Hacking with HEW

alpine9000 · **Joined:** Fri Oct 14, 2011 2:40 am **Posts:** 34

Fiend wrote:

NSFW wrote:

http://www.renesas.com/products/tools/i ... anding.jsp

There's a "Downloads" link on the left side, which takes you to a list, and I'm pretty sure the first item in the list is the one you want: "High-performance Embedded Workshop V.4.09.00 Full Update."

That actual link seems to be something javascripty, otherwise I'd just paste it here.

Happy New Year!

I already downloaded that one and it won't install because it requires HEW to already be present, hence my problem.

It seems I can get HEW if I download the evaluation version of Renesas' C/C++ SH compiler, but that is only an evaluation version, though the evaluation might only pertain to the compiler portion. I'm going to give it a try and we'll see what happens.

Happy New Year.

I went down this road. In the end I found that HEW is available on the kpitgnutools site "HEW 4.08-ntc for KPIT GNU Tools with Simulators".

Merp · **Joined:** Thu Jul 23, 2009 5:46 pm **Posts:** 863

To make the hacking process a little more streamlined, I've added a new build phase from the build > build phases menu, to run the patching utility/tests.

I have this phase as a "single" occurance, and it runs $(PROJDIR)\TestRom\YourBatchFile.bat

Results :mrgreen:

Code:

Building All - EcuHacks2 - Debug

Phase Library Generator starting
Please wait...This may take a few minutes
Nothing to do - skipping
Phase Library Generator finished

Phase Compiler starting
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\EcuHacks.c
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\GenericTests.c
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\SpeedDensity.c
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\SpeedDensityTests.c
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\TestUtilities.c
Phase Compiler finished

Phase Assembler starting
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\EndMarkers.s
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\Metadata.s
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\ResetHandler.s
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\RomAddresses.s
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\SpeedDensityTables.s
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\Debug\EcuHacks.s
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\Debug\GenericTests.s
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\Debug\SpeedDensity.s
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\Debug\SpeedDensityTests.s
C:\PatchDev\Debug\MY04_USDM_FXT_A2ZJ500I_CamTuning\2004_USDM_FXT_A2ZJ500I_SD\HEW\EcuHacks2\Debug\TestUtilities.s
Phase Assembler finished

Phase Linker starting
Phase Linker finished

Phase UPDATE ROM starting
        1 file(s) copied.
        1 file(s) copied.
S30DFF00200041325A4A35303049DE
S309FF0078440000208C8F
S315FF07F520FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDF
S315FF07F530FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFCF
S315FF07F540FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBF
S315FF07F550FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFAF
S315FF07F560FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9F
S315FF07F570FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8F
S315FF07F580FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7F
S315FF07F590FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6F
S315FF07F5A0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5F
S315FF07F5B0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF4F
S315FF07F5C0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3F
S315FF07F5D0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2F
S315FF07F5E0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1F
S315FF07F5F0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0F
S315FF07F600FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE
S315FF07F610FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEE
S315FF07F620FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDE
S315FF07F630FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFCE
S315FF07F640FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBE
S315FF07F650FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFAE
S315FF07F660FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9E
S315FF07F670FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8E
S315FF07F680FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7E
S315FF07F690FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6E
S315FF07F6A0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5E
S315FF07F6B0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF4E
S315FF07F6C0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3E
S315FF07F6D0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2E
S315FF07F6E0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1E
S315FF07F6F0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0E
S315FF07F700FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD
S315FF07F710FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED
S315FF07F720FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDD
S315FF07F730FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFCD
S315FF07F740FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBD
S315FF07F750FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFAD
S315FF07F760FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9D
S315FF07F770FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8D
S315FF07F780FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7D
S315FF07F790FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6D
S315FF07F7A0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D
S315FF07F7B0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF4D
S315FF07F7C0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D
S315FF07F7D0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2D
S315FF07F7E0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1D
S315FF07F7F0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0D
S315FF07F800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC
S315FF07F810FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEC
S315FF07F820FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDC
S315FF07F830FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFCC
S315FF07F840FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBC
S315FF07F850FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFAC
S315FF07F860FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9C
S315FF07F870FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8C
S315FF07F880FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7C
S315FF07F890FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C
S315FF07F8A0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5C
S315FF07F8B0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF4C
S315FF07F8C0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3C
S315FF07F8D0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2C
S315FF07F8E0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1C
S315FF07F8F0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0C
S315FF07F900FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB
S315FF07F910FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEB
S315FF07F920FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDB
S315FF07F930FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFCB
S315FF07F940FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBB
S315FF07F950FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFAB
S315FF07F960FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9B
S315FF07F970FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8B
S315FF07F980FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7B
S315FF07F990FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6B
S315FF07F9A0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5B
S315FF07F9B0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF4B
S315FF07F9C0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3B
S315FF07F9D0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2B
S315FF07F9E0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1B
S315FF07F9F0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0B
S315FF07FA00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA
S315FF07FA10FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEA
S315FF07FA20FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDA
S315FF07FA30FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFCA
S315FF07FA40FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBA
S315FF07FA50FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFAA
S315FF07FA60FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9A
S315FF07FA70FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8A
S315FF07FA80FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7A
S315FF07FA90FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6A
Press any key to continue . . . 
        1 file(s) copied.
This patch file was intended for: A2ZJ500I.
This patch file converts ROM to:  A2ZJ5SDI.
Validating patches...
Patch start: 00002000, end: 00002007, length: 00000008 - Valid.
Patch start: 00007844, end: 00007847, length: 00000004 - Valid.
Patch start: 0007F520, end: 0007FA9F, length: 00000580 - Valid.
This patch file can be applied to this ROM file.
Applying patch.
Verifying patch.
ROM file modified successfully.
Press any key to continue . . . 
        1 file(s) copied.
This patch file was intended for: A2ZJ500I.
This patch file converts ROM to:  A2ZJ5SDI.
Preparing to remove patch.
Validating patches...
Patch start: 00002000, end: 00002007, length: 00000008 - Valid.
Patch start: 00007844, end: 00007847, length: 00000004 - Valid.
Patch start: 0007F520, end: 0007FA9F, length: 00000580 - Valid.
This patch file was previously applied to this ROM file.
Removing patch.
Verifying patch.
ROM file modified successfully.
Press any key to continue . . . 
Comparing files A2ZJ500I.bin and REVERTED.BIN
FC: no differences encountered
Phase UPDATE ROM finished

