Ducati Ecu Tuning Software
Just a quick update for anyone curious. I've copied the stock 748 memcal to my laptop and have started dissecting it. I also have all the documentation for the MC68HC11 MCU that's within the 16M ECU (and I suspect many other Duc ECUs as well). I'm going through and picking apart the bin now and have made some very serious progress. I also found a very incomplete, yet functional XDF for the 16M ECUs (thanks for Desmo over at Speedzilla.com) to allow tuning through TunerPro which I am very familiar with and have used to tune several cars in the past.
Subaru Ecu Tuning Software
Ducati ECU Tuning Resources. If you Google 'ducati ecu models'. I have a Daytona TC88 module in the Sporty and it is easily programed with the TC88 software. Stand alone ECU offering full tuning ability. Microtec M197 - Replacement ECU for DUCATI. - Tuning Software. Ducati models with the Marelli 59F, 59M and 5AM ECU. Monster 400, 620, 695, 1000. Tuning Software, Tune Downloads & Accessories.
Using that XDF as a base and my bin file, I've found all the NECESSARY stuff to perform basic tuning on the 16M ECUs. I'm still working on finding other tables and options within the bin to allow for more advanced tuning and to figure out proper datalogging and emulation capabilities.
The site is basically done, but I'm working on setting it up with all of the knowledge I currently have, as well as all the files, software, documentation, and other things that I have so that once it goes live, it's a great starting point for anyone interested in tuning themselves, or helping out with hacking the Ducs ECUs to expand the community. Keep in mind that I'm working on this in my spare time (which is not a lot right now) so it might take some time for me to fill up the site and post it live, but I'd rather it be a solid start that's organized and presentable than a terrible clusterF like most sites.
Bottom line is that I'm already at a point that I can tune my own Duc with my own computer and since I had all of my old tuning stuff it cost me $0. Now I'm looking to expand the current DIY tuning possibilities for the 16M ECUs and to make the same tuning options available to all of the FI Ducs Logged. So I have started to get interested in this as well. Seems there just isn't any info on hacking the Ducati ECU like in the auto world. From looking at Ducatidiag and learning a little bit about the OBD protocols, it looks like its just a matter or learning what Standard PID's are supported on the various ECUs (like RPM, and temp) and what proprietary Magnetti-Marelli or Ducati specific PID's are needed to access everything else.
I am assuming that Ducatidiag writer is also using OBD to flash the ECU, reset the immobilizer, etc. I have mixed feelings about paying €100 for the writer software. I kinda feel like that should be shared openly (at least the protocol / PIDs etc) and maybe one should ask for a donation for upkeep and development of the software. Anyway, I might spend some time on an Android app to do some of this.
Your site would be a great place to share infomation about all this. I hope you like hacking because the time of doing that starting from zero will account for far more than hundred bucks. Unless Syneject M3C ECU sheets will leak (I failed in finding any traces), you have to start from zero. First, you have to understand the protocol used to read/write image files within the ECU. Could be KWP2K/ISO, but you don't know. If you have something which is already able to read/write, you have to sniff the transaction (serial, CAN, K-line. depending of the HW interface of the tool you have) and see the traffic which is going on.
This will likely include some sort of 'authentication' between the tester and the ECU, probably based on some 'seed' passed by the ECU to the tester. Once you understand the protocol to read/write, you might want to be very successful in reading the existing images and writing them back, unless you want to run over many bricked ECUs. Once you are able to do that, you are at 1/3 of the way. Then the joy starts, and you have to be able to reverse engineer the image file, understand what zones are code, and what zones are maps. And the maps, there is more than one, so you have to understand which one controls what. You are going to be looking at a very wild Monster otherwise.
When you are perfectly able to understand which maps are for what, you need to have something which allows you to extract them and edit them easily (as they are a few thousand values arrays). Final part, you have to reverse engineer the checksum used by the ECU to validate the image file. Or, you can bribe some Chinese/Taiwanese at Synerject and get the specs « Last Edit: January 01, 2012, 10:14:41 AM by HotIce » Logged. I hope you like hacking because the time of doing that starting from zero will account for far more than hundred bucks.
Unless Syneject M3C ECU sheets will leak (I failed in finding any traces), you have to start from zero. First, you have to understand the protocol used to read/write image files within the ECU. Could be KWP2K/ISO, but you don't know. If you have something which is already able to read/write, you have to sniff the transaction (serial, CAN, K-line. depending of the HW interface of the tool you have) and see the traffic which is going on. This will likely include some sort of 'authentication' between the tester and the ECU, probably based on some 'seed' passed by the ECU to the tester. Once you understand the protocol to read/write, you might want to be very successful in reading the existing images and writing them back, unless you want to run over many bricked ECUs.
