C            stD TMR_OCR3d
A8E8 DC 0E            ldD L000E
A8EA B3 20 E4        subD L20E4
A8ED 1A B3 01 A7      cmpD L01A7
A8F1 25 03            bcs LA8F6
A8F3 14 0B 10        bset TMR_OCR1d, #%00010000
A8F6 7F 01 6F        LA8F6 clr L016F
A8F9 FC 01 73        ldD L0173
A8FC FD 01 76        stD L0176
A8FF B6 01 72        ldaA L0172
A902 B7 01 75        staA L0175
A905 B6 20 EA        ldaA L20EA
A908 B1 01 3C        cmpA L013C
A90B 26 18            bne LA925
A90D 14 AC 08        bset L00AC, #%00001000
A910 13 20 20 06      brclr L0020, #%00100000, LA91A
A914 15 20 10        bclr L0020, #%00010000
A917 14 0B 20        bset TMR_OCR1d, #%00100000
A91A 15 B0 40        LA91A bclr L00B0, #%01000000
A91D 15 AA 10        bclr L00AA, #%00010000
A920 BD B5 B8        call LB5B8
A923 20 1B            jr LA940
;

makes any sense to you, then I could certainly use your help reverse engineering this thing. There's about 8 thousands lines of code to go through and doing it in my spare time will take forever. Plus I've tuned cars before, but that was using existing bin files and existing definitions. This is my first time digging down to the assembly level to make it happen. I've got a decent grip on it, but I'm very slow and have to do a lot of research as I go. Some help commenting out the disassembled file would certainly speed things up!!!

[CDawg]

Wow!  Cool progress.  Sorry I cannot help as I have no relevant skills.

[nicholasv]

So I have started to get interested in this as well.  Seems there just isn't any info on hacking the Ducati ECU like in the auto world.

From looking at Ducatidiag and learning a little bit about the OBD protocols, it looks like its just a matter or learning what Standard PID's are supported on the various ECUs (like RPM, and temp) and what proprietary Magnetti-Marelli or Ducati specific PID's are needed to access everything else.

I am assuming that Ducatidiag writer is also using OBD to flash the ECU, reset the immobilizer, etc.

I have mixed feelings about paying €100 for the writer software.  I kinda feel like that should be shared openly (at least the protocol / PIDs etc) and maybe one should ask for a donation for upkeep and development of the software.

Anyway, I might spend some time on an Android app to do some of this.  Your site would be a great place to share infomation about all this.

[HotIce]

I hope you like hacking because the time of doing that starting from zero will account for far more than hundred bucks.
Unless Syneject M3C ECU sheets will leak (I failed in finding any traces), you have to start from zero.
First, you have to understand the protocol used to read/write image files within the ECU. Could be KWP2K/ISO, but you don't know.
If you have something which is already able to read/write, you have to sniff the transaction (serial, CAN, K-line, ... - depending of the HW interface of the tool you have) and see the traffic which is going on.
This will likely include some sort of "authentication" between the tester and the ECU, probably based on some "seed" passed by the ECU to the tester.
Once you understand the protocol to read/write, you might want to be very successful in reading the existing images and writing them back, unless you want to run over many bricked ECUs.
Once you are able to do that, you are at 1/3 of the way.
Then the joy starts, and you have to be able to reverse engineer the image file, understand what zones are code, and what zones are maps.
And the maps, there is more than one, so you have to understand which one controls what. You are going to be looking at a very wild Monster otherwise.
When you are perfectly able to understand which maps are for what, you need to have something which allows you to extract them and edit them easily (as they are a few thousand values arrays).
Final part, you have to reverse engineer the checksum used by the ECU to validate the image file.

Or, you can bribe some Chinese/Taiwanese at Synerject and get the specs  

http://www.synerject.com/contacts.html

[HotIce]

Also,

IF THIS CODE:

Code:

