...Yet another random post having to do with this....
The Techtom / Mines "daughterboard" for the 7MGTE ecu appears to be nothing more than a board with a eprom socket, processor socket (the GOOD ones seem to have the processor crystal on the daughterboard itself), and a FPGA/CPLD programmable logic chip.
Like on the rom reader board, when the "CE" pin in enabled on the eprom, the logic chip switches the inputs/outputs to the eprom pins; whereas when the "CE" pin goes low, it switches those pins back to the ecu logic..
Pretty simple concept - "Technosquare" sells a empty "TOY-47" (I believe that is the part #) for the SDIP64 toyota processors..
Contacted them and got 2 prices....
Board with scramble logic chip (seems to just change the data pin order of the eprom) - $550 - NO EPROM, NO MAPS, NO NOTHING!!
Board with no-scramble logic chip - $850 - Once again, NO EPROM, NO MAPS
Seems to be a bit much for nothing!
And, the MR2 "Datalogger" appears to be nothing more than a PIC / Atmel microcontroller wired to certain I/O pins on the main processor using the PIC / Atmel A/D converters and UART to output that data to a PC
Some of the guys over at MAMEWorld, seem to have this type of mask rom type SDIP64 processor down pat....
I guess the guys over at Williams really liked these processors....
The mask rom can be directly dumped much like a eprom, just with a few hoops to jump through..
There are eprom writers (the $2000+ type) that can deal with this mask-rom setup by just dropping it into the reader
Somthing to do with timing on the I/E and /EN pins puts this type of processor into an actual "eprom" mode; clock stopped, no commands will execute, and rom acts just like a eprom...
I highly doubt my willem programmer will be able to handle this...
With the datasheet from the "knock" processor, and being able to easily dump that one, one source of attack on the mighty Denso could very well be emulating the knock controller... and seeing just what commands it will accept..
I have 2 raw 7MGTE processors, and 2 bench ecus ready for abuse...
After seeing this thread last night, I dug them out and dusted 'em off; since it really looks like everyone involved wants to come to the same end result without paying the $$$ these companies want for a 20-year old ecu!
3P, Brutus; mad props for getting down to the dirty with these!!
I've never had a car that I couldn't mod the ecu to my liking - I really don't want this to be the first!
Another random thought (sorry, i'm ADHD)
When I was doing my whole 240sx thing, there was a tuner out of OZ that created a FULLY, real-time programmable daughterboard (Google: BiKiRom) for the 240sx ecu - FULL consult (Nissan OE ecu protocol) datalogging, PC GUI software w/3d maps, real-time editing / updating, rev limiters, boost functions (for the SR20DET), and a whole lot more - FOR $350!!!
Now, only if the 7MGTE ecu actually produced an actual datastream, something like that could be possible.... I don't get why I can plug into a 85 Toyota pickup, and get a complete datastream, the MKII produces one too... but; lord forbid the MKIII could even think of one.... Not even with OEM Toyota scan tools, Launch X431, Mastertech, OTC Genisys, Snap-On Solus, Snap-On Modus..... I've tried EVERYTHING to get an actual datastream from the diagnostic port.... no luck.... For a "Supercar" like the MKIII supra, you would think a datastream would exist....
Enough babbling... off to work....
Attachment: Fujitsu datasheet for 42-pin "Denso" Ecu Processors
The Techtom / Mines "daughterboard" for the 7MGTE ecu appears to be nothing more than a board with a eprom socket, processor socket (the GOOD ones seem to have the processor crystal on the daughterboard itself), and a FPGA/CPLD programmable logic chip.
Like on the rom reader board, when the "CE" pin in enabled on the eprom, the logic chip switches the inputs/outputs to the eprom pins; whereas when the "CE" pin goes low, it switches those pins back to the ecu logic..
Pretty simple concept - "Technosquare" sells a empty "TOY-47" (I believe that is the part #) for the SDIP64 toyota processors..
Contacted them and got 2 prices....
Board with scramble logic chip (seems to just change the data pin order of the eprom) - $550 - NO EPROM, NO MAPS, NO NOTHING!!
Board with no-scramble logic chip - $850 - Once again, NO EPROM, NO MAPS
Seems to be a bit much for nothing!
And, the MR2 "Datalogger" appears to be nothing more than a PIC / Atmel microcontroller wired to certain I/O pins on the main processor using the PIC / Atmel A/D converters and UART to output that data to a PC
Some of the guys over at MAMEWorld, seem to have this type of mask rom type SDIP64 processor down pat....
I guess the guys over at Williams really liked these processors....
The mask rom can be directly dumped much like a eprom, just with a few hoops to jump through..
There are eprom writers (the $2000+ type) that can deal with this mask-rom setup by just dropping it into the reader
Somthing to do with timing on the I/E and /EN pins puts this type of processor into an actual "eprom" mode; clock stopped, no commands will execute, and rom acts just like a eprom...
I highly doubt my willem programmer will be able to handle this...
With the datasheet from the "knock" processor, and being able to easily dump that one, one source of attack on the mighty Denso could very well be emulating the knock controller... and seeing just what commands it will accept..
I have 2 raw 7MGTE processors, and 2 bench ecus ready for abuse...
After seeing this thread last night, I dug them out and dusted 'em off; since it really looks like everyone involved wants to come to the same end result without paying the $$$ these companies want for a 20-year old ecu!
3P, Brutus; mad props for getting down to the dirty with these!!
I've never had a car that I couldn't mod the ecu to my liking - I really don't want this to be the first!
Another random thought (sorry, i'm ADHD)
When I was doing my whole 240sx thing, there was a tuner out of OZ that created a FULLY, real-time programmable daughterboard (Google: BiKiRom) for the 240sx ecu - FULL consult (Nissan OE ecu protocol) datalogging, PC GUI software w/3d maps, real-time editing / updating, rev limiters, boost functions (for the SR20DET), and a whole lot more - FOR $350!!!
Now, only if the 7MGTE ecu actually produced an actual datastream, something like that could be possible.... I don't get why I can plug into a 85 Toyota pickup, and get a complete datastream, the MKII produces one too... but; lord forbid the MKIII could even think of one.... Not even with OEM Toyota scan tools, Launch X431, Mastertech, OTC Genisys, Snap-On Solus, Snap-On Modus..... I've tried EVERYTHING to get an actual datastream from the diagnostic port.... no luck.... For a "Supercar" like the MKIII supra, you would think a datastream would exist....
Enough babbling... off to work....
Attachment: Fujitsu datasheet for 42-pin "Denso" Ecu Processors