Honda Development

djmatix · **Joined:** Tue Jan 14, 2020 6:18 pm **Posts:** 3

kalisto2002 wrote:

I have a large amount of honda specific PGMFI PIDs. If you go into the disassembly check SID22 then the specific packets inside them.
in the SI 8th gens, its sent like 18,da,10,f1,22,26,10 gives you back a 57 byte packet that contains stuff like RPM, Final Timing, Map, Battery Voltage, IAT, ECT, AFM in G/rev

there is a lot of them that can be found. too bad you are using ktuner already, i am trying to get my hands on some J ecus so i can start writing definitions for them.

Awesome! Thanks for that info, i'll check those out. As far as already using ktuner, i'm open to whatever. I originally went with ktuner because I spoke with him about how to manage a 5-speed setup using a base 3.2 TL that never came with a manual transmission. There isn't much support for that platform on ktuner and he has expressed near zero interest in advancing it.

I have two 37820-RDA-A84 (07-08 3.2 Base Auto TL) ecus, one 37820-RDB-A61 (07-08 3.5 Type-S Auto TL) ecu that i'm currently using that i've flashed a 3.5 Type-S M/T ktuner rom onto with the 3.2 maps copied over.

I've also got an 08 MDX, not sure what ECU it is but I can pull it because i'd love to get some PIDs specific to that one relating to the SH-AWD system. A friend of mine is nearly finished swapping the UA8/UA9 3.7L 6spd SH-AWD drive train into an 08 Accord and was wanting to make an SH-AWD readout like I have on the cluster of my MDX that shows the power being sent to each corner.

On top of all that, I have a can sniffer permanently installed in the Element so I can grab data while I drive. I've also got a Honda HIM/HDS that I had to use to re-sync the various systems when I changed over the ECUs like occupancy detection (airbag related), SRS, ABS/VSA, immobilizer and even write the Element's original VIN to the Acura TL ECU because in order to pass emissions here all of the system vins have to match.

I'd love to help get these definitions done. The HIM/HDS has a TON of the .rwd files so I can help with those. Or if you want me to get some hardware to dump these ECUs i'd be willing to do that as well! Let me know how I can help!

djmatix · **Joined:** Tue Jan 14, 2020 6:18 pm **Posts:** 3

kalisto2002 wrote:

its sent like 18,da,10,f1,22,26,10 gives you back a 57 byte packet that contains stuff like RPM, Final Timing, Map, Battery Voltage, IAT, ECT, AFM in G/rev

Interesting that you say that because I grabbed a recent stream while driving around from the 08 type-s ECU and check out this snippet

Looks like i've been staring at it the whole time lol

Code:

ID: 18DA10F1 Length: 8 Data: 7 22 26 10 26 11 26 12 
ID: 18DAF110 Length: 8 Data: 10 A9 62 26 10 FF FD FF 
ID: 18DA10F1 Length: 8 Data: 30 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 21 61 E0 0 1C 58 27 B 
ID: 18DAF110 Length: 8 Data: 22 26 7A 88 45 21 12 94 
ID: 18DAF110 Length: 8 Data: 23 64 F 2F 0 CF 7C 41 
ID: 18DAF110 Length: 8 Data: 24 2 20 38 0 0 FF 0 
ID: 18DAF110 Length: 8 Data: 25 F 0 0 0 0 0 87 
ID: 18DAF110 Length: 8 Data: 26 46 0 2D 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 27 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 28 0 0 26 11 0 F FF 
ID: 18DAF110 Length: 8 Data: 29 FF FC 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 2A 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 2B 0 80 D 82 22 74 80 
ID: 18DAF110 Length: 8 Data: 2C 80 DB 2 28 0 54 80 
ID: 18DAF110 Length: 8 Data: 2D 21 84 EA 6A 7D 83 29 
ID: 18DAF110 Length: 8 Data: 2E 2 29 0 57 3C 3C 0 
ID: 18DAF110 Length: 8 Data: 2F 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 20 0 0 26 12 FF FF C0 
ID: 18DAF110 Length: 8 Data: 21 3 FE 0 2B 14 6 9B 
ID: 18DAF110 Length: 8 Data: 22 27 52 3 3E 3 34 1F 
ID: 18DAF110 Length: 8 Data: 23 4B 2 11 3 2 1 0 
ID: 18DAF110 Length: 8 Data: 24 0 0 0 0 0 1 FF 
ID: 18DAF110 Length: 8 Data: 25 0 0 0 0 0 0 F 
ID: 18DAF110 Length: 8 Data: 26 0 0 0 F 3 3 1 
ID: 18DAF110 Length: 8 Data: 27 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 28 0 0 55 55 55 55 55 

