cracking the ecu....
#276
Is this title ok?
Well, I completed my homework and here is the update and teaser ![Wink](https://www.rx8club.com/images/smilies/wink.gif)
There are two methods to trick the "Mazda Module Programming" software to reflash the PCM.
Method 1. Edit the active saved session with a hex editor and replace all reference of the latest
flash entry with the old entry, for example changing level T to S: SW-N3Z2ET000 -> SW-N3Z2ES000
The session files are location at:
C:\Documents and Settings\All Users\Application Data\Ford Motor Company\MMP\Users
Method 2. By entering special function Generic Module Configuration by entering code "23198"
with Module Setting: Protocol>CAN, Address>PCM-7E0>Mazda
The following is a screen shot of the available menu:
![](https://www.rx8club.com/attachments/series-i-aftermarket-performance-modifications-23/88464-cracking-ecu-mmp-a6.jpg)
In order to successfully force the application to use the file saved on the system, when you first install the software you must first edit the file Registry.xml and edit the value of "ForceCalibrationDownload" to 00 (originally default to 01). If you didn't happen to done this first, you will need to remove the session folder from C:\Documents and Settings\All Users\Application Data\Ford Motor Company\MMP\Users.
Once the application fire, you place the file .PHF in a .zip file and save it in the "Calibration Files" Folder which by default is at "C:\Program Files\Ford Motor Company\Calibration Files" this will bypass the download online.
An of course, once you have a legit copy you will be allow to auto-update to the latest version. And method 2 doesn't require you to establish internet connection, so it is a good and alternative mechanism for a reflash. However, if your subscription expired, method 1 will required you to host your own status server to trick it into by serving the ping status Or patched a few bytes in the .exe file to ignore the status.
NOTES: Any mistake made on Method 2 may render the PCM inoperative; especially VID or PATs info, or even flashed the wrong flash file.
Disclaimer: use it at your own risk.
Because method 2 is very dangerous, I'm currently working on some protocol emulation to study its behavior before doing the real reflash as I do not have a spare PCM to work with.
Until next time,
![Wink](https://www.rx8club.com/images/smilies/wink.gif)
There are two methods to trick the "Mazda Module Programming" software to reflash the PCM.
Method 1. Edit the active saved session with a hex editor and replace all reference of the latest
flash entry with the old entry, for example changing level T to S: SW-N3Z2ET000 -> SW-N3Z2ES000
The session files are location at:
C:\Documents and Settings\All Users\Application Data\Ford Motor Company\MMP\Users
Method 2. By entering special function Generic Module Configuration by entering code "23198"
with Module Setting: Protocol>CAN, Address>PCM-7E0>Mazda
The following is a screen shot of the available menu:
![](https://www.rx8club.com/attachments/series-i-aftermarket-performance-modifications-23/88464-cracking-ecu-mmp-a6.jpg)
In order to successfully force the application to use the file saved on the system, when you first install the software you must first edit the file Registry.xml and edit the value of "ForceCalibrationDownload" to 00 (originally default to 01). If you didn't happen to done this first, you will need to remove the session folder from C:\Documents and Settings\All Users\Application Data\Ford Motor Company\MMP\Users.
Once the application fire, you place the file .PHF in a .zip file and save it in the "Calibration Files" Folder which by default is at "C:\Program Files\Ford Motor Company\Calibration Files" this will bypass the download online.
An of course, once you have a legit copy you will be allow to auto-update to the latest version. And method 2 doesn't require you to establish internet connection, so it is a good and alternative mechanism for a reflash. However, if your subscription expired, method 1 will required you to host your own status server to trick it into by serving the ping status Or patched a few bytes in the .exe file to ignore the status.
NOTES: Any mistake made on Method 2 may render the PCM inoperative; especially VID or PATs info, or even flashed the wrong flash file.
Disclaimer: use it at your own risk.
Because method 2 is very dangerous, I'm currently working on some protocol emulation to study its behavior before doing the real reflash as I do not have a spare PCM to work with.
Until next time,
#278
Is this title ok?
Originally Posted by jird20
Dear seik8,
Any updates two months later?
Cheers
jird20
Any updates two months later?
