FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas...)

[bretman]

One last couple of bits of info:

We found that the second brake switch sensor (BPA PID) originates from the Instrument Cluster. The JDM cluster does not have a cruise light and also does not pass on the BPA signal, even if you have the right brake switch.

If this is not present, it behaves in the same way as if you have a two wire brake switch.

... and I'm pretty sure that the majority of JDM vehicles do have a 180 Kph speed limiter.

[baxevan]

Hi there.
I have a Mazda2 DE and fitted the steering wheel with CC. Still waiting for the brake switch. I'm on the same boat.
My PCM3 Line is the only difference like the BL mazda3. The CCC data have a minor difference in first bytes.

[JamieM]

A number of people have asked now if they can change PCM1-9 as-built data bytes other than the single bit that controls cruise control on the RX-8 (which is all rx8cc can do), for experimentation or otherwise or for different Mazda cars.

To save me having to create a dedicated program for each and every car/combination, I've quickly thrown together a modified version of rx8cc that will read the current ABD from the PCM and save it to a txt file, which you can modify, and then it can load from the txt file and write the new data back to the PCM. Will still only work with PCMs similar enough to the RX-8, with the same address/layout/format of ABD (read using [21,00], 0x82 bytes long etc as per http://forscan.org/forum/viewtopic.php? ... =10#p16553)

Since this is kind of a new tool I have called it rx8abd (version 1.0 here: https://drive.google.com/open?id=1b96Pe ... yDXQ2_kv0P). It has mostly the same command line options as rx8cc (run with "--help" to see).

May not work, use entirely at your own risk. Be very careful editing the text file because it WILL write anything you change in there to your PCM, calculating the checksums automatically. It does ignore whitespace and checks the length / validity of hex digits, but I accept absolutely no responsibility whatsoever if anything goes wrong, intended or not, or you break your car / ecu.

Usage:

Code: Select all

> rx8abd COM# outputFile.txt

Code: Select all

> rx8abd COM# inputFile.txt --write

e.g.

1.png (16.22 KiB) Viewed 5325 times

Then go edit the text file you specified the name of (will appear in same directory), notepad or any text editor will do.

It might be wise to make a backup of this file first... So you can go back to it if necessary...

Original abd.txt:

Code: Select all

FFFF FFFF 03
0DFF FFFF FE
FFFF FFFF FF
FFFF FFFF FF
FFFF FFFF FF
FFFF FFFF FF
FFFF FFFF FF
FFFF FFFF FF
FFFF FFFF FF

Let's modify it a bit:

Code: Select all

FFFF FFFF 03
0DFF FFFF FE
FFFF FFFF FF
FFFF DEAD FF
FFFF FACE FF
FFFF D00D FF
FFFF FFFF FF
FFFF FFFF FF
FFFF FFFF FF

(I did this on my spare ecu on my bench, so the silly values don't matter, but obviously don't use those...)

2.png (27.61 KiB) Viewed 5325 times

Confirm it looks ok then type "y" followed by enter (or "n" to abort, which is the default if you just press enter)

3.png (30.37 KiB) Viewed 5325 times

You can see the values changed

Running it in read mode (without --write) is safe and won't make any modifications to your PCM. Actually, it is a good test to see if your car is similar enough to the RX-8 to be compatible with my tools (though checking the ABD manually is still a good idea before doing any writing). Run with the --log option (just like rx8cc) to see what your VIN block looks like in comms.log (or how much of it your ELM327 is fast enough to read )

Have fun!

(but be careful!)

[Airborne_Ape]

Do this for an F150 and you'll be a millionaire overnight.

[dejlo74]

i followed jamies descriptions about enabling cc on rx8 and i have used jamies both programs. awsome work you have done jamie. thanks.
everything works fine, i can get into pcm and read as built in data and even download it on my pc.
however, i am having issue with security code key. i cant get pass that to enable cc.
it seems that the security code is changed. any advice on this issue?

