Memory dump of ECU

[b3lha]

I have dumped the memory of my ECU to a file and I'm starting to analyse it. Any other hardcore computer guys want to take a look?

Car: 94 JDM version S40-ii
RomID: 742512

CPU is M37791 (Mitsubishi MELPS7700)

This file is a dump of the whole 16-bit address space.

0000-00FF is IO
1000-14FF is RAM data (14FF downwards is the program stack)
8000-8FFF is ROM data (possible 16x16 tables at 0x8120 and 0x8e20 ?)
9000-FFCF is ROM code
FFD0-FFFF is Interrupt vectors
The rest of the address space appears to be unused.

[Dessertrunner]

YEs I am interested how did you dump the data? I tried to open the file and didn't have any luck.
Tony

[JaySVX]

Any way you can export it to raw text? Having issues with the .bin.

[b3lha]

OK. Here's some raw text files (inside the zip):

Archive: ECU3.zip
Length Date Time Name
-------- ---- ---- ----
331776 04-27-07 14:43 AddressSpace.txt - This is the whole address space from 0000 to FFFF (engine off).
320896 04-27-07 15:32 disassembled-code.txt - This is a disassembly of the program code from 9000 to FEB5.
6240 04-27-07 14:43 RAM-data.txt - This is the RAM data from 1000 to 14FF (engine idling).
19968 04-27-07 14:43 ROM-data.txt - This is the ROM data from 8000 to 8FFF.
-------- -------
678880 4 files


I'm putting together some info on how to do this and will post it later today.

Phil.

[Hocrest]

OK, now the real question???

Does subavanagon + Your Memory Dump Info + This and a few things =

[b3lha]

Originally Posted by Hocrest

OK, now the real question???

Does subavanagon + Your Memory Dump Info + This and a few things =

YES
(once the correct parameter addresses are found)

Please check my website for further details. I have created a HOWTO for building the interface and posted the results of my investigations so far.
http://www.alcyone.org.uk/ssm
I have also written some open-source software to download data from the ECU.

I am making three of these interfaces with the intention of selling two of them. Currently two are complete, tested and working. The third one is almost complete, just waiting on a part that was out of stock at the supplier.

[SVXdc]

For folks in the states: the audio harness used to connect to the Subaru diagnostics plug is a Metra 70-1780 or Scosche SU-02 (one of the two pieces in the kit — the one with the 8 speaker wires).

If you want to get fancy, you can transplant the Red (+12V) and Black (Ground) wires from the other harness so those pins are the correct colors, plus any other colors you'd like to use for Transmit and Receive.

Attached are pictures of the pair from Crutchfield.com, and a head-on view drawing.

[LetItSnow]

JSRBBQSAUCE. I haven't played with assembly in a bazillion years!

[SVXdc]

That is cool, Phil. I'd like to look through that code disassembly at some point. I'd want to poke around the net and see if there's any kind of tool that can help plug symbols back in, to make it a little more readable.

Originally Posted by LetItSnow

JSRBBQSAUCE

[b3lha]

Originally Posted by LetItSnow

JSRBBQSAUCE. I haven't played with assembly in a bazillion years!

Well fortunately, this CPU is a bazillion years old!

It was far from cutting-edge even when the car was built 15 years ago. It's a newer variant of the old 6502 chip from the BBC Micro of 1982 and a lot of the instructions are very similar. I spent most of my early teens learning how to program my BBC Micro and somewhere I've got a well-used book on 6502 assembler. I knew it would come in handy one day!

[Trevor]

Phil, you ARE the cutting edge.

We certainly have a range of in depth skills on the network.

Good one, Trevor.

[cdvs]

Originally Posted by Hocrest

... + This and a few things = ...

By 'a few things' you mean a dropping resistor, voltage divider or other voltage converter to reduce the vehicle's 12V+ to 5V+ for the RS232/TTL converter linked to above or similar premade device?

This seems a quicker and less complicated method to get to the same place as building the interface from scratch.

We could then connect with the audio plug described as follows:

pin 2 (orange/white) transmit (rs232/ttl)
pin 3 (blue/white) receive (rs232/ttl)
pin 5 (red/black) to +12V in (choice of above) to +5v out (rs232/ttl)
pin 9 (green/black) ground (rs232/ttl)

Good show!

[SVXdc]

Originally Posted by cdvs

By 'a few things' you mean a dropping resistor, voltage divider or other voltage converter to reduce the vehicle's 12V+ to 5V+ for the RS232/TTL converter linked to above or similar premade device?

The MAX232 chip is somewhat susceptible to blowing up when the voltage goes out of range, so a voltage converter is recommended.

The 78L05 is an ideal part — The TO-92 version (package that looks like a transistor) is tiny, very inexpensive (less than $1), and provides more than enough current (100mA), where the MAX232 draws at most 10mA. The larger 7805 is rated up to 1A. The wiring is exactly the same.

pin 2 (orange/white) transmit (rs232/ttl)
pin 3 (blue/white) receive (rs232/ttl)
pin 5 (red/black) to +12V in (choice of above) to +5v out (rs232/ttl)
pin 9 (green/black) ground (rs232/ttl)

Viewing the pins-side of the connector, oriented as in the drawing in my earlier post, the pin numbers run from 1 at the top left corner, across the top to 4, then resume on the bottom left with 5 across to 9.

The car's factory wire colors are different in my '96, as well as on the '96 wiring diagram:
2 — Brown/White
3 — Green/Red
4 — Red/Blue
5 — Brown/Red
9 — Black/Red

Pin 4 goes to the Cruise Control module. All other positions are unpopulated.

Originally Posted by b3lha

[the CPU is] a newer variant of the old 6502

I thought some of those instructions and opcodes looked really familiar. I played with the Apple ][ way back when.

somewhere I've got a well-used book on 6502 assembler. I knew it would come in handy one day!

It'll only come in handy if you can find it . Fortunately, there's always the Internet.

[b3lha]

Originally Posted by SVXdc

The colors are different in my '96, as well as on the '96 wiring diagram:

I'm talking about the colours on the radio harness connector, not the car.

[SVXdc]

Originally Posted by b3lha

I'm talking about the colours on the radio harness connector, not the car.

I knew that. I was replying to cdvs' post, which appeared to be referring to the car's wiring.