pcmhacking.net

Tazzi wrote:OoOoOoOooo.. ebay specials arrived!
BA FPV ecu. Will grab a read shortly.

Rolls, is there something I can do to help with the DMR? Is there any application which uses DMR?

I can get a list of all DMRs for my PCM without too much work then I can use heuristics to determine a list for all PCMs as the RAM layout is very similar. Will use a similar method to how we are generating memory address templates for the editor. Another lurker on here is helping me out massively with that task, he has probably spent about a month on it so far and we have almost all strategies (BA/BF/FG) complete.

Anyway sorry for the ramble but to answer your question regarding help, not really at this stage. Just try and do as much dumb stuff with the tool and see if you can break it (or a PCM lol), that will be the most help.

Some more details about the editor application.

Basically we are generating one master template with all parameters defined (up to ~6000 parameters currently) and then parsing the assembly to generate a text diff to another strategy, from that you can build a new definition without any manual work. We will do the same thing with the DMRs. This process is achievable due to the assembly being similar enough you can determine with reasonably high accuracy where a table is in a completely different strategy. Pretty fun stuff and I believe what will differentiate this product from others on the market. Most of the other guys do it manually by hand which is error prone (just look at all the errors in HPT and EFI live) and extremely laborious which == money.

If we perfect this we should be able to map a single strategy per vehicle class, eg BA, BF, FG or the equivalent for other manafacturers. I then get all of the stock calibrations from Ford etc (eg I have literally every PHF file), pump them into the tool and voila you now have 2000 strategies mapped in a few minutes (minus the time it took to write the tool!)

I want to have as good (if not better) datalogging as SCT, as good parameter/map support as Sniper and a better editor package than them all. Couple this with map tracing and complete parameter/map/DMR support for every BA/BF/FG ford made and the product should be better than anything else on the market for these cars.

On another topic I've decided I will monetize this product due to the massive amount of hours we are putting into it (only 1 other guy helping atm) however I will still have a free version. I'm still debating how to do this and I'm definitely open to suggestions, especially from tuners or people who use software like this on a daily basis.

My thoughts are to keep the editor package free with flash read/write and a "demo" strategy per vehicle. Eg if you download the free version you can flash read/write, edit base fuel map, ignition tables, gear ratios and other basic stuff that you would do to a stock car, will include DMRs for all of these free items as well. If you want full parameter/table support you can purchase a definition for your vehicle, this will allow VIN change and there will be nothing stopping you from flashing this same strategy onto 100 cars if you desire. If you were a tuner you'd probably end up purchasing a few as there will be differences between manual/auto etc. If you want full data logging support you can buy this with the definition at the same time. Map tracing will be another add-on. If I ever do live tuning that will probably be fairly expensive as it will be a massive undertaking.

Hopefully this keeps the tool basically free for backyarders, also means I have no obligation to support it (support takes up a lot of time!). If you are a backyarder and don't want to purchase anything you can use the free XML definition support to map the binary yourself and do whatever you want with it.

The one other thing I'm not sure about is copy protection, I hate it and as we are all hackers we love to try and break it so I want to use a release model that doesn't require much protection. Most likely all I will do is encrypt the full purchasable definitions with individual user details. I'm not fussed if people share their definition with their mates or forum buddies but want to avoid wide spread sharing/giving away. If I encrypt with full name and address people will be less inclined to put it up on a torrent site etc.

People will obviously be able to reverse the definitions by reading the binary back out of their car if they desire, I'm not sure I can really prevent that so I hope that any pricing I come up with people think is fair and people will be happy to pay if they want them. If not then that is fine as well.

Posting another PM up if anyone wants to give this a go.

80gus wrote:I will write something that can build a .BIN file from these at some stage. Maybe then someone can catagorise the PHF files and make a list of what is manual, turbo etc. Be easy enough to automate but is near the bottom of my list of things to do.

Rolls im sure i could handle this. let us know when and how ill get it done.

I have a basic PHF to BIN tool that I wrote however it just null pads the missing sections. If you want a challenge write something that finds a full tune with the same OS and copies the missing sections out, it then builds a full BIN file with no null padding. Bonus if it works properly with all oak types. I've got extremely dodgy hard coded ranges in there currently which you could fix up.

Source code for my existing one that you can fork is here, I just checked in all the libraries so it should compile out of the box. It also includes a plugin library so you could easily extend it to work with other file types.
https://github.com/rolandh/PHF2BIN

rolls wrote: Anyway sorry for the ramble but to answer your question regarding help, not really at this stage. Just try and do as much dumb stuff with the tool and see if you can break it (or a PCM lol), that will be the most help.

