Reverse engineering the Td5 ECU For smart dudes only ... ;)

Might be of interest to the software dudes and those who wish to 'tweek' their vehicles ...

Reverse engineering the Td5 ECU - Australian Land Rover Owners


Progress on BDM programming the Td5 ECU | DiscoTD5.com

How?

nathan5346 said:

How?

Click to expand...

Check the Aussie linky -

Dippypud said:

Check the Aussie linky -

Click to expand...

Would you like to explain what it means in laymans terms?

nathan5346 said:

Would you like to explain what it means in laymans terms?

Click to expand...

No ...

Let me try to explain in Laymans terms what he is trying to do. Hopefully I'll keep it simple...

TLDR; He wants to understand the software instructions of the map so that he can tweak to his own likings without "buying" a new map.

Software, any software you see, from your Windows, to your MAC, to the LandyZone website, to download software such as Winzip is "packaged" into instructions. These instructions are then loaded into your a computer's chip and thus the chip follows the given instructions.

Now typically, the software comes in a package. Let's say for arguments sake that your download Winzip. Winzip is packed into a file which you download and install. Now Winzip, because they are a business and they have use proprietary techniques which they use for a business advantage actually hide the instructions from the end user, 1) because you don't care, 2) because if it was easily available, people would give it out for free and they would no longer be a business. To actually get to do what this guy is doing, i.e. peep into what the software instructions actually are, you have to "reverse engineer" the software you downloaded.

The ECU works on the same generic principle. You have a map, which is the software, which is provided my Landrover or your favourite tuning supplier to give instructions to the engine based on input from the various sensors. This guy is snooping into the contents of the ECU instructions, to figure out what the heck it is actually doing, so that eventually he can play around at will with the map and do the changes he would want to do to tweak the performance by providing a different set of instructions. Essentially, he is doing trying to understand the contents/instructions of his ECU map so that he can do DIY on it. At least that is what I figured out he's trying to do!

Is that fairly accurate Dippy? Is that understandable Nathan?

PS: Eventually I suppose he'd provide the contents of the map and what it actually does so that other's can follow. Provided you have the techincal know how, tools, and balls to try to change things around

I've read somewhere here that Andy from AliveTuning has a Computer Science background, and he's probably done something similar in the past. Note, I cannot confirm this for a fact.

dattard21 said:

Let me try to explain in Laymans terms what he is trying to do. Hopefully I'll keep it simple...

TLDR; He wants to understand the software instructions of the map so that he can tweak to his own likings without "buying" a new map.

Software, any software you see, from your Windows, to your MAC, to the LandyZone website, to download software such as Winzip is "packaged" into instructions. These instructions are then loaded into your a computer's chip and thus the chip follows the given instructions.

Now typically, the software comes in a package. Let's say for arguments sake that your download Winzip. Winzip is packed into a file which you download and install. Now Winzip, because they are a business and they have use proprietary techniques which they use for a business advantage actually hide the instructions from the end user, 1) because you don't care, 2) because if it was easily available, people would give it out for free and they would no longer be a business. To actually get to do what this guy is doing, i.e. peep into what the software instructions actually are, you have to "reverse engineer" the software you downloaded.

The ECU works on the same generic principle. You have a map, which is the software, which is provided my Landrover or your favourite tuning supplier to give instructions to the engine based on input from the various sensors. This guy is snooping into the contents of the ECU instructions, to figure out what the heck it is actually doing, so that eventually he can play around at will with the map and do the changes he would want to do to tweak the performance by providing a different set of instructions. Essentially, he is doing trying to understand the contents/instructions of his ECU map so that he can do DIY on it. At least that is what I figured out he's trying to do!

Is that fairly accurate Dippy? Is that understandable Nathan?

Click to expand...

I got it now....we can all write our own maps if we read that link

hehe, something like that

nathan5346 said:

How?

Click to expand...

ffs nath cant you follow simple electrickery.:jaw:

nathan5346 said:

I got it now....we can all write our own maps if we read that link

Click to expand...

i thought we all did that as a matter of course.:jaw::behindsofa:

gemsdad said:

ffs nath cant you follow simple electrickery.:jaw:

Click to expand...

:lol:

Apparently he's having problems with the 32 bit branch instruction codes, he'll never get his bulkhead bolts unseized that way.

Rattlegun said:

Apparently he's having problems with the 32 bit branch instruction codes, he'll never get his bulkhead bolts unseized that way.

Click to expand...

that goes without saying really.after all his thread says for "smart dudes only".

For what it's worth I've never said what I'm doing is for "smart dudes only" - that was a comment made by the OP, and the OP isn't me

The issue I was having with disassembling the instructions with 32bit addresses was resolved earlier in the year. For some reason the "correct" disassembly target wasn't handling the code properly, whereas a more generic target did.

I doubt if more that one or two tuners have actually bothered disassembling the ECU code for themselves. I believe that Pete Bell has done so with at least one variant.

Most tuners are using either EVC or Swiftec tuning programs with commercial "map packs" that describe the function of individual maps within the ECU. The purchase price of these programs is in the order of 3000 euros+. Compared with the many, many 100's of hours I've spent working on the code I reckon that is a pretty reasonable price to pay.

On the other hand I've found some fairly useful things like a software switch to disables EGR on EU3 Td5 maps. The commercial remaps I've seen max out the values of the EGR map to prevent the system operating whereas the software switch tells the ECU to skip the EGR code.

While I've been working with the TD5 ECU's I've also found a decent solution for recovering bricked ECU's which avoids the need to unsolder flash memory chips for external reprogramming. The process uses a sub-$100US interface plus a set of configuration files and scripts that I've put together to allow manipulation of blocks of flash memory. This means rather than completely rewriting the bricked ECU with a "virgin" rom image you can rewrite just the variant or fuel map portions of memory that are corrupted during a failed map upload. By using this method it's possible to retain the original VIN and coding information that is otherwise lost. There is a bit more information on this page: Td5 ECU Tools: scripts for the USBBDM NT | DiscoTD5.com

cheers
Paul