Once you are able to do that, you are at 1/3 of the way. Then the joy starts, and you have to be able to reverse engineer the image file, understand what zones are code, and what zones are maps. And the maps, there is more than one, so you have to understand which one controls what. You are going to be looking at a very wild Monster otherwise. When you are perfectly able to understand which maps are for what, you need to have something which allows you to extract them and edit them easily (as they are a few thousand values arrays). Final part, you have to reverse engineer the checksum used by the ECU to validate the image file.
Or, you can bribe some Chinese/Taiwanese at Synerject and get the specs ALL good info and that's the point of the site.to get a COMMUNITY EFFORT in making all of this stuff work. I don't have anything on M3C's but does this give you an idea of what I'm working with for my 16M from my 748?
From the full 8k lines of assembly code I posted above, I was able to figure out enough to make a definition file for use with TunerPro. The bin has no checksum so I got lucky with that. Here's my VERY BASIC, yet functional bin file being edited in action It's FAR from complete, but it is to a point that you can tune with it Here's the same table thrown into a spreadsheet and a chart made for it: And this is both of the charts side by side. The spreadsheet is primitive but it's the same data and there are several ways to manipulate it: « Last Edit: January 01, 2012, 03:12:18 PM by accludetuner » Logged. Did you try to upload your map? Because, that's where the check-sum comes into place.
It seems really strange that any firmware of that kind, allows you to drop an image into Flash/EPROM without any kind of validation. If not for anti-tempering, only for simple data verification. Just to be clear, check-sum is not encryption, but validation, so the fact you can look at clear-text data does not mean that you will be able to push your edited image into the ECU (without compiling the proper check-sum field into the image file).
So right now I am most interested in the last generation, IAW5AM. It looks like from tools (DucatiDiag, TuneECU, TuneBoy, Rexx ECU) reading and writing the flash can be done via OBD commands. I am very curious if anyone knows how these guys (especially the free tools) figured out what OBD PIDs and formats to use for various things. From what I can tell from DucatiDiag, the MM IAW uses a proprietary mode 21 for most of the behavior. So besides just trying every number you can and trying to reverse engineer things, I am hoping there is something quicker. Logged Pages: 2.
The attached link takes you to a French guy's site who has created a diagnostic software package for the 5.9AM ECU's. There is a full list of compatible bikes on the site. He has done some tweaks to the software and it now works with older 5.9M ECU's like the one fitted to my 2003 999. For the newer ECU's he requires you to post a read out from the software so that he can send you a fully functioning version of the software (it is linked to the ECU serial number to prevent commercial use) for the older ECU's it works straight out of the box (including setting the TPS and resetting the service light). All that is required to get you up and running are some leads off Ebay 1. A VAG KKL 409.1 EOBD lead 2. A Fiat/Lancia/Alfa EOBD adaptor lead (must have the +ve and -ve battery connection leads) and of course a computer Download the software This is my functioning setup Netbook with 1gb RAM, 250gb HDD, Win7 Starter OS VAG KKL 409.1 EOBD lead (sourced off ebay) CDM20602 Drivers, downloaded from the FTDI site (just Goolge it) Fiat/Lancia/Alfa Romeo EOBD Adapter Lead (sourced off ebay) 3m USB extension lead Last edited by chrisw; at 01:49 PM.
This is what I'd been hoping I'd see someday. There is a similar one for Triumphs called Tune ECU that I used on a mates Rocket III Roadster the other week and it is superb. As well as the usual diagnostic and test functoins you can also copy the fuel/ignition map, modify it, and download new maps to the ECU. I haven't studied the site you've linked to yet but I'm a bit puzzled about the VAG OBD connector. Triumph uses a standard car type 16 pin OBD connector but Ducati doesn't, although I suspect this will become a standard requirement for all bikes sold in Europe in the near future. I'm sure that once I've read the details all will become clear. Thanks for posting the link Chris.
There's been a lot of development of this diagnostic software. Older ECU's are now catered for and the IAW59 and IAW5AM software now allows you to dump the mapping to your PC. For a fee of 100 euros the creator of the software will send you flasher software enabling maps to be uploaded to the ECU plus for IAW5AM's the disabling of the immobiliser for a single ECU and IAW59M's the disabling of the immobiliser unrestricted. I have converted an ECU connector from a damaged wiring loom to enable reading and flashing of ECU's off bike.
I'm looking for some IAW59M's to read the maps from as a depository is being created on the software forum. On my own bike my ECU became faulty and I was able to pick up an ECU off eBay, reflash it and disable the immobiliser. When the immobiliser is disabled it is not virginising so the ecu can't be coded to the key chip.