M3C siemens contitech ECU flash/remapped on Monster 1100 / Scrambler

A DIY, way to R/W flash memory ECU M3C of a Ducati Monster 1100, througth background debug connection interface (BDM).
BDG signal is inside ecu, therefore is necessary open ECU.

This method permit to modify original map table, or upload a ready-made Ducati performance bin file.

Here’s what you need:
BDM Freescale s12 interface  (If it is not available. . Maybe this one is compatible)
– Laptop Windows 7, 32 bit
Codewarrior HC12 v5.1 special edition
srecCvt-gui.exe
Srecordizer.exe
Winols test version

The engine of m3c ecu is a powerful Freescale MC9S12XS256 microcontroller of which the affected memory range in hexadecimal start at 780000 and finish at 7FFFFF of global memory.
This range contains the full flash memory and can be replaced by an external file.bin.

In the real as you can see in the left of the image,  we can read and write only an area at time, precisely  Block_1S and Block_0.
In case you want write a DP file, only half of the file.bin is needed and precisely the half about Block_0, (Block_1S inside file.bin is identical of original).
In case you want edit original map table, i finded it in Block_1S and Block_0 remains original.

Wiring and reading & saving:

For download Block_1S and Block_0 as SX file open hiwave.exe located in /program files/freescale/cws12v5.1/prog/hiwave.exe and in the section “command” write:
– SAVE 0x0780000’G..0x079FFFF’G block_1s.sx              (For Block_1S 312kb)
– SAVE 0x07E0000’G..0x07FFFFF’G block_0.sx               (For Block_0 312kb)
If you copy and paste this line please pay attention at ‘ Near G, probably you need to rewrite it manually.
Do the above with Ecu connected at motorbike, ignition key in “ON” position (engine OFF) and click on “Reset”  in the command bar of CW.

At now, is necessary srecCvt-gui.exe to convert SX just made in to a S19 file.

Block_1S.sx —-> Block_1S.s19 (304kb):

Block_0.sx —-> Block_0.s19 (242kb):

Winols to find map inside Block_1S.S19
Map table area start from address E1B000 to E1B07F:

There is other tables in this file, but i dont know how it useful.
Anyway, i’ve tryed to increase +1, +2, +3 value of all data in the range above with Srecordizer.exe.

Srecordizer.exe
Srecordizer is a simple hex editor, but it auto adjust last bit of checksum in each line.
Example of already edited of +2 value in map table area from E1B000 to E1B07F.

One time Write preparation

To write Flash is needed again “Hiwave.exe”, but to avoid brick ecu you need to disable the ability to run software protection.
Specifically, the protection is enabled by the 1 bit state inside the flash, which can be written non-intrinsically from the write tool.
To do this, you must create a file named “Preload.cmd” in the root where “Hiwave.exe” resides, containing:

// Before loading the commands written below will be executed
// The following commands must be enabled to load in flash with the ICD12
// initialize the flash mechanism
FLASH NOUNSECURE

A prove of correct loading of preload.cmd is visible when you start Hiwave.exe.

Write Flash Memory

Important  . . first do above Write protection paragraph.
In “Hiwave.exe” open TBDML HCS12 curtain and select Flash…

For write first Erase flash memory and then button “Load…” will activate and permit load S19 file.
Obviously depending which S19 about Ducati performance map or original edited map table you wonna load:
– Ducati Performance S19 file go writed in PFLASH 00F88000 – 00FFBFFF (Block_0)
– Original edited S19 file go writed in PFLASH 00E08000 – 00E7BFFF (Block_1S)
Never delete other part of Flash memory 🙂

How to convert  DP BIN  into DP S19 file

To convert a BIN file into a S19 file ready to flash with this method first download Splitfile and use it in this way:

In the folder parts there is 2 splitted file of each one wheigs 128kb.
Rename they in this way:
– part.0 —-> Block_1S.bin
– part.1 —-> Block_0.bin

Now recover BIN2SREC and do:
bin2srec.exe -s -o 780000 Block_1S.bin > Block_1S.sx
bin2srec.exe -s -o 7E0000 Block_0.bin > Block_0.sx
Use the usual SrecCvt.exe to convert addressing of SX file into S19:


With my DP file “M1100_ABS_A2IU1NIL_00601000_NoO2NoFlapTune.bin” the S19 become:
– Block_1S.S19 —-> 304 Kb
– Block_0.S19 —-> 237 kb
Now you can write as above, your Block_0.S19 in your ECU…  remeber with DP map is not needed write Block_1S.S19 because it is identically at original.

Have a good luck enjoy, donate at end page 🙂 !

14 Replies to “M3C siemens contitech ECU flash/remapped on Monster 1100 / Scrambler”

  1. Hello Morris

    You have done a great work. As I can understand you wanted to convert a ducati standard m3c for a 1100 to a DP one. I worked on these Ecus some time ago joined to a group of hobbyist , breaking one of these and researching about the BDM pads. I had not the necessary Freescale interface but a group’s member had one and could read the memory content to a file. Someone of those knew very well the Winols software but noone could know where the maps were.
    After that I bought a different interface wich read and write on the m3c by its can bus. I could modify sucessfully some thing on the m3c as its wellcome message on the dashboard, but when I tried change others bytes at random mode, then the m3C didn’t work. I thought it was cause of a CRC byte or something else.
    I would like know if you can tell me about the memory zone where the rpm limit is and also if it is possible how the mapp is built.

    Thanks in advance.

    1. Hi,
      Pratically i’ve saved all Flash memory and with winols in 2d/3d way i see some possible map . . I try to edit it and rewrite with success.
      With this change (i think air/fuel ratio) termignoni work well, but i dont know where is rpm limit parameter or others data.
      Aniway i’ve located where DP ecu is modified and it isnt in the Block_1s, where i work, but in block_0.

  2. Hello Morris,

    I have M3A synerject ECU can you help to connection pinout with S12 programmer.,
    these MCU family is MC9S12Q128MFUE16.

  3. Hi,

    Have you located where the immobilizer check is in the map? I’m new to this, but looking to disable my immobilizer in my m3c (monster 696). Apparently DP ecus have the immobilizer disabled.

    Thanks

  4. Ok, thank you for the quick reply. Reason I’m looking to disable it is because my crashed bike destroyed my speedometer, so I bought another used one and now it won’t start due to immo error.

  5. Congratulations on your site and thanks for this tutorial, I tried the whole procedure egira too

    codewarrior 5.1 works only on win32bit not on 64bit, but also runs on virtual machine, used
    Oracle virtualbox virtual machine, and winxp 32 pro serviced pack2, sp1 does not work.

    thank you

  6. The reason why you could change the Flash memory content and it still works, it is that the ECU does not implement any Flash memory check using any checksum.
    In most recent ECUs for cars, in order to avoid tampering, ECU manufacturers implement Flash Checksum check. In case any person modify any part of the Flash memory, the checksum value does not match anymore, and the ECU does not start the engine.
    This countermeasure also have the purpose to detect any Flash memory corruption and avoid ECU becoming “crazy”.

    1. What you say is right, it was probably a fortune.

      Regarding the checksum I think that if it were implemented, it is possible to restore it in some way.

      In any case, every single line of the S19 file presents its checksum as the last bit, which is recalculated by Srecordizer.

      Hello

Leave a Reply

Your email address will not be published. Required fields are marked *