Jeff tries to make a hot rod out of a farm truck. '92 Mighty Max

[aaronatstate]

[quote=""Jeff V.""]Tonight I was driving home, and I had a moment of inspiration. Sadly, it has not panned out.

One of the problems I'm having is finding a good way to drive the MIVEC solenoids. I can't use a 2006 Eclipse ECU right now because of the flashing problems and the drive by wire.

Prior to 2006, the only other cars with MIVEC and flash ECUs were the FTO GP and Pajero Evo. But I haven't found any of their ECUs for sale on the international auction sites. I can't even find pictures of the circuit board from one.

This is where the inspiration came in. Even if I can't find one of those ECUs, surely another Mitsu ECU uses the same circuit board. It would have the paths for the MIVEC circuit, even if all the electronics weren't there. Sort of like the VICS and boost solenoid circuits on the US 3S ECUs. I know the pinout for the FTO, so tracing out the MIVEC circuit would be cake. Armed with that information, I might be able to modify a US ECU to match.

What other V6 cars used the 4 plug, 2 row flash ECU, and were sold overseas?

European 99 VR4

I already have one of those!

Or so I thought. I can't find it. I'm certain I didn't sell it, but I can't remember if I loaned it to Adam or something like that.

At least I know my theory holds some water. I pulled the circuit board number from my old notes, and did a little Googling.

This is off a European 6A13 Galant. There's the path for the MIVEC circuits, right there.



So I can't find my EU VR4 ECU, which means I can't trace the circuit. Without knowing which CPU pins it goes to, I can't pull the MIVEC maps out of the 6G74M Pajero Evo ROM I have. Without the maps, I can't build or modifiy a flash file to work with a US ECU.

Not that that really matters. None of the US ECUs have anything remotely like those empty circuit paths. So even if I could figure out the ROM and the electrical parts, I still don't have a circuit board I can use.

Maybe I'll think of something else. The truck is still weeks away from needing an ECU anyway.[/quote]

So if you can figure out which CPU pins the MIVEC would it be possible to build the circuit external to the ECU and then run wires into the ECU and solder them to the CPU pin? Or is that a stupid idea (wouldn't be upset if it was, I know nothing about this stuff :lol

[Jeff V.]

I actually thought of the same idea. It's not terrible. The bigger problem is just building it so it's durable.

I think I'm going to scrap this idea. I was really hoping the transistor pads would be present on some easily available US ECU. They're not. It'd be nice to do as a short term fix, but not if I'm having to change the connectors and import ECUs from Europe.

Steve is running his truck with a window switch, and as far as I know, that's working out for him.

If I'm going to sink time and money into reverse engineering something, it'll be the drive by wire Eclipse ECU. That's been the end game all along. I'll just run it without the MIVEC in the short term.

[aaronatstate]

Is the basics of the MIVEC like, above XXXX RPM the solenoid is engaged, or is it more sophisticated where it is constantly adjusting the valve timing?

[Jeff V.]

As far as I can tell, it's an on-off thing. The main problem is you need to run the solenoids on a pulse width modulated circuit to keep them from getting too hot.

I powered one up on a bench and ran it wide open for a few minutes. It got over 140* according to my laser thermometer. I shut it down at that point.

Since there's problems disassembling the 06+ M32R software, I was hoping to find an older one I could convert and use while I figure out the newer ECU. Nothing is easy with this.

[stealthee]

From driving my Lancer MIVEC definitely just feels like it's on/off. It kicks in around 4000 RPM. It's completely different under and over that.

[ChargerX3]

Yea it’s just on or off. The trick part is that it is pulse modulated with a voltage drop after the initial kick.

Window switch works fine as I don’t tend to run the engine over 4K rpm for extended periods of time so it doesn’t overheat.

It would be nicer though to have a permanent solution via our ecu rather than another box to control that circuit.

[DCIV]

There is a 2wd and 4 cyl 20 mins from me with 165k and be wants 800 bucks. Says the head is cracked.

Wonder if the front subframe from a 3/s would bolt up?


Coop

[vr4]

[quote=""DCIV""]There is a 2wd and 4 cyl 20 mins from me with 165k and be wants 800 bucks. Says the head is cracked.

Wonder if the front subframe from a 3/s would bolt up?


Coop[/quote]
After a little cutting and welding it should go right in no problem

[DCIV]

[quote=""vr4""]After a little cutting and welding it should go right in no problem[/quote]

Lol I’m sure it wouldn’t but it would be the lightest weight 3/s out there!

Actually that truck is the perfect for a 4g swap.


Coop

[stealthee]

There are a lot of 4g swapped Maxes out there already.

[ChargerX3]

Yea not an easy swap. Front subframe is different on rwd. Ls1 swap would be just as easy at this point.

[Jeff V.]

The game has changed.

