NC specific EcuFlash development
03-15-2018, 06:08 PM
#1
Newb
Thread Starter
Join Date: Mar 2018
Posts: 3
Total Cats: 13
NC specific EcuFlash development
Hmm. I was one of the first people with an OFT for the NC. You're right, it has been 5 years... but Shiv never delivered on his promise for the NC. Also good luck doing anything meaningful with the supplied definition as they are incomplete to say the least. BTW, there are no racerom-like features offered for the NC OFT.
Originally this effort was destined for the OFT because I got tired of the tuner BS and wanted to DIY. That said, in time it became clear that Shiv basically abandoned the NC. My OFT even bricked itself during an update. So yeah, that just pushed everything to a whole new level of annoyed. Anyway... I spent 4 years systematically working thru the disassembly, and coming to grips with the OEM logic.
OFT 2013 NC LFLPEB Definition
Above is the OFT definition delivered sans the APP folder which was added when Shiv discovered those addresses. It was NEVER updated. It contains a whooping 26 tables, everything else is undefined.
ROMDROP 2013 NC LFLPEB Definition (and it's not even the latest)
Those are just the category folders. Within each are multitudes of defined tables. It totals well over 1500+ defined parameters. Does anyone need access to all of that? Nope... but it's there. I put insane work into this and IMO it's just not comparable.
Anywho, I'm posting here because Afx mention this forum as a spot for DIYers... so figured I'd show my face and say 'ello!
Reply
13
13
03-20-2018, 01:26 PM
#3
Newb
Join Date: Aug 2017
Location: Tampa, FL
Posts: 12
Total Cats: 2
This is so overwhelmingly needed. I haven't had a running car in 4 months thanks to EcuTek tuners on the NC platform. When do you think this will be available? And forgive my ignorance, but what would be needed outside of the cable?
Reply
1
1
03-20-2018, 01:30 PM
#4
Hmm. I was one of the first people with an OFT for the NC. You're right, it has been 5 years... but Shiv never delivered on his promise for the NC. Also good luck doing anything meaningful with the supplied definition as they are incomplete to say the least. BTW, there are no racerom-like features offered for the NC OFT.
Originally this effort was destined for the OFT because I got tired of the tuner BS and wanted to DIY. That said, in time it became clear that Shiv basically abandoned the NC. My OFT even bricked itself during an update. So yeah, that just pushed everything to a whole new level of annoyed. Anyway... I spent 4 years systematically working thru the disassembly, and coming to grips with the OEM logic.
OFT 2013 NC LFLPEB Definition
[IMG]http://codemotiv.s3.amazonaws.com/OFT_Romraider.png[IMG]
Above is the OFT definition delivered sans the APP folder which was added when Shiv discovered those addresses. It was NEVER updated. It contains a whooping 26 tables, everything else is undefined.
ROMDROP 2013 NC LFLPEB Definition (and it's not even the latest)
[IMG]http://codemotiv.s3.amazonaws.com/rd_ecuflash.jpg[IMG]
Those are just the category folders. Within each are multitudes of defined tables. It totals well over 1500+ defined parameters. Does anyone need access to all of that? Nope... but it's there. I put insane work into this and IMO it's just not comparable.
Anywho, I'm posting here because Afx mention this forum as a spot for DIYers... so figured I'd show my face and say 'ello!
Originally this effort was destined for the OFT because I got tired of the tuner BS and wanted to DIY. That said, in time it became clear that Shiv basically abandoned the NC. My OFT even bricked itself during an update. So yeah, that just pushed everything to a whole new level of annoyed. Anyway... I spent 4 years systematically working thru the disassembly, and coming to grips with the OEM logic.
OFT 2013 NC LFLPEB Definition
[IMG]http://codemotiv.s3.amazonaws.com/OFT_Romraider.png[IMG]
Above is the OFT definition delivered sans the APP folder which was added when Shiv discovered those addresses. It was NEVER updated. It contains a whooping 26 tables, everything else is undefined.
ROMDROP 2013 NC LFLPEB Definition (and it's not even the latest)
[IMG]http://codemotiv.s3.amazonaws.com/rd_ecuflash.jpg[IMG]
Those are just the category folders. Within each are multitudes of defined tables. It totals well over 1500+ defined parameters. Does anyone need access to all of that? Nope... but it's there. I put insane work into this and IMO it's just not comparable.
