Modifying Motronic 2.3.2 ECU hardware and software

[vwnut8392]

These ECU's are very hard to find any straight forward information on and what little info is out there is scattered about the internet and buried in archives that would take a lifetime to find let alone figure out how the ECU functions. The M2.3.2 community unfortunately doesnt have the luxury and ease of documentation like the ME7 community.

First modification i feel one should do is unsolder the factory EPROM's and install 28 pin DIP sockets. if you cannot accomplish the installation of the DIP sockets than the rest of the hardware modifcations below aren't for you. Please find someone who is capable of installing the sockets for your sake because these ECU's are getting to be far and few between not to mention rather expensive atleast in the USA anyhow.

Here is my ECU with a DIP socket installed on the on the timing/fuel board.


i'll start with info i found on how to convert the hardware in my AAN ECU to an RS2 spec ECU which i have done to mine. The modification of an AAN ECU to make it an RS2 spec ECU is rather simple if you have some basic soldering skills and a few hours on on hand. All you have to do is replace the MAP sensor which the AAN is stock with a 250KPA sensor and install a 300KPA sensor. the OEM bosch sensor is no longer made but i have seen modified ECU's by MTM that that looked like they had recalibrated the 250KPA sensor and made it into a 300KPA sensor. what leads me to believe this is the some of the the original part numbers and pressure rating had been sanded away and they where stamped with new numbers that indicated they where OEM bosch 300KPA sensor. another option is to install a VMAP-D adjustable map sensor which is now sold by 034motorsport.com. lastly i've heard of some guys using a GM 3BAR map sensor mounted outside of the ECU's casing. I'm running a VMAP at the moment but im going to investigate into the GM sensor and try it out, i will post pictures and my results when i get a chance. i think if the GM sensor works out it will be the most cost effective solution to a MAP sensor upgrade. to complete the RS2 conversion you you have to locate component R201 which is a 6.15K ohm resistor in the AAN ECU and it needs to be replaced with a 6.5K ohm resistor. you can use a surface mount or a standard resistor, the standard resistor is a bit harder to solder than the surface mount. once you do them 2 modifications you must run RS2 software in your ECU this includes the boost chip as well. for my ECU i chose the 8A0 907 551 B file and detuned it as best i could to run on my moderately stock AAN engine.

another hardware modification i added was a latch adapter board from http://www.boostbutton.com. this board allows you to run a more common 27C256 chip instead of the obselete 87C257. i run 2 SST27SF512 chip in my ECU and on the boost chip you need to offset the 32K file to 0X8000 with the device offset on your chip burner. the reason for doing this is that the 512 chip is double the size of the 256, the ECU reads the chip backwards in a sense so the file needs to start at the middle of the chip and fill to the end of the chip. also it is best to solder the latch adapter board straight to the boost board as having a DIP socket with the latch adapter and the chip on top causes the fuel/timing board to flex because that combination is too tall.

Here's some pictures of the latch adapter board installed in my ECU.





i have been working on trying to compile Tunerpro XDF files so everyone can tune their M2.3.2 car's freely i am posting them for everyone to explore and share. I hold no responsibility if you bomb your engine using these so use them at your own risk. these XDF's where compiled originally using PRJ's Motronic map finder program. i will post his program in hopes he doesnt get mad at me for sharing it because it is a very useful piece of software. These definition files are far from perfect so please dont criticize me or them, im just trying to help out the community in any way i can. Also i have been working on defintions for the S4/S6 crowd too which i will post, the ECU most commonly found in the S4/S6 cars in the USA atleast are 4A0 907 551 A and 4A0 907 551AA. my definitions are based around the 551AA ECU as its the most common one here. the RS2 defintion is for the 8A0 907 551B, i started a defintion for the 551C file only to realize it is an immobilizer equipped file and it will not work in my AAN powered 84 4000 quattro. If you feel you can add anymore information to these definitions please do and share. i almost forgot about the checksum, if you modify either the timing/fuel chip you have to correct the checksum. i use winOLS to correct the checksum for the timing/fuel chip. for the boost chip i dont know how to correct the checksum on the boost chip but my car seems to run fine even though i have a CEL and a fault for the checksum being incorrect. maybe someone can add the abililty to correct the checksum's to the definition files.

