Monster 1100/796/696

M3C siemens contitech ECU flash/remapped on Monster 1100 / Scrambler / KTM300 tpi

A DIY, way to R/W flash memory ECU M3C of a Ducati Monster 1100, througth background debug connection interface (BDM).
BDG signal is inside ecu, therefore is necessary open ECU.

This method permit to modify original map table, or upload a ready-made Ducati performance bin file.

Here’s what you need:
BDM Freescale s12 interface  (If it is not available. . Maybe this one is compatible)
– USBDM driver
– Laptop Windows 7, 32 bit
Codewarrior HC12 v5.1 special edition
Winols test version
– Map M1100_ABS_A2IU1NIL_00601000_NoO2NoFlapTune

The engine of m3c ecu is a powerful Freescale MC9S12XS256 microcontroller of which the affected memory range in hexadecimal start at 780000 and finish at 7FFFFF of global memory.
This range contains the full flash memory and can be replaced by an external file.bin.

In the real as you can see in the left of the image,  we can read and write only an area at time, precisely  Block_1S and Block_0.
In case you want write a DP file, only half of the file.bin is needed and precisely the half about Block_0, (Block_1S inside file.bin is identical of original).
In case you want edit original map table, i finded it in Block_1S and Block_0 remains original.

Wiring and reading & saving:

For download Block_1S and Block_0 as SX file open hiwave.exe located in /program files/freescale/cws12v5.1/prog/hiwave.exe and in the section “command” write:
– SAVE 0x0780000’G..0x079FFFF’G              (For Block_1S 312kb)
– SAVE 0x07E0000’G..0x07FFFFF’G               (For Block_0 312kb)
If you copy and paste this line please pay attention at ‘ Near G, probably you need to rewrite it manually.
Do the above with Ecu connected at motorbike, ignition key in “ON” position (engine OFF) and click on “Reset”  in the command bar of CW.

At now, is necessary converter to convert SX just made in to a S19 file. —-> Block_1S.s19 (304kb): —-> Block_0.s19 (242kb):

Winols to find map inside Block_1S.S19
Map table area start from address E1B000 to E1B07F:

There is other tables in this file, but i dont know how it useful.
Anyway, i’ve tryed to increase +1, +2, +3 value of all data in the range above with Srecordizer.exe.

Srecordizer is a simple hex editor, but it auto adjust last bit of checksum in each line.
Example of already edited of +2 value in map table area from E1B000 to E1B07F.

One time Write preparation

To write Flash is needed again “Hiwave.exe”, but to avoid brick ecu you need to disable the ability to run software protection.
Specifically, the protection is enabled by the 1 bit state inside the flash, which can be written non-intrinsically from the write tool.
To do this, you must create a file named “Preload.cmd” in the root where “Hiwave.exe” resides, containing:

// Before loading the commands written below will be executed
// The following commands must be enabled to load in flash with the ICD12
// initialize the flash mechanism

A prove of correct loading of preload.cmd is visible when you start Hiwave.exe.

Write Flash Memory

Important  . . first do above Write protection paragraph.
In “Hiwave.exe” open TBDML HCS12 curtain and select Flash…

For write first Erase flash memory and then button “Load…” will activate and permit load S19 file.
Obviously depending which S19 about Ducati performance map or original edited map table you wonna load:
– Ducati Performance S19 file go writed in PFLASH 00F88000 – 00FFBFFF (Block_0)
– Original edited S19 file go writed in PFLASH 00E08000 – 00E7BFFF (Block_1S)
Never delete other part of Flash memory šŸ™‚

How to convert  DP BIN  into DP S19 file

To convert a BIN file into a S19 file ready to flash with this method first download Splitfile and use it in this way:

In the folder parts there is 2 splitted file of each one wheigs 128kb.
Rename they in this way:
– part.0 —-> Block_1S.bin
– part.1 —-> Block_0.bin

Now recover BIN2SREC and do:
bin2srec.exe -s -o 780000 Block_1S.bin >
bin2srec.exe -s -o 7E0000 Block_0.bin >
Use the usual Converter to convert addressing of SX file into S19:

With my DP file “M1100_ABS_A2IU1NIL_00601000_NoO2NoFlapTune.bin” the S19 become:
– Block_1S.S19 —-> 304 Kb
– Block_0.S19 —-> 237 kb
Now you can write as above, your Block_0.S19 in your ECU…  remeber with DP map is not needed write Block_1S.S19 because it is identically at original.

Have a good luck enjoy, donate at end page šŸ™‚ !

Appendix standalone ecu wiring:


38 replies on “M3C siemens contitech ECU flash/remapped on Monster 1100 / Scrambler / KTM300 tpi”

Hello Morris

You have done a great work. As I can understand you wanted to convert a ducati standard m3c for a 1100 to a DP one. I worked on these Ecus some time ago joined to a group of hobbyist , breaking one of these and researching about the BDM pads. I had not the necessary Freescale interface but a group’s member had one and could read the memory content to a file. Someone of those knew very well the Winols software but noone could know where the maps were.
After that I bought a different interface wich read and write on the m3c by its can bus. I could modify sucessfully some thing on the m3c as its wellcome message on the dashboard, but when I tried change others bytes at random mode, then the m3C didn’t work. I thought it was cause of a CRC byte or something else.
I would like know if you can tell me about the memory zone where the rpm limit is and also if it is possible how the mapp is built.

