Fromage- Show us some of the work you have done with Ferrari remotes and ECUs/TCUs. I have seen Trev's and Eric's work, but not yours.
We are talking about different ecu's here. This thread is about ignition computers, not transmission computers!Does this make it possible to re-flash an ECU to the latest F1 tranny software?
Never say never Trev ;-)Also early TCU's didn't have self upgrade either so they won't work either. Unless you somehow managed to reverse engineer all the code and understand it enough to be able to graft the fast shifting routines out of the newer firmware and patch them into the old firmware and then recalculate all the checksums. (a big effort to do) they will never support CS TCU upgrades. Ofcourse Ferrari (or more correctly, Magneti Marelli could release a software upgrade) but this will most likely never happen - in order to help preserve the differentiation of the CS over the 'lesser' models. The only one addition to this is that I recall there may actually be a few early CS's with an older h/w revision of TCU, dumping these could yield the possibility to reflash many of the original 360 (later rev) TCU's but again all this is time consuming and nobody is really that bothered about it. Hell, I don't even have flappy paddles!!!
Well done! I really must set some time aside to fully reverse that codeNever say never Trev ;-)
I made some progress recently, I can now reflash CS software and parameters in the CFC201F.05 and CFC201F.50 hardware configurations. So, early (but not the very early) 360 and Maserati TCUs can be converted to CS spec.
Fromage- Show us some of the work you have done with Ferrari remotes and ECUs/TCUs. I have seen Trev's and Eric's work, but not yours.[/QUOTE
I don't have a Ferrari or any collector car that knows what a computer chip is, however, have had input on design and produced computer boards by the 10s of thousands... my dealer updated the software on a daily driver recently... unfortunately didn't spend a night at the correct motel
In a former life I had a lot experience writing dissemblers so I've began writing my own in C which I will github. This has multiple benefits since I can configure it to auto identify 'code blocks' it pattern recognizes. I downloaded the C16x instruction set guide from here..Back from holidays, I discover some excellent posts here Great job Trev! I had a look to your code and yes, I have seen some of these snippets in Andy's code. Thanks very much for sharing your work to the community! Checksum recalculation is indeed vital even if only one byte must be changed. In addition to Eric's expertise in the 360 TCU field, we'll have now Trev coming in the ECM field. I've been playing quite a lot with the 7.1.1 on different cars (430, Porsche, Golf V6) and its is quite a complex piece of software. Just understanding fully their ERCOS real time OS is already a challenge
Although, reversing a 512k firmware is almost mission impossible even if you can spend 24h per day on it. Little Endian encoding doesn't make the job easier too. But whatever can be discovered can be enriching.
Trev, what reversing software are you using?
Sorry Mark, been away for a while... Would be interested to see the Challenge dump to compare the maps.Hello Trev,
great DIY, because both Galletto, MPPS and even new Galletto 2 does not work out of the box on the 360. Pin 20 to ground did the trick with boot mode?
I have the old 178765 on my 360 F1, does any later soft work on this car because of the Euro2 -> Euro3 changes? Or the other way around, is it better to remap the original 178765 or take the stock CS soft instead?
I have a 18254 Challenge version handy here, do you think this will work or does any better version exist? Offset 1015E-101AA: 0691175H 069117/15H52CE F131 CHALLENGE c 0261204841 000000000 182542 000.
Hi Trev,Back on topic you can find a setting EEPROM read/write tool here;
ME7_95040 - EEPROM programmer
which is handy!
... It dumps the 512byte 94050 EEPROM from Bosch ME7 ecu's and allows re-writing them. Very clever. This is very different to the FIRMWARE, its the settings memory, its also checksummed too. Its where the immobilizer is paired and other settings too so Eric this is specifically aimed at you (!) since you've already dumped the little IC from the keyfob's.
This allows a couple of things, firstly you can get used ECU's to become 'virgin' ones again so they will be accepted by any 360. Currently only one bank ECU is un-coded to the car with the other one paired to the immobilizer. With this trick you can make both virgin!
The other advantage is there are some settings for immobilizer OFF, haven't yet playeed with any of this yet but it looks interesting.
In preparation I've written a 94050 check-summing tool (again open source BSD), see;
So in practice you dump the data EEPROM, hex edit it to adjust settings (I'll write a nice gui for this once we've identified all the values we can tweak...) and then use the checksum corrector on it before uploading it back to the chip.
Hi Guys,Finally, ME7_EEPROM ver 1.4 did the job!