Working With Diagnostic Data Cable & Software - Page 14

Gimpster · 12-20-2020, 10:14 PM

I have lurked on this forum for years, and finally I will register to post.

Our friend has dumping the flash working in HUD ECU Hacker now! Here is the dump from my 2020 Hawk DLX. I believe the VE table is 17x33 and at location 0x6E53. Start playing with creating a TunerPro definition, but don't really know the scalars yet

Have couple tables which I *think* are timing related, but not sure on those yet. They are at 0x6525 and 0x6781. This ECU has strange (to me anyway) size tables.

I used to do Honda and Mitsubishi ECU hackery as a hobby, this is when it started to get fun for me. A disassembly of the bin sure would be nice.

motoshop · 02-09-2021, 06:15 PM

Hello friends,

I am james from motoshop Lommel. We are in Belgium and with the E5 restrictions we got a lot of trouble with the scooters and bikes we sell. I was recently able to read the .bin file from the Delphi MT05.2 ECU used in Bullet 125cc and also the 50cc from the scooters with EFI. A lot of research later i am able to configure speed, rev lim and tune the maps. Thanks to Hud ECU Hacker!
I now connect a scooter with the rongmao ECU and tried to download the bin file, but the connection is not stable. I can clear DTC and read parameters, but when i try to download, the connection gets aborted.

Any of you guys find a way to extract the bin file? I can help with the max speed and rev limiter, if i can flash the bin!!

Setup is a VAG cable for the moment, i ordered tacktrix openport J2534, but it didn't arive yet.

Also working on the Zontes G125cc, U125cc and U-1 125cc, as well as the 310 series. They got the bosch MSE 6.0 Ecu. Anybody able to help setup HUD ECU Hacker for this type off ECU or working flashtool for this one?

If anybody needs stock bins just PM me. I got several.

posplayr · 02-10-2021, 03:01 PM

Motoshop,
Thanks for posting. As Gimpster has not responded I will with what I know. He has been maintaining another thread and Katflap has continued to work on this problem. My understanding the main missing link to a low-cost ECU remapping is the reflashing of the ECU MAPS. The problem seems to be some combination of cheap USB convertors and the flash software.

You mention that the download is not stable. My guess is it is the cheap Chinese USB to serial conversion chips. I don't have any specific experience with the Delphi MT05 but have programmed USB to RS-232 in the past and has problems using adapters with clone chips. Basically, it drops bits and is otherwise unstable.

I think Gimpster has success using a genuine ELM327 although I don't think he has been able to reflash??? Considering the cost of alternatives even a $40 adapter is very cost-effective if it allows for a MAP reflash.

Keep us posted on progress using the tacktrix openport J2534.

Hopefully, Gimpster or Katflap can provide updates/corrections to my understanding.

motoshop · 02-11-2021, 04:13 AM

Posplayr,

thanks for the reply. My cable is original VAG K-line cable +€200,- so i wont think this could be the problem, still waiting on my openport. I found that the pin-out from different brands of scooter on the obd connector is different. Some use only 4 pins K-line, some 3 etc. If anybody needs extra background info to help let me know.

Also working on the bullit series 125cc with succes in remapping.

Looking for a way to extract .bin from bosch mse 6.0m for the zontes G125, U125, U-1 125, CF moto 650 series.

Greetings

hunitori · 02-19-2021, 12:00 AM

Quote:

Originally Posted by motoshop

Posplayr,

thanks for the reply. My cable is original VAG K-line cable +€200,- so i wont think this could be the problem, still waiting on my openport. I found that the pin-out from different brands of scooter on the obd connector is different. Some use only 4 pins K-line, some 3 etc. If anybody needs extra background info to help let me know.

Also working on the bullit series 125cc with succes in remapping.

Looking for a way to extract .bin from bosch mse 6.0m for the zontes G125, U125, U-1 125, CF moto 650 series.

Greetings

The only way reading bin for Bosch MSE6.0 is using WinOls and you will be swimming in data

motoshop · 02-19-2021, 03:49 AM

Hunitori,

Can i extraxt the complete bin with WinolS? And flashback edited?

Thanks

hunitori · 02-21-2021, 11:48 PM

Quote:

Originally Posted by motoshop

Hunitori,

Can i extraxt the complete bin with WinolS? And flashback edited?

Thanks

Do you have Whatapps? add me +84931865713

hexman · 10-27-2022, 06:19 AM

Quote:

Originally Posted by hunitori

The only way reading bin for Bosch MSE6.0 is using WinOls and you will be swimming in data

You can also use TunerPro. Maps on MSE6.0 are located near address 0x140000 and the best thing of MSE is the bin structure. Unlike Keihin ECUs the maps are separated from OPCODE and they are easily recognized. Every map has a kind of header where X and Y breakpoints number is indicated. Also X and Y breakpoints value are given in some of them.