Finally i just want to bring up decompiling the M2.3.2 ECU using ida pro. I know that the M2.3.2 Processor is a basically an INTEL 8051 processor, when using ida pro im not sure which form of the 8051 processor to use but i have been using the C515 style to attempt to learn the ECU and use ida pro. im not sure if im using the right style of processor though. i have been trying to figure out how to do this for some time now. i know there are users on this forum and out there in general who have a full understanding of the ECU but will not elaborate on how to go about decompiling the software and already have a full understanding of the ECU. i have attempted to talk to some of these people but when it came down to it i felt these people where just degrading me and seemed to protect it like its bosch's best kept secret. i personally feel people have a right to know if they want to learn about how their car works so im going to post whatever i learn about M2.3.2.

Have fun with this info and i hope it helps out everyone that is seeking knowledge about this ECU and i hope the people out there that have more knowledge than me will contribute to this thread and not beat around the bush with information. Im not fishing for negativity by posting this, im trying to share my knowledge and hopefully learn more about this ECU in the process.

[vwnut8392]

Well i worked with the URS4/URS6 4A0 907 551AA chip set a little bit and came up with these XDF's. I know their not perfect but their a step in the right direction. the category labeled "Differences by comparison" are differences i found between comparing the 551C RS2 binary and an MTM stage 1+ file. those maps are different in some way in comparison to the original 551AA file. i've been trying to figure out the axis's for the boost chip with little luck. also i think i have the XDF for the boost chip setup so it will correct the checksum. Im not sure if it actually works as i havn't tested it. Please use these with caution as they aren't perfect and revisions/input to them is much appreciated.

[vwnut8392]

This is the procedure i use to correct the checksum for the boost chip. The first thing your going to want to do is go download a copy of HxD hex editor.
Here's a link to the download page for it, pick the language that suites you best.
http://mh-nexus.de/en/downloads.php?product=HxD

once ya have that open your modified 32k boost chip BIN file in HxD. highlight from 0x0000 to 0x3FFF. next you'll want to click analysis up top and pick checksum. with the little window open pick "Checksum-16" and make sure the region radio button is highlighted. and say OK. after that a window will pop up showing the 16 bit checksum.
That part of the checksum goes at at offset 0X3FFA and ends at 0X3FFB. now for the next 2 sets of bits in the checksum. these have to be inverted and to do so you must take the checksum you calculated with HxD and subtract it from FFFF. once you have those values input them into offset 0-3ffC and offset 0x3ffD. Oh and the last to sets of bits ar ethe ECU's internal number. To do this math easily you can simply use the calculator in windows. To do that open it up, click view and than programmer. once that is up make sure you click the radio button on the left for HEX and your good to go to calculate the second half of the checksum.

Here is the example from RS4BOOST. These example are from stock bainaries for so you can see what is exactly changed.

xx = 16Bit Checksum of the complete binary file
yy = binary complement of xx => FFFF - xx

zz is an internal Bosch build number of the file

Here different examples for the last 6 Bytes (xx yy zz):

Audi S2 - ABY - M2.3.2
895907551A* *- 0261203145 - 1267357519
...F9 D9* *06 26* *A1 47 => FFFF - F9D9 = 0626

Audi S6 - AAN - M2.3.2
4A0907551C - 0261203601 - 1267358644
...0A 96* *F5 69* *A2 45 => FFFF - 0A96 = F569

Audi RS2 - ADU - M2.3.2
8A0907551C* - 0261203543 - 1267358647
...AA 37* *55 C8* *A2 53 => FFFF - AA37 = 55C8

Regards Tom

Also remeber that with the 32K files they are technically a double file so if you modify anything from 0x0000 to 0x3FFF you must make the same identical modification from 0x4000 to 0x7FFF. also the checksum is repeated starting at 0x7FFA so if you change it at 0x3FFA you must make it identical at 0x7FFA.

Feels good to have some help with this and i'd like to thank tom AKA RS4BOOST for explaining that for me because my brain is fried from working on all this. hope this helps all you guys with the steps toward tuning you own ECU's. :hurray:

[vwnut8392]

when i do binary comparison my choice program is a program called HEXcmp. pretty simple to use and will show you what differences there are plus you can offset one BIN to another because no 2 versions of motronic are laid out the same even though they all are all mostly the same with minor revisions.
http://www.fairdell.com/hexcmp/

One other program i use is winOLS. this is a great map discovery program and it will correct the motronic 2.3.2 checksum for you.
http://www.evc.de/en/product/ols/software/

idaPRO is another program i've been trying to learn how to use for some time. This is what most of the professional guys are using to reverse engineer the binary of most automotive ECU's.
https://www.hex-rays.com/index.shtml

lastly tunerproRT is a great piece of software that is needed to modify your tune. this is the piece of software that you will use the XDF files and the BIN files i previously posted.
http://www.tunerpro.net/

[vwnut8392]

Here's some stock binaries i've collected so far for various I5 20V turbo cars. 3/4 of these rar files have the timing/fuel BIN and the boost BIN too. As i find more i will post them up for everyone to have. I have a couple tuner files but i dont know if its acceptable to post them up here even if i leave them unnamed.

