Mitsubishi Lancer Evolution Forum banner

581 - 600 of 623 Posts

·
Registered
Joined
·
1 Posts
hi Guys
Catching up on this issue especially.
Does anyone have a tip for me how I can view the CBF file with my CxF viewer I can not open.
thank you
Best regards
Algonus
 

·
Registered
Joined
·
43 Posts
I do byte to byte compare between cff and raw file.
raw rom file starts at offset 0xB74 in CFF file and last byte removed.
It's mean that we can pack and unpack CFF without any special software.
I will unpack all other known roms.
 

·
Registered
Joined
·
43 Posts
It's interesting to do side by side compare between EVO and RA same builds. There are not a lot differences and code the same. It can help to find important tables.

Seems that unpacked rom should be 3 byte less.
8631B001 and 8631B001_dio30 it is the same code. Only difference in last 3 bytes, that part of cheksum of CFF container.

1391614 bytes - it's proper rom size.

All unpacked roms
 

·
Registered
Joined
·
15 Posts
I only spent a few minutes looking at the DLL but thankfully they left debugging info in it. I assume you've worked out how to decrypt the CFF files?

I wonder if anyone has create an .ols file with the tables and data? I have some files that I want to decode and see if they match the firmware you've published. If so they would certainly expose the checksum and gear/clutch settings.
 

·
Registered
Joined
·
43 Posts
.cff is not encrypted. It's container like database

it's something like

header_16_bytes;
block_size - 4 bytes;
array of offsets.
data;
block_size - 4 bytes;
array of offsets.
data;

First two blocks I just parsed in HEX by my eys :)

Update: cbf and cff files have identical structure.
 

·
Registered
Joined
·
43 Posts

·
Registered
Joined
·
43 Posts
One more thing :)

There is CFF_INFO_TBL.mdb (ms access file) inside ECU REWRITE ROM DATA from MUT3 (europe).
It's mitsu comments what was changed in each rom release.

8631B222 10 Outlander TC-SST Decreasing the frequency of boost control for hydraulic pressure for reduction of shift shock. Decreasing the hydraulic boost pressure for reduction of shift shock.

8631B223 11 Outlander TC-SST Decreasing the frequency of boost control for hydraulic pressure for reduction of shift shock. Decreasing the hydraulic boost pressure for reduction of shift shock.
this roms very similar to 8631B001-8631B003

I can't found any other descriptions for other roms. Can you check you MUT for this file?
 

·
Registered
Joined
·
43 Posts
We can enable debug mode in PassThruCAN and log all communication between car and software.

To enable logging do
1. Create folder
C:\program files\PassThruCAN\Temp\debug

2.
Add to file
C:\program files\PassThruCAN\ini\01Mutc.ini

[DEBUG]
LEVEL=3
Level can be 0..4

I create two logs with level 3 and 4.
here is some logs

teach_in_init_mode3.log - Start PassThruCan, click Teach-int with connected tactrix. Teaching not executed.
get_eng_ecu_mode3.log - Start PassThruCan, clickReader and then Ok to get engine ecu version.

I think MUT3 also should have debug mode.



