PDA

View Full Version : ECU hacking/tuning/chip tuning -whatever you wanna call it!



kj16v
22-06-2008, 23:27
Hi all. Over the past few months I have been delving into the world of Clio ecu hacking. I've been speaking to a few other like minded people and I thought I would start a thread that all can contribute to.

Enthusiasts of other makes have similar ecu tuning communities so why, not the Renault community? For example, Honda ECUs were cracked a long time ago and the know-how is common knowledge.

My ultimate goal is to produce a ecu mapping software for the f7p/f7r, like Fastchip's (now defunct) Rtuner. I now know that Rtuner was very limited. It's possible to do a whole load more with the ecu.

Unfortunately I'm no programmer but, if there any like-minded people out there hopefully we can work together to produce something good.

To date I have some stock Clio 16V bins (binary files), and bin from my Rtuner chip (but the output's been scrambled!).

I'm currently trying to write an xdf (bin definition file) in TunerPro RT, TunerPro keeps crashing when I try it!

I don't want this to be some anal closed community for LEET speakers! all are welcome to contribute and share info and files. If anybody wants any bins etc. I'll be happy to send them to you. If anybody already has an xdf for it that's ****ing brilliant! Let me know!

stan
23-06-2008, 08:51
Good effort mate :D

Coops
23-06-2008, 10:33
i need to do some research mate into general stuff as all thats french to me, but i need to understand this etc so nice effort 8)

AndyFielder
23-06-2008, 12:03
I have quite a library of binary from various maps etc.

The biggest problem is getting past the copy protection some chip tuners use.

There is also software that will enable anyone to tweek, tune, edit, view eproms for many many cars. Including clios!

Andy

gamefreaks
23-06-2008, 18:18
Hi,

My name is Zak. Someone over at Retro-Renault linked your post.
Don't have any F7P/R powered cars at the min. But I used to have a Ph1 19 16v.

Sounds like an interesting project, I might be able to help.

Anyways, I am a C/C++/C# programmer. Not much experience in ecu stuff, but have done a few projects dissasembling code from different architectures etc, and I am a damn good application programmer.

I guess what you are looking to do initially is disassemble the rom and figure out where the data tables are and how they work.

Further down the line, I guess it would be interesting to have a crack at writing an Open-Source ECU? (Dissassemble, figure out what its doing, re-write in C, test, repeat!)

Drop me an email sometime.

MAXIBOY
23-06-2008, 18:20
^^^^

good first post...

kj16v
24-06-2008, 00:26
Hi Zak. Spot on mate! I have the locations of a few tables, courtesy of "Gigaz" on Retro-Renault. I can email them and some other stuff to you (and anybody else who wants them) if want.

Andy: Sounds good mate. do you have a standard valver or Willy bin? I've got several valver bins but they're all quite differnt from one another.


Does anyone know how you can host files so people can download them?

simonr85
25-06-2008, 12:21
Does anyone know how you can host files so people can download them?

How big are the files? I can probably provide you some sort of hosting service, and how many people would be downloading?

AndyFielder
25-06-2008, 12:29
got williams, valver cup ones, cammed ones, and turbo ones.

AndyFielder
25-06-2008, 12:29
I can host them on my website if you like.

Oszy
25-06-2008, 17:20
Does anyone know how you can host files so people can download them?

How big are the files? I can probably provide you some sort of hosting service, and how many people would be downloading?


Every EPROM contains a 64kbyte program.
Actually I have a manual in Hungaryan language, what can be adjusted and how, but actually even I could not understoud, so I do not feel the strength to translate it to english :))
I have a friend of my who can easily adjust my program. I have several programs from him, if you need I can send it by e-mail, or burn to an EPROM. I am not a dealer :)

Regards,
Oszy

J o n
25-06-2008, 18:19
there's an easier option guys, just use WinOLS, speak to Gunner ;)

clio_rsi_turbo
25-06-2008, 21:40
:discussion:

kj16v
27-06-2008, 23:52
there's an easier option guys, just use WinOLS, speak to Gunner ;)

Is this what Gunner uses?

I've just downloaded a demo copy of WinOLS and I'm not finding it easy to work with. Also, it's not free and the company, EVC, only deals with businesses.
So looks like it may be a non-starter to me, but cheers though. I might PM him. I hear hie's very hard to get hold of at the moment?