Challenge accepted!

well I've bricked two PCM's now, a BA turbo and an FG.. The BA was probably due to me trying to log the write, but the FG one was by the book and had the exact same error. I have to stop talking to Rolls via the fordmods PM as most of the time I get an nginx error.. so either their web server setup is borked or they use nginx as a reverse proxy and that is borked. (I didn't get your last PM rolls)

In answer to your question Rolls.. no, pretty sure I have the continuous and ignition worked out ok.

I got sick of using alligator clips last week and put this together:



I have a second OBD2 port from a FG loom that I'm about to wire in for sniffing purposes.. but basically the pin (screw) over to the right is hooked to the FEPS voltage so I can just clip a multimeter to it as I have in the photo.. over the other side is the Can listener (I have it working with wireshark presently but looking at some other options on Linux at the moment as my spare laptop has Fedora on it.) The can listener unplugs from it's block plug and it makes no difference to anything if it's in or out.. but it also self terminates the can bus with 120 ohms so if anything my signal should be cleaner than you guys for that alone. I have two other pins beside that that are hooked to can hi and low and I plan to use them much later to hook in things like spare ICC's and BCM's It has a 120 ohm resister on it, but it's not connected as the listener doesn't need one.

The switches on the front are hooked up such that the red light is continuous feeds and the green is ignition. The voltage readout is on the reads the voltage on the ign line. Everything on that pin out you sent that was on an IGN feed was hooked to the big red wire leading to the PCM and all the continuous feeds on the Yellow....
I've got a second PCM plug here with all three on it and a much longer lead so I will wire that one in shortly. will double check everything then but when I do a read it asks me to turn off and on too.. and it reads fine so I 'd be surprised if it turned out I was turning off the wrong feed.

oh, forgot, I also have a 12 volt UPS battery hooked in so even if the power fluctuates here it shouldn't cause issues. Also the can wiring I've extended I've done using twisted pair straight from a 50 metre roll of Cat5e I scored from work.

Did you try the new version with recovery mode that I sent out last night? Sounds like it is failing after the erase for some reason with the Mongoose, I suspect it adds an extra packet or something that the OpenPort doesn't and hence I detect a timeout. The new version dumps quite a bit more information when you get an error as well now.

I'm sure it isn't bricked just that your cable is responding differently to the OpenPort, once we figure that out I'll be able to patch it.

If you only had J2534 logging ticked I doubt that was why it failed. Most likely the same issue with both FG and BA.

edit: I emailed you my last PM last night so dw about it not working. So frustrating that other forum, you write up a big reply and it fucks it. Even more annoying when you see you have PMs but you can't read them!

MeZmeriZe wrote:well I've bricked two PCM's now, a BA turbo and an FG.. The BA was probably due to me trying to log the write, but the FG one was by the book and had the exact same error.

Tried using VCM yet?

Might need to get a separate CAN sniffer up and running.. and see exactly where it fails. Makes it easy to diagnose any issues such as what I was getting before without FEPs

Tazzi wrote:

MeZmeriZe wrote:well I've bricked two PCM's now, a BA turbo and an FG.. The BA was probably due to me trying to log the write, but the FG one was by the book and had the exact same error.

Tried using VCM yet?

Might need to get a separate CAN sniffer up and running.. and see exactly where it fails. Makes it easy to diagnose any issues such as what I was getting before without FEPs

Think he only has a Mongoose and a VCX which doesn't have FEPS

Either way should be able to figure it out, at least with the new version it'll say exactly what packet it sent last when it times out. Curious if it gets any reply at all, if it doesn't then it would be bricked but I have no idea how as I can't brick either of mine even when I'm trying to! Tried pulling power during erase and the flash write, writing all zeros, FF etc but no dice it won't die! Lol

Maybe the mongoose does something interesting with the packets when they are sent but not when it reads. Quite lost as to what it would be doing differently as the flash read works fine.

Curious, have you loaded the flash read in a binary editor? Is it actually read successfully, it isn't corrupted etc? I guess it didn't even write one single block successfully though so I doubt that is the issue.

BA FPV attached.

Had a couple issues with reading Rolls.. trying to recreate them. I believe the timeouts were a bit too quick and the ecu was a bit slow at responding at points which timed out the application.

I'll set the timeout to 5 seconds, currently they are about a second. BA seems to be about 5-10x slower than the BF which is interesting.

rolls wrote:I'll set the timeout to 5 seconds, currently they are about a second. BA seems to be about 5-10x slower than the BF which is interesting.

Perfect. Plenty of wiggle room for the BA that way.