Reprogramming can be done in two methods :
1.Physically in the control unit
2.Through the diagnostic port of the car
Physically in the control unit:
Extracts the memory from the control unit in
order to read its original file. This original file is reprogrammed and
recorded new in its memory, or in a new one (this depends on the type of memory
that the ECU has installed)
Normally the ECU houses the memory inside a socket allowing it to be easily removed.
Basically all these ECUs are identical at the
hardware level. They all have a Microprocessor, which accesses the SOFTWARE
stored in the memory housed inside the socket.
After accessing the socket that contains the
memory chip, we can see that it is made up of two plastics, carefully we can
separate them and finally access the memory chip.
When looking at the registered code, we can
notice that it is not a commercial code, searching on the Internet we can find
more specifications about the chip code.
These memories are similar to the memories used
by desktop PCs, they simply contain data cells that are electrically stored and
depending on the model, they can be erased for later processing, or in the case
of memory with OTP so you are not enabel to programming.
We can also find FLASH memories of this type
that are memories identical to the previous ones but they give us the advantage
that we can erase them and write to them without the need to have a special
lamp to erase them.
What we need is the content of the memory, for
this I needed a memory reader that is compatible with said memory. The
programmer must bring a CD with software to read the memories. We proceed to
read the reader's manual and after understanding how it works, place the memory
to be read (Our CHIP) in the appropriate place, configure the program to
proceed with the reading.
Then we will have our reading done and
specified in a binary file, If we read a 27c256 we will have a 32kb file and if
we read a 27c512 we will have a 64kb file.
What does this file contain?
The binary that is generated after reading the
memory is nothing more nor less than the ecu software.
How is this?
As we said before, the main Microprocessor of
the ECU does not have a place within them to store Software, so they require an
external memory (Our Chip) which contains the Software that It is what will
define the behavior of the processor, indicating what and when it has to do the
things it has to do.
What are Maps?
As we said, the bin contains the Software. The
Software is made up of lines of code that basically acquire information from
the sensors (position, rpm, temperature, etc.) to then determine when and how
to apply the actuators (injectors, spark, etc.).
This software also has reference tables, which
indicate that for a certain input state, it must generate a certain output
state. These tables are located in certain positions and are known as MAPS.
How to view the content of the BIN?
quick answer, the bin file contains values that
can be seen in Hexadecimal format, for this we use a program that may be
similar to WINHEX. This program allows us to open the file and view its content
quickly.
And what are all those hieroglyphs?
That is the memory represented in hexadecimal
values, these values are interpreted by the ECU microprocessor, which
understands and executes what it has to do.
What can I modify?
Generally, what is modified are the parameters
located in the tables known as maps, in this way the ecu will generate another
output to the same information, allowing us to inject more gasoline or modify
the advance or the rpm limiter, or the idle.
Change and just like that?
No. Many ECU memories come with an Integrity
Check system, in this case the Corsa's is very simple. This means that if you
change a value in memory and do not properly modify the integrity parameter,
the ecu DOES NOT START.
What are we going to modify?
The idea is to modify the rpm cutoff by raising
it to 6800 rpm, and most importantly recalculate the checksum so that our ECU
continues to work. Before continuing, we are going to clarify what the rpm cut
is and how to calculate the checksum, and then we continue.
What is rpm cutoff?
rpm = revolutions per minute, that is, the
number of turns the crankshaft makes in one minute. The cut is not in rpm
values but is modified by a constant. According to the equation below:
Rpm Cutoff = 3,932,490 / (value in
address/corresponding position in decimal).
We have already learned how to select a block
in WinHex, now we have to go to a memory location.
In this case we are interested in going to
position "87D" and "87F".
If we do so we find something similar to this:
As we can see we have at address 87D: 02 5d and
at 87F: 02 5c
Note: they are taken in pairs because these
particular constants are 16 bits.
Let's proceed to translate this to decimal.
025d Hex = 605 decimal and 025c Hex = 604 decimal.
We had said that the cut was calculated with an
equation, so we have to Cut1 = 3,932,490 / 605 = 6,499.98 and Cut2 = 3,932,490
/ 604 = 6510.74
Well, we have already determined where the cuts
are and what the calculation equation is like.
Cheksum calculation
Now we will explain, as an example, how to
calculate the checksum with a commercial program: WINHEX, which can be
downloaded in a DEMO version. The first thing we must do is run the program and
open our .BIN, in this case the CSUN. Then, as we have said before, the
checksum was calculated between memory positions 8 to 32767 or speaking in hexa
from 8 to 7FFF.
How do I calculate the checksum?
What we are going to do is "paint" or
"select" from 8 to 7FFF with the program, but before doing it with
the mouse, we can use a block selection tool, in the "Edit" menu.
We will place in the fields from: 8 to 7FFF.
The program will automatically select the defined
block for us.
And now?
Now, we turn to another WINHEX tool, which will
automatically calculate the total sum of the block, and will give us the
result.
For that we go to the menu: Tools ->
Calculate Hash.
We select the method (Checksum 16) and Accept.
As a result, the Program calculates and we will
effectively see that the value obtained is identical to the one located in
position 6 and 7.
Is it important to verify this?
Yes very important
This tool, like the soft one that I uploaded in
the previous entry, is of utmost importance and necessity, because before
recording the memory with the new BIN we must verify that the checksum is
correct or else the ECU will not work.
If the checksum is not correct, it can be
easily edited with WinHex by putting the value calculated by the tool in
positions 6 and 7.
What are we going to modify?
The idea is to modify the rpm cutoff by raising
it to 6800 rpm, and most importantly recalculate and repair the checksum so
that our ecu continues working.
Where do we start?
To calculate the value of the rpms.
We had said that:
Cut1 = 3,932,490 / (value at address 87D in
decimal) and. Cut1 = 3,932,490 / (value at address 87F in decimal)
We are going to leave the two cuts at 6800
rpms, to do this we need to know what value we are going to put in the divider.
We clear
(value at address 87D in decimal) = 3,932,490 /
Cut1 and (value at address 87F in decimal) = 3,932,490 / Court2
So (value at address 87D in decimal) =
3,932,490 / 6800. And (value at address 87F in decimal) = 3,932,490 / 6800
following = 578 and = 578
Are these the values that I have to put in memory?
NO. We remember that the memory was in
Hexadecimal mode, so we must convert the number 578 Decimal to Hexadecimal,
which will give us 02 42.
I already know what I have to put, how do I do it?
Easy, I edit the file locating myself at
position 87D and replace the values with the new ones.
Ready?
NO. The CheckSum needs to be recalculated and
corrected.
And how I do it?
Read the previous part carefully which
indicates how to perform this checkSum calculation. If we calculate the new
checksum value we will obtain as new: 3B F7.
And now?
Now we go to position 6, and we change the
value we had for the new value.
Ready?
Yes, we just need to save the binary with
another name so as not to lose the original, and we now have the first modified
binary of our ECU.
Missing?
It wouldn't hurt to double-check the accounts
and checksum, just to be sure.
Record the new Bin into a new EPROM memory.
Note: remember that our binary is for a 256
EPROM, if we want it for a 512 EPROM we will have to duplicate the file.
If everything went well, and we verified the
values and modifications, we would be able to test the new chip with the
correct cut.