Build Finished
0 Errors, 0 Warnings

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

Awesome.

gabedude · **Posted:** Sun Jun 03, 2012 4:04 pm

Has anyone encountered the linker crashing in Windows 7 32 bit?

If not, I'll go ahead and build in Linux.

Thanks,

Gabe

Merp · **Joined:** Thu Jul 23, 2009 5:46 pm **Posts:** 863

I've never encountered that error running on x86 and x64 windows 7.

Perhaps some setting in the build -> KPIT Toolchain is off, or a directory didn't update properly when you opened the project on a different machine?

gabedude · **Posted:** Sun Jun 03, 2012 7:47 pm

The linker is crashing, that is the thing. I did edit the project file for the correct path to the project. I had to do that. There must be some other project related file that specifies which files to link. I'll figure it out. Thanks.

Merp · **Joined:** Thu Jul 23, 2009 5:46 pm **Posts:** 863

Enjoy: https://github.com/Merp/MerpMod

NSFW if you want me to update any headers, just lmk.

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

Holy crap, that's awesome. Thanks for sharing all of that!

Merp · **Joined:** Thu Jul 23, 2009 5:46 pm **Posts:** 863

You're welcome, thanks for getting things started with HEW!

The custom build phases are detailed in the README.md and the supporting batch files are included. They also rely on SharpTune.exe which is not bundled (yet).

Build configuration is passed to SharpTune and back, which determines the config header file used (to select features/options) and determine the appropriate output directories/filenames. e.g. Build config "Gratis_Testing" will use Gratis.h to select the features by preprocessor options, and after building produces patch files named <CALID>.MerpMod.Gratis.Testing.<version>.patch that are saved in the Gratis_Testing folder. Also, only "*_Testing" or "*_Release" configs produce definition files, so using "*_Debug" allows you to debug the code in HEW without generating a million useless definitions. More details on these later.

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

gabedude wrote:

The linker is crashing, that is the thing. I did edit the project file for the correct path to the project. I had to do that. There must be some other project related file that specifies which files to link. I'll figure it out. Thanks.

I just noticed this, sorry for the delay. I was using a 32-bit Win7 laptop when I started messing with HEW, so it really should work. I switched to an x64 desktop after a while and had no linker crashes there either... I don't know why it would blow up like that. Did you find a solution?

dschultz · **Posted:** Sun Sep 08, 2013 2:58 pm

Merp wrote:

Enjoy: https://github.com/Merp/MerpMod

NSFW if you want me to update any headers, just lmk.

Thanks for all the work you did here, there's so many more options in your update since NSFW released the HEW EcuHacks!

whitewater · **Joined:** Thu Dec 29, 2011 2:04 am **Posts:** 181

Darn,

I was looking forward to install HEW tonight to get started playing with some of that stuff. They have to manually review registrations during business hours.

Guys, I admire the amount documentation that you have put together. This is spectacular, all I really want right now is the FBKC check engine light, I think its a neat feature ! I also see in the repo that you guys have implemented a per gear WGDC tables, that's pretty cool.

They better turn on my account first thing Monday morning so I can take a look when I get back from work

Merp · **Joined:** Thu Jul 23, 2009 5:46 pm **Posts:** 863

Getting the CEL stuff enabled shouldn't be too difficult, especially if the rom you're working with already has SD stuff defined.

PGWG has not been tested in the wild, but I have flashed it on an ecu. The logic is a bit different, but there are some explanations in the 32BITBASE.xml on the MerpMod Github.

Are you looking for HEW from renesas or kpitgnutools?

whitewater · **Joined:** Thu Dec 29, 2011 2:04 am **Posts:** 181

I was looking at the one from kpitgnutools, is that the one that is mostly used around here ?

So far I have been looking at the C code and patched a rom with sharp tune and opened it in ida. I see all the code inserted in the rom gap. I literally spent 1h looking at it so I still need some time to fully wrap my head around it. The main thing I am trying to figure out right now is where is the entry point into the hack code from the original denso code? Where in the de so code do you jump to ecu hacks or cell flash ?

Is this something that is defined into the code or somewhere related to the linker configuration

This is pretty awesome

Merp · **Joined:** Thu Jul 23, 2009 5:46 pm **Posts:** 863

KPIT seems to be the most common, but HEW is available from renesas with their compilers. I haven't kept tabs on it so I don't know if they offer a free version, or if there is anything on renesasrulz.

All of the hooks are done in metadata.c: https://github.com/Merp/MerpMod/blob/ma ... Metadata.c This file also contains the header that is part of the sharptune api.

Because these hooks typically just replace 4 bytes they don't really need to be compiled and linked so they get passed over to sharptune (in the MerpMod.x -> *CALID*.patch file) which reads the metadata, checks the baseline data, gets the payload, and applies the patches if everything is good.

Search for SDHookPatch and you'll see what's going on with the SD algorithm. For functions other than SD, they run out of a "main" subroutine which is hooked at WGDCHook.

RomRaider

Hacking with HEW

Who is online