Відео

Like my dad always yelled at me “keep it simple stupid!”

Ghidrauto@gmail.com

discord.gg/wbgD7T2N

Tactrix 2.0 for read and write with pcmflash. OBDX gt for gm class 2 diagnostic communication

I’m not actually a tuner. This is my first time, so I don’t have any knowledge of how the cruise control tables work. However in the 4 denso ecus I have looked at. Isuzu, Nissan, and Suzuki. I have been able too find the sensors, or switches by finding their dtcs “ckt hi, ckt low” and then tracking down the inputs from there. So I guess make some assumptions on what could be your cruise control tables, label every ram address’s(or rather functions that handle them) associated with the cruise control, ckt hi lo dtcs, obviously also brake pedal. and then start tracking them too eachother

You could try the m16c language from silverchris’ GitHub. Renasas documentation suggestions that developer tools and compilers for r8c and m16c are the same.

@@GHIDRAuto Thanks sir

I am not sure, what processor? Ghidrauto@gmail.com

You are looking for a flash tool? Or you want tuning for it?

That’s awesome man! Glad you found my info helpful. It seems overwhelming till you spend some time staring at the binary. Electric trains are cool. Ultimately I want to transition this into electric cars. I think that would be cool. I too am considering computer science classes

That is a good idea. I have already touched on that a little, but I will take some time for that specifically. In the mean time Have you watched the video in this link all the way through? this will inadvertently show you how to find conditions to set. How to find EGT, MAF, ECT, sensor scalers. Denso sh7058 and 55 ua-cam.com/video/jRo1wr7o80g/v-deo.html

check out my m32r video for the m32r language link, and then the others you can find on GitHub. as you need them.

lol it was bound to happen

@@GHIDRAuto keep update brother thanks

Hey, definitely something that can be done! Different ecus will have different levels of difficulty, but in the denso sh language ecus, it is exceptionally easy to

Hey man. I would try sh2A first as I did with this one probably use sh7055 for the memory map sizes. (See my “starting a new project” video for links and setup instructions. If sh2a does not work, try m32r. There is one that will show up if you google it from “ripnet” that will not work (or did not last time I checked) dig through my videos for the “m32r” vid, or join discord.gg/qHTsXpNW and you will find a link too my GitHub that has a working m32r processor language.

And thank you for the compliment and interest man!

@@GHIDRAuto The content is very interesting, and little to no information is available in such an understandable format. You deserve it !

Thanks man. Yeah I started the channel due too the lack of info!

That’s interesting. Likely! Thank you.

Nm... You answer at 7:30

I would like too agree with your logic about the 2 speed sensors, however both speed 1, and speed 2 are unquestionably being written by the same value. If you are who I think you are. I Dug through our 06 wiring diagrams, and unfortunately the speed sensor is wired directly to the Speedo. The 07 dpf trucks and newer are communicating speed via canbus, so their speed could be manipulated via the 3600 value, or the 1.6xxx value. I could attempt too read the Speedo’s processor if it has one. Take yours apart and see if it has a micro processsor or just a chip? Might find a potentiometer or a resister could do the trick

@@GHIDRAuto yeah its me, idk i remeber looking up the VSS stuff a while back but kinda came to a road block, then lost interest. But if its a hall effect VSS, then it will be algorithm based... Probably

Copy. Well, if it has a processor, maybe I’ll try to read it.

Hardest part is getting the ball moving. Then it slowly falls into place

For sure man.

@@GHIDRAuto could you please make a video of start using with ghidra and setting of it from start to end so that i can do homework from beginning thank you

@@steveswilliams7341 ua-cam.com/video/fZAmQVCgZRs/v-deo.htmlsi=F90dLvASKc9Gv4GB this is starting a new project. Something more specific? Have you watched my other videos?

@@GHIDRAuto Ohh Sorry I seen a lot of your videos but i forget this one LOL thank you i will do as your tutorial if i have something to ask which way can i contact to you telegram? whatsapp?

Sounds good

lol just making this shit up anyways man. somebody should hire my just so I stop making these videos 🤣. but in all honesty I have nothing but clues, not proficiency at all.

@@GHIDRAuto Come find me. I wanna show you some stuff.

@@GHIDRAuto M S G M E O N F B O R I G

@@GHIDRAuto Hmu. I wanna introduce you to some folks.

@@GHIDRAutothat's really cool Man, we do the Same stuff on Ghidra all the tiME. Check the capital letters ;)

Nice, thank you for the advice! I am taking a bit of a break from the project, but I’ll take some time hopefully soon and check out what you are saying!!