Cheers
jird20
![Stick Out Tongue](https://www.rx8club.com/images/smilies/tongue.gif)
I didn't have time over the holiday and was too busy with work these past weeks and it will not settle down until maybe late march or so. Because I have no spare pcm, I'm being very cautious of the next step I'm going to do. So it will be a little while before I have something new to share. And tracing those PCM pins are like search the needle in a haze stack and they are very hard to see as most of the connection are tiny. I'm not sure if it use multi-layer PCB, if it is, then tracing the pins will be almost impossible without a scope.
#279
Zoom-Freakin'-Zoom
iTrader: (5)
Originally Posted by seikx8
Since you ask, I have to reply. No ![Stick Out Tongue](https://www.rx8club.com/images/smilies/tongue.gif)
I didn't have time over the holiday and was too busy with work these past weeks and it will not settle down until maybe late march or so. Because I have no spare pcm, I'm being very cautious of the next step I'm going to do. So it will be a little while before I have something new to share. And tracing those PCM pins are like search the needle in a haze stack and they are very hard to see as most of the connection are tiny. I'm not sure if it use multi-layer PCB, if it is, then tracing the pins will be almost impossible without a scope.
![Stick Out Tongue](https://www.rx8club.com/images/smilies/tongue.gif)
I didn't have time over the holiday and was too busy with work these past weeks and it will not settle down until maybe late march or so. Because I have no spare pcm, I'm being very cautious of the next step I'm going to do. So it will be a little while before I have something new to share. And tracing those PCM pins are like search the needle in a haze stack and they are very hard to see as most of the connection are tiny. I'm not sure if it use multi-layer PCB, if it is, then tracing the pins will be almost impossible without a scope.
my guess would be an 04 6sp?
beers
![Beer](https://www.rx8club.com/images/smilies/beer.gif)
#281
Administrator
BIG BIG NEWS!!! just opened an email from Brian Herron over at DrewTech
The Mongoose vehicle interface/cable is availalbe for shippingNOW with the FEPS programing voltage capability for ecu flashing!!!
this is an additonal $100 dollars bringing the Mongoose to $395- thats friggin cheap folks. we can crack the code and actaul flash it using seik's methods ford/mazda's module reprogramming software and one of theseDrewTech Mogoose.
http://www.drewtech.com/products/mongoosepwm.html
The Mongoose vehicle interface/cable is availalbe for shippingNOW with the FEPS programing voltage capability for ecu flashing!!!
this is an additonal $100 dollars bringing the Mongoose to $395- thats friggin cheap folks. we can crack the code and actaul flash it using seik's methods ford/mazda's module reprogramming software and one of theseDrewTech Mogoose.
http://www.drewtech.com/products/mongoosepwm.html
#283
Zoom-Freakin'-Zoom
iTrader: (5)
zoom.
pm
beers![Beer](https://www.rx8club.com/images/smilies/beer.gif)
pm
beers
![Beer](https://www.rx8club.com/images/smilies/beer.gif)
Originally Posted by zoom44
BIG BIG NEWS!!! just opened an email from Brian Herron over at DrewTech
The Mongoose vehicle interface/cable is availalbe for shippingNOW with the FEPS programing voltage capability for ecu flashing!!!
this is an additonal $100 dollars bringing the Mongoose to $395- thats friggin cheap folks. we can crack the code and actaul flash it using seik's methods ford/mazda's module reprogramming software and one of theseDrewTech Mogoose.
http://www.drewtech.com/products/mongoosepwm.html
The Mongoose vehicle interface/cable is availalbe for shippingNOW with the FEPS programing voltage capability for ecu flashing!!!
this is an additonal $100 dollars bringing the Mongoose to $395- thats friggin cheap folks. we can crack the code and actaul flash it using seik's methods ford/mazda's module reprogramming software and one of theseDrewTech Mogoose.
