Haybusa Parts and Service Member Support

Author Topic: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!  (Read 79791 times)

Offline entropy

  • Mad Post Whore
  • ******
  • Posts: 3128
hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« on: July 09, 2007, 03:26:02 AM »
bikeland.org,   zx12rzone.com,   Hacking the Planet one ZX-12 ECU at a time

Using skillz & persistance and Enginuity sw. "ridgeracer" has successfully hacked into several versions of the ZX12's ECU. 

After exposing the ECU's board &  mounting a plug, he can view, modify and reflash the ECU's maps.

Got some testing to do, but this is REALLY a cool development.
Often wrong, but never unsure!!!!!

Offline sm2w

  • Rider
  • ***
  • Posts: 209
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #1 on: July 09, 2007, 07:01:23 PM »
Where can I get more info ?

Offline entropy

  • Mad Post Whore
  • ******
  • Posts: 3128
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #2 on: July 10, 2007, 02:10:03 AM »
Where can I get more info ?
go to website:
bikeland.org,   (forums)

then click on:
zx12rzone.com,

the thread name is: 
Hacking the Planet one ZX-12 ECU at a time
Often wrong, but never unsure!!!!!

Offline osti33

  • Post Master
  • *****
  • Posts: 1102
2 Club member x 5
Bonneville, Loring, ECTA, Texas, Mojave

Offline badass1000

  • Post Master
  • *****
  • Posts: 1551
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #4 on: July 10, 2007, 11:02:04 PM »
it would be nice if they could do this on the gsxr 1000's and busa.

Offline Oz Booster

  • Site Donor
  • Mad Post Whore
  • *
  • Posts: 3968
  • aka Maj T
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #5 on: July 11, 2007, 04:49:22 AM »
Maybe you could ? i sent this post to a mate that does this sort of stuff and he replied
"What he is doing is connecting to the JTag bus for the CPU, this allows you to access the internal flash that contains the maps."
There are programmes that allow reprogramming of some factory ecu's, just with the simplicity of plugging in a Powercommander it would be uneconomic to put a lot of time and effort into developing a system .
Official Site Donor

Offline entropy

  • Mad Post Whore
  • ******
  • Posts: 3128
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #6 on: July 11, 2007, 05:24:33 AM »
Maybe you could ? i sent this post to a mate that does this sort of stuff and he replied
"What he is doing is connecting to the JTag bus for the CPU, this allows you to access the internal flash that contains the maps."
There are programmes that allow reprogramming of some factory ecu's, just with the simplicity of plugging in a Powercommander it would be uneconomic to put a lot of time and effort into developing a system .

Oz Booster
I haven't heard of ANY system which allows reprogramming of the 12, Busa or Kawi/Suz 1000's ECU with the exception of what Ridgeracer is doing right now with his project on the ZX12.  If there is such a system, we'd sure like to know about it.

Yes indeed, a Powercommander can modify the fuel and ign by indvid cyl with USB + ign module at a cost of $600+ and a trunk full o' boxes & cables.  Wouldn't it be cool to just plug into the ECU and do it that way??

BTW: The 12's ECU has 2 separate fuel and ign maps, and apparently only 1 is routinely used.  Maybe use the 2nd set of maps for nitrous???

RR is now working on determining what exactly is the mechanism for the rev limiter; if he can crack that one, it is likely we can extend the limiter to whatever without modifying clock speed.

Very cool project, very cool indeed.
Often wrong, but never unsure!!!!!

Offline Oz Booster

  • Site Donor
  • Mad Post Whore
  • *
  • Posts: 3968
  • aka Maj T
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #7 on: July 11, 2007, 09:05:29 AM »
Not Suz,Kaw(except for the race ecu) Yam or honda But Triumph,Harley,Ducati,Benelli are some, And many cars
Couple of examples
http://xtronics.com/memory/efi_ecu_faq.htm
http://www.tuneboy.com.au/Products/Products_Models.html
Official Site Donor

Offline cajunboys

  • Rider
  • ***
  • Posts: 254
  • Gender: Male
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #8 on: July 11, 2007, 10:39:09 AM »
It would also be nice to be able to have a extended Rev on the ZX-14,as on the Busa's??

Offline entropy

  • Mad Post Whore
  • ******
  • Posts: 3128
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #9 on: July 11, 2007, 10:42:17 AM »
Not Suz,Kaw(except for the race ecu) Yam or honda But Triumph,Harley,Ducati,Benelli are some, And many cars
Couple of examples
http://xtronics.com/memory/efi_ecu_faq.htm
http://www.tuneboy.com.au/Products/Products_Models.html

WHOA!!
great stuff, wonder why Suz & Kwak were left out???
Often wrong, but never unsure!!!!!

