Creating an open source tuning solution for the MS6

[Altenius]

I'm starting a new project to reverse engineer the MS6 ecu (and hopefully more in the future) to create a cheaper way to tune our cars. The resources and final program will be located at https://github.com/Altenius/MazdaspeedRE. Eventually, I want to create an application for modifying the tables and flashing the ROM.

So far, I have a dump from the flash memory of a Mazda 6 MPS ECU. Currently the goal is to find the subroutines that handle writing and reading from the flash memory over the CAN bus. If anyone wants to take a look, the dump is in the Github repo I linked above.

So far here's what progress I've made:

• Found subroutines that handle CAN communication
• Found a few maps that have yet to be identified

I'll keep posting to this thread as I make progress.

[whitebn07]

Thanks for the PM. I unfortunately can't respond to it so I will respond here.



I have 30 years of competition engine building experience, some reverse engineer experience and a fair bit of older programming experience (C for DOS!). I used a Renesas uP in a project a few years ago and went digging last night for the programmer. I finally found it and it's an E8 which will program and read the SH7058.

I'll remove my stock MS6 ECU and dump the ROM with the E8.

Did you decompile the ROM dump or identify some tables by looking at the data with a hex editor?

Were you planning on confirming the operation of the tables you've found by building a test jig around the ECU ( as opposed to trying it on a running engine?

Do you have access to a Cobb AP? That would really be helpful with the reverse engineering!

[Altenius]

Originally Posted by whitebn07 Thanks for the PM. I unfortunately can't respond to it so I will respond here. I have 30 years of competition engine building experience, some reverse engineer experience and a fair bit of older programming experience (C for DOS!). I used a Renesas uP in a project a few years ago and went digging last night for the programmer. I finally found it and it's an E8 which will program and read the SH7058. I'll remove my stock MS6 ECU and dump the ROM with the E8. Did you decompile the ROM dump or identify some tables by looking at the data with a hex editor? Were you planning on confirming the operation of the tables you've found by building a test jig around the ECU ( as opposed to trying it on a running engine? Do you have access to a Cobb AP? That would really be helpful with the reverse engineering!

I found the tables through the disassembly so eventually I'll cross reference the indexes to sensors. Im not going to test anything on my engine because it's my daily so I'll either build a testing station or do some virtual emulation.

I dont have an access port and it's more expensive than I'm willing to spend (that's why I started this )

If you can get another dump then that would be helpful.

[Altenius]

So just an update:

I found some code that deals with downloading a program through the interface outlined the data sheet (section 23.5.2). I've been unable to find any calls to this subroutine though so I'm unsure if it's ever used.

I also found the subroutines that respond to diagnostics requests. It implements most of the modes found here and here plus more. The microcontroller has two CAN channels (labelled HCAN0 and HCAN1). It uses HCAN0 for diagnostics messages and HCAN1 for everything else (instrument cluster, AWD control module, etc). Edit: These channels are combined into one.
The OBD-II port also has an ISO 9141-2 K-Line pin connected to the BCM.

One thing I found, and it could be an issue with my CAN adapter, is that all CAN messages must be padded to 8 bytes. So the ECU will not respond to "02 09 02" but it will respond to "02 09 02 00 00 00 00 00"

[Thor Hammer]

Originally Posted by Altenius So just an update: I found some code that deals with downloading a program through the interface outlined the data sheet (section 23.5.2). I've been unable to find any calls to this subroutine though so I'm unsure if it's ever used. I also found the subroutines that respond to diagnostics requests. It implements most of the modes found here and here plus more. The microcontroller has two CAN channels (labelled HCAN0 and HCAN1). It uses HCAN0 for diagnostics messages and HCAN1 for everything else (instrument cluster, AWD control module, etc). Edit: These channels are combined into one. The OBD-II port also has an ISO 9141-2 K-Line pin connected to the BCM. One thing I found, and it could be an issue with my CAN adapter, is that all CAN messages must be padded to 8 bytes. So the ECU will not respond to "02 09 02" but it will respond to "02 09 02 00 00 00 00 00"

Good on you for wanting to do open source. But it sounds rather tedious. What is your reason for doing this? Rather than say, use Cobb or Versatune.

