Modifying Motronic 2.3.2 ECU hardware and software.

[vwnut8392]

I think there is a 60-2 option on VEMS now that some people have used on the 20VT engine - that same arrangement will get you rolling on Volvo M4.4 assuming you can suitably customise that for 2226cc and the throttle body mods for IAC and such.

i run my AAN in my 4000 on 60-2 with single window cam sensor. i tested it with my jimstim on the bench and i got around 12,200RPM before i started getting trigger errors in VEMS. i was using a hall effect GM crank sensor with a custom 60-2 trigger wheel and the stock hall cam sensor. this time around its going to be an OEM VW/audi VR crank sensor and the hall cam. still staying 60-2 as well. the volvo engine is a 2.5 so it shouldnt be that tough to configure. the IAC shouldnt be that bad, i have a full machine shop at my disposal along with a trusty tig welder so making an adapter or custom intake wont be that bad.

[S2central.net]

I genuinely think that is your best way forward - use jimstim to run the 60/2 configuration the Volvo ecu and then set about porting it onto the AAN. I think you are right about some VW engine having a 60-2 configuration that can be adapted. Great you have done that already with VEMS as that is fundamental.

[prj]

Volvo is waste of time on 2.2T.
M2.3.2 does everything M4.4 does and some of it better as well, such as boost control.

[vwnut8392]

Volvo is waste of time on 2.2T.
M2.3.2 does everything M4.4 does and some of it better as well, such as boost control.

a waste of time to you because you know everything there is to know about M2.3, as for the rest of us stupid people as you would put it we need to look at other solutions so we can perform basic tuning on our cars. honestly why are you wasting your time even posting here genius? dont you have some custom ECU code to write or a car to tune?

[prj]

a waste of time to you because you know everything there is to know about M2.3, as for the rest of us stupid people as you would put it we need to look at other solutions so we can perform basic tuning on our cars.

The solution if you want to tune your own car is a standalone ECU. Period. What you are doing is repeatedly banging your head against the wall and insulting anyone who calls you out on your masochism. No amount of repeating your opinion of your entitlement to other people's hard work will ever get you ANYTHING.

Transplanting a totally different OEM ECU to work with a totally different engine is much more difficult than picking apart M2.3.2, which you are not able to do. Forget it. The only thing these engines have in common is that they have 5 cylinders.
Plus, this is completely off-topic, since in this thread we discuss modifying M2.3.2.

[vwnut8392]

i have VEMS standalone. looks like im going to be banging my head for a loooong time than. as for making an management that doesnt belong on an engine is easy, i've made digifant 1 from a corrado G60 run a 10V engine NA and turbo with no hiccups or problems but enough about that. lets get back on the topic at hand.

[vwnut8392]

I was doing some more BIN comparison with different boost chips and i think i found one that seems to have the checksum routine disabled. i was comparing a tuner file to a stock file and i discovered a line of code thats 6 bytes long thats 00 in the tuner file and not in the tuner file. below is the actual code change from file to file. can any of you guys confirm if my suspicion is right? i dont have my emulator right now to test it.

Hex offset 0XB83
Stock file
79 E7 E7 D2 E6 F7 

Tuner file
00 00 00 00 00 00

i feel this is what this code modification does because the checksums are identical still and the tuner file has some pretty heavy modifications to the mapping.

[-ice-]

Hi,

Please search for 8051 opcodes and discover what these commands mean. Done in 5 Minutes. Posting source code of tuners is not a nice way.

Will start to work with the boost chip today. First goal is finding the map access routine.

Regards

[vwnut8392]

im no programmer, i dont understand any of that and i've tried. as far as i know putting 00 in a line of factory code has nothing to do with the tuner in specific. all he did was take a line of factory code and shut it off. what are they going to do sue me because they modified bosch's super secret code? if anything bosch should be mad that people are talking about their big secret in public. i went round and round with a gentleman once over the same thing, he wanted to sue me because i discovered the same thing at the same time he did. he had no patent on what was discovered nor did either of us have the right to reverse engineer bosch software but we did anyhow. just like any tuner out there, they have no patent on their code nor could they ever get a patent on it because they would have to pay bosch for the rights and have full documented permission from bosch to modify their patented software and hardware. so that makes anything a tuner does fair game to be public information. with the laws in the US anyhow you can do whatever you want with things such as this as long as you aren't profiting from it, so if you give it away there is nothing that can be done.

although MTM might be one tuner that has permission from audi and bosch to do what they want with the software and hardware and put patents on it. if i recall reading somewhere MTM was or still is very closely tied with audi sport.

