ECUFlash XML Definitions & Stuff

Hey Guys,

I thought I’d start this thread as a bit of a brain dump of what I’ve been working on for the last few months (with a big help from Steve - TME_Steve). Basically I got sick of seeing the same crap VR4 EcuFlash Defs, so I’ve gone to the effort of disassembling the VR4 ROM.

First and foremost - my disassembly is very much based on assumption. It's by no means accurate - but I’m hoping with the greater VR4 community, i can get my disassembly more accurate. I've probably got over 40% disassembled, with more each day (when i can).

I've created some (better) defs, and hoping to cater for all VR4 Roms (7201 is the white elephant here as I’m yet to even look at it in depth - so this applies to all H8 based roms). At the moment, I’m trying to get vr4base correct with all the tables that exist in the VR4 rom, then I’ll go back to try fixing the 238100x based ROMs (Steve has indicated that the addresses are out for the axis - so I’ll start disassembly on that once i finish the 2003001* roms)

What I present to the VR4 community is my version of definitions (work that I’ve done so far). I must admit that i took the current version of defs that are going around, cleaned it up, and then corrected/confirmed them with the actual disassembly. I'm hoping for feedback in this thread (names, wether tables are working), and i will correct the definitions and republish the new version so at any point everyone can access the latest versions. I will also post my findings in this thread, as I’ve found a lot of little things that might be handy for everyone (what the various MUT locations are - plus an EvoScan XML file for you to have fun with, what unused Pins on the ECU can be used as input/outputs)

I know there has already been a lot of work, and I will say that I’ve taken parts of what’s already been done. So it's difficult to give credit to everyone that has worked on this already.

Having said that, a few people that I’d like to thank so far:

• Steve (TME_Steve/shtiv) - His wealth of information has been invaluable to know what’s going on.
• Kenneth - Bits and pieces that Kenneth has given me has helped me a little bit to disassemble.
• Ceddy – Info he’s posted on his Evo work has also helped with disassembly.

This has taken me at least 2-3 months to get where I am. It's a very time consuming process. I ask in return to give credit where credit is due. If you find what I post useful, a donation of sorts will help/motivate me to spend time on it. I've come to the point of giving up a few times but due to the love of giving something to the community has kept me going.

Enjoy & look forward to hearing from everyone with what they think.

Cheers,
Bill

PS. By using these defintions and information, I accept no responsibility for any damage (blown motor, bricked ecu, death/injury, etc) or costs incurred (fines, defects, void insurance, cost for repairs, etc) in relation to this definitions. They are provided as-is, and by downloading and using them, you are accepting all responsibility.

Download Link: Here
Instruction Manual: Here (work in progress! so very incomplete)

*Check header in XML files for build date/time!


Version 1.0 - Initial release

• vr4base is the only file i'm working on at the moment. 2381000* based roms might have incorrect addresses. this will be fixed eventually.
• Dont touch leanspool. If you want it enabled, let me know and i'll work on it. Just dont change any values in those tables... or enable the periphery bit for it.

<reserved for future use>

If they help, here's some more defs that have been put into the public domain;

• 7201 ROM - VR-4
• 7202 ROM - 6A13 SOHC

Hope these help :thumbsup:

If you have the time, I think you'd be doing a bigger favour to the community to disassemble the 7201 ROMs as well, they're still pretty common (at least here in the UK) and now we are able to remap them (either reflashing them with MMCFlash or reprogramming the flash by desoldering) it would make sense to nail down a solid definition for that instead :)

I'm not sure if it's this simple, but if you're able to disassemble the Kernel Bootloader for the 7201 to permit reflashing with EcuFlash, you'd be doing an even greater favour to us all ;)

I probably couldnt take the flash kernel from another ROM, as the flashing process is different for each processor... i hope that there will be a new version of ECUFlash one that will support it.

As for the 7201 defs, leave it with me... i'm having a look though a couple of roms now and have found a few things just in a hex editor.

I'll see what i can put together.

Things i've learnt so far about it, while the ROM layout is different, i believe (like the super H) the same original source code was compiled as tables, axis, etc look the same.

Dont quote me, only difference if oyu want to start looking through it with a hex editor is bit order. H8/SuperH is Big Endian, 7201 appears to be Small.

Hi Bill,
Cheers for the Definitions
Have used to flash my 2001 legnum's fuel, timing and WGDC.
Thanks a heap
Ben

Quote:

---

Originally Posted by BCX

Dont quote me, only difference if oyu want to start looking through it with a hex editor is bit order.

---

Sorry I felt the need to quote you :P

I think that the table scales got a rework between the 7201 and 7202 roms - they certainly don't appear to be identical byte for byte (still undiscovered). Apart from that I also came to the conclusion that it was near identical code recompiled for different target hardware.

Hi Rich,

What do you mean when you refer to table scales as being still undiscovered?

Cheers

Quote:

---

Originally Posted by kinkyafro

Sorry I felt the need to quote you :P

I think that the table scales got a rework between the 7201 and 7202 roms - they certainly don't appear to be identical byte for byte (still undiscovered). Apart from that I also came to the conclusion that it was near identical code recompiled for different target hardware.

---

Quote:

---

Originally Posted by pbaron

Hi Rich,

What do you mean when you refer to table scales as being still undiscovered?

Cheers

---

Hi Pierre,

On the 7202 the table scales are defined and identified in the ROM e.g. the ignition maps have scales for load and RPM. On the 7202 you can adjust the load scale (which is useful as theres only one value for loads above 200). So we know what the scale values are from the 7202 default values but can't adjust them as we don't know where they are in the ROM.

Rich, these were identified in my version of the 7201 def and I have adjusted them successfully for the fuel and ignition load scales.

Have you not had a look at the work I did soon after you published you bare bones def? Or are you talking about something else entirely.

Quote:

---

Originally Posted by kinkyafro

Hi Pierre,

On the 7202 the table scales are defined and identified in the ROM e.g. the ignition maps have scales for load and RPM. On the 7202 you can adjust the load scale (which is useful as theres only one value for loads above 200). So we know what the scale values are from the 7202 default values but can't adjust them as we don't know where they are in the ROM.

---

oops ignore me then think I'll be having a proper look at them soon as that's worthy of a map tweak.