kalisto2002 · **Joined:** Wed May 06, 2015 1:01 am **Posts:** 38

djmatix wrote:

kalisto2002 wrote:

its sent like 18,da,10,f1,22,26,10 gives you back a 57 byte packet that contains stuff like RPM, Final Timing, Map, Battery Voltage, IAT, ECT, AFM in G/rev

Interesting that you say that because I grabbed a recent stream while driving around from the 08 type-s ECU and check out this snippet

Looks like i've been staring at it the whole time lol

Code:

ID: 18DA10F1 Length: 8 Data: 7 22 26 10 26 11 26 12 
ID: 18DAF110 Length: 8 Data: 10 A9 62 26 10 FF FD FF 
ID: 18DA10F1 Length: 8 Data: 30 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 21 61 E0 0 1C 58 27 B 
ID: 18DAF110 Length: 8 Data: 22 26 7A 88 45 21 12 94 
ID: 18DAF110 Length: 8 Data: 23 64 F 2F 0 CF 7C 41 
ID: 18DAF110 Length: 8 Data: 24 2 20 38 0 0 FF 0 
ID: 18DAF110 Length: 8 Data: 25 F 0 0 0 0 0 87 
ID: 18DAF110 Length: 8 Data: 26 46 0 2D 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 27 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 28 0 0 26 11 0 F FF 
ID: 18DAF110 Length: 8 Data: 29 FF FC 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 2A 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 2B 0 80 D 82 22 74 80 
ID: 18DAF110 Length: 8 Data: 2C 80 DB 2 28 0 54 80 
ID: 18DAF110 Length: 8 Data: 2D 21 84 EA 6A 7D 83 29 
ID: 18DAF110 Length: 8 Data: 2E 2 29 0 57 3C 3C 0 
ID: 18DAF110 Length: 8 Data: 2F 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 20 0 0 26 12 FF FF C0 
ID: 18DAF110 Length: 8 Data: 21 3 FE 0 2B 14 6 9B 
ID: 18DAF110 Length: 8 Data: 22 27 52 3 3E 3 34 1F 
ID: 18DAF110 Length: 8 Data: 23 4B 2 11 3 2 1 0 
ID: 18DAF110 Length: 8 Data: 24 0 0 0 0 0 1 FF 
ID: 18DAF110 Length: 8 Data: 25 0 0 0 0 0 0 F 
ID: 18DAF110 Length: 8 Data: 26 0 0 0 F 3 3 1 
ID: 18DAF110 Length: 8 Data: 27 0 0 0 0 0 0 0 
ID: 18DAF110 Length: 8 Data: 28 0 0 55 55 55 55 55 

I really need an HDS so i can figure out what some of the bytes do without trying to hunt through pointers for it.
I also wanted to do a sniff of the vin change on the pcm, Think you can do that for me?
The vin change. I'm not sure which SID i should be looking for to do it.
Do you have a way to communicate in real time? I/E discord or something similar?
Send me a pm with your discord name if you have one.

lowlyfe1 · **Joined:** Sun Sep 24, 2017 2:18 am **Posts:** 36

is it possible anyone can extract this for me please

lowlyfe1 · **Joined:** Sun Sep 24, 2017 2:18 am **Posts:** 36

ive had the file extracted

noyp · **Joined:** Thu May 16, 2019 3:40 pm **Posts:** 1

got bunch of errors extracting the attached file using rwd-xray, maybe somebody can extract this for me please. i've successfully flashed it using tactrix through honda's ecurewrite j2534 pass-through on my honda fit jdm1.5L VTEC CVT, im hoping its binary can be read by romraider for tuning purposes