[Altenius]

Originally Posted by Thor Hammer Good on you for wanting to do open source. But it sounds rather tedious. What is your reason for doing this? Rather than say, use Cobb or Versatune.

Mostly for experience. But Versatune and AP are expensive so I want to start something cheaper for Mazdas.

[JohnnyTightlips]

You are the hero we need.

[MD1032]

Subscribed...godspeed sir. I wish I knew anything about this stuff or could help you in some way!

[flylike2kites]

It's great that you're feeling adventurous, but it may be a better idea for you to just talk directly to the developers of VersaTune and pick their brains. They've already figured this stuff out YEARS ago.


Also, VersaTune is a STEAL compared to other similarly functioning tuning options.

Let's check the facts. For 550 dollars, you receive FULL CONTROL. You can flash, datalog, the software works without any serious glitches, you receive amazing support, you have tons of base tunes with dyno time behind them, as well as ways to make backups and scale the data that exists. You don't have to do any sort of splicing, and everything is absolutely plug-&-play.

I'm from the "deceased" TurboDodge platform, so all we have are the super buggy FI/C and MegaSquirt. I spent close to a grand on an MS3X system, a long ass wiring harness which could make it into my cabin, temp sensors, usb cables, and the like, AND I had to splice it in and create a base tune!

Yes, the software may seem pricey, but a good amount of that money is the premium data cable! You can always just purchase the software and buy your own cable.

I think that you should give VersaTune a try before you jump off the deep end.

[Altenius]

Originally Posted by flylike2kites I'm from the "deceased" TurboDodge platform, so all we have are the super buggy FI/C and MegaSquirt. I spent close to a grand on an MS3X system, a long ass wiring harness which could make it into my cabin, temp sensors, usb cables, and the like, AND I had to splice it in and create a base tune! Yes, the software may seem pricey, but a good amount of that money is the premium data cable! You can always just purchase the software and buy your own cable.

I've spent $25 in hardware so far, way less than the MongoosePro cable that VersaTune sells. I'm not trying to bash VersaTune, I think it would be beneficial to have something open source for Mazdas.

[flylike2kites]

Yes, but is RomRaider sophisticated enough to handle sequential spark and direct injection?

Will OpenECU be able to have a fast enough of a logging rate to be able to work with the Mazda ECU?

Both of these softwares look like side branches of MegaSquirt, which also has an open source forum, and VersaTune, which was created from scratch by two Mazdaspeed6 owners.

You're welcome to try, but I just wanted to point you in the right direction.

Good luck.

[Pu Manchu]

Originally Posted by Altenius Mostly for experience. But Versatune and Cobb are overpriced and it pisses me off (just like everything else car related) so I want to start something cheaper for Mazdas.

i appreciate the passion for experience and learning, but i can't agree that versatune and cobb are over priced. even if your time was only worth $10/hr, it would take a lot more than 55 hours to build anything near either of those tools. i think they are great value.

[Altenius]

Mazda's algorithm for computing the security key was relatively basic so I can get security access now. I've used it to dump the flash memory from the ECU in my car and I'm comparing it to the Mazda 6 MPS ROM to identify maps. Writing back to the flash should be simple but I'm going to setup a simulator with my spare ECU to do tests on.

If anyone wants to help find maps the dump is in the Github repo

[Fstrnyou]

While the VT cable is much more expensive than making one, it's very high quality and very much worth it. I'm not going to risk bricking my ECU because of a faulty hacked together cable.

It wouldn't surprise me if the VT guys started out wanting to put together something good to openly share with the community and then realized they spent entirely too much time on it, lost their day jobs, and needed a new source of income.

[MD1032]

Originally Posted by Altenius I've spent $25 in hardware so far, way less than the MongoosePro cable that VersaTune sells. I'm not trying to bash VersaTune, I just want something like RomRaider or OpenECU for Mazda.