J o n
28-06-2008, 10:32
yeah it's the program Gunner uses and if anyone knows of Chip Wizards he uses this too. It's hex based so a ****ing pain to learn, but I guess as with anything once you master it then you can do what you like :)

Gunner's not on here much, but if you want I can get him to contact you pal

kj16v
01-07-2008, 10:35
Gunner's not on here much, but if you want I can get him to contact you pal

Cheers that would be much appreciated.

summeh
01-07-2008, 11:38
Doesn't gunner just copy chips using a chip copier.

gamefreaks
07-07-2008, 17:13
Hi Zak. Spot on mate! I have the locations of a few tables, courtesy of "Gigaz" on Retro-Renault. I can email them and some other stuff to you (and anybody else who wants them) if want.

Andy: Sounds good mate. do you have a standard valver or Willy bin? I've got several valver bins but they're all quite differnt from one another.


Does anyone know how you can host files so people can download them?

Ok, lets try again! The forum spat my last post into the bit bucket!

gamefreaks
07-07-2008, 17:18
Hi Zak. Spot on mate! I have the locations of a few tables, courtesy of "Gigaz" on Retro-Renault. I can email them and some other stuff to you (and anybody else who wants them) if want.

Andy: Sounds good mate. do you have a standard valver or Willy bin? I've got several valver bins but they're all quite differnt from one another.


Does anyone know how you can host files so people can download them?

Ok, lets try again! The forum spat my last post into the bit bucket!

Can't seem to edit posts either! 8)

Sorry not been on for a while.

Anyways, we could really do with somewhere to beable to dump info as we get it. A Wiki or similar.

But, yes, by all means, please do send me what you have and I will have a look and see what I can figure out.

Hex-based tools sound pretty crude to me so I'm sure we can create something a bit more intuiative than that with a bit of research.

My e-mail addy is in my profile. MSN too, but i'm not on very often.

Regards,

-Zak

kj16v
07-07-2008, 20:58
Cheers Zak. I'll email you some info and programs hopefully this week.

kj16v
07-07-2008, 22:01
Hi Stan These are the tables I get accosding to the file locations I have and the bin that these tables are based on. Note the two random peaks in the injection graph. Can't be right :?

Injection
http://img98.imageshack.us/img98/1393/cliofueltablefr6.jpg (http://imageshack.us)
http://img98.imageshack.us/img98/1393/cliofueltablefr6.74333485a7.jpg (http://g.imageshack.us/g.php?h=98&i=cliofueltablefr6.jpg)
http://img120.imageshack.us/img120/3684/cliofuelgraphbw5.jpg (http://imageshack.us)
http://img120.imageshack.us/img120/3684/cliofuelgraphbw5.ede75b2f36.jpg (http://g.imageshack.us/g.php?h=120&i=cliofuelgraphbw5.jpg)

Ignition
http://img134.imageshack.us/img134/1633/clioignitiontablezp1.jpg (http://imageshack.us)
http://img134.imageshack.us/img134/1633/clioignitiontablezp1.ffb08fd768.jpg (http://g.imageshack.us/g.php?h=134&i=clioignitiontablezp1.jpg)
http://img55.imageshack.us/img55/4715/clioignitiongraphpc0.jpg (http://imageshack.us)
http://img55.imageshack.us/img55/4715/clioignitiongraphpc0.31645dfdbc.jpg (http://g.imageshack.us/g.php?h=55&i=clioignitiongraphpc0.jpg)

summeh
07-07-2008, 22:09
i'll see about creating a sub forum for ECU related stuff if you guys are interested?

kj16v
07-07-2008, 22:12
For anyone who wants to know what all this stuff is about, read this. Obviously none of the bin locations apply to our ECU, but the general jist of it is the same. Enjoy!:

http://cherrypicker.tripod.com/id10.html

kj16v
07-07-2008, 22:13
i'll see about creating a sub forum for ECU related stuff if you guys are interested?

Brilliant mate :D

stan
08-07-2008, 10:25
The spike on the fuelling map, on the right, around max rpm and no load...this is on over-run. typically fuelling is given here so that when you come back on throttle, there is no surge since fuel is heavier than air, and therefore takes longer to reach the back of the inlet valve.

as for the spike on load, I can only assume this is down to the VE that the head/cam combo is giving.

kj16v
09-07-2008, 22:39
Got a bin from my own stock ECU today. Can I send it to someone to host?