http://www.drewtech.com/products/mongoosepwm.html
#284
Administrator
Originally Posted by TeamRX8
you also need another $99.95 for the PCM Scan software, still great news ![Smilie](https://www.rx8club.com/images/smilies/smile.gif)
then you still have to figure out which parameters to change, how to change them, and how much change without blowing your engine ... that's the not so easy part for most people![Uhh](https://www.rx8club.com/images/smilies/uhh.gif)
![Smilie](https://www.rx8club.com/images/smilies/smile.gif)
then you still have to figure out which parameters to change, how to change them, and how much change without blowing your engine ... that's the not so easy part for most people
![Uhh](https://www.rx8club.com/images/smilies/uhh.gif)
meh thats the small stuff
![Big Grin](https://www.rx8club.com/images/smilies/biggrin.gif)
i should say- if we have a tweaked map in hand we can flash it with seik's method the ford software and this cable
![Big Grin](https://www.rx8club.com/images/smilies/biggrin.gif)
#288
Int'l Man of Mystery
Join Date: Jan 2004
Location: Central Florida
Posts: 3,651
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by turbosa22c
i dont know about that. getting into the code is one thing but trying to figure what lines of code does what is another. if it were that simple the big mazda tuners would have done so.
What big Mazda tuners? That's the issue at hand. There aren't any. I hope no one is going to say RE Amemiya, RMagic or Racing Beat, because first... they all have cracked and can flash the ECU for the RX-8... you just have to mail it in to them. Second... none of them are that large... Racing Beat is about the only one that comes close to counting as a large professional aftermarket tuning company among them.
It's not rocket science. It's a matter of business... there's been little money in Mazdas compared to Fords, GM's and Chryslers... then Subarus and Evos...
#291
Administrator
mind you this will also allow just about anyone with a modicum of sense and a pc/laptop to reflash their PCM with whatever Flash comes out next from mazda- without going to the dealer![Smilie](https://www.rx8club.com/images/smilies/smile.gif)
japan i was about to say those 3. however small they are they ar ethe Major Players as afar as the rotary world goes. and they have the abiltiy to offer non-stock tunes. perhaps this will allow for a delivery method besiddes sending the pcm to them?
![Smilie](https://www.rx8club.com/images/smilies/smile.gif)
japan i was about to say those 3. however small they are they ar ethe Major Players as afar as the rotary world goes. and they have the abiltiy to offer non-stock tunes. perhaps this will allow for a delivery method besiddes sending the pcm to them?
#293
No respecter of malarkey
iTrader: (25)
Originally Posted by zoom44
mind you this will also allow just about anyone with a modicum of sense and a pc/laptop to reflash their PCM with whatever Flash comes out next from mazda- without going to the dealer![Smilie](https://www.rx8club.com/images/smilies/smile.gif)
japan i was about to say those 3. however small they are they ar ethe Major Players as afar as the rotary world goes. and they have the abiltiy to offer non-stock tunes. perhaps this will allow for a delivery method besiddes sending the pcm to them?
![Smilie](https://www.rx8club.com/images/smilies/smile.gif)
japan i was about to say those 3. however small they are they ar ethe Major Players as afar as the rotary world goes. and they have the abiltiy to offer non-stock tunes. perhaps this will allow for a delivery method besiddes sending the pcm to them?
careful, it's possible to screw up a PCM flash ...
.
#296
Is this title ok?
I'm bored so I created this Simple WebService so you may use the MMP application without internet connection.
[Edit]
Here is the new version. Written in .NET 2.0
Method 1 (Modify registry.xml):
1) Run application: MMPService.exe
2) Run application Mazda Module Programming (LCT Shell.exe)
3) Do whatever...
4) Shutdown application Mazda Module Programming
5) Shutdown MMPService.exe
Method 2 (Modify hosts file):
1) stop local iis server: net stop iisadmin
2) Run application with following command: MMPService.exe hosts
3) Run application Mazda Module Programming (LCT Shell.exe)
4) Do whatever...
5) Shutdown application Mazda Module Programming
6) Shutdown MMPService.exe
If you zipped up the flash .phf and place the .zip file in folder where the MMPService.exe is located, it will feed the file to the program when MMP application request them. Make sure the .zip file name is the same as the .phf name.