Originally Posted by Pu Manchu i appreciate the passion for experience and learning, but i can't agree that versatune and cobb are over priced. even if your time was only worth $10/hr, it would take a lot more than 55 hours to build anything near either of those tools. i think they are great value.

You can also have someone assemble your built engine for you. Or you can spend hours researching engine building, buy the proper tools, bring your stuff to a machine shop and have it machined, and assemble it yourself at the cost of more man hours than makes financial sense... yet people do it all the time. Some of us DIY for the sake of DIY'ing alone.

FWIW I thought initially that teaching myself to tune these cars was a complete waste of time and money. At this point I've tuned enough cars including my own (for which I have over 200 maps for 5+ different fuels and a crazy number of hardware iterations), that, the tables have turned, and now my investment looks like nothing. An open source ECU edit for this platform would be phenomenal for the entire community.

[Pu Manchu]

Originally Posted by MD1032 An open source ECU edit for this platform would be phenomenal for the entire community.

time is an investment, and altruism is a hoax.

[Realgib3]

Some of the part you guys are really missing is the shear amount of modifiable data that is still NOT available to change with even VT.

OP, I was never able to/didn't want to spend the time developing my own flashing tool, but I've disassembled the ECU with IDA and worked with Mazda Edit Pro to label many missing tables, so once you get to that point, if you need any guidance, just let me know.

[Altenius]

Originally Posted by Realgib3 Some of the part you guys are really missing is the shear amount of modifiable data that is still NOT available to change with even VT. OP, I was never able to/didn't want to spend the time developing my own flashing tool, but I've disassembled the ECU with IDA and worked with Mazda Edit Pro to label many missing tables, so once you get to that point, if you need any guidance, just let me know.

Glad to hear you've already done some work! I'm actually at that point or close to it so any information you have on the tables would help.

[kTaLgsTo]

This is interesting, I commend you.

In the General Motors platform there was a tool called Tiny Tuner, which was pretty powerful, to the point you could even change what displayed on your info screen (where the ms3 shows MPG and such). With Tiny Tuner, they made it free for all to use, but the catch was they never created a proper flashing program for it, so you still had to use a tuning company 'like versatuner'. So in our case you would download the file with versatuner, upload it into 'tiny tuner' make your changes, save back into versatuner and write file. It was pretty awesome.

Good Luck!!!!

[Realgib3]

Originally Posted by Altenius Glad to hear you've already done some work! I'm actually at that point or close to it so any information you have on the tables would help.

It's been forever, but the biggest reasons I was in there was to allow for more RPM and bigger TB control.

The biggest things that came out of it were

1. There really is a hard cut at 8k on GEN1/6 ECU's
2. All the data tables look up a group of "Axis" tables. I think there are something like 8 axis tables. So to change the rpm scale or load scale, etc, don't have to actually change the scale directly on every single table that uses RPM and load, instead, you just change the scale on the axis lookup table and that flows over to all tables that use it. This makes it incredibly easy to change these scales and allow for more rpm, load, etc.

3. There are many more throttle tables than are available in Cobb/versa and also lots of control over DEFCO, which is what causes most of the issues for bigger TB's.

[Altenius]

I've started progress on the application here: https://github.com/LibreTuner/LibreTuner. It's not in a usable state yet but if anyone would like to help feel free to submit a pull request. It's built on Qt so it's cross-platform (at least to Windows and Linux) but I'm not sure about Mac, that will depend on available hardware. The Openport 2.0 does not support Mac. As far as I know, SocketCAN does not have native support either. I'm not sure about others.

[Altenius]

It's been a while since I last posted so I'll do an update for anyone interested. The base of the program is mostly done. ROMs can be downloaded, tunes can be created, and tables can be edited. I'm waiting to finish the rest until I flash my spare ECU, which is waiting on me to do tests first to minimize the risk of bricking it.

I attached a screenshot showing some features. I've found more tables than are shown which will be added before the first release.