COpenFile(C:\Program Files\PassThruCAN\DiagDB\gbf\protocol.gbf)
DICloseProtocol KW2C3PE
CCloseFile(019F4DC2)
DI: ECU (GENERIC_ENG_AT) loading PAL function PALDetermineID from GBF
DCUploadComParameters: cmdecho: 0x08 status: 0x00 => success!
DCUploadComParameters: cmdecho: 0x08 status: 0x00 => success!
DCUploadComParameters: cmdecho: 0x08 status: 0x00 => success!
DCSendMessage
+ msg without caesar header: 1a 87
DCSendMessage: 02 00 02 00 00 00 44 5a 01 01 01 00 1a 87
+ ECU Flags, Address: $01, $01
+ DCWaitMessage: Caesar header: 16 00 16 00 00 00 00 01 4c 5a
- type = 'L' 76
+ DCWaitMessage: Reserving message buffer of 22 bytes
+ DCWaitMessage: Response message: 5a 87 04 85 00 01 ff 00 00 53 05 09 31 38 36 30 41 39 38 32 20 20
GPD> LAST_MSG
type was 76, 'L'
QQQ MLSetInfo 'ECUORIGIN87',4
QQQ MLSetInfo ECUOrigin87 = '4'
QQQ MLSetInfo 'SWVERSIONNUMBERLONG',5440777
QQQ MLSetInfo SWVersionNumberLong: dec='5440777', hex='530509'
QQQ MLSetInfo 'PARTNUMBERASCII',27475212
QQQ MLSetInfo PartNumberASCII= '1860A982 '
DIOpenCBFPALFunction, ECU: GENERIC_ENG_AT
DIGetProtocolName (ECU) GENERIC_ENG_AT
DIOpenStandardPALFunction PALReadFlashId
DIOpenProtocol (KW2C3PE)
COpenFile(C:\Program Files\PassThruCAN\DiagDB\gbf\protocol.gbf)
DICloseProtocol KW2C3PE
CCloseFile(019F4DC2)
DI: ECU (GENERIC_ENG_AT) loading PAL function PALReadFlashId from GBF
DCUploadComParameters: cmdecho: 0x08 status: 0x00 => success!
DCUploadComParameters: cmdecho: 0x08 status: 0x00 => success!
DCSendMessage
+ msg without caesar header: 1a 9c
DCSendMessage: 02 00 02 00 00 00 44 5a 01 00 01 00 1a 9c
+ ECU Flags, Address: $00, $01
+ DCWaitMessage: Caesar header: 15 00 15 00 00 00 00 01 4c 5a
- type = 'L' 76
+ DCWaitMessage: Reserving message buffer of 21 bytes
+ DCWaitMessage: Response message: 5a 9c 01 04 85 00 01 ff 53 05 09 31 38 36 30 41 39 38 32 30 33
GPD> LAST_MSG
type was 76, 'L'
QQQ MLSetInfo 'ECUORIGIN',4
QQQ MLSetInfo ECUOrigin = '4'
5a 87 04 85 00 01 ff 00 00 53 05 09 31 38 36 30 41 39 38 32 20 20 - my ECU hardware number
5a 9c 01 04 85 00 01 ff 53 05 09 31 38 36 30 41 39 38 32 30 33 - my ECU software number
 

·
Registered
Joined
·
15 Posts
I wish I still had my MUT update CDs since they had the North American database. I've tossed so many of those in the garbage over the years. I assume all the dealers have long ago switched to the medic3. No idea what format those files are.
 

·
Registered
Joined
·
15 Posts
We can enable debug mode in PassThruCAN and log all communication between car and software.
I used the can passthru driver from drewtech to log all the J2534 calls. It's just a shim DLL that writes the calls to a text file and dispatches them to the real DLL.
 

·
Registered
Joined
·
26 Posts
I used the can passthru driver from drewtech to log all the J2534 calls. It's just a shim DLL that writes the calls to a text file and dispatches them to the real DLL.
tactrix also includes a logger shim example in C++ in the OpenECU folder, though I have not tried it.

nice pick up on the debug mode for passthrucan
 

·
Registered
Joined
·
1,072 Posts
Discussion Starter #593
Lots of exciting stuff happening here lately. Keep it up guys! Torque Management for the TCU needs to GO AWAY.
 

·
Registered
Joined
·
1,005 Posts

·
Registered
Joined
·
15 Posts
Lots of exciting stuff happening here lately. Keep it up guys! Torque Management for the TCU needs to GO AWAY.
Go away, no, adjustable, yes.

Normally torque calculations influence the clutch pressure and timing. Instead it's often easier to reduce the limits and adjust the ECU to dumb down its response to a torque reduction request. I haven't looked at the evo/ralliart ECU but from driving one I could feel that they were using fast and slow path for STR as well as cylinder skipping.
 

·
Registered
Joined
·
43 Posts
Extracted Roms contains 3 very similar data blocks.

EVODOMR03_4168_9B43 - 23004 bytes
EVOEUR03_9B44_F51F - 23004 bytes
EVONASR03_F520_1498D - 21614 bytes

I zeroed them in B001, B002 and B222 roms.
After that B001 exactly equal to B002
In B222 several bytes are different.

So seems like
EVODOMR03_4168_9B43
EVOEUR03_9B44_F51F
EVONASR03_F520_1498D
It's factory maps

It's 99% different mapping for different region.

Text from AMT_17800000_000204_dio30_C.cbf

RLI $E5: Vehicle Information: Country Code
Country Code (1Byte)
00.01.11-32
Japan / DOM
Rest of world / EXP
USA / NAS
Europe / EU
Australia / MMAL
Gulf coast countries / GCC


So ... can we change country code in Codings and receive japan SST version? :)
 

·
Registered
Joined
·
15 Posts
Yes I think I have the A2L for that gearbox. It belongs to a client so I'm not able to give it out. If you want, I licensed the German to English translator plugin for my OLS.
 
581 - 600 of 623 Posts
Top