Hacking the Motronic ECU (Audi RS2)

[prj]

Am I remotely on the right track if I say, that 0x38 is filled from another memory location (sensor voltage?) using a transfer table?

[prj]

That's basically what I meant.
As an example - If I log coolant temp and then look at a table where coolant temp is used and see, which value the ECU accesses, I can try and derive the formula from that...

[S2central.net]

Trace won't help with axis calculations but will give confirmation when you have them right.

[prj]

After writing the map directory parser, I found some more constants.
I believe this is a list of all the constants in hex, that are used in the maps, which are referenced from the map directory:
0x36, 0x37, 0x38, 0x3A, 0x3F, 0x2E, 0x04, 0x5D, 0x86, 0x4B, 0x30, 0x03

The first half of them I know, the other half I have yet to figure out.
And then there is the conversion of the axes into real world values... to figure that out on my own I most certainly need a trace.

[prj]

Decided to give TunerPro a go, but it's pretty basic...
It is not even possible to make it calculate axes.

Unfortunately, if I am going to use an Ostrich, I don't have much choice.
I think I now understand why you wrote a PHP script in the first place, I am going to start writing a map directory parser myself it seems... (just for starters).

[prj]

I'd drive you around if it weren't for a little distance problem.

Regarding the Ostrich and M87C257 emulation, I found this http://www.turbo-mopar.com/forums/sh...ad.php?t=35796.

There is not a single person in my country who can tune Motronic 2.3.2... and the following of ABY, AAN and ADU cars is pretty large. But I am not sure whether I should drop 350$+ into this when I have zero experience of tuning an engine.

[S2central.net]

This combo works but of course you can only realtime edit one chip at a time - unless you run 2 x emulators

the other thing to know is that ostrich doesn't support 87c257 - I had to work my way round that from 1st principles with a chip converter module.

I generally find that I create the boost chip manually as it doesn't tweaked anything like as much as fuel and timing. I actually need to spend more time on emulation stuff to unlock a few more things. Finding the time is tricky though plus I really need a driver as well.

[prj]

Thanks for the file.

Coming back to emulators.
The Ostrich 2.0 supports real time ROM tracing and it is supported by TunerProRT. The cost is also not that high, 175$.
However, there is one issue... since our cars have two chips, I am not sure whether you can emulate both at the same time with this, or whether you need two units.
Any insights on the matter?

[cid]

Long time I don't check S2 forum, someone really brought this topic back to life...

Anyway, it is been more than 3 years I stopped working on the RS2 bin file, couldn't find all the info I need plus I sold the car.

I will just upload the xdf file once again in case someone need it.

http://uploading.com/files/c1mc75c8/RS2.xdf/

[prj]

Interesting...
I still don't like the fact that it is written in Excel/VBA though.

It would be much better to just make a DAMOS for WinOls.
I have started with that by looking at different images of the chips, but without slow and painful disassembly or an emu with trace I'm blind.

[newborg]

It comes with these original files and the configuration files that make them work.
0261200484_1267356530_A810_Audi_S2.bin
0261200484_1267356560_A7C8_Audi_S2.bin
0261203478_1267358361_762B_Audi_RS2_Turbo.bin
0261203478_1267358361_81C6_Audi_RS2.bin
0261203543_1267358668_64DC_Audi RS2.bin
0261203601_1267358373_54CC_Audi S4.bin
0261203601_1267358373_5AEA_Audi S4.bin

I was able to edit my idle 100rpm.

[S2central.net]

Disassembly will turn you crazy... I made little progress with that... Working blind without documentation of address maps and stuff gives you a very sore head. Lets not forget there are three microcontrollers in our ECU.

[prj]

I probably should start writing something similar.
Issue is, I probably need an emulator to understand it all, since just going off the disassembly is quite difficult.

[S2central.net]

My bet is all they have done is translated the map directories found on some motronic chips... This doesn't work for S2/RS2 turbo chip. Nor does it find some really useful things like fuel injector constants. I wrote a PHP script to parse the entire motor chip and build a map definition file for the package I use now. Took a while to have it calculate scales and such but it worked a treat I only found out about the map directory after writing all that code, but it was a useful sanity check. Then you discover that everything you need is not referenced in the map directory anyway.

If this aftermarket package has unlocked all the tricks for S2/RS2 on both chips then its worth the money, but I would be surprised if that is the case.

[prj]

Looked at it also a while ago. The fact, that it is written in Excel/VBS is a bit "meh" to say the least.