Thanks in advance.

Pratically i’ve saved all Flash memory and with winols in 2d/3d way i see some possible map . . I try to edit it and rewrite with success.
With this change (i think air/fuel ratio) termignoni work well, but i dont know where is rpm limit parameter or others data.
Aniway i’ve located where DP ecu is modified and it isnt in the Block_1s, where i work, but in block_0.

Hello Morris,

I have M3A synerject ECU can you help to connection pinout with S12 programmer.,
these MCU family is MC9S12Q128MFUE16.


Have you located where the immobilizer check is in the map? I’m new to this, but looking to disable my immobilizer in my m3c (monster 696). Apparently DP ecus have the immobilizer disabled.


Ok, thank you for the quick reply. Reason I’m looking to disable it is because my crashed bike destroyed my speedometer, so I bought another used one and now it won’t start due to immo error.

Congratulations on your site and thanks for this tutorial, I tried the whole procedure egira too

codewarrior 5.1 works only on win32bit not on 64bit, but also runs on virtual machine, used
Oracle virtualbox virtual machine, and winxp 32 pro serviced pack2, sp1 does not work.

thank you

The reason why you could change the Flash memory content and it still works, it is that the ECU does not implement any Flash memory check using any checksum.
In most recent ECUs for cars, in order to avoid tampering, ECU manufacturers implement Flash Checksum check. In case any person modify any part of the Flash memory, the checksum value does not match anymore, and the ECU does not start the engine.
This countermeasure also have the purpose to detect any Flash memory corruption and avoid ECU becoming “crazy”.

What you say is right, it was probably a fortune.

Regarding the checksum I think that if it were implemented, it is possible to restore it in some way.

In any case, every single line of the S19 file presents its checksum as the last bit, which is recalculated by Srecordizer.


Hi all,

I happened on this blog that I find very interesting and out of curiosity I tried to read an ecu coming from an M696.

In your opinion this USBDM interface is OK?
and instelled this CW: CodeWarrior_HC12_v5.1_SPECIAL.exe

I connected all the stuff but after writing this command in Hiwave – Command page “SAVE 0x0780000’G..0x079FFFF’G” and pressing “reset button” I can only read folllowing comments:
“File does not exist: reset.cmd” and
“Reset Vector undefined”. What’s wrong?
Can I send you some pic to your email please?
Thank you for your support
Cheers, Marco

Hi Marco, i’ve used another usbdm adapter, you can find link in m3c ecu page.
I think your adpter is not compatible with codewarrior suite.
If hw connection to ecu and adapter are compatible ok you can see some response from ecu simply pressing Reset button..
When you start CW suite your usbdm adapter is correctly recognized?

Hi, Do you know if this process will work without the ECU connected to the bike, just with 12v and GND applied to the relevant pins?

I have found info suggesting that 12v goes to A4 and B4 and GND goes to M4… do you know if this is correct or if it will work for this process?

Thanks for the great info!

Hi Dave, i never tried but i think you can work with ecu on the table.
Sure you have to give Power supply in the correct pin of ecu connector and try.
If you have success give me notice and then i publish here.

Hi Morris, yes it worked OK… I applied 12v to A4 and B4 and GND to M4.
I have been able to save and convert the block_1s and block_0 files however when I load block_1s.s19 into WinOLS it does not have any checksums… is this normal?? Also, the data appears in WinOLS but it will not auto find any maps. I am wondering if theres something I am missing? Any suggestions? Thanks for your info so far!

Nice Work! Is more easy now.
Yes is normally, checksum value is unknow for Winols, it dont have this file in the database.
Winols can show you in graphics the contents of your file, but it not discover maps alone.
Go to address E1B000, bye.

very good job.

Does your method permit to show the new label on the dashboard ( when you switch to the DP map) like it’s possible to do with the iaw 5am.

Yes, is possible to change startup message on Dashboard, is necessary to edit original text in the sx file.
But i never tried to do it.

Is possible to clone my m3c ecu to another one in order to have a real copy of it?
I have a Scrambler icon 2019 model.
I want to play whit one m3c in order to deactivate service oil or desmo, and (if possible) activate/deactivate ABS or another options. For example, Scrambler DS 2019 have a ABS off option and this is not available on my bike.

Hi Jordi, of course you can copy your m3c ecu, you have to follow my tutorial.
Im sorry, but with this way you can modify air/fuel ratio or how above write all flash with another.

Hi, i dumped flash memory of KTM300 tpi ecu, but it is not exactly equal at M1100 dump.
I tried to mod map but with no significant changes (only one attempt available).
User Dave, (you can see on the comments), as his words, it succesfully modded ecu of KTM 300 Tpi for resolve some issues, but it never shared to me files…


Iā€™ve been dealing with a KTM tpi and have been successful extracting the file. Even partial editing but Iā€™m trying to figure where the fueling table is as well as the oiling table. Do you know how to figure out which table does what?


Hi, a user “Dave” as you can see in previous comments , boast to succesfully edited a KTM 300 tpi , but it never shared to me address of fuel table or other . .
However, i’ve founded something from address E1BA00 to E1BE8F, but i didn’t have opportunity to test it.

Leave a Reply

Your email address will not be published. Required fields are marked *