The bad news - these binaries from MSE6.0 has near 3000 different routines ISO of 900-1000 for any Honda Keihin ECU. And the worst thing of all - address offsets are relative. r13 and r2 values are used as a reference for address offsets - this registers are writen at the inition of 2 binary sections with OPCODE. r2 and r13 values can be found searching for r2 and r13 operand usage in opcode window. But the 90% of routines still need to be executed in order to found which address it uses (maybe there is another way to do it, I don't know).

It means that Ghidra doesn't detects references to addresses unless you execute this particular routine and creates a references to all addrsses it W/R. A true PITA cos it's veery difficult to create decent memory map. And without memory map theere is no way to analyse the routines.

Personally I'm stuck with this ECU - of course I can see the maps, create xdf and so on but can't analyse the OPCODE as I'd like to.

P.D. Just sorted the reference problem - now all references to RAM are correct!

Se83 · 02-25-2021, 03:01 PM

Hello. help with the map definition file Delphi mt05.2

radekwrc · 08-15-2021, 05:42 PM

Hello
I also have such a store in Poland.
I failed to connect via Ecu hacker to my private bike keewaay rks E4 with Yeson ECU
I am trying to connect to the 50cc E5 bike as they are very weak now. Unfortunately, to no avail.
I do everything Raptorix wrote in help.
I am using elm327.
My bike has an ECU not a delphi but a Yeson, and this other bike has some Chinese invention.
I also have an application that reads errors and parameters and has a terminal !. Once connected to these vehicles, I typed the commands 81 and AT DPN, and typed the appropriate values into the xml file for the Ecu Hacker.
For the E5 vehicle I should enter the Ecu 11 and protocol 05 address for elm327. The protocol number gave progress, but the ECU address 0x11 gives nothing, the ecu hacker works best on the ECU 0x33 and protocol 0x05, but it disconnects. Something else is missing, can you help me?
Screenshot for ecu 0x11 and ecu 0x33
did you manage to connect to other ecu than delphi?

Rfoster950 · 09-16-2022, 12:24 PM

What is lastest version of hud hacker I see a 4.7 on other sites iare those lagit.. if not where can I find 3.8

cristianluchetti · 09-17-2022, 10:17 AM

Quote:

Originally Posted by Rfoster950

What is lastest version of hud hacker I see a 4.7 on other sites iare those lagit.. if not where can I find 3.8

In the link that you pass is the latest improved version and you should be fine if you have any questions, contact the author and he will be able to give you the oldest version, but you should not have problems using version 4.7 because it is fine

https://netcult.ch/elmue/HUD%20ECU%20Hacker/

krisztian_andre · 05-13-2024, 09:51 AM

Hi,

I have Lexmoto Urban 125 clone (lj125t-16) with a Delphi MT05 that is pulsating during idle and no load conditions. I adjusted the valves which made it stop bogging down (could have been simply that disconnecting the battery fixed it), but the idle still seems too high and pulsating. I am attaching my recording that I made with HUD ECU Hacker (this thing is great!). The rpm jumps around 5:30 is me revving it a bit otherwise I left it alone.

My idle seems hight and the rev cahnges correlate with IACV Correction. Why is that?

Graph:

https://postimg.cc/FYCkkyHQ

Recording:
https://file.io/PcNAG02hL053

https://file.io/PcNAG02hL053
https://file.io/PcNAG02hL053
https://file.io/PcNAG02hL053
https://file.io/PcNAG02hL053
Best regards,
Kris

Raptorix · Yesterday, 11:39 PM

Hello
Please create a graph from the Regal Raptor logfiles that are installed with the program and compare them with yours. You have problem with too much air entering the engine. This may be because your IACV is fully open or your throttle does not close. This would explain the far to high idle speed and also that the ECU regulates the IACV to zero which is ABSOLUTELY anormal. The ECU tries to close your IACV but still too much air enters the engine. Either your IACV is defect or your throttle does not close correctly. If too much air enters into the engine the engine runs too fast.