I do need to start in on another video. I found all my PIDS! so that was a big deal. I’ll show how I came too that and then hopefully how too call your preferred parameters instead of oem parameters for those who do not have the ability too data log parameters they need

@@GHIDRAuto can't wait to see it brother

Hey man! I know your handle….. GitHub nussitiles(forgive spelling) and rom raider correct!? I gained some critical information from you that gave me my first step into this journey. The other night I found all of my sae, and manufacturer specific pids. Do you guys os patch the Ecu’s supported by romraider too mode 23 datalog? (Ram dump) I need to datalog some paremeters that I found in the Ecu. The paremeters are brought into “PID function”(based on the architecture of the rest of the pids, these clearly were designed for this) however they are not called out be either sae or manufacturer specific PIDS. if I can figure out how too mod 23 I’ll do that, other wise I’ll redirect some PIDs too call these functions (parameters) I want too see rather then some of the lesser used ones available. Hey if you ever want to reach out, feel free too ghidrauto@gmail.com. Suggestions, questions, interest in project files, etc.

And I should ad. Okay that makes sense about volatility. Thank you for dropping the knowledge.

@@GHIDRAuto nissutils, yes, the repo you linked in the description. We don't need to patch ROMs for logging because this family of denso ECUs have mfg-specific requests (0xAC) that let you log pretty much anything, fairly efficiently. I think it's implemented in romraider, not sure.

Looks like I am going to have too go down this rabbit hole. And, when you say “this family denso” is “this family referring too denso ecus with our sh7055,58, and59 ecus (mine included). Or your denso ecus in the Mazdas and subies?

@@GHIDRAuto "this family" = nissan, infiniti, renault, but not subaru. Even though these are also SH705x, the firmware is different. Not familiar with mazda, honda or others

My email is ghidrauto@gmail.com

yes some of my videos are on Mitsubishi 7055 and 7052. look through their descriptions. mitsubishi sh7055 and denso sh7055 will us the same processor maps, and the same memory map sizes. you will also be able too use the links on one of my videos for the scripts to set up memory maps, and analyze. the decompiled code, and the structures will look different between the denso and mitsubishi though. just watch the videos and you will see.

I don’t have any damos. I am not a tuner. Just personal projects/interest.

Something tells me you need too start a yt channel so I can learn from you! What do you usually see it in?

Japanese. Vehicles it seems. A lot of Mitsubishi and denso ecus like too disassemble with sh2e

No problem!

Right on

Thanks man!

I’m trying man

Thanks for the comment. Yeah I’ll keep making them!

legend bro, appreciate you!!@@GHIDRAuto

Except and I don't mean it as disrespect, but his methodology is flawed and these are neither dtcs nor anything dtc related. He isn't analyzing the code but making erroneous conclusions and assumptions that are not based on any analysis. Denso ecus like bosch most often use factors and none are applied here making these values useless. I didn't want to be harsh, I don't want be harsh, but I told the dude a few times that these videos are completely wrong and it's not how any of this works. I spent one year reverse engineering a Denso ecu to get a solid understanding of what and where the maps are , what the factors are and creating my own winols file. One...year of my time. I also never used the decompiler, those can be misleading. In the video we see him converting hex values to raw decimal values which can be anything but not as they appear. Again, I am not trying to be a douche, just trying to point out these issues. You can consider the videos misleading at this point. If you need information on Denso I can help somewhat. So yes, the only way to understand what the values are, is to see what the surrounding code does. To first figure out which memory address corresponds to what. And how the value is represented. For instance for some Denso ECUs the RPM is stored in memory in raw form and needs to be multiplied by 0,1953125 to get the actual value. 0x8000 = 32768. 32768 * 0,1953125 = 6400. You will not see the RPM value used in raw form ever. The alternative is (RPM * 12800)/65535. These factors WILL differ from ECU to ECU. Sometimes ECT(coolant temp) will also require not just a factor, but then also substracting a number. Such as ((ECT raw value )*160/255)-40. So again, the information in the videos is misleading, it has nothing to do with DTCs or temperatures. Go to github and look at romraider subaru definitions, they are in XML and have formulas inside to convert the RAW sensors values to voltage, temperature whatever. They all do. Example : <scaling units="psi absolute" expression="x*.01933677" to_byte="x/.01933677" format="0.000" fineincrement=".01" coarseincrement=".1" /> The formula is (raw value) * 0,01933677 So again I am not trying to be a douche but pointing out the logical fallacy of the video. And if the poster of the videos tries flashing any changes he makes right now, he will end up bricking his ECU at best and destroying his engine at the worst. Look no further than the video segment at 1:11 where he incorrectly assumes that the values he sees are DTCs. First notice how the table of data has repeating numbers. You won't see that in actual DTC codes, each value will be unique and not repeat. This is wrong, those are not DTCs but random values which without analyzing what references them and HOW the instructions process the data, cannot be inferred what they mean. They could even be executable code(unlikely), they could be map data, but certainly NOT DTCs!!