A8B0 15 22 10        LA8B0 bclr L0022, #%00010000
A8B3 13 20 04 15     brclr L0020, #%00000100, LA8CC
A8B7 14 20 0C         bset L0020, #%00001100
A8BA 14 0B 10         bset TMR_OCR1d, #%00010000
A8BD DC 0E           ldD L000E
A8BF FD 20 E2         stD L20E2
A8C2 F3 01 B5         addD L01B5
A8C5 DD 1C           stD TMR_OCR3d
A8C7 15 20 04         bclr L0020, #%00000100
A8CA 20 2A           jr LA8F6
;
A8CC B6 01 73        LA8CC ldaA L0173
A8CF F6 01 C3         ldaB L01C3
A8D2 3D               mul
A8D3 8F               xgDX
A8D4 B6 01 74         ldaA L0174
A8D7 F6 01 C3         ldaB L01C3
A8DA 3D               mul
A8DB 89 20           adcA #$20
A8DD 16               tAB
A8DE 3A               aBX
A8DF 8F               xgDX
A8E0 FD 01 A7         stD L01A7
A8E3 F3 20 E4         addD L20E4
A8E6 DD 1C           stD TMR_OCR3d
A8E8 DC 0E           ldD L000E
A8EA B3 20 E4         subD L20E4
A8ED 1A B3 01 A7     cmpD L01A7
A8F1 25 03           bcs LA8F6
A8F3 14 0B 10         bset TMR_OCR1d, #%00010000
A8F6 7F 01 6F        LA8F6 clr L016F
A8F9 FC 01 73         ldD L0173
A8FC FD 01 76         stD L0176
A8FF B6 01 72         ldaA L0172
A902 B7 01 75         staA L0175
A905 B6 20 EA         ldaA L20EA
A908 B1 01 3C         cmpA L013C
A90B 26 18           bne LA925
A90D 14 AC 08         bset L00AC, #%00001000
A910 13 20 20 06     brclr L0020, #%00100000, LA91A
A914 15 20 10         bclr L0020, #%00010000
A917 14 0B 20         bset TMR_OCR1d, #%00100000
A91A 15 B0 40        LA91A bclr L00B0, #%01000000
A91D 15 AA 10         bclr L00AA, #%00010000
A920 BD B5 B8         call LB5B8
A923 20 1B           jr LA940
;

makes any sense to you, then I could certainly use your help reverse engineering this thing. There's about 8 thousands lines of code to go through and doing it in my spare time will take forever. Plus I've tuned cars before, but that was using existing bin files and existing definitions. This is my first time digging down to the assembly level to make it happen. I've got a decent grip on it, but I'm very slow and have to do a lot of research as I go. Some help commenting out the disassembled file would certainly speed things up!!!

Here's the S12X manual, which should be is the main CPU within the M3C ECU:

http://www.freescale.com/files/microcontrollers/doc/ref_manual/S12XCPUV1.pdf

[accludetuner]

I hope you like hacking because the time of doing that starting from zero will account for far more than hundred bucks.
Unless Syneject M3C ECU sheets will leak (I failed in finding any traces), you have to start from zero.
First, you have to understand the protocol used to read/write image files within the ECU. Could be KWP2K/ISO, but you don't know.
If you have something which is already able to read/write, you have to sniff the transaction (serial, CAN, K-line, ... - depending of the HW interface of the tool you have) and see the traffic which is going on.
This will likely include some sort of "authentication" between the tester and the ECU, probably based on some "seed" passed by the ECU to the tester.
Once you understand the protocol to read/write, you might want to be very successful in reading the existing images and writing them back, unless you want to run over many bricked ECUs.
Once you are able to do that, you are at 1/3 of the way.
Then the joy starts, and you have to be able to reverse engineer the image file, understand what zones are code, and what zones are maps.
And the maps, there is more than one, so you have to understand which one controls what. You are going to be looking at a very wild Monster otherwise.
When you are perfectly able to understand which maps are for what, you need to have something which allows you to extract them and edit them easily (as they are a few thousand values arrays).
Final part, you have to reverse engineer the checksum used by the ECU to validate the image file.

Or, you can bribe some Chinese/Taiwanese at Synerject and get the specs 

http://www.synerject.com/contacts.html

ALL good info and that's the point of the site......to get a COMMUNITY EFFORT in making all of this stuff work.



I don't have anything on M3C's but does this give you an idea of what I'm working with for my 16M from my 748?

From the full 8k lines of assembly code I posted above, I was able to figure out enough to make a definition file for use with TunerPro. The bin has no checksum so I got lucky with that. Here's my VERY BASIC, yet functional bin file being edited in action It's FAR from complete, but it is to a point that you can tune with it





Here's the same table thrown into a spreadsheet and a chart made for it:





And this is both of the charts side by side. The spreadsheet is primitive but it's the same data and there are several ways to manipulate it:

[HotIce]

Did you try to upload your map?
Because, that's where the check-sum comes into place. It seems really strange that any firmware of that kind, allows you to drop an image into Flash/EPROM without any kind of validation. If not for anti-tempering, only for simple data verification.
Just to be clear, check-sum is not encryption, but validation, so the fact you can look at clear-text data does not mean that you will be able to push your edited image into the ECU (without compiling the proper check-sum field into the image file).

[accludetuner]

I have burned the stock bin to another chip, re-read that new chip to the computer, and then compared it against the original bin file and there were no conflicts. That's telling me no checksum. Again, this is for my 10+ year old ECU and the newer ones may be (and probably are) different.

[nicholasv]

So right now I am most interested in the last generation, IAW5AM.

It looks like from tools (DucatiDiag, TuneECU, TuneBoy, Rexx ECU)
reading and writing the flash can be done via OBD commands.

I am very curious if anyone knows how these guys (especially the free tools) figured out what OBD PIDs and formats to use for various things.

From what I can tell from DucatiDiag, the MM IAW uses a proprietary mode 21 for most of the behavior.
So besides just trying every number you can and trying to reverse engineer things, I am hoping there is something quicker.