RVR Sports gear X3 1998.

Technical information, definitions, advice, and support for factory ECU remapping, aftermarket systems, and much more.
Post Reply
professor_jonny
Member
Posts: 10
Joined: 11 Jun 2020, 06:19
State: International
Model: rvr sports gear x3
Engine: 2.0-Litre 4G63 Turbo I4 16V DOHC
Transmission: 4 Speed Tiptronic Automatic

RVR Sports gear X3 1998.

Post by professor_jonny »

Hi I have a 1998 RVR auto and wish to tweak the tune of the ECU. The ECU has four plugs three rows of pins with an embedded transmission controller.

From my investigations it has two 7202f chips inside which is common to a few models of vehicle from 1998 to 1999 being the 1998 magna TF/KF ,98-99 3.5L Pajero and Montero sport,1998 v6 6g72 Delica van and I'm guessing a few more.

IM looking for an XML to suit programming I have tried the magna and evo5 ones but no luck.

From what I gather many of these models did not have a flash connector fitted and required two extra wire being added to the ecu one to read the ecu and another to read the TCU some had an immobilizer that interfered with this process on some cars that did have the connector.

because of this it is rather uncommon to find a rom for them or an xml or any info really for many of these models.

I have dumped my car's rom would someone here be able to help me create a xml?

Also I'm unable to attach pictures of my ECU or a rom to my post is there a minimum post count or some rules around new members?


I have opened up the rom with IDA and a script I found on Github Called ECUROM.idc I'm not sure if I'm operating the script correctly or if I need to set the ram, rom, entry point and kernel settings to decompile properly.
Would someone happen to have a tutorial as everything seems to be centric around the SH2 processor and not the H8/500?

professor_jonny
Member
Posts: 10
Joined: 11 Jun 2020, 06:19
State: International
Model: rvr sports gear x3
Engine: 2.0-Litre 4G63 Turbo I4 16V DOHC
Transmission: 4 Speed Tiptronic Automatic

Re: RVR Sports gear X3 1998.

Post by professor_jonny »

here is a link to two roms from slightly different ECU's and a preliminary XML hopefully this link works.

[url]https://1drv.ms/u/s!ArPAPtK-JLCsiMlonKAjvxXqRN_2KQ?e=4kb0T5[/url]

BCX
Member
Posts: 88
Joined: 01 Dec 2011, 10:19
State: South Australia
Model: Mitsubishi Galant VR4
Engine: 2.5-Litre 6A13-TT V6 24V DOHC
Transmission: 5 Speed Manual

Re: RVR Sports gear X3 1998.

Post by BCX »

Disassembly for H8, I haven't found a specific guide. it's taken me years to get to where i am with my disassembly for Galant/Legnum, Magna, Evo5/6, 3000gt, triton and pajero.

Once you find something in one disassembly, it's quite easy to find the same in another Rom for another vehicle.

I havent had much luck with ecurom.idc for h8. I usually set up the segments and name registers, etc manually and go from there.

Happy to have a look at the rom and create a comprehensive XML if you'd like? might take a few days, but is there a list of tables you're specifically after?
8th Gen Galant VR4
MK Triton [6G74 conversion]

professor_jonny
Member
Posts: 10
Joined: 11 Jun 2020, 06:19
State: International
Model: rvr sports gear x3
Engine: 2.0-Litre 4G63 Turbo I4 16V DOHC
Transmission: 4 Speed Tiptronic Automatic

Re: RVR Sports gear X3 1998.

Post by professor_jonny »

BCX wrote:
16 Jun 2020, 17:22
I havent had much luck with ecurom.idc for h8. I usually set up the segments and name registers, etc manually and go from there.
The script seems to work, I looked in the hardware manual for the H8/500 and under mode 4 max the memory map H'0000-H'01FF is the vector table and on reset the value in H'0000 to H'0003 is copied into the program counter and page register then it jumps to it and runs ?

So the value of H'0001-H'0003 is the entry point and code page on a standard reset?

So if I jump to this address and press C it will decompile the rom into assembly problem is it only decompiles a small section of the rom from the rom segment which in my rom entry point is 10000+400 (offset+start address) that is the bit I don't get it does not seem to fully decompile.
Do I have to decompile it step by step and branch by branch?
BCX wrote:
16 Jun 2020, 17:22
Happy to have a look at the rom and create a comprehensive XML if you'd like? might take a few days, but is there a list of tables you're specifically after?
The xml in my one drive above seems to be ok but i have another xml with conflicting info i don't know if what i have is proper and legit but I'm happy for you to lookover the xml and I can give you some coin via paypal or bitcoin for your time.