@debian:~/Util/rwd-xray$ ./rwd-xray.py 37805-PWC-9040-M1.rwd.gz
Traceback (most recent call last):
File "./rwd-xray.py", line 134, in <module>
main()
File "./rwd-xray.py", line 51, in main
fw = f_class(f_raw)
File "/home/cedie/Util/rwd-xray/format/x31.py", line 14, in __init__
addr_blocks, encrypted = self._get_firmware(data[start_idx:-4]) # exclude file checksum
File "/home/cedie/Util/rwd-xray/format/x31.py", line 75, in _get_firmware
assert addr >= addr_next, "address decreased"
AssertionError: address decreased
@debian:~/Util/rwd-xray$

SanGawku · **Joined:** Wed Jan 13, 2021 9:01 am **Posts:** 2

Did everyone stop working on this?
Sad to see.

zamundanet · **Joined:** Fri Jul 19, 2019 4:50 pm **Posts:** 4

Hello guys , can someone help with definitions for this file. Its from Honda Accord 2004 . Ecu is Motorola 37805-RCA-A250. I have original bin file. I am willing to pay if needed. Thank you in advance.

Javidrifter · **Joined:** Thu Jul 01, 2021 9:31 pm **Posts:** 2

Hey guys how are you reading the ROM? I have a PND I can mess with from an 05 RSX. I have an open port 2.0 a Kess clone & a few J2534 tools I can use. Just getting my feet wet with this stuff.

zamundanet · **Joined:** Fri Jul 19, 2019 4:50 pm **Posts:** 4

Hello Guys , can somebody point me to a right direction here , i have a friend with Type R FK8 2018 we want to log the car , is there anything viable on the market for dataloging ,different from hondata? Thanks in advance.

Nii-Saan · **Joined:** Fri Jul 02, 2021 9:37 am **Posts:** 23

I just recently picked up a 2009 SI and now I'm digging into this.

These ECUs don't seem super complicated.
I managed to pick apart the definitions and the 2d/3d table loading functions from one of the bins posted here.
The unfortunate thing about that is that, they don't have scalars (At least that i could find) it looks like its just the raw
data it reads.

I'm working on a utility to write the ecus, it will be open sourced once it can at least write my car.

But this is what I have for a definition for my car.

I'm currently tearing through it, I have a bunch of 1mb rom files that I used rwd-xray on to convert from rwd to bin, then filling the first 0x8000 bytes with 0s
as they when writing it doesn't require the bootloader section, nor is any calibration data stored in them.
So once I finish up with that, I will be releasing a ton of definitions for the SH based ecus all in romraider format.

https://hondaecu.miraheze.org/wiki/Main_Page

mmmorks · **Joined:** Thu Mar 03, 2022 6:51 am **Posts:** 1

Nii-Saan wrote:

I just recently picked up a 2009 SI and now I'm digging into this.

Sweet! Have you figured out the checksum algorithm yet for the ones you've been looking into? I saw you've got STD checksum in your definition files, but wasn't sure if that was just a placeholder.

mrf582 · **Posted:** Fri Dec 16, 2022 8:55 pm

Hi all, where are we at with disassembly of these ECUs? Have we started looking into map interaction logic yet, or are we mostly focused on defining maps and getting read/write working? I have more free time now that my custom BMW ECU firmware project is done. I started looking at this in Ghidra years ago but haven't since.

Should I retrace my steps and start again or is there some new information?

Nii-Saan · **Joined:** Fri Jul 02, 2021 9:37 am **Posts:** 23

mrf582 wrote:

Hi all, where are we at with disassembly of these ECUs? Have we started looking into map interaction logic yet, or are we mostly focused on defining maps and getting read/write working? I have more free time now that my custom BMW ECU firmware project is done. I started looking at this in Ghidra years ago but haven't since.

Should I retrace my steps and start again or is there some new information?

So reading and writing is accomplished already I left a thing in one of the other threads.

It's more trying to work harder on figuring out interactions between maps and doing custom patches like spark cut and the like most of the roms have better than 256kb of Free space in them.

toytruck89 · **Joined:** Mon Jul 10, 2023 6:56 am **Posts:** 35

@Nii-Saan, any way you can chime in with some pointers for making up the definitions? when I have the X and Y set up, I can only get the tables to show up with all zeroes.

And do you know what checksum version is in some of these ROMs? I saw one hand written out into the definition file for the P720 Civic.

Do you have any of that information that used to be up on Mirahaze?

RomRaider

Honda Development

Who is online