RomRaider

It will be interesting to see if the new OpenPort cable can flash the Mazda roms.

You can read this old post with some basics the 2d/3d map structure for Subarus which will be the same:
http://forums.openecu.org/viewtopic.php?t=503

From this, you can make some guesses about MAF scaling, timing and fuel tables but nothing definitive. Beyond that, you would need to reverse engineer the ROM with IDA. This is no easy task. You are talking about many, many hours of work and that is if you know what you are doing.

Thanks for link! I will have to subscribe to get the files posted there, and read it several times to understand it. For right now, I was interested in some fueling tables and ignition tables. And yes I understand what loooong hours for r&d are like, but this is one thing that I would have to learn first, ugg, and that is very daunting. Although I am willing to try, and am a quick learner. Any more tips?

Check out Freon's thread on getting started with IDA:
topic2184.html

Some guesses based on this particular rom:
MAF SCALING? 0x67F28
PRIMARY FUEL? 0x685B4, 0x68624, 0x6865C
TIMING? 0x67974, 0x679AC

Merchgod,

What version of IDA Pro will work wiht our ECUs? I saw that v 4.9 is avail as a free download and if that works, I may start playing with it. Not sure I want to spend $515 to get v5.2 though.

I'm pretty sure the freeware version won't work because it doesn't support either processor, although I think Colby created his own HC16 module to work with an older version (do a search at the openecu site).

Okay, I have been looking over alot of pages trying to understand it all. Some of it makes sense, some of it I don't understand yet. So far though, I don't think I am looking at the same things you guys are. The locations you mention for possible maps, don't look like maps to me... I also found a different rom, I have found what looks to be timing/fueling maps, and others, but they would be a guessing game to me. Since you guys are more familiar with this stuff, maybe you could compare what else I got...

The offsets I listed are not the actual data, they are the map "description" (a look-up table which describes the x/y/z offsets, size, etc. for each 2d/3d map). These are described in the link I posted earlier.

There's little you can do with a hex editor but make a few guesses and usually not very good ones at that. It would be like putting together a puzzle in a completely dark room. You might get a few pieces together, but you are not going to get very far. See if someone in the mazda community is/has worked on disassembly of these roms.

They link in openecu I read and couldn't

I figured I'd throw this out there...

"Sounds like there's not much power to be had. They said modifying timing made little to no difference on the dyno. They also had to remove the knock sensor and front o2 for their tune? "
and yet there tune modifies the timing...

There is always more power to be had than what the factory releases on the street. Common sense should tell you that.
Knock sensor and o2, well maybe the knock sensor is a bit sensitive I don't know, but the o2, well, I have to admit, Mazda does some weird strategies, like their lowspeed (AKA <5500) fueling based on TPS X RPM, not the traditional load map. And obviously, if your not tuning ALL the RIGHT maps, it doesn't seem like you can gain anything.
and
"Mazda has already cut the mixture to maximum efficiency - it is so close to ideal there was nothing significant we could do the improve it. This was discouraging to discover, but common sense says Mazda tried very hard to optimize fuel mileage - and our findings confirmed this." - remember rotaries by nature are not efficient on fuel, but variable length runners and no port overlap have increase this engine over all previous.
Their fueling strategies can help this out alot, but I think, like all manufactures, they are limited to running 14.7 afrs. With that being said, leaner mixtures, and more timing can increase the efficiency, and I'm sure your tuners have found the same. At the right loads, I have safely run 18:1 afrs on the rotary and 20:1 on piston engines.
I just wanted to share what I found so far. Keep on tuning.

no upgrade in this topic?

cannot find definitions to RX-8.

Does anyone know a way to open tune it?

Or the only way is U$250 from epifansoft?

This is relevant to my interests as well. Looks like (the post above) has made SOME kind of ECU definitions for the RX-8 ROM, but I'm not sure if that's public knowledge at this point.

Deleted my old post because I'm a dummy posted the wrong ROM... anyways.

Figured I'd post this up here..

After a few months of playing around, getting a bench ECU setup, and designing my own interface tool.. I was able to pull off the factory ROM from an 04 RX-8 PCM on my bench.

The revision number, or CAL ID, or ECU ID (I'm not sure which) is 60E0FC00 which differs from the original ROM in the OP (newer revision) that was found online way back when.

Not sure what to do with this.. but.. here ya go!

Addresses of interest:

0x1FF5: SBL_END, end of bootloader section??

0x2000: 60E0FC00 Copr.DENSO2000, application jump address?

0x5D90C: MazdA, this is actually the secret word for the programming access seed/key algorithm

0x6D300: N3Z2EBWW.Z05 60E0FC00 Copr.DENSO2000SSW-N3Z2EU000.HEX, Calibration software start address + cal ID ??

Here is also a RAM dump from the bench module. Only things off the top of my head I can find (aside from obvious tables) are EEPROM contents loaded into RAM.

RAM Addresses: 0xFFFF6000-0xFFFF7DFF

Some more RX8 info in case anyone googles this 20 years from now.

Able to run ScoobyROM on the ROM, and since the RX8 has the same table structures as the Subaru 32 bit stuff, we can find a bunch of tables.

I am also able to generate an XML file with some tables that are a bit obvious.. but haven't confirmed much of anything. Also some hand modifications are needed to get it to read the ROM's ECU ID properly in romraider..

but yeah! This is rad!

Working on a reflash app still.. think I found the kernel needed to load into the CPU to start a UDS reflash.. so.. yay!