D.I.Y toyota stock ecu mapping?

petbeemer

Member +
My friend is using the ostrich emulator on his evo, he say's he can download files made by HKS, Mine's, Blitz and upload them onto the ecu with the ostrich :eek: I told him to fugger off, you cannot get a tuners information out of their roms and what will the integrity of these files be?

Thats my idea, i own the rights to that Ecu setup
 

petbeemer

Member +
Is it got something to do with reading data out of a rom in a different protocol, then emulating the data so the stock ecu can understand the alteration?

No the early evo/scoob/lancia/ducati uses a eprom chip to store address in hex on, through various input/output sensors around the engine it then compares what its recieved and looks to the 'look up table' (the eprom) to see what it should or shouldn't be doing i.e fueling/timing/boost etc

the emulator (now an ostrich we did make our own at first) basically stores whats on the chip in ram so can be re-written on the fly i.e 'live mapping' so long as you know what your changing and when, with the stock ecu we now have 3 stage launch control, cel as knock, NLTS, rev limit on cel, anti lag timing retardation that can be progressive, theres no limit to what it can do!
 

GP82

Member +
No the early evo/scoob/lancia/ducati uses a eprom chip to store address in hex on, through various input/output sensors around the engine it then compares what its recieved and looks to the 'look up table' (the eprom) to see what it should or shouldn't be doing i.e fueling/timing/boost etc

the emulator (now an ostrich we did make our own at first) basically stores whats on the chip in ram so can be re-written on the fly i.e 'live mapping' so long as you know what your changing and when, with the stock ecu we now have 3 stage launch control, cel as knock, NLTS, rev limit on cel, anti lag timing retardation that can be progressive, theres no limit to what it can do!

Wow, that is good progress, especially getting features like launch control to work on a stock ecu. So basically the sky's the limit with rom chips that store address's in hex on form with the equipment you have developed. All this is done via the diagnostic's port on the early evo's?
 

hardcoreep

Member +
All these questions are answered in the article.

a) It is possible to get the data out of the stock ECU. The TECHTOMS company had that ability till Toyota shut them down. If you look on their site they offer no Toyota ECU tuning solution after 97. They only had the ability to read the data not alter it. So they dumped what they could use into the daughterboard and added their own code to get it to operate like a normal multi-map ECU.

b) The TECHTOMS writer offers live mapping, but no longer supports Toyota.

c) As for copying. I have seen tuners able to copy Honda chips, like Spoon and Mugen. Its a simple matter of taking the EPROM off the board, putting it in a reader, uploading the data, and burning it back to the new chip. And I know people who've done this for their Evolutions and older WRXs. My friend had a MadDog ECU for his Evo III and it had a board which had switchable chips on it. Those chips seem to have a lower form of protection. I've opened many Honda/Mitsubishi/Nissan aftermarket ECUs and they seem, for whatever reason to have very little protection. This is in stark contrast to the 4E and 4A ECUs I've seen. Those tend to have physical and electronic security. My blitz still has its security stickers on it, but i've seen where people open their ECU only to tear the board off the main one because it was glued to the top of the box.

As a Link agent i must admit Link usually do the same, but if something is created then it can be reversed, always!
I'm sure it can be reversed but... 1) Toyota owns the company that makes its own ECUs, so unless someone inside the company releases/steals the protocols/software/hardware to emulate a Toyota ECU only TRD and TOM's will have the capacity to do. 2) TECHTOMS already did this, because I'm sure they got no help from Toyota, but this requires using Toyota's copyrighted source code and that will get you into trouble should you start offering something commercially. I suspect part of having their ECUs work differently is the reason they have a better intellectual property claim over the traditional cell/fuel/look-up system the others are using. 3)Is there enough of a market to warrant the resources needed to crack the stock ECU when other solutions do fine.
 

petbeemer

Member +
Wow, that is good progress, especially getting features like launch control to work on a stock ecu. So basically the sky's the limit with rom chips that store address's in hex on form with the equipment you have developed. All this is done via the diagnostic's port on the early evo's?
On the early evo its adla for logging which i make cables for and mapping through the ostrich live via usb cable that comes with it, yes the sky is the limit even extra load and timing tables have been extended to higher boost levels.
More details are available on my site http://www.4g63.co.uk
 
Last edited:

petbeemer

Member +
3)Is there enough of a market to warrant the resources needed to crack the stock ECU when other solutions do fine.

Thats the key, you need man power and time and i agree is it worth it in the end which is why i never continued with my work on the ecu ages ago, things like megasquirt are a cheap alternative that are full of features and plenty of people contribute to all the time
 
Top