02-09-2021, 06:15 PM	#2
motoshop Join Date: Feb 2021 Posts: 3	Rongmao ECU Hello friends, I am james from motoshop Lommel. We are in Belgium and with the E5 restrictions we got a lot of trouble with the scooters and bikes we sell. I was recently able to read the .bin file from the Delphi MT05.2 ECU used in Bullet 125cc and also the 50cc from the scooters with EFI. A lot of research later i am able to configure speed, rev lim and tune the maps. Thanks to Hud ECU Hacker! I now connect a scooter with the rongmao ECU and tried to download the bin file, but the connection is not stable. I can clear DTC and read parameters, but when i try to download, the connection gets aborted. Any of you guys find a way to extract the bin file? I can help with the max speed and rev limiter, if i can flash the bin!! Setup is a VAG cable for the moment, i ordered tacktrix openport J2534, but it didn't arive yet. Also working on the Zontes G125cc, U125cc and U-1 125cc, as well as the 310 series. They got the bosch MSE 6.0 Ecu. Anybody able to help setup HUD ECU Hacker for this type off ECU or working flashtool for this one? If anybody needs stock bins just PM me. I got several.
	1

02-10-2021, 03:01 PM	#3
posplayr Join Date: Dec 2020 Location: Arizona Posts: 15	Motoshop, Thanks for posting. As Gimpster has not responded I will with what I know. He has been maintaining another thread and Katflap has continued to work on this problem. My understanding the main missing link to a low-cost ECU remapping is the reflashing of the ECU MAPS. The problem seems to be some combination of cheap USB convertors and the flash software. You mention that the download is not stable. My guess is it is the cheap Chinese USB to serial conversion chips. I don't have any specific experience with the Delphi MT05 but have programmed USB to RS-232 in the past and has problems using adapters with clone chips. Basically, it drops bits and is otherwise unstable. I think Gimpster has success using a genuine ELM327 although I don't think he has been able to reflash??? Considering the cost of alternatives even a $40 adapter is very cost-effective if it allows for a MAP reflash. Keep us posted on progress using the tacktrix openport J2534. Hopefully, Gimpster or Katflap can provide updates/corrections to my understanding. __________________ Potential Hawk DLX 250 Owner. Currently researching EFI tuning options for minor engine mods (trail port, 4 deg advanced plate, 10:1 CR). Prior bikes Suzuki 81 GS750EX, 83 GS1100ED. Long time member at GSResources.com
	2

09-16-2022, 12:24 PM	#11
Rfoster950 Join Date: Aug 2022 Posts: 8	What is the latest version of hud hacker What is lastest version of hud hacker I see a 4.7 on other sites iare those lagit.. if not where can I find 3.8
	0

02-11-2021, 04:13 AM	#4
motoshop Join Date: Feb 2021 Posts: 3	Posplayr, thanks for the reply. My cable is original VAG K-line cable +€200,- so i wont think this could be the problem, still waiting on my openport. I found that the pin-out from different brands of scooter on the obd connector is different. Some use only 4 pins K-line, some 3 etc. If anybody needs extra background info to help let me know. Also working on the bullit series 125cc with succes in remapping. Looking for a way to extract .bin from bosch mse 6.0m for the zontes G125, U125, U-1 125, CF moto 650 series. Greetings
	1

02-19-2021, 03:49 AM	#6
motoshop Join Date: Feb 2021 Posts: 3	Hunitori, Can i extraxt the complete bin with WinolS? And flashback edited? Thanks
	0

05-13-2024, 09:51 AM	#13
krisztian_andre Join Date: May 2024 Posts: 3	Hi, I have Lexmoto Urban 125 clone (lj125t-16) with a Delphi MT05 that is pulsating during idle and no load conditions. I adjusted the valves which made it stop bogging down (could have been simply that disconnecting the battery fixed it), but the idle still seems too high and pulsating. I am attaching my recording that I made with HUD ECU Hacker (this thing is great!). The rpm jumps around 5:30 is me revving it a bit otherwise I left it alone. My idle seems hight and the rev cahnges correlate with IACV Correction. Why is that? Graph: https://postimg.cc/FYCkkyHQ Recording: https://file.io/PcNAG02hL053 https://file.io/PcNAG02hL053 https://file.io/PcNAG02hL053 https://file.io/PcNAG02hL053 https://file.io/PcNAG02hL053 Best regards, Kris
	0

Yesterday, 11:39 PM	#14
Raptorix Join Date: Feb 2020 Posts: 14	Hello Please create a graph from the Regal Raptor logfiles that are installed with the program and compare them with yours. You have problem with too much air entering the engine. This may be because your IACV is fully open or your throttle does not close. This would explain the far to high idle speed and also that the ECU regulates the IACV to zero which is ABSOLUTELY anormal. The ECU tries to close your IACV but still too much air enters the engine. Either your IACV is defect or your throttle does not close correctly. If too much air enters into the engine the engine runs too fast.
	0