Offline Oz Booster

  • Site Donor
  • Mad Post Whore
  • *
  • Posts: 3968
  • aka Maj T
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #10 on: July 11, 2007, 05:47:21 PM »
ECU type and brand enthusiasm ,
Official Site Donor

Offline BrianK

  • Post Master
  • *****
  • Posts: 1155
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #11 on: July 30, 2007, 07:53:32 PM »
i had a triumph speed triple before i bought my busa and i tuned it with the tuneboy program. you plug your laptop right into tthe ecu and remap it, correct the speedo error, adjust ignition timing, adjust rev limiter, adjust idle and more. cost $400 for the program and cable. outstanding program


07 RCC STAGE1  STAGE 2

Offline Pete

  • Post Master
  • *****
  • Posts: 1790
  • a.k.a 'Geri'
    • Pete's turbo build
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #12 on: July 31, 2007, 12:19:34 AM »

Oz Booster
I haven't heard of ANY system which allows reprogramming of the 12, Busa or Kawi/Suz 1000's ECU with the exception of what Ridgeracer is doing right now with his project on the ZX12.  If there is such a system, we'd sure like to know about it.


The Teka TFI manipulates the stock ECU on Suzukis and the settings are stored after removing the device so must only be in the ECU. You could argue this is "reprogramming"

Offline gazza414

  • Mad Post Whore
  • ******
  • Posts: 2024
  • Gender: Male
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #13 on: July 31, 2007, 03:25:03 AM »
so does a yosh box.....but we are talking about a alot higher level of interogation here
1 Fast Hayabusa N/A 217.443mph so far

Offline RidgeRacer

  • Apprentice Post Whore
  • **
  • Posts: 14
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #14 on: September 25, 2007, 01:15:02 PM »
it would be nice if they could do this on the gsxr 1000's and busa.

[edit] Apparently PetriK already posted this. Guess I should of looked more before I did the duplicate post

Well, funny you should mention that...

This is a photo of a 32920-24FD0 ECU. It has the same port as the ZX-12



I hooked it up and downloaded the code and maps using the same method that I use for the zx-12.




I have identified the base maps and done a preliminary definition for the freeware map viewing / editing software from Enginuity.org  Here are some examples.

Ignition Map  http://www.bikeland.info/images/ecu/busamap001.jpg  I haven't figured out the formula to convert it to degrees BTDC, yet.

Base Fuel Map http://www.bikeland.info/images/ecu/busamap002.jpg


Here is the map and definition file if you want to download the enginuity software and look at the maps yourself.  I still have a way to go on the maps but the answer to the basic question of can it be reprogrammed like the ZX-12 seems to be yes.

http://www.bikeland.info/downloads/ecu/busa004.zip

As for the GSXR-1000; Anyone have an older 16bit, broken, gixxer ecu laying in their garage collecting dust that you don't want anymore?   


« Last Edit: September 25, 2007, 01:20:32 PM by RidgeRacer »

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #15 on: September 27, 2007, 11:13:47 AM »
So lets get in to the real business...

What if someone needs a bike that runs well over 200mph for a mile in next may with some help from NOS. What if someone is determined to achieve that with a Busa and without a powercommander and with some help from nitrous. For tuning that someone uses already innovate wbo and a datalogger hooked to various bike sensors ;-).

One easy way to achieve that is to lock the injectors full open for nitrous, but then its very low AFR in the beginning of the run with gas and running lean at the end of the run. The power is far from optimum and there is a risk to the engine without retarding the ignition as the run will be 15+ seconds on the gas.

I really hope that this project gets to the next stage where we can tune the new generation busa ecus with help of switchable maps. I am determined to give this stuff a more than a try if and when all of this becomes available for a Busa.

Btw. the real winners at this part of the world are those who can ride the same bike for the full the 300 mile journey to the airfield and also back. This year ... hmmm, 6 bikes of top 12 needed a truck to make the journey back. Most common reasong for a blown engine was melted internals due to electronics failure in fuel enrichment or alike circuits/connectors. Therefore running the original ecu with modified maps is a very tempting idea to minimize the failure points.




« Last Edit: September 27, 2007, 11:20:35 AM by PetriK »

Offline Steve S

  • Rider
  • ***
  • Posts: 238
    • Quantum Motorsports
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #16 on: September 27, 2007, 03:43:03 PM »
Very cool and very clever RR.

Offline gazza414

  • Mad Post Whore
  • ******
  • Posts: 2024
  • Gender: Male
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #17 on: September 27, 2007, 05:58:57 PM »
For boosted applications the software will need to be recoded.....2bar + compensation
1 Fast Hayabusa N/A 217.443mph so far

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #18 on: October 01, 2007, 03:53:42 PM »
For boosted applications the software will need to be recoded.....2bar + compensation

Well the pressure map looks like it currently handles ambient pressures and less.

Anyhow rescaling to handle it for 3xambient pressures should be easy.  The only thing that really is unresolved is that what is the mechanism when MAP pressure map is on and when the TPS map is on.