Stan Sorry mate. Not been ignoring you, Hadn't yet had a chance to reply to your PM properly. :oops:

AndyFielder
10-07-2008, 09:24
i can host it, send me an email and i will put it on the net

kj16v
11-07-2008, 20:42
i can host it, send me an email and i will put it on the net

Cheers. Emailed to heading@gmail.com

summeh
17-07-2008, 01:28
On those graphs you posted KJ, why is there little/no ignition advance at high RPM's? I know that after about 2.5k-3k rpm the amount of igition advance you need tails off, but didn't know it dropped off. Or am I reading that graph wrong?

summeh
17-07-2008, 18:32
btw KJ, in what way is Rtuner limited? As I've been looking in to this recently also.

kj16v
19-07-2008, 00:16
On those graphs you posted KJ, why is there little/no ignition advance at high RPM's? I know that after about 2.5k-3k rpm the amount of igition advance you need tails off, but didn't know it dropped off. Or am I reading that graph wrong?

The graphs above are from a bin I downloaded off a site. So I don't know whether that one works.

I made a bin of my own standard ecu chip (graphs below). I going to use this as the standard because I know it works. I emailed my bin, along with my current xdf, to AndyFielder, so it should be hosted on his site, for anyone who wants to download them.

http://img525.imageshack.us/img525/307/cliofuelgraphbk3.th.jpg (http://img525.imageshack.us/my.php?image=cliofuelgraphbk3.jpg)

http://img185.imageshack.us/img185/5161/clioignitiongraphmn3.th.jpg (http://img185.imageshack.us/my.php?image=clioignitiongraphmn3.jpg)


With Rtuner all you can do is adjust the the fuel/ign maps, and switch between open and closed-loop modes. ie. running with or without the lambda sensor.

It is possible to make a hugely more powerful program. If you can decipher the chip then it is possible, for example the rpm and load breakpoints can be adjusted, ecu can be set to closed-loop at your choice of revs/load, startup maps can be adjusted, same for water temp enrichment, etc, etc... Most of which most people wouldn't need, but it's all there.

stan
19-07-2008, 17:49
its not live adjustment with the RTuner, thats the drawback.

i'll have an emulator in a week or 2, so live adjustments are possible.

Daz.
19-07-2008, 18:04
Great thread chaps - I'm looking forward to this developing

kj16v
19-07-2008, 19:43
its not live adjustment with the RTuner, thats the drawback.

i'll have an emulator in a week or 2, so live adjustments are possible.

Yeah, I'm looking at getting an Ostrich emulator from Moates. Did you register with that website I sent you the link to?

Got any more info on table locations or anything else interesting?

stan
19-07-2008, 21:18
yup registered on that forum, but havnt looked on it yet. will get some time on it this week.
Im ordering the APU1 Autoprom PAckage

kj16v
17-08-2008, 14:32
So, Stan what's happining then, Any news?

I working on something that could be very promising. More on that soon :wink:

bakakas
06-09-2008, 06:16
Hello guys i'm from greece and i own a clio 1.8 16v and i am trying to make a chip for my clio also. I have in my hands a chip from superchip and 2 chips bought from ebay. I read them but i dont have the stock bin to compare them. The 2 from ebay is just the same but with the rev limit different. Also the ebay chip has far too advanced ignition map but i dont have a stock one to compare it. can someone send me a stock bin?

kj16v
09-09-2008, 12:57
Hello guys i'm from greece and i own a clio 1.8 16v and i am trying to make a chip for my clio also. I have in my hands a chip from superchip and 2 chips bought from ebay. I read them but i dont have the stock bin to compare them. The 2 from ebay is just the same but with the rev limit different. Also the ebay chip has far too advanced ignition map but i dont have a stock one to compare it. can someone send me a stock bin?

Hi, Andyfielder should have my stock bin hosted on his site. IF not, I'll email the bin to you.

cliokongen
09-09-2008, 13:21
Very interesting read this :)

Michael

swiss
13-09-2008, 01:49
Got any more info on table locations or anything else interesting?

I've got some one.

bakakas
13-09-2008, 04:38
Got any more info on table locations or anything else interesting?

I've got some one.
Can you share them please? I found that the addresses of the rev limiter isn't right for me. I found the one that work for me and it is 4313 for the limiter and 4315 is the address which says where to start the engine revving

kj16v
02-10-2008, 14:30
Things have been hectic for the last few months so haven't much time to work on Cio stuff. I found a TunerPro definition file for the Clio 16V a while back. I had been working on modifying it a bit and translating it into English. It's unfinished but I thought I'd post it up anyway.

