Contents of ECU dump

by **ludvik** » Tue Jan 21, 2014 5:37 pm

Hi!

When I open an ECU dump (posted by Audi A3 user) with WinOLS I see in Project Properties in ECU section that the processor is PowerPC.

Does it mean that beside maps there is also ECU software in ECU dump?

Best Regards,
Ludvik

by **whereisit** » Sat Jan 25, 2014 6:34 pm

The dump unloads all data out of the ROM which holds information on everything you car uses. There is information for maps, check sums, scalars, error coding, etc. A lot of information. I believe when it mentions the processor (PowerPC) it is talking about what the actual Chip is on the ECU board.

by **lauko** » Sat Jan 25, 2014 7:49 pm

Interesting. But still these are ECU dumps, so you probably don't get all the other "software" for climate control, power windows, etc? That would be too awesome :)

by **ludvik** » Wed Jan 29, 2014 11:02 pm

Hi!

I did a little bit of analysis of Ford Fiesta TDCI 1.4 ECU dump. WinOLS said that the CPU was C167CR. With the help of disassembler I found the following piece of machine code at address 00270h:

00270 : CA 00 9E 32 CALLA CC_UC,329EH
00274 : 49 81 CMPB RL4,#1
00276 : 3D 14 JMPR CC_NZ,02A0H
00278 : CA 00 CE 32 CALLA CC_UC,32CEH
0027C : 49 81 CMPB RL4,#1
0027E : 3D 10 JMPR CC_NZ,02A0H
00280 : E6 FC 00 FE MOV R12,#0FE00H
00284 : E6 FD E0 FE MOV R13,#0FEE0H
00288 : CA 00 1E 31 CALLA CC_UC,311EH
0028C : 47 F8 20 00 CMPB RL4,#0020H
00290 : 3D 07 JMPR CC_NZ,02A0H
00292 : F2 F4 08 50 MOV R4,5008H
00296 : F2 F5 0A 50 MOV R5,500AH
0029A : DA 00 02 3C CALLS 0,3C02H
0029E : CB 00 RET

It seemed reasonable to me and I checked the contents of the first CALLA address (329Eh):

0329E : D7 50 24 00 EXTP #0024H,#2
032A2 : F2 F4 00 00 MOV R4,0000H
032A6 : F2 F5 02 00 MOV R5,0002H
032AA : 46 F4 90 48 CMP R4,#4890H
032AE : 3D 05 JMPR CC_NZ,32BAH
032B0 : 46 F5 24 42 CMP R5,#4224H
032B4 : 3D 02 JMPR CC_NZ,32BAH
032B6 : E1 18 MOVB RL4,#01H
032B8 : 0D 09 JMPR CC_UC,32CCH
032BA : 46 F4 FF FF CMP R4,#0FFFFH
032BE : 3D 05 JMPR CC_NZ,32CAH
032C0 : 46 F5 FF FF CMP R5,#0FFFFH
032C4 : 3D 02 JMPR CC_NZ,32CAH
032C6 : E1 28 MOVB RL4,#02H
032C8 : 0D 01 JMPR CC_UC,32CCH
032CA : E1 08 MOVB RL4,#00H
032CC : CB 00 RET

In fact it looks like a routine: contains RET and all JMPR addresses are sensible.

So it seems that there is some machine code in ECU dump but I agree: it would be great to see software for other "peripherals" :)

Best regards,
Ludvik

by **whereisit** » Thu Jan 30, 2014 5:14 am

lauko wrote:Interesting. But still these are ECU dumps, so you probably don't get all the other "software" for climate control, power windows, etc? That would be too awesome :)

There may very well be a doorway leading to information from other computers in the car as the ECU is now-a-days located on the CAN and the CAN typically connects the ABS, Instrument Cluster, and Climate/Infotainment systems together. I could foresee at least a pathway being available for you to pull data on. It's all updated and flashed typically through an OBD port or Flash port (for some MB) so the information is just waiting to be found. :thumbup: