Reading a ROM image.

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
User avatar
DieselBob
Posts: 169
Joined: Sun Mar 28, 2010 7:43 am
cars: Isuzu DMax
Alfa Romeo Guilletta
Location: NSW

Reading a ROM image.

Post by DieselBob »

Looking for a tool.
Or a direction.

Have an Alfa 147 that I want to change the City(auto) shift points.
(Youngest is about to get their P's)

Looked on goggle and it listed various tuning packages, they are all finished products.
I prefer a homebrew solution with exposed wiring and the ability to add functionality.

I need to dump the ROM file and run it through IDAPro.

So looking for a GitHub type solution....
Or any info thats around...

If there isn't 1 and i can get enough information.. Who knows where it'll end.
User avatar
AngelMarc
Posts: 612
Joined: Sat Apr 08, 2023 11:23 am
cars: A CB450 running to 8,000RPM with a P59.

Re: Reading a ROM image.

Post by AngelMarc »

I always like suggesting the DIY approach for the most open and customizable. Been working on scratch built ECU code with help from ChatGPT. I keep breaking things when I go to test it though.
Don't stress specific units.
User avatar
NSFW
Posts: 802
Joined: Fri Feb 02, 2018 5:13 am

Re: Reading a ROM image.

Post by NSFW »

If no open-source solution exists, there are a couple directions to explore. You'll likely need both, eventually:

1) open up the ECU, identify the chips that are inside. You might be able to read and write the flash chip using JTAG or BDM or similar. This is probably the quickest route to a working tuning tool. But opening up the ECU is cumbersome...

2) find out what OBD protocol the ECU uses, and find a way to monitor the bus while someone flashes it using a dealer tool, or an aftermarket tuning tool. Then try to figure out what all of the messages mean. Knowing what CPU and flash chip are in the ECU will help with some aspects of this.
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
User avatar
antus
Site Admin
Posts: 10014
Joined: Sat Feb 28, 2009 10:34 am
cars: TX Gemini 2L Twincam 8psi
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Subaru WRX 2007

Re: Reading a ROM image.

Post by antus »

Do you know what type of a PCM it is? I am seeing hits on Bosch PCMs on ebay and one of the stickers has a number that starts with ME73 and searching on that I find sites like https://ecuconnection.co.uk/product/alf ... -xx-bosch/

Probably software like Kess or Ktag will support it, so first step would be buy another one cheap on ebay, then identify the PCM type specifically, and then if its supported by something like Kess get one of those to read it and post the bin up.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
darkman5001
Posts: 275
Joined: Fri Dec 17, 2021 10:15 pm
cars: 2005 Yukon, 2004 Suburban, 2001 Tahoe, 2002 Envoy, 2006 Envoy, 2003 Lincoln LS
Location: New Jersey, USA

Re: Reading a ROM image.

Post by darkman5001 »

antus wrote: Sun Nov 02, 2025 10:18 pm Do you know what type of a PCM it is? I am seeing hits on Bosch PCMs on ebay and one of the stickers has a number that starts with ME73 and searching on that I find sites like https://ecuconnection.co.uk/product/alf ... -xx-bosch/

Probably software like Kess or Ktag will support it, so first step would be buy another one cheap on ebay, then identify the PCM type specifically, and then if its supported by something like Kess get one of those to read it and post the bin up.
Pretty Interesting. That ECU in that Ebay link is also the E55 which is used in certain GM cars such as the Cadillac CTS and the Buick Lacross. From my experience they seem to be problematic ECUs. One of my customers has a 2005 Buick Lacross with 3.6L. I put a remanufactured E55 in it a few years back because it had in injector circuit failure within the module. Fast forward to this month and the same car is back for the same issue. Got a junk yard E55 from a 2005 Cadillac CTS with a 3.6L and I have been having weird issues with it like most of the time it doesn't want to communicate. I managed to reprogram it for the car it was going into using a "certain program", and programming ended up being successful. Rebooted and it was back to not talking again. Also, MIL circuit on the unit appears to be bad as well. MIL works with old module, but not with this one. Just seems to be a very problematic unit. It seems that there are other cars other than GM using this ECU. But in a GM, it is known as the E55.
User avatar
delcowizzid
Posts: 5709
Joined: Sat Feb 28, 2009 10:38 am
Yahoo Messenger: [email protected]
Location: Wellington NZ

Re: Reading a ROM image.

Post by delcowizzid »

Yeah they don't like heat and vibration and it's bolted to an engine lol same with holden abs modules that are constructed the same way and lose comms and tie up the data bus lok
If Its Got Gas Or Ass Count Me In.if it cant be fixed with a hammer you have an electrical problem
User avatar
DieselBob
Posts: 169
Joined: Sun Mar 28, 2010 7:43 am
cars: Isuzu DMax
Alfa Romeo Guilletta
Location: NSW

Re: Reading a ROM image.

Post by DieselBob »

The ECU is a magneti marelli.
CFC208F.18,
Need to keep it for the car.
In the process of finding something to open and ID the Processor.
Have MultiECU for normal diagnostic.
Haven't sniffed that yet.
Only really decided to do this on the weekend.

In the middle of Reversing an old earthmoving EPROM for a friend that works for the company and wants to understand how the operating code works.
So burning the candle at both ends.
Appreciate the advice..
Will update as it progresses.
User avatar
antus
Site Admin
Posts: 10014
Joined: Sat Feb 28, 2009 10:34 am
cars: TX Gemini 2L Twincam 8psi
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Subaru WRX 2007

Re: Reading a ROM image.

Post by antus »

Im not finding tuneing / flash software but I am finding CFC208F seems to be the main identifier and its called a "Marelli SELESPEED CFC208F"
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396