Be good if someone could test it and found out if the locations are correct. Bit difficult for me to check since I haven't got a 16V any more!

kj16v
02-10-2008, 14:32
Hey, the file didn't come up! Oh well, PM me and I'll email it to you!

Or Andyfielder, do you mind hosting it for me?

sideways danny
13-10-2008, 00:19
hey, this is very interesting :) I've been using Tunerpro for about 18 months, and a moates ostrich for a few years now but only on nissans. Very interested to get involved with the clio stuff :)

kj16v
15-10-2008, 10:45
Hi, well you're very welcome to a copy of my valve xdf. I'd love to know how well all the table work, as I don't own a 16v any more!

Do you work at GDI then?

sideways danny
15-10-2008, 19:54
pm on it's way. And yes I work at GDI :)

Oszy
12-11-2008, 11:18
Hi all!

Sorry for just to came up with a question, but does anyone know where is the idle data in the Williams program? I know it is handled by the ECU, but do not know where to make the idle adjustment.

Thanks in advance.

Best Regards,
Zsolt

kj16v
12-11-2008, 22:20
Hi all!

Sorry for just to came up with a question, but does anyone know where is the idle data in the Williams program?

Hi, I think - it's from 4200h - 4208h. Not 100% sure on that though.

In the xdf I have it labeled as IAC

Oszy
17-11-2008, 15:36
Hi all!

Sorry for just to came up with a question, but does anyone know where is the idle data in the Williams program?

Hi, I think - it's from 4200h - 4208h. Not 100% sure on that though.

In the xdf I have it labeled as IAC


Thanks, but unfortunately not! :?

Oszy
19-11-2008, 09:50
maybe handled by another eprom?? :?

sideways danny
02-12-2008, 02:52
found this, tables are labeled in french though

http://tunerpro.markmansur.com/download/bindefs/Renault/Clio16S_7494.xdf

kj16v
08-12-2008, 01:03
Hi Dan. That's the same one I started translating into English.

Oszy
08-12-2008, 11:12
found this, tables are labeled in french though

http://tunerpro.markmansur.com/download/bindefs/Renault/Clio16S_7494.xdf

So the idle is not handled by this Eprom :((((((((((((((

preston420
16-01-2009, 14:24
hi iv got a williams 1 but i all so bought a williams 2 for a few spares im selling the ecu out of it if any one wants it, its been chiped and remaped to over 175bhp looking for no less than £100 let me no if any one wants it cuz i have no use for it due to the fact i want mine standard cheers mark

kj16v
16-01-2009, 16:06
^^For Sale section mate :) ^^

preston420
16-01-2009, 19:39
kk sound mate im new to the site cheers for letting me no

sideways danny
14-03-2009, 02:58
found this, tables are labeled in french though

http://tunerpro.markmansur.com/download/bindefs/Renault/Clio16S_7494.xdf

So the idle is not handled by this Eprom :((((((((((((((

not looked at this in ages as things have been hectic, but going to get back into it now. Basically all the .xdf files I've found or have been sent are only useful on 128k chipped ECUs (valver) the XDF for the 256k ECU (williams) is going to be totally different. Not sure what cross-overs there are on compatibility and what was used in different years so anyone who knows, it would help loads :)

sideways danny
14-03-2009, 03:39
found this, tables are labeled in french though

http://tunerpro.markmansur.com/download/bindefs/Renault/Clio16S_7494.xdf

So the idle is not handled by this Eprom :((((((((((((((

not looked at this in ages as things have been hectic, but going to get back into it now. Basically all the .xdf files I've found or have been sent are only useful on 128k chipped ECUs (valver) the XDF for the 256k ECU (williams) is going to be totally different. Not sure what cross-overs there are on compatibility and what was used in different years so anyone who knows, it would help loads :)

got that the wrong way round, the XDFs only suit 256k chips (32k bins)

sideways danny
14-03-2009, 04:16
sussed it, was being unbelievably dim. the 16k bins need stacking for the XDF to work, strange way for it to have been written but sorted :)

16v_paddy
14-03-2009, 04:22
clear as mud that :? made my head hurt just reading it :lol:

sideways danny
14-03-2009, 04:46
clear as mud that :? made my head hurt just reading it :lol:

probably best if it got deleted TBH, delerious ramblings of an ill man that's slept all day and decided to look at hexidecimal tables at 2am

summeh
19-04-2009, 02:41
The ecu's use 256kbit chips (8x32kbit), which equals 32kbytes, hence the bin files being 32kbytes in file size.