[Mcstiff]

[EDIGREG]

excellent post, great work!

[chaloux]

wow. only took 15 years for this info to get ""out there" eh? Nice work!

[vwnut8392]

Thanks guys! i feel the info should be out there for everyone to learn and evolve this ECU. i would love to see this ECU evolve into something far greater because i feel it has alot more potential than what bosch intended it.

[vwnut8392]

Im posting these 2 tuner file sets for comparison and education only. i dont know know if putting these out in public here is acceptable, so if it isnt i'll gladly remove this one post.

Sorry everyone, i was informed to delete these tuned files. you can PM me if you'd like and i will gladly give them to you still.

[chaloux]

That is seriously awesome. I vote KEEP

[Marc]

That is seriously awesome. I vote KEEP

its a fine line to walk. the same reason its illegal in most countries to upload copies of retail software for public download. The truly immoral part comes in writing said software down to a chip and using it without paying the creator of the software (which you just made very easy for anyone to do).

I'm fine with posting details of map locations and the like, but please remove any tuner files from here. Sorry if that upsets anyone, but as the owner of the server where this forum lives, I'm liable for stuff like this.

Thanks for understanding.

[chaloux]

Hey I hear ya. As a non-employee/owner I get to vote keep, but wouldn't if I was you.

[vwnut8392]

that's fine marc, i will remove them as per your request. i was recently informed that you host this forum and pretty much run it. is it safe to post a link outside of this forum to them? than this way they would not be hosted directly from here. if that doesnt work than anyone who wants these tuned files can PM me and i will send the files or a link as to where they can be downloaded from.

i had a run in one time with a tuner over a tuned file with custom code that i had originally created and gave away for free. he claimed it to be his but couldnt prove it in court, he made it sound like he just magically made the modifications and it worked with no proof of how it functioned lol. it got thrown out over all because the judge made a valid point and that point is that we just modified the code, the code was really written and copyrighted by bosch. if anything me and the other guy should have been there defending ourselves against bosch. the judge told me that if bosch doesnt care what is done with this software than more power to me and he doesnt understand how someone can copyright something thats already copyrighted. i contacted bosch USA personally about motronic 2.3.2 and they told me "that motronic 2.3.2 is obsolete and they no longer support it, have a great day.".

So thats my story with playing with tuned files. i feel that if a tuner does say his tune is "copyrighted" he's full of it. its like thomas edison's family suing sylvania or like manufacturer for making money off of the light bulb . yeah the current manufacturers have refined it and made it better but when it all boils down to it thomas edison invented the light bulb and he carried the patent for it. im not trying to argue but i just like to tell my story and point of view on tuning and when people think they own it.

[Marc]

the issue isn't necessarily with 'starting with' a tuner file, its copying it into an ecu with no modifications. you could take your argument to a level of absurdity. what if you changed just the ID tag on the fuel chip, does that now count as a new chip?

Anyways, thanks for removing them. I guess I dont have a big problem with external links to the same files.

[vwnut8392]

the issue isn't necessarily with 'starting with' a tuner file, its copying it into an ecu with no modifications. you could take your argument to a level of absurdity. what if you changed just the ID tag on the fuel chip, does that now count as a new chip?

Anyways, thanks for removing them. I guess I dont have a big problem with external links to the same files.

i know its a big gray area and im glad you realized i only put these here for people to learn and further their knowledge on this ECU and not for just anyone to pirate the software and get a free tune. i dont want to get you or the forum in trouble because i really like it here, its drama free and everyone seems to get along well.

[AngryTaco]

just until dramarider shows up at least........

[vwnut8392]

Ive been looking at the 4A0 907 551 C binary for the rev limiter and i think i may have found it at 0XA37C. using the info on rev limiters from the motronic.ws web site i think i have successfully calculated the rev limiter.

to figure out the rev limiter you have to locate the binary at 0XA37C and 0XA37D. in the case of the 551C file the hex is 97 and 03. you have to take the 97 and convert it from hex to decimal. 97 converted to decimal is 151. the math goes like this to get the actual real world rev limiter, 983600/151=6513.907284768212. so this makes the rev limiter on that file 6513.90. the value of 983600 came from the motronic.ws web site for the RS2. using the 983600 value is considered a short cut to get the rev limiter. i dont exactly understand the math on there using the whole 16 bit hex code to get the rev limiter. if someone could elaborate on that method of doing it that would be great.