Offline Oz Booster

  • Site Donor
  • Mad Post Whore
  • *
  • Posts: 3968
  • aka Maj T
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #19 on: October 01, 2007, 04:16:13 PM »
from what i have read 5% throttle is the switch over point from MAP to tps , is this something you can adjust to have MAP all the time.
Official Site Donor

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #20 on: October 02, 2007, 02:24:58 PM »
Maybe... Intake air pressure... if tps < 5% invokes MAP then also intake air pressure > 1.1bar could be used for the same. In addition to change some control logic, that would require a different MAP sensor and recoding the MAP maps.  Personally I see this option of having the OEM ECU for turbo use a way more reliable system than powercommander+extra boost injection box for turbos.  Harness connector 60 is free and could be used for additional MAP sensor (unless they removed the electronic parts on later models) or possibly the ram air compensation function could be used for turbos when ram air maps are reprogrammed. Just hook the MAP sensor to gear position input and ramp up the ram air compensation accordingly... What does Ridgeracer say to this ? Based on the experience of debugging kawi, how easy would it be to modify the busa ecu program for turbo use ?

Btw, do you guys know any low cost source for a new generation (2004-2007) ECU's. Currently only 1999-2001 is on the table and need a couple of new generation ecus...

Also donations of damaged ECU's would be perfect, at least one of those will be literally opened:


« Last Edit: October 02, 2007, 02:34:11 PM by PetriK »

Offline RidgeRacer

  • Apprentice Post Whore
  • **
  • Posts: 14
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #21 on: October 03, 2007, 11:36:53 AM »
The short answer is you can do it, but it won't be easy.

On the hardware side if you change the IAP (inlet air pressure) sensor you will need to also replace the SAP (static air pressure) sensor. Both need to have the same voltage to pressure output.  One of the first things the software does is subtract the SAP from the IAP to establish absolute pressure. You can't be comparing apples and oranges.

On the software side it may be more involved than just tweaking the maps. The variables are limited to 16 bit numbers meaning 0-65,535 or -32,767 to + 32,767. (I've seen no evidence yet of any floating point math taking place) So if the current formula is  ranged around -32,767 being vacum or -1 atmosphere and 0 being 1 atmosphere or ambient which makes 32,767 2 atmosphere. That would make 3 atmosphere out of range of a 16 bit variable. That means you would have to go through the code and rescale all the related variables. It would mean rewriting, and worse, recompiling the code.

Imagine you've just been handed a thousand page manuscript on paper, you don't have the word processor file. You boss wants you to go through it and change a character's name from Fred to Mike. While that would be a pain you could still do it without retyping the entire thing. Just whiteout Fred and type in Mike. They are both four characters long. This is also easy to do in the ECU software, replace one byte of code/data with a different byte of code/data. If the software says compare something to 6 I can change it to 3.

But what if your boss wants you to change the characters name to Helen? Helen doesn't fit in place of Fred. Not only that Helen is female and now you have to find every reference to 'he' and change it so 'she' etc. That is what you are asking when you want to go to 3 atmospheres. Not impossible, but not in the same league as just tweaking some map numbers.

To continue the analogy; without the original Word file (source code) you will have to retype (compile) the entire manuscript by hand. The obvious answer would be to scan the manuscript and create a new word file (disassemble the code and create a new assembly source code. )  Easier than doing it by hand but still time consuming.

The IDApro software we are using to disassemble the code should allow us to do this, in theory, but I haven't tried it yet.

Offline Oz Booster

  • Site Donor
  • Mad Post Whore
  • *
  • Posts: 3968
  • aka Maj T
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #22 on: October 03, 2007, 05:11:36 PM »
 :lol: Ok thats why i work on the hardware and let someone else do the software .
I hear Tuneboy and you have been in contact (Petrick  too ? ),  i am sending Wayne my 01 ecu to compare code to his 16 bit processor.
Official Site Donor

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #23 on: October 23, 2007, 12:42:21 PM »
OK guys, anyone with knowledge about Renesas/Hitachi AUD interface for SH7052 aka e8a http://www.renesas.com/e8a ?

The 32Bit Busa ECU "programming connector" looks just like that interface.




« Last Edit: October 23, 2007, 01:42:16 PM by PetriK »

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #24 on: October 27, 2007, 05:16:26 AM »
Having now opened the 32bit busa ecu (2004-2007) I can confirm that the processor is SH7052 running with 10Mhz xtal. This thing means that the procesessor memory can be reprogrammed, i.e. you can modify things like fuel, ignition, ram air compensation and throttle enrichment maps and set rpm limits directly to processor memory. Programming the maps into processor memory is beneficial compared to powercommander and alikes as you can modify not only TPS based maps but also Vacuum based maps which means that its easier to make a bike streetable.

This particular processor can be programmed throught he AUD connector at the back of the board or using serial protocol. If we are lucky the Serial TXD and RXD signals on the ECU Harness Connecto are connected so that those could be used for reprogramming without notching the ecu - even though notching an ecu is very easy. Anyway there is still a lot to be done to accomplish the same as the ZX12 guys already are trialling with programming their ecus with very promising results.

This is what Busa 32BIT ecu (32920-24FK0) looks inside


ps. For you guys with older 16bit ecus, you are lucky as all you need to start reprogramming your ecus already exists. (links to software, hardware and instructions are on RidgeRacers site).
« Last Edit: October 27, 2007, 05:21:23 AM by PetriK »