@@farmdve “These arnt dtcs.” It’s my truck, I have tested it. You are wrong. My Suzuki sidekick Ecu with an (Mitsubishi) sh7055 processor I am having a hard time with. I have asked for help in private message, you have not responded. “Rpm is never raw value” in my denso sh7055 and my denso sh7058 Ecu it is. There are loads of maps that are using x and y as 32bit full float values. And again in almost every function, they use floating point numbers (raw value). You are wrong. The reason why there are multiples of the same dtcs listed is because this Ecu has different organized sets of functions that deal with different types of dtcs. However all of them call on this dtc map with a decimal value. Ie 16 being the 16th place in the dtc map. No function has the same dicimal value (I have no idea why) if three functions call the same dtc, said dtc is listed three times in order for each function to have its own decimal value 16, 17, and 18 may be 0401. You are wrong. lol I even found the map(the same length as the dtc map) that sets priority level of said dtc’s this isn’t hard man it’s just time consuming. I don’t understand why you are taking so much interest in “telling the world” I am wrong when you clearly have never even tuned an Ecu with full float 32bit normalizers in their maps. That’s wild man. Something tells me you own a tuning platform and are trying to convince people that this is harder than it is. You seem like someone who knows a lot about tuning. I have only been doing this for a year….but again you are …. Well ….. you fill I. The blank. All fucking around aside, I could use some help. I think my next project on these two ecus. Is getting them too ram dump,DRM,mode 23. You say you are willing to help, you can clearly see I’m trying to help the community. Put your time where your mouth is, let’s OS patch this bitch and get her too dump some ram…… or are you just a troll? I dig the traffic. And I appreciate you as a person and your interest in my project. It’s cool when people have the balls too call someone out. Helps the community as a whole

github.com/NationalSecurityAgency/ghidra.git

Thanks man. Lol yeah for sure, winols and ghidra has been wild too try and learn!!

Please, please, please!! Send me a link. I really want to start working on my tricore file!

Thanks man! Maybe you can teach us how too disassemble tricore!? I have tried my edc17p14 a couple times. I can’t figure out what I looking at lol. I also don’t have as much interest in my Vw tdi, as my diesel truck. But when it comes time too do a tdi/vitara swap I’m hitting you up!!!

Nice!! I have only been working on this stuff for around 1.5 years. Ghidra for 6 months. My personal truck has very limited support that I could find. I did find a mappack on stageX ai, but they had many mislabeled maps. Trying too change boost and it was my rail pressure instead. 275800-6704. That is what made me start using ghidra

Good to hear. Thank you for the comment! I am sure I could learn a lot from you too! Make some videos

Ghidrauto@gmail.come.

@@GHIDRAuto thank you, I just send you a email

lol this is a cars Ecu. Yeah man learn c++ I use chatgpt becuase I’m a dumbass and don’t know c++. Gooogle man. This is your cars Ecu.

@@GHIDRAuto thank for the reply. I am good in c++ (thank God at least that, usually work with Windows API). What youre doing is wayyy more impressive. Also thanks for explaining 😁

I’m sure I could learn alot from you. Someone with your expertise would be leaps and bounds ahead of me!

@@GHIDRAuto Haha, never 😂. Its always fun to learn something new tho, and I find RE so entertaining. The average person has no idea hew wide the Technology department is. By the way, do you have any onher socials ? 😁

Yeah for sure. Social media? Reddit is ghidrauto, none of my other socials have too do with this stuff.

Send me the binary file ghidrauto@gmail.com. Do you have any maps detected yet?

Thanks for the comment man.

Yes nussitiles for memory allocation

You are asking what my first nap I ever found was? If so, drivers wish. Second was SOI MAIN. Then max IQx ECT. the. I found a mappack that I purchased. It had many miss labeled maps. So that is when I started learning ghidra. Through that process, someone confirmed my assumption about dtc maps, and then I used dtc hex map to find sensor scalers and calibrations.

@@GHIDRAuto how many maps did you have now in your mappack?

Hundreds. All IQ maps. All rail pressure maps. All boost maps. Sensor calibration maps. Soi maps. Injection corrections maps. Too many too list. Torque maps are only used too reference in this calibration.

Get to know your 2d, and 3d structures. Ghidra likes too turn them into “labs”. And it foobars your functions that reference them. You’ll notice something fishy.

Ghidrauto@gmail.com