If things doesn't seemed to work, open the task manager and look for process "XMLRegistryD.exe" and kill it or restart the pc. This daemon doesn't seem to terminate when the MMP application exit. Make sure you follow the order of start and stop the application to insure the registry.xml file is restored properly so that you may continue using the application with your active subscription. Registry.xml is also copied to Registry.xml.bak as backup when it first run.
BTW, the MMP version 4.6 is way more stable and easier to use. I would recommend you subscribe and download the latest MMP version from mazdatech if you don't have one already.
DISCLAIMER: use at your own risk. All information and application posted are provided for educational purpose only. In no event shall the author be held liable for any action you may incur. By downloading the application, you have read and understand the disclaimer.
Have fun
[Edit]
Here is the new version. Written in .NET 2.0
Method 1 (Modify registry.xml):
1) Run application: MMPService.exe
2) Run application Mazda Module Programming (LCT Shell.exe)
3) Do whatever...
4) Shutdown application Mazda Module Programming
5) Shutdown MMPService.exe
Method 2 (Modify hosts file):
1) stop local iis server: net stop iisadmin
2) Run application with following command: MMPService.exe hosts
3) Run application Mazda Module Programming (LCT Shell.exe)
4) Do whatever...
5) Shutdown application Mazda Module Programming
6) Shutdown MMPService.exe
If you zipped up the flash .phf and place the .zip file in folder where the MMPService.exe is located, it will feed the file to the program when MMP application request them. Make sure the .zip file name is the same as the .phf name.
If things doesn't seemed to work, open the task manager and look for process "XMLRegistryD.exe" and kill it or restart the pc. This daemon doesn't seem to terminate when the MMP application exit. Make sure you follow the order of start and stop the application to insure the registry.xml file is restored properly so that you may continue using the application with your active subscription. Registry.xml is also copied to Registry.xml.bak as backup when it first run.
BTW, the MMP version 4.6 is way more stable and easier to use. I would recommend you subscribe and download the latest MMP version from mazdatech if you don't have one already.
DISCLAIMER: use at your own risk. All information and application posted are provided for educational purpose only. In no event shall the author be held liable for any action you may incur. By downloading the application, you have read and understand the disclaimer.
Have fun
![Wink](https://www.rx8club.com/images/smilies/wink.gif)
Last edited by seikx8; 02-15-2007 at 12:30 AM.
#297
so we had a couple of mazda engineers come out and try to "fix" a problem with a cx7, and to make a long story short mazda can plug a laptop right into the obd2 port and reprogramme anything in the ecu (timing, boost, etc etc)
forget hacking the thing, the software already exists....
forget hacking the thing, the software already exists....
#298
Registered User
Join Date: May 2005
Location: Madrid, Spain
Posts: 213
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by j9fd3s
so we had a couple of mazda engineers come out and try to "fix" a problem with a cx7, and to make a long story short mazda can plug a laptop right into the obd2 port and reprogramme anything in the ecu (timing, boost, etc etc)
forget hacking the thing, the software already exists....
forget hacking the thing, the software already exists....
This thread is amazing anyway.
#299
No respecter of malarkey
iTrader: (25)
Originally Posted by j9fd3s
so we had a couple of mazda engineers come out and try to "fix" a problem with a cx7, and to make a long story short mazda can plug a laptop right into the obd2 port and reprogramme anything in the ecu (timing, boost, etc etc)
forget hacking the thing, the software already exists....
forget hacking the thing, the software already exists....
of course Mazda like any manufacturer has the software, but they're not inclined to make it public, sheesh ...
![Pfanndinator](https://www.rx8club.com/images/smilies/pfanndinator.gif)
Cobb Tuning has software, but it's not for sale yet
Racing Beat has access to part of the software, but they're not intending to share it
a few others in the works too
#300
Gotta Love Two Strokes
Originally Posted by TeamRX8
of course Mazda like any manufacturer has the software, but they're not inclined to make it public, sheesh ...
Cobb Tuning has software, but it's not for sale yet
Racing Beat has access to part of the software, but they're not intending to share it
a few others in the works too
![Pfanndinator](https://www.rx8club.com/images/smilies/pfanndinator.gif)
Cobb Tuning has software, but it's not for sale yet
Racing Beat has access to part of the software, but they're not intending to share it
a few others in the works too