[saturnnights]

JamieM!

thank you so much for leaving stub chunks within your code that actually performed the VIN change in the ABD block. my vehicle is a 2004 standard power/automatic that i swapped with the engine/trans/electronics from a 2005 high power/6 speed manual. this was the last piece in order to be able to pass emissions check without grief [because the chassis VIN and the PCM VIN didn't match].

and now they do!

had a whole different trip of fun following your "blessing" left on https://www.rx8ownersclub.co.uk/forum/v ... 30&t=74833

Download the latest version of rx8cc.zip from the attachments to this post below. Unzip it. You should find an executable rx8cc.exe inside. It is just a python script packaged up with PyInstaller, feel free to decompile it and check the Python source if you wish - there's nothing sinister but I encourage you not to trust random .exes from the internet!

but, i got there in the end.

thanks again!

[JamieM]

Ah nice, I'm impressed! I figured if people were smart enough to get the source code out of the exe then they deserved to have it

There's a very good reason those stubs are there - I actually used them in the early stages of development to change the VIN of my bench test ECU, which I plugged into my car to test stuff sometimes.

I did a very similar thing to what you've just done myself though a few weeks ago - knocked up a quick modified script from that stuff I'd left in to change the VIN. The reason being I swapped my healthy bridgeport engine + mapped PCM from it's rusty shell into a whole other (less terminally rusty) RX-8, so had to change the VIN on my PCM to match the VIN of the new shell's RKE/Immobiliser, before I could then use FORScan to do the PATS "pairing" procedure between the two and start the engine in the new shell. Worked flawlessly!


dejlo74:
I'm afraid if your security key isn't one of the ones known to rx8cc, which tries all the keys from Mazda's IDS software + the one I know of for MazdaEdit, then there's nothing we can really do (not via OBDII anyway), unless you know what the key is. Is this an RX-8 I asssume? I have never seen an RX-8 that doesn't have either Mazda's standard key or MazdaEdit's, so this is strange, unless MazdaEdit have found out about my project and changed their key in response Has your ECU been mapped?

The only way to obtain an unknown key is the way I originally did it for mine - dump the entire ROM via the AUD port of the microprocessor on the circuit board (see https://www.rx8ownersclub.co.uk/forum/v ... 0#p1015427) and compare it to a known map e.g. stock to find the address of the key. This requires soldering to the ecu circuit board (https://www.rx8ownersclub.co.uk/forum/v ... 5#p1017363), and building some custom hardware to talk to the cpu (or buying Renesas's expensive debug hardware... I built my own: https://www.rx8ownersclub.co.uk/forum/v ... 0#p1024384) - not something I'd recommend unless you are really comfortable with that kind of stuff.

[saturnnights]

The only way to obtain an unknown key is the way I originally did it for mine - dump the entire ROM via the AUD port of the microprocessor on the circuit board (see https://www.rx8ownersclub.co.uk/forum/v ... 0#p1015427) and compare it to a known map e.g. stock to find the address of the key. This requires soldering to the ecu circuit board (https://www.rx8ownersclub.co.uk/forum/v ... 5#p1017363), and building some custom hardware to talk to the cpu (or buying Renesas's expensive debug hardware... I built my own: https://www.rx8ownersclub.co.uk/forum/v ... 0#p1024384) - not something I'd recommend unless you are really comfortable with that kind of stuff.

well timed information here! i am in the process of taking a chunk of my disused 4 port engine harness and using it to create a bench OBD/CAN harness for interacting with the PCM outside of a car [for example, ROM dumping and key extracting]. these bits of your work will also prove useful with further scrying into the PCM.

thank you for your contributions on the RX-8 platform

[maciekelga]

Hi,
I have a question regarding some small changes in BCM on my Mazda 6.
Is it possible to switch off DRL function in BCM with FORScan?
Facelift Mazda 6 have in BCM possible to turn on/off function that headlights are on all the time, even if switch os in OFF position.
Maybe also is possible to switch on auto door lock.

[dejlo74]

thanks for your reply jamie. i did tuned my ecu once with mazda maniac coobport. but after rebuild i got installed stock software.
mm wrote that ecu could be locked if not changed to stock software,probably reason my issue. i bought another used ecu and was able to enable cc with rx8cc.but, cant start the car even numbers on ecu are same.