Anywho, I'm posting here because Afx mention this forum as a spot for DIYers... so figured I'd show my face and say 'ello!
Reply
0
0
03-21-2018, 02:39 AM
#7
Newb
Thread Starter
Join Date: Mar 2018
Posts: 3
Total Cats: 13
Here's a copy/paste from the other forum...
Definitions have been built for the following calibration IDs:
L831ED
LF4XEE
LF4XEG
LF9VEB
LFDJEA
LFG1ER
LFG3EN
LFGMEE
LFLMED
LFLPEB
LFLPEC
LFLXEC
LFMAEB
LFN5EN
LFZZEA
If you do not see your calibration listed, you will have to submit your factory ROM so it can be analyzed and a new definition built. Encrypted ROMs from EcuTek and MazdaEdit will not work. If you find yourself in that boat but are interested in the app, you'll have to flash back to bone stock. You can read the factory ROM using ROMDrop along with a Tactrix Openport, or you can do so with an OFT. Granted, all of this is a little premature as there is no submission email or dropbox yet (working on that).
In any case, I'll keep this short for the time being... just remember, the idea of this entire project is about being open and communal. No faux secret sauce nonsense. If you don't want to openly share info with the community, then don't look at the definitions... period.
Anyway... if anyone wants a peek at things, look here..
https://github.com/speepsio/romdrop
The definitions are built for EcuFlash. Again, full instructions will be provided a bit later tho I'm sure most can figure it out. This is pre-release beta level software. So far it's been solid; however, any of the definitions might contain errors that could result in all sorts of ugliness... so keep that in mind. Any odd values, or anything that just seems off.. don't hesitate to report it.
Anyway, I'll chip away at a starter cheat sheet.. and once there a bit more organization, maybe all of it can get thrown into a new release thread. That said, if you are a bit more adventurous... then one could technically get their feet wet right now.
L831ED
LF4XEE
LF4XEG
LF9VEB
LFDJEA
LFG1ER
LFG3EN
LFGMEE
LFLMED
LFLPEB
LFLPEC
LFLXEC
LFMAEB
LFN5EN
LFZZEA
If you do not see your calibration listed, you will have to submit your factory ROM so it can be analyzed and a new definition built. Encrypted ROMs from EcuTek and MazdaEdit will not work. If you find yourself in that boat but are interested in the app, you'll have to flash back to bone stock. You can read the factory ROM using ROMDrop along with a Tactrix Openport, or you can do so with an OFT. Granted, all of this is a little premature as there is no submission email or dropbox yet (working on that).
In any case, I'll keep this short for the time being... just remember, the idea of this entire project is about being open and communal. No faux secret sauce nonsense. If you don't want to openly share info with the community, then don't look at the definitions... period.
Anyway... if anyone wants a peek at things, look here..
https://github.com/speepsio/romdrop
The definitions are built for EcuFlash. Again, full instructions will be provided a bit later tho I'm sure most can figure it out. This is pre-release beta level software. So far it's been solid; however, any of the definitions might contain errors that could result in all sorts of ugliness... so keep that in mind. Any odd values, or anything that just seems off.. don't hesitate to report it.
Anyway, I'll chip away at a starter cheat sheet.. and once there a bit more organization, maybe all of it can get thrown into a new release thread. That said, if you are a bit more adventurous... then one could technically get their feet wet right now.
Reply
0
0
03-26-2018, 01:22 PM
#11
Junior Member
Join Date: Sep 2015
Location: Memphis, TN
Posts: 199
Total Cats: 31
Also, if you'd like to start tinkering: https://github.com/speepsio
Last edited by albuquerquefx; 03-26-2018 at 09:58 PM. Reason: Linkage to new thread!
Reply
0
0
03-26-2018, 04:13 PM
#13
Junior Member
Join Date: Sep 2015
Location: Memphis, TN
Posts: 199
Total Cats: 31
Here is my stock ROM you can tinker with... For clarity, the Tactrix cable is only needed if you're going to interact with the ECU. The software itself does not require the cable, even during installation.
