Search results

  1. bk_

    3P's TCCS Disassembly/Analysis

    Hi JonS. I noticed a few updates just then :) Just wondering if you figured out anything more about the tables format stored in the ECU. If not, I will be able to make some minor progress in 2 weeks time once I have some items delivered to me from Japan. Will reveal more details once I test...
  2. bk_

    3P's TCCS Disassembly/Analysis

    The table I did discover is in fact the IGNITION table, not the INJECTION table. I'm not sure how to interpret the numbers. Jeremy Ross's calculation (if you reverse engineer his excel spreadsheet at http://www.jmrhzu.btinternet.co.uk/mk1_ECU/MK1A_IGN.xls ) is based on IGN = VAL*4/17... which...
  3. bk_

    3P's TCCS Disassembly/Analysis

    And here's our answer: How did I decode it? dumped the binary to a file, fired up notepad++, set encoding to japanese -> Shift-JIS.
  4. bk_

    3P's TCCS Disassembly/Analysis

    OK. works now, using 4.9, and not opening the idb file directly.
  5. bk_

    3P's TCCS Disassembly/Analysis

    Tried it on two machines, one Win XP Pro SP2, the other Win XP Home. Both same error. Tried on other project files, same thing. What version of IDA are you using? md5sum of the files: $ md5sum d8x.cfg d8x.w32 e082f56bf0cefec39ce367f1c9964c7b d8x.cfg 37d0da9b6cf09f7676ac509306d8bc43 d8x.w32...
  6. bk_

    3P's TCCS Disassembly/Analysis

    Getting the same type of error.
  7. bk_

    3P's TCCS Disassembly/Analysis

    I performed a visual binary diff between the 1JZ-GTE JZ??? AT ROM that was posted here earlier by lom51 (post 226, page 23), versus 1JZ-GTE JZX90 MT chipped ROM. Anyone known the dimension and column/row units of the fuel map table? What about the ignition table? Is that on the 42-pin MCU? I...
  8. bk_

    3P's TCCS Disassembly/Analysis

    Getting an error with IDA: Any ideas?
  9. bk_

    3P's TCCS Disassembly/Analysis

    Friend of mine said the D151803 chip on the chipped JZX90 says: line 1) 90 mark II line 2) 1JZ.MT line 3) NORMAL But the 3rd line on the EEPROM is unknown. I presume it would be related to the type of tune. I know on a HKS device I had, there was a E605, and the mines one has a E613... so it...
  10. bk_

    3P's TCCS Disassembly/Analysis

    Here's some photos of a few 1JZ-GTE ECUs I have had: http://trap.mtview.ca.us/~xk/pics/supramania/ Hmmm... and there is one (JZX90 MT #1) with 7554 as the build. I also included photos of the chipped IMEC (JZX90 MT #3) I've also uploaded the descrambled dump to svn tree. I cannot guarantee it...
  11. bk_

    3P's TCCS Disassembly/Analysis

    No. MCU says: D151803-6980 5A41A-2-8195 JAPAN 3B1833
  12. bk_

    3P's TCCS Disassembly/Analysis

    Cool. I've ran it successfully on the scrambled image, after a few compile and runtime tweaks :) Couple of small tweaks: I had to comment out the line 'long xor = 0xAA', and change 'long temp_addr = scrambled_addr ^ xor;' to 'long temp_addr = scrambled_addr ^ 0xaa;' in order to compile on g++...
  13. bk_

    3P's TCCS Disassembly/Analysis

    The vendor is called IMEC (International. Meiwa Evolutionary. Cabin) I'll post up as much info as possible once I have access to do so. I had quite a few 1JZ-GTE ECUs (JZX90 AT, 2x JZX90 MT, 2x JZZ30 AT, JZZ30 MT, JZA70 Mines) but I got rid of them all since I had no use. Funnily enough, I...
  14. bk_

    3P's TCCS Disassembly/Analysis

    I managed to dump (using a PIC) the ROM from a Toyota JZX90 MT (1JZ-GTE) ECU with a TY64A daughterboard. MCU is D151803-6980 I did attempt a descramble but not really sure what I should be looking for. Here's a sample of the dump, scrambled, last 256 bytes: 00003f00 5f 5f 5f 5f c0 ea...