Jump to content
LegacyGT.com

5EAT TCU Reverse Engineering


utc_pyro

Recommended Posts

  • Replies 610
  • Created
  • Last Reply

Top Posters In This Topic

roadie, i think i had a little ah ha moment. For the ID, it might be 410 because the hex values match to the link i shared

 

Yeah. I saw that the second byte at 410 was increasing while I accelerated.

Link to comment
Share on other sites

Hooked up a spare TCU to see what would happen on the canbus.

 

http://i.imgur.com/EwEI9vC.jpg?1

 

Didnt expect this, maybe something was wrong. Had to select "listen only" in settings instead of "active" as last time in the car. Will have to try "listen only" in the car to verify. Period=0 ?

 

http://i.imgur.com/AYTlNmV.png

Edited by roadie08
Link to comment
Share on other sites

Sick. Now im assuming we can edit anything we want on it now?

 

Not untill you fire up IDA or a hex editor and see if you can find anything. There are also online disassembaly programs that support this CPU if you don't want to deal with the cost or hassle of setting up IDA.

Link to comment
Share on other sites

Not untill you fire up IDA or a hex editor and see if you can find anything. There are also online disassembaly programs that support this CPU if you don't want to deal with the cost or hassle of setting up IDA.

 

which cpu is it so I know what im looking for. Im going toi see if I can find some hex editor that supports our cpu. so far I am able to open the files but from there i dont know since I know nothing when it comes to programing

Link to comment
Share on other sites

'05 USDM ROM is up thanks to the OP donors that bought the thing, ClimberD, and Sasha.

 

http://www.romraider.com/forum/viewtopic.php?f=40&t=13725&p=128168#p128168

 

Found some SSM commands BF, A0, A8, B0, B8.... and 81,83,27?

 

00026580 push lr

00026582 push R10

00026584 push R9

00026586 push R8

00026588 add3 R10, fp, #-0x2EF8

0002658C ldi8 R9, #0

0002658E ldi8 R8, #0

00026590 bl.s sub_266E8 || nop

00026594 ldub R0, @(4, R10)

00026598 ldi16 R1, #0xBF ; '+'

0002659C beq R0, R1, loc_265E0

000265A0 ldi16 R1, #0xA0 ; 'á'

000265A4 beq R0, R1, loc_265E0

000265A8 ldi16 R1, #0xA8 ; '¿'

000265AC beq R0, R1, loc_265E0

000265B0 ldi16 R1, #0xB0 ; '¦'

000265B4 beq R0, R1, loc_265E0

000265B8 ldi16 R1, #0xB8 ; '©'

000265BC beq R0, R1, loc_265E0

000265C0 ldi16 R1, #0x81 ; 'ü'

000265C4 beq R0, R1, loc_265E0

000265C8 ldi16 R1, #0x83 ; 'â'

000265CC beq R0, R1, loc_265E0

000265D0 ldi8 R1, #0x27 ; ''' || nop

000265D4 beq R0, R1, loc_265E0

000265D8 ldi8 R1, #0x10 || nop

000265DC bne R0, R1, loc_26680

Edited by roadie08
Link to comment
Share on other sites

which cpu is it so I know what im looking for. Im going toi see if I can find some hex editor that supports our cpu. so far I am able to open the files but from there i dont know since I know nothing when it comes to programing

 

m32r

Link to comment
Share on other sites

roadie, you have ubuntu on any of your computers? for the life of me i cannot try to disassemble the .bins into plain text so we can read them.

 

ive looked at this website which is an evo forum and they have already disassembled the code.

 

take a look for yourself and see

 

https://www.evolutionm.net/forums/ecuflash/564101-rom-disassembly-raw-text-file.html

Link to comment
Share on other sites

roadie, you have ubuntu on any of your computers? for the life of me i cannot try to disassemble the .bins into plain text so we can read them.

 

ive looked at this website which is an evo forum and they have already disassembled the code.

 

take a look for yourself and see

 

https://www.evolutionm.net/forums/ecuflash/564101-rom-disassembly-raw-text-file.html

 

Havent tried that, but onlinedissasembler will probably have similar output.

Link to comment
Share on other sites

One thing is that if we can identify where the unique address is for the rom we could use ecuflash and view some stuff in there

 

I think the ecuid is at 802A to 802E

 

0000802A .byte 0x91

0000802B .byte 0xFE

0000802C .byte 0x20

0000802D .byte 0x71

0000802E .byte 0

Edited by roadie08
Link to comment
Share on other sites

I think the ecuid is at 802A to 802E

 

0000802A .byte 0x91

0000802B .byte 0xFE

0000802C .byte 0x20

0000802D .byte 0x71

0000802E .byte 0

 

I dont think that worked but probably doing it wrong. see if you can use other tuners and get some data off it. Hopefully shooting for a some graph or editable fields

Link to comment
Share on other sites

Roadie: Are you digging into 91FE207100?

 

I have looked at the rom in winols demo but dont understand the table layout...

 

Also trying to connect directly to the mcu in bootmode but no luck yet.

Link to comment
Share on other sites

  • 3 weeks later...

Dont know if I get it into bootmode correctly.

 

Power on -> pull mod0 high -> pull reset low

 

Then reset should go high as in normal mode but it does not. I can pull it high but not sure if thats correct.

 

Any ideas?

Link to comment
Share on other sites

  • 1 month later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



×
×
  • Create New...

Important Information

Terms of Use