Tuners Rejoice! Free Tuning For M4.4!

Recommended Posts


I finally got my MCU to communicate! :D looks like I need to adjust my injector constant a bit though :lol:IMG_20150308_212834253_zpsrmh1fr9n.jpg

Doesn't look that bad though.....

Edited by Piet
Link to post
Share on other sites
  • Replies 7.5k
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

Attention: The first 30 or so pages of this thread are outdated. Please refer to the M4.4 Wikia article where all the relevant information is currently being collated. Before asking any questions p

Crush it.

After alot of testing and rewriting code, we finally got a useful new mod working. As we all know, some time ago my dad Piet found out how to convert to bigger maf housings with the maf factor. Conver

Posted Images

One problem with reading ROM in internal ROM mode is that you will get .... internal ROM.

And that is what WhizzMan wanted to have as he was wondering if there is any routine which will let you read full 1MBit flash.

Link to post
Share on other sites

I see a lot of "Codewort Kunde" are around 0F740 address.

And "Codewort Tester" starting at 0F271

Codewort Kunde -> code word customer

Very likely this is something Volvo specified with them being the customer. No idea what tha might be used for, maybe detection if code has been used by unauthorized sources?

Codewort Tester -> code word tester

This is a bit more tricky to translate. "Tester" can mean both a person reviewing the code / testing the code OR a "trigger word" for a fault code scanner. Bosch also makes diagnostic equipment, however they didn't supply the OEM equipment for these cars.

Link to post
Share on other sites

Does anyone know at wich addresses DTC codes are stored?

I was looking at an ADX a few weeks ago which would display fault codes, It was for an American made car, Can't remember which one though. I know is doesn't help you at all.

Edited by Avinitlarge
Link to post
Share on other sites

And that is what WhizzMan wanted to have as he was wondering if there is any routine which will let you read full 1MBit flash.

Exactly. The chance that we will find a way to read the entire 1Mbit flash in the running code is pretty slim at best. You'd have to be really creative and find a function that will let you read an arbitrary memory address by manipulating some sort of RAM value that will point to the address you want to read *and* find a way to address this in both the low and the high bank. Since none of the code in flash is written do have such a functionality, you'll have to be lucky and creative at least to pull that off.

The "boot mode" code that resides on the internal ROM is meant to deal with at least the upgrading of the contents of the flash in the form of a write new content. It also contains code to erase the flash. It'd be logical if Bosch put more routines in there. Stuff to test basic hardware functionality and quite possibly also routines to read/verify the content of the EEPROM would be quite plausible to exist in the internal ROM. That way The ECU could be tested before the final software+maps were put on and afterwards more factory tests would be possible without exposing those tests to Volvo, dealers or us punters.

I know there was some way to read the ROM contents of the early 75TS ECU. People did that. I think (but never tried) it might involve destructive work putting the chip on an own board and use the "verify internal rom" command. You could possibly brute force the contents per byte if the chip would flip the "error bit" pin after each byte is verified against internal ROM contents. I haven't tried this myself, but to me it seems like the most logical way to attack the protection of the internal ROM.

The only other way I can think of is maybe finding a way to have the chip switch between internal and external ROM and then put some bits/bytes from internal ROM in RAM so you can transfer them over. You could then write a special firmware for this, put it on external EEPROM and possibly offload the data via serial.

Question: I just got a N/A ECU on the wreck yard as a spare. The "bridges" required to modify it to turbo are indicated in photos earlier in this thread. What exact component should I be mail-ordering to solder on? I'm a noob when it comes to SMD components and it doesn't look like these are hard wire bridges.

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.