Reply
1
1
03-27-2018, 11:35 AM
#14
Junior Member
Join Date: Sep 2015
Location: Memphis, TN
Posts: 199
Total Cats: 31
I had a question from someone in PM, and thought others would get some benefit from the answer...
Since Speeps is out on vacation with the fam, I'm gonna come in here and cram a bunch of words into his mouth while he can't defend himself 
j/k
The work is functionally complete; easily 90%+ of the data elements are identified and understood. If you download my sample OE ROM file above and mess with it, you'll find there are a few specific categories and/or individual elements inside other known categories which contain "WIP" in the name. These elements are in some form of not-completely-understood state. For these examples, the dimensions of the map / table / element are known, but not always the logic or scaling behind the data. As such, you're still technically able to modify the data, but there may be no good understanding of the outcome.
You'll also see there are some tables which are flagged as "DISABLED", "DO NOT MODIFY", "ZEROES" or "ONES". These are variations on a similar theme: the ECU logic provides for functionality which Mazda elected to either completely disable in code, to treat as purely static related to unique code pointers, or just filled with static content to make it irrelevant. The truly disabled elements don't matter, but the other three element types should really be left alone unless you feel you have a great reason to get touchy feely.
There is also the remote possibility one axis got the wrong scale formula applied, or perhaps a bad label was put on a table that didn't get caught. If you stumble into a table that just doesn't look quite right, post something to Speeps so he can take a look. Through some trial and error, we've found a few mislabeled tables (eg: at one point there were tables for seven STFT "buckets" even though the ECU only provides five. Oops!) As these are found, they will be corrected and the matching definition metadata files will be updated on the Speepsio GitHub repo. Also, as you dig through the existing data, you'll also see places where Mazda decided to use odd data to disable a function without really disabling the code -- eg of the five aforementioned STFT "buckets", Mazda set the MAF load breakpoint for the last two buckets at 200, which is so high as to effectively render them useless. Why? Who knows. They're no longer useless in my tune!
Also consider the factory ECU wasn't meant for real-time updates, so even if you modify just a single value, you still have to power-cycle the ECU to get the updated data programmed. Using the RomDrop function can make this a lot faster; Speeps spent quite a bit of time trying to optimize flashing just for data blocks versus the whole binary, in many cases you can get updated tune data into the ECU in under 20 seconds. That's almost short enough to do a reflash at a stoplight...
How far out is this from completion?
j/kThe work is functionally complete; easily 90%+ of the data elements are identified and understood. If you download my sample OE ROM file above and mess with it, you'll find there are a few specific categories and/or individual elements inside other known categories which contain "WIP" in the name. These elements are in some form of not-completely-understood state. For these examples, the dimensions of the map / table / element are known, but not always the logic or scaling behind the data. As such, you're still technically able to modify the data, but there may be no good understanding of the outcome.
You'll also see there are some tables which are flagged as "DISABLED", "DO NOT MODIFY", "ZEROES" or "ONES". These are variations on a similar theme: the ECU logic provides for functionality which Mazda elected to either completely disable in code, to treat as purely static related to unique code pointers, or just filled with static content to make it irrelevant. The truly disabled elements don't matter, but the other three element types should really be left alone unless you feel you have a great reason to get touchy feely.
There is also the remote possibility one axis got the wrong scale formula applied, or perhaps a bad label was put on a table that didn't get caught. If you stumble into a table that just doesn't look quite right, post something to Speeps so he can take a look. Through some trial and error, we've found a few mislabeled tables (eg: at one point there were tables for seven STFT "buckets" even though the ECU only provides five. Oops!) As these are found, they will be corrected and the matching definition metadata files will be updated on the Speepsio GitHub repo. Also, as you dig through the existing data, you'll also see places where Mazda decided to use odd data to disable a function without really disabling the code -- eg of the five aforementioned STFT "buckets", Mazda set the MAF load breakpoint for the last two buckets at 200, which is so high as to effectively render them useless. Why? Who knows. They're no longer useless in my tune!
Also consider the factory ECU wasn't meant for real-time updates, so even if you modify just a single value, you still have to power-cycle the ECU to get the updated data programmed. Using the RomDrop function can make this a lot faster; Speeps spent quite a bit of time trying to optimize flashing just for data blocks versus the whole binary, in many cases you can get updated tune data into the ECU in under 20 seconds. That's almost short enough to do a reflash at a stoplight...