I have also heard that people with manual version of my ECU have dropped an evo5 rom into the car and ran with no issues, I have both dumps of an auto and manual and they are basically identical apart from 4 words in the rom apart from the ROMID.

ultimately id like to install a evo5 rom but id like to find out what the differences between the auto and manual dumps and I really need to decompile to do this, this might be a big task as I have never done any thing like this with an imbedded system.

It was reported the the person who flashed an stock EVO rom to an auto RVR ECU had a TCU fault code when they installed a EVO 5 base rom, but this is chinese whispers from a long defunct forum from a few guys that were members of in the past.

This ECU is a bit different as it has two CPU's and two roms one for the engine and one gearbox on the same PCB.
BCX wrote:
16 Jun 2020, 17:22
is there a list of tables you're specifically after?
In respect to this I'm not 100% sure what I need, but I know the options in the rom are limited to that of the EVO line.
I have brought a bigger twinscroll turbo and manifold from an EVO 5 and will need to tune it likely replacing the injectors with bigger ones.

I have just purchased an openport cable and evoscan software.

BCX
Member
Posts: 88
Joined: 01 Dec 2011, 10:19
State: South Australia
Model: Mitsubishi Galant VR4
Engine: 2.5-Litre 6A13-TT V6 24V DOHC
Transmission: 5 Speed Manual

Re: RVR Sports gear X3 1998.

Post by BCX »

professor_jonny wrote:
21 Jun 2020, 12:57

The script seems to work, I looked in the hardware manual for the H8/500 and under mode 4 max the memory map H'0000-H'01FF is the vector table and on reset the value in H'0000 to H'0003 is copied into the program counter and page register then it jumps to it and runs ?

So the value of H'0001-H'0003 is the entry point and code page on a standard reset?
Correct
professor_jonny wrote:
21 Jun 2020, 12:57
So if I jump to this address and press C it will decompile the rom into assembly problem is it only decompiles a small section of the rom from the rom segment which in my rom entry point is 10000+400 (offset+start address) that is the bit I don't get it does not seem to fully decompile.
Do I have to decompile it step by step and branch by branch?
some of the branches/routines are missed by IDA... and some of the routines arent used at all, but the code was complied with the routines there.

professor_jonny wrote:
21 Jun 2020, 12:57
The xml in my one drive above seems to be ok but i have another xml with conflicting info i don't know if what i have is proper and legit but I'm happy for you to lookover the xml and I can give you some coin via paypal or bitcoin for your time.
Haven't forgotten, it's in progress... i'll have something soon.
professor_jonny wrote:
21 Jun 2020, 12:57
I have also heard that people with manual version of my ECU have dropped an evo5 rom into the car and ran with no issues, I have both dumps of an auto and manual and they are basically identical apart from 4 words in the rom apart from the ROMID.

ultimately id like to install a evo5 rom but id like to find out what the differences between the auto and manual dumps and I really need to decompile to do this, this might be a big task as I have never done any thing like this with an imbedded system.

It was reported the the person who flashed an stock EVO rom to an auto RVR ECU had a TCU fault code when they installed a EVO 5 base rom, but this is chinese whispers from a long defunct forum from a few guys that were members of in the past.

This ECU is a bit different as it has two CPU's and two roms one for the engine and one gearbox on the same PCB.
There's potential that the code is the same, the reflashable Triton ECU i used when I transplanted the 6g74 had a rom very similar to a TH magna. so i copied and edited my TH xml to match the triton romid.

In legnum/galant world, the differences between ROMs are values in tables rather than code differences.
professor_jonny wrote:
21 Jun 2020, 12:57
In respect to this I'm not 100% sure what I need, but I know the options in the rom are limited to that of the EVO line.
I have brought a bigger twinscroll turbo and manifold from an EVO 5 and will need to tune it likely replacing the injectors with bigger ones.
The XML i'll provide will be quite extensive, sounds like you might want some idle/crank parameters and fuel/ign/bdel/wgdc 2d tables & inj scaling and latency tables.
8th Gen Galant VR4
MK Triton [6G74 conversion]

Post Reply