However the map/program data is actually only stored in the top half (as you mentioned being stacked). They probably avoided using the smaller 128k chips because they were almost end of life when renault/siemens put the ecu together.

So if you've a 16kbyte map file then you simply need to stack it at memory location 4000 hex.

This also means you can have multiple maps per chip. So on a 256 chip you can store 2 maps, although the ECU will only EVER see the data starting at 4000 hex because thats where it looks.

Similar you could use 512k chips or larger.

There are some pretty decent "flashable" 512k chips available, although they seem to be drying up now. but they are pretty handy if you need to test a few things and don't have access to an emulator.

SST do one... SST27SF512 or SST27SF256. Buggered if I can find any in stock anywhere though.

summeh
19-04-2009, 02:43
Those definition files have been on tunerpro website for quite some time btw :wink:

kj16v
22-04-2009, 10:54
Speaking of having to maps on one chip, I was reading a site recently showing how you can swap between two maps at the flick of a switch. Sweet 8) I'll put a link to it if I find it again.

Hey Dan: Have you ripped a bin from any genuine Williams eprom? If so, I don't suppose you could email it to me could ya? :D

summeh
22-04-2009, 14:06
Speaking of having to maps on one chip, I was reading a site recently showing how you can swap between two maps at the flick of a switch. Sweet 8) I'll put a link to it if I find it again.

Hey Dan: Have you ripped a bin from any genuine Williams eprom? If so, I don't suppose you could email it to me could ya? :D

Why dont you just download the one from the tunerpro website? definition file is also there, altho the def is the same as the 91onwards clio 16v 1.8 (cat/lamba sensor).

kj16v
22-04-2009, 15:49
I already have both the bin and xdf from the site, but I always like to use original bins taken from a known chip where possible. That way I know its a good'n, and the exact model/ecu, etc.

summeh
22-04-2009, 15:50
pm your email addy i'll send you over my bin later tonight that i extracted from my standard williams map.

kj16v
23-04-2009, 08:14
PM'd. Cheers mate

treishu
01-05-2009, 12:53
good luck guys.

tommysb
17-05-2009, 22:04
Hi,

what sort of hardware is needed to program the ECU's 'chip'? As far as I can tell, this is just an EEPROM? Does anyone have a part number for the EEPROM that's used in a clio16v/williams?
Is the basic idea that the EEPROM just holds a lookup table of values, for specific engine conditions?

kj16v
21-05-2009, 01:14
Hi. Yes that's it exactly. The original chip is a 27c256 OTP (one time programmable). It holds look-up tables for everything, ignition, fuel, temperature compensation, etc, etc. plus op-code.

To program a chip, you just need a programmer that will do 27256 eproms. To actually tune an engine, and make custom maps you need a lot more...

tommysb
21-05-2009, 22:03
Cool thanks. I've been reading up about this a bit more, looking at 27c256 datasheets and think it's possible to program the EEPROM in 'slow' mode just using a serial interface, and some simple circuitry.
In terms of tuning - TunerProRT looks like the best (value) solution with an EEPROM emulator, to sort the map out.
Is there a way of observing the effects that varying a parameter has, without a rolling road?

sideways danny
21-05-2009, 23:56
you will need

-Wideband Lambda
-Willem eprom burner (ebay, very cheap)
-Emulator (I prefer the Moates Ostrich, and i'll be updating to an ostrich 2 as soon as tunerpro 5 is released)
- a method of monitoring knock/detonation
-

tommysb
26-05-2009, 21:52
Makes perfect sense, cheers Dan. Still learning about this (car) stuff, but work in Electronics, so the programming etc is all clear!
Translating from the french shouldn't be too necessary - there's only about 4 parameters by the looks of it. If you want a hand with anything specific, I'll ask my sister, she is a native speaker!

sideways danny
26-05-2009, 23:30
there's more parameters than that, I have the 2 different XDF files and there's non duplicated tables in each, which aren't identified. I believe on of the unknown tables to be the MAP sensor VQ table

I'd like to find

-Acceleration fueling
-Injector k value/Mspb
-MAP voltage/kpa
-Lambda feedback controls

tommysb
05-06-2009, 20:48
I'd like to find those too! I'm looking, I'll let you know if I get anything going.

Just programmed my first EEPROM. Nothing spectacular, just made sure that the data I want to put on it, actually appears and stays on it!

tommysb
05-06-2009, 22:20
Hi Dan, which files are you using with the alternate definitions? I've got a pretty good idea where the MAP table is now. But not sure!