Reply
0
0
03-27-2018, 06:12 PM
#16
Junior Member
Join Date: Sep 2015
Location: Memphis, TN
Posts: 199
Total Cats: 31
Just download the full release rather than trying to grab the individual file. I'm cross-posting this from Speeps over on M.Net:
ROMDROP Full Releases
https://github.com/speepsio/romdrop/releases
Requirements:
Installation
Application Files
Application Files (generated)
Usage
BTW you can associate a rom's file extension (typically .bin or .hex) with romdrop, afterwhich, you'll only need to double-click the rom you want to flash. Romdrop will automatically attempt to "data" (quick) flash that file to the ECU... no menus, no keypresses, no nothing.
It’s advised that you do not simultaneously run applications that consume heavy resources while flashing. Doing so can impact USB speeds which can result in a failed flash (BTW, a failed flash and all it's blinking lights isn’t the end of the world... it's recoverable).
Menu Items
ECUFlash Setup
ROMDROP Full Releases
https://github.com/speepsio/romdrop/releases
Requirements:
- Tactrix Openport 2.0 J2534 Device
- Tactrix ECUFlash (a free and fast ROM editor)
- Windows 10 (probably works with older versions, but untested)
- NC1/NC2/NC3 Mazda Miata
Installation
- Unzip the romdrop archive to desired location
- License agreement MUST remain in the same folder as the executable
Application Files
- romdrop_license.txt - end user license agreement
- romdrop.exe - application executable
- metadata (folder) - all ecuflash definitions that are currently available.
- colormaps (folder) - preferred ecuflash color maps
Application Files (generated)
- romdrop.log - All loggable activity. If something goes awry for whatever reason, copy this log file to submit for analysis.
- candump.raw - raw binary data sniffed off the canbus
Usage
- connect Openport into available USB slot
- connect Openport to vehicle OBD port
- double click romdrop.exe to execute from desktop or execute from command line: romdrop.exe
BTW you can associate a rom's file extension (typically .bin or .hex) with romdrop, afterwhich, you'll only need to double-click the rom you want to flash. Romdrop will automatically attempt to "data" (quick) flash that file to the ECU... no menus, no keypresses, no nothing.
It’s advised that you do not simultaneously run applications that consume heavy resources while flashing. Doing so can impact USB speeds which can result in a failed flash (BTW, a failed flash and all it's blinking lights isn’t the end of the world... it's recoverable).
Menu Items
- Clear Diagnostic Trouble Codes - self explanatory.
- Flash DATA block only - this is a quick flash option. Only the core data blocks of the ecu are flashed. This cuts down flash times tremendously based on generation. NC1 are ~30s, and NC2/3 are ~20s.
- Flash Entire ROM - if a patch has been applied to one of the rom’s routines, the changes will tend to exist in an area not touched by the “Flash Data Block Only” command. Under these circumstances, this option exists to flash the rom in it’s entirety. There are a few instances where defined data exists outside of the core data blocks as well. In those rare cases, a full flash is recommended as well. Flash times are ~90s.
- Read ROM from ECU - this is the first thing you should do if you’re virgin to the application. Why? You'll always want a backup of your original stock rom. Also it’s a good way to test communications between the app and your vehicle.
- Sniff CAN Communications - The app can log 2MB of raw CAN communications. This is for the true hacker types.
ECUFlash Setup
- download and install ecuflash
- navigate to file>options>Directories>Metadata Directory, and set location to romdrop's metadata folder
- navigate to file>options>Directories>Color Map Directory, and set location to romdrop's colomaps fodlder
- quit and relaunch ecuflash for changes to take effect
Reply
4
4
10-17-2018, 10:37 PM
#17
Newb
Join Date: Feb 2011
Posts: 1
Total Cats: 0
new ecu definition
any chance a definition file can be worked up for my ecu. Just pulled the file tonight and none of the preexisting definitions work for it. Seems like its LFG3EK.
I am very new and if there is already a definition file available. Point me in that direction and I'll gladly seek it out.
Thanks all
I am very new and if there is already a definition file available. Point me in that direction and I'll gladly seek it out.
Thanks all
Reply
0
0
Thread
Thread Starter
Forum
Replies
Last Post