[vwnut8392]

i totally forgot to include the info on how to defeat the immobilizer on the 4A0 907 551C ECU.

To defeat the ECU you need to locate hex offset 0XA614 and you will find 11 in HEX.
you will see this code starting at this location.

Code: Select all

11 1E FF C8 5A 1E 5F

Make this line of code look like this.

Code: Select all

00 00 00 00 00 00 00

Once that change is made correct the checksum and burn the file to your new chip! no more immo fault and the car shutting off!

This also works with the 4A0 907 551D, 4A0 907 551E etc ECU's, also this work with the 8A0 907 551C and above RS2 ECU although you will find that this line of code is at different offset's but you can figure out where the line of code lives using a program like HEXcmp.

[AngryTaco]

Just a question because I was seriously considering delving into these chips back when I wanted to major in both mechanical and electrical engineering:

What do you need to hook up to your computer to actually program (burn) and read these chips? What software? I know it has to be C++ based but I hate writing and coding with a passion. I'd rather be under a muddy Ramcharger trying to replace a twisted driveshaft with a piece of sqaure tubing in the middle of the woods with a oxy/ace torch and hungry hungry hippos staring at me vs code.

[elaw]

I can't claim to know much about Motronic but here's some generic info that relates to all ECUs...

To actually read (and write) the chip(s) you need something called an "EPROM programmer". It hooks to your computer and has a chip socket on it... you plug the chip in, fire up the software on the PC, tell the software what kind of chip it is, and hit "read" and out comes the data.

But that's where the real fun begins. The program may have been created in a common programming language like C++ (or more likely C) but what's in the chip is not readable programming language. It's just a bunch of bytes like this:

SaabROM.png (20.54 KiB) Viewed 124017 times

At that point either you or a specialized piece of software has to go through all those bytes and figure out what's going on. And there are a lot of them... many thousands.

I'm also using the term "bytes" a little generically. If the CPU in the ECU is 8-bit, it processes one byte at a time. 16-bit CPUs access them in pairs (usually sometimes), and 32-bit CPUs access them in groups of 4 (again, sometimes but not always).

[AngryTaco]

wanna burn a chip for my 900 turbo? LOL I want to put a 2.1L head and intake manifold on plus a TD04 off of a 9000. I only say that because of the SS you posted.

[elaw]

What year 900T? Or more specifically, first-gen or second?

For a second-gen car (with Trionic engine management) you don't really "burn a chip", the data is in flash memory. And there's a whole web community dedicated to reprogramming Trionic... take a look at http://ecuproject.com/index.html.

If it's a first-gen car with LH engine management, there are a few people out there doing chips for them that I can give you info on if you want. But that system is pretty limited - if you want crazy power (and don't mind replacing transmissions constantly ), you might have to upgrade the engine to Trionic. But that's not a small task.

[AngryTaco]

Its a 92 (pre-gm). I dont really follow Saab all that much but I know my way around the car. It has the APC unit if that matters

[vwnut8392]

To read and write chips i use a willem GQ4X eprom programmer.
http://www.mcumall.com/comersus/store/comersus_viewItem.asp?idProduct=4312
There's a bunch of adapters they sell for this programmer too. i have the adapter to read the PLCC44 chip found in 0BD2 MK3 VW ECU's and the adapter to read PSOP44 chips from MK4 ME7 ECU's too. this chip burner comes with software and everything to read and write chips. this thing supports like 10,000 different chip if i recall correctly. i've even read and reprogrammed the mileage chips out of instrument clusters with this programmer.

another option for doing live tuning on this ECU is to get a moates ostrich 2 ROM emulator.
http://www.moates.net/ostrich-20-the-new-breed-p-169.html?cPath=95
use this emulator with tunerproRT tuning software and you can live tune and data trace whats doing what in the binary. you need to find or create a definition file for the version of the ECU your working with and that versions chip read out. i have started creating several XDF definition file for tunerpro but i feel what i have found isnt concrete enough to put it out there yet. im afraid people will be blowing up cars because i improperly labeled a map.

i use both of these devices to interface with my M2.3.2 ECU along with a VAG COM cable and VAG COM to watch the measuring blocks and get a rough idea of how the engine is reacting to the tuning.

If you want to start tracking maps down i would suggest either buying or hunting up a cracked copy of winOLS. thats a great piece of software and it will attempt to do some of the work for you and hunt for maps plus with the full version it will correct the checksum.