[DCIV]

I understand the bench set up, but have no idea what you accomplished....minus I’m sure it’s significant.


Coop

[mjannusch]

Whoa - okay, this just got interesting!

[ChargerX3]

GM programmer works with 4g eclipse? No way??? How did you get the code? Will it reflash?

Hell I would just like to verify my fuel and timing tables at this point.

[Jeff V.]

Sorry to keep you guys in the dark on this. I promise I wasn't trolling. I've just been really busy.

Yes, I reprogrammed it. Just now actually.



But that's not the cool part. You guys might remember in the past I talked about something called J2534. It's a specification that lets someone build a generic tool that supports the standard, and then a manufacturer can write reflash or diagnostic software that communicates using that standard.

So someone like Tactrix or DrewTech can make a J2535 compliant tool, and Mitsubishi can make J2534 compliant reprogramming software, and the two can talk to each other successfully.

Since 2008 (I think) manufacturers have been required by law to provide J2534 software for reprogramming anything that handles emissions systems. Mainly engine computers. But it's subscription based.

GMs MDI tool, which I bought for my Corvette, is also J2534 compliant. So that's why the Mitsu software will talk to the GM tool. Big deal, right? I've had my Tactrix OpenPort 2 for years. Why now?

That's the cool part. Two cool parts, actually.

1. The Evo guys figured out how to use the Mitsu software without the subscription. So now instead of only having one shot at this, I can use it as often as I need to.

2. Someone else wrote a CANbus sniffer for the OpenPort2.

Are you seeing where this is going?

I have software that's no longer subscription locked.
I have a tool I can use to reprogram the ECU.
I have a second tool that can eavesdrop on the ECU being reprogrammed.





So I hooked up both the MDI and the OP2 to my bench ECU using a Y-cable, fired up the eavesdropper, and let the bits fly.



While the Mitsu software and MDI were doing their thing, the OP2 was eavesdropping on the conversation.

Code: Select all

[419425707] 00 00 07 E0 02 10 85 00 00 00 00 00 	//Tool requests a diagnostic session
[419445625] 00 00 07 E8 03 7F 10 78 38 34 30 44 	//ECU says hang on a moment
[419694713] 00 00 07 E8 02 50 85 78 38 34 30 44 	//ECU says diagnostic session ready. What do you seek? 
[419754078] 00 00 07 E0 02 27 05 00 00 00 00 00 	//Tool says, I seek the holy grail! (Request security challenge)
[419754622] 00 00 07 E8 06 67 05 F5 C1 CD 41 00 	//ECU says, What is the air speed velocity of an unladen swallow? (Reply with security challenge)
[419842789] 00 00 07 E0 06 27 06 E6 1B 39 9B 00 	//Tool says, African or European? (Calculate password based on challenge)
[419844467] 00 00 07 E8 03 67 06 34 C1 CD 41 00 	//ECU says "agghhhh"  and now there's nobody guarding the bridge (Correct password entered)
[419943127] 00 00 07 E0 10 0C 3B 9A 01 01 00 18 	//Tool says, I'm now going to reprogram you.
[419943409] 00 00 07 E8 30 00 00 FF FF FF FF FF 	//ECU says....nothing.  Because it's being reprogrammed.
[419943953] 00 00 07 E0 21 05 06 00 00 00 01 00 
[419959272] 00 00 07 E8 03 7F 3B 78 FF FF FF FF 

This is just a tiny sample. The full log of the reflash is much larger.

Thanks to that code log, I can either try to write my own tool to reflash the ECU directly, or I can find a way to convert my own ROM files into the format the Mitsu tool uses.

On that note, I also found a pile of IDAPro tools written by a Johns Hopkins University student that are used for reverse engineering embedded software....like the Mitsu code that runs on the M32R chip. I finally have a tool that works for processing those very painful indirect memory references the M32R uses. Disassembly will still be a big pain, but it'll be a lot easier than it was.

There's still a lot of work to be done, but I think I might finally be motivated to finish this thing.

[Chris GTO TT]

Wow that is pretty amazing! The details are a bit over my head, but I think I get the basics.

[Jeff V.]

Wow that is pretty amazing! The details are a bit over my head, but I think I get the basics.

Ask questions. It's ok!

[mjannusch]

That's awesome! Might unlock some interesting ECU possibilities......

[DCIV]

Okay I will bite.

So it’s no big deal to can flash the ecu, it’s cool because it’s GM stuff and now free all because of those peasky Mitsu’s you’ve dealt with all your life. So maybe mitsu’s have finally given back to Jeff! Haha.

But the real cool part is that you can communicate directly with the ecu that we couldn’t before? We just flashed the programming not actually changed it? So could you do things like add different functions that was not originally there? Over clock the ecu? Change peramators for things like bigger displacement?


Coop