[kTaLgsTo]

You have my vote, keep it going

[Altenius]

I have some more updates since the last time I posted. Most notably, I have flashed a new tune onto my spare ECU (frugally using a $25 canable). I still need to add support for J2534 devices but I need to get access to one first (probably a Tactrix OpenPort 2.0, but I'm too cheap to buy one ). So now that downloading, flashing, and modifying tables are working, here's my todo list:

• Add support for J2534
• Clean up the code and fix bugs
• Add data logging
• Make a nicer looking UI

The ECU has more protection against bricking than I previously thought. When reflashing the ECU, the important boot and flash subroutines are not erased and the ECU will not execute the mutable code unless a checksum is correct, making bricking it nearly impossible.

I don't have any ETA on when features will be done but I'm trying to work on it whenever I have any spare time.

[electrogeneral]

I'm new here and will be buying a MS6 later this week.

I also own a 3000GT VR4 with a flashable ECU. That platform pretty much went through what you are doing now, albeit with a more narrow application(only 98-99 3000GT ECUs are flashable). What came of it was Chromed ECU . I have a Tactrix 2.0 I am willing to lend you to help further your development.

I have seen what a somewhat open-source project can turn into and how it can help keep a niche car community alive.

[phate]

So, the ECU is cool and all.

How about the diff controller?

[nindoja]

Subbing, and now going to steal my buddy's ECU out of the parts car before it gets scrapped. Might poke around some and see how I can contribute.

[Altenius]

Originally Posted by electrogeneral I have a Tactrix 2.0 I am willing to lend you to help further your development.

I still have a lot I can do before I need to use the cable, but if you can lend me one that would be great!

Originally Posted by phate So, the ECU is cool and all. How about the diff controller?

Is that the same as the AWD control module? I'm not familiar with what it does but if it's reflashable and I can get access to the ROM, it's a possibility.

[phate]

Originally Posted by Altenius Is that the same as the AWD control module? I'm not familiar with what it does but if it's reflashable and I can get access to the ROM, it's a possibility.

Yep, same thing.

[MSMS3]

Originally Posted by electrogeneral I'm new here and will be buying a MS6 later this week. I also own a 3000GT VR4 with a flashable ECU. That platform pretty much went through what you are doing now, albeit with a more narrow application(only 98-99 3000GT ECUs are flashable). What came of it was Chromed ECU . I have a Tactrix 2.0 I am willing to lend you to help further your development. I have seen what a somewhat open-source project can turn into and how it can help keep a niche car community alive.

The Tactrix 2.0 is a J2534 pass through dongle and cable with internal data logging capability. I have one that I use for other purposes, including datalogging on multiple vehicles and platforms. It has a sim card type removable memory chip that can be programmed. If we ever have an open source tuning capability, this type of two-way device would be the way to make the tuning software work.

I'd loan mine, too, were I not using it elsewhere. It would be great to see this project yield results.

[dzt]

Originally Posted by Altenius I have some more updates since the last time I posted. Most notably, I have flashed a new tune onto my spare ECU (frugally using a $25 canable). I still need to add support for J2534 devices but I need to get access to one first (probably a Tactrix OpenPort 2.0, but I'm too cheap to buy one ). So now that downloading, flashing, and modifying tables are working, here's my todo list: Add support for J2534 Clean up the code and fix bugs Add data logging Make a nicer looking UI The ECU has more protection against bricking than I previously thought. When reflashing the ECU, the important boot and flash subroutines are not erased and the ECU will not execute the mutable code unless a checksum is correct, making bricking it nearly impossible. I don't have any ETA on when features will be done but I'm trying to work on it whenever I have any spare time.

That's awesome I've been keeping up with this project for a few months. Have you updated the repo by any chance with the code you used to flash over to the ECU I'd love to see and possibly contribute.

[Altenius]

Originally Posted by dzt That's awesome I've been keeping up with this project for a few months. Have you updated the repo by any chance with the code you used to flash over to the ECU I'd love to see and possibly contribute.

The repo has been moved to gitlab an I've been updating it as much as I can. The code that flashes the ECU is at https://gitlab.com/Altenius/LibreTun...rc/flasher.cpp. I haven't gotten around to adding J2534 support but it's next on my list. I started developing on Windows instead of Linux and the UI looked terrible so I've been adding a theme to make it look a little better on Windows.

[dzt]

Originally Posted by Altenius The repo has been moved to gitlab an I've been updating it as much as I can. The code that flashes the ECU is at https://gitlab.com/Altenius/LibreTun...rc/flasher.cpp. I haven't gotten around to adding J2534 support but it's next on my list. I started developing on Windows instead of Linux and the UI looked terrible so I've been adding a theme to make it look a little better on Windows.

By the way update the Discord link on the README!

[Altenius]

Originally Posted by dzt By the way update the Discord link on the README!

Fixed!

[Altenius]

It's been a while since I posted again, but I want everyone to know that I'm still working on this! I've just been really busy. The software is working with J2534 interface and I have successfully flashed my spare ECU with my OpenPort 2.0; I haven't tested in on my speed6 yet but it should be working (I'm waiting to do more tests with my spare before soft bricking my car's ECU).

I do need more ROMs from the other firmware versions so I can map out the table locations. I need to modify the downloader to be able to download unrecognized firmware first but if anyone have a J2534 interface and is interested in downloading their ROM (it takes about 25 minutes and there's no risk of breaking your ECU), then let me know! This goes for both MS6s and MS3s (first gen only).

[Altenius]

The first release is close! I have the interface in a state I like but I still need to make minor changes to the flashing & downloading windows. I'm going to start looking for more tables so I want to know which one everyone would prefer I find first.

Also, I still need an MS3 ROM if anyone is interested in providing that.

[Jeff23spl]

The newcomer would probably want sensors, wastegate duty tables + limiter tables. This could manage the average ebay intake cel and capacity to raise power a bit.

Then fuel and timing

And probably everything else you can find in the actual tuning devices.

My concern could be around the multiple levels tables. Sometimes we have a table affected by another one and i expect the actual tuning options company spent a lot of time testing to figure out which one is good or not.

If you find somewhere the trigger temperature for cooling fans it could be a nice thing.


I don't know much about ecu programming but is it a complete rom that your read, update and download or you can access some separate files ?

Is it something that can give access to other cpu like a non speed mazda ?
The maf cal is a common problem for every car equipped...

[Altenius]

Originally Posted by Jeff23spl I don't know much about ecu programming but is it a complete rom that your read, update and download or you can access some separate files ? Is it something that can give access to other cpu like a non speed mazda ? .

It is only one file, yea. The ROM is stored on the 1 MB flash memory on the ECU and takes about 25 minutes to download and much less to flash. I would need someone to use my program to download the ROM off of an MS3 and send it to me.

I'm only dealing with mazda platforms at the moment (mazdaspeed then rx8) but I'm hoping to reverse other platforms later, maybe subarus.

[Mach914]

Hey there, I might be able to send you a map within a month if still needed. I have been using open ecu and ecuflash on my WRX, but am buying a Mazdaspeed 3.... Hence why i found this forum.

Interested in helping development of this project also if it is still active. I will need to find some tools to pull the map from the car, I saw some links to gitlab earlier in this topic.

Let me know.

[Altenius]

Originally Posted by Mach914 Hey there, I might be able to send you a map within a month if still needed. I have been using open ecu and ecuflash on my WRX, but am buying a Mazdaspeed 3.... Hence why i found this forum. Interested in helping development of this project also if it is still active. I will need to find some tools to pull the map from the car, I saw some links to gitlab earlier in this topic. Let me know.

It is still active but development has been slow lately while I'm fixing my speed.

That would be great if you can help. I rewrote the downloader and I need to add a generic ms3 definition but when that's finished I can send you the program so you can download it. Is it gen 1 or 2?