[-ice-]

You don't have to be a programmer to find out that opcode 0x00 is a special one...

[kymi]

This situation seems to be a bit weird. I made my decision to learn (r)s2 motronic around one year ago. Since then I've been following -ice-, Acki and others making good progress in this thread. Currently I'm running E85 in my car, no tricks, just ECU with own binary. And vwnut you're still struggling with 6 bytes of code that does nothing so special. It even doesn't fiddle inputs or outputs.

But to be fair, please check out: http://www.win.tue.nl/~aeb/comp/8051/set8051.html and it should be a few minutes to solve both 6byte secrets.

PS. Thank you prj, -ice- and Acki and this thread for the pieces in my puzzle.

[prj]

This situation seems to be a bit weird. I made my decision to learn (r)s2 motronic around one year ago. Since then I've been following -ice-, Acki and others making good progress in this thread. Currently I'm running E85 in my car, no tricks, just ECU with own binary. And vwnut you're still struggling with 6 bytes of code that does nothing so special. It even doesn't fiddle inputs or outputs.

But to be fair, please check out: http://www.win.tue.nl/~aeb/comp/8051/set8051.html and it should be a few minutes to solve both 6byte secrets.

PS. Thank you prj, -ice- and Acki and this thread for the pieces in my puzzle.

If he would put in even 1% of the effort it takes to write those mega posts about how everyone is so mean to him, I am sure he would have solved it long ago.

Glad the info is of some use.

Btw, for the boost chip. 551c routine addresses:
0x1657 - READ_2D_MAP
0x1684 - READ_AXIS_RPM (this is a special routine for RPM axis only)
0x1688 - READ_AXIS_16BIT
0x168B - READ_AXIS (main routine into which other axis routines go)
0x1700 - READ_MAP_VALUE (reads the actual value from the map after running axis routines including interpolation)
0x1707 - INTERPOLATE (Interpolates between two values)
0x173E - READ_3D_MAP_RPM (3d maps are only supported with RPM as one axis. It locates the first and the 2nd axis offset, then reads and interpolates first row, then reads and interpolates second row, then interpolates them between each other).

Some other stuff:
0x1B - N75 pwm output (TF1)
0x191 - IE1 - N75 override from MOT chip for diagnosis check and in case of fuel cut.
0x688 - Knock detection routine
0x8AD - The actual RESET function, not the crap at 0x00.
0xE6B - Boost control
0x1372 - Calculates whether overboost is on or not (for that it adds a value to the throttle axis when it reads the target boost map)
0x15AC - Boost cut
0x15D6 - MAP sensor plausibility diagnostics.

[vwnut8392]

well gentleman, i know i complain alot and it seems like i dont put much effort into this but in reality i have put alot of effort into trying to grasp this. i've spent hours, days and weeks starting at idapro trying to understand what does what not to mention reading tons of books and manuals on the 8051 processor but i just cant get my brain around it. i even went as far as getting my cousin's college books on programming which covered the 8051 a good bit as well. but over all i did start this thread originally and through my complaining i feel this thread has compiled more info on the M2.3.2 ECU in one place than any other so i guess all of my whining has been a help.

anyhow i'll keep trying to get my brain around it as i dont give up easily. im very stubborn lol.

[-ice-]

Thx for the hints, PRJ.

Does anybody associate something with Axis-Descriptor 0x2e?


Regards

[prj]

Thx for the hints, PRJ.

Does anybody associate something with Axis-Descriptor 0x2e?


Regards

0x2E is temporary variable. Look where map is accessed and you will see what's put into it.