A DIY, way to R/W flash memory ECU M3C of a Ducati Monster 1100, througth background debug connection interface (BDM).
BDG signal is inside ecu, therefore is necessary open ECU.
This method permit to modify original map table, or upload a ready-made Ducati performance bin file.
Here’s what you need:
– BDM Freescale s12 interface (If it is not available. . Maybe this one is compatible)
– USBDM driver
– Laptop Windows 7, 32 bit
– Codewarrior HC12 v5.1 special edition
– Converter
– Srecordizer.exe
– Winols test version
– Map M1100_ABS_A2IU1NIL_00601000_NoO2NoFlapTune
The engine of m3c ecu is a powerful Freescale MC9S12XS256 microcontroller of which the affected memory range in hexadecimal start at 780000 and finish at 7FFFFF of global memory.
This range contains the full flash memory and can be replaced by an external file.bin.
In the real as you can see in the left of the image, we can read and write only an area at time, precisely Block_1S and Block_0.
In case you want write a DP file, only half of the file.bin is needed and precisely the half about Block_0, (Block_1S inside file.bin is identical of original).
In case you want edit original map table, i finded it in Block_1S and Block_0 remains original.
Wiring and reading & saving:
For download Block_1S and Block_0 as SX file open hiwave.exe located in /program files/freescale/cws12v5.1/
– SAVE 0x0780000’G..0x079FFFF’G block_1s.sx (For Block_1S 312kb)
– SAVE 0x07E0000’G..0x07FFFFF’G block_0.sx (For Block_0 312kb)
If you copy and paste this line please pay attention at ‘ Near G, probably you need to rewrite it manually.
in the command bar of CW.
At now, is necessary converter to convert SX just made in to a S19 file.
Block_1S.sx —-> Block_1S.s19 (304kb):
Block_0.sx —-> Block_0.s19 (242kb):
Winols to find map inside Block_1S.S19
Map table area start from address E1B000 to E1B07F:
There is other tables in this file, but i dont know how it useful.
Anyway, i’ve tryed to increase +1, +2, +3 value of all data in the range above with Srecordizer.exe.
Srecordizer.exe
Srecordizer is a simple hex editor, but it auto adjust last bit of checksum in each line.
Example of already edited of +2 value in map table area from E1B000 to E1B07F.
One time Write preparation
To write Flash is needed again “Hiwave.exe”, but to avoid brick ecu you need to disable the ability to run software protection.
Specifically, the protection is enabled by the 1 bit state inside the flash, which can be written non-intrinsically from the write tool.
To do this, you must create a file named “Preload.cmd” in the root where “Hiwave.exe” resides, containing:
// Before loading the commands written below will be executed
// The following commands must be enabled to load in flash with the ICD12
// initialize the flash mechanism
FLASH NOUNSECURE
A prove of correct loading of preload.cmd is visible when you start Hiwave.exe.
Write Flash Memory
Important . . first do above Write protection paragraph.
In “Hiwave.exe” open TBDML HCS12 curtain and select Flash…
For write first Erase flash memory and then button “Load…” will activate and permit load S19 file.
Obviously depending which S19 about Ducati performance map or original edited map table you wonna load:
– Ducati Performance S19 file go writed in PFLASH 00F88000 – 00FFBFFF (Block_0)
– Original edited S19 file go writed in PFLASH 00E08000 – 00E7BFFF (Block_1S)
Never delete other part of Flash memory 🙂
How to convert DP BIN into DP S19 file
To convert a BIN file into a S19 file ready to flash with this method first download Splitfile and use it in this way:
In the folder parts there is 2 splitted file of each one wheigs 128kb.
Rename they in this way:
– part.0 —-> Block_1S.bin
– part.1 —-> Block_0.bin
Now recover BIN2SREC and do:
bin2srec.exe -s -o 780000 Block_1S.bin > Block_1S.sx
bin2srec.exe -s -o 7E0000 Block_0.bin > Block_0.sx
Use the usual Converter to convert addressing of SX file into S19:
With my DP file “M1100_ABS_A2IU1NIL_00601000_NoO2NoFlapTune.bin” the S19 become:
– Block_1S.S19 —-> 304 Kb
– Block_0.S19 —-> 237 kb
Now you can write as above, your Block_0.S19 in your ECU… remeber with DP map is not needed write Block_1S.S19 because it is identically at original.
Have a good luck enjoy, donate at end page 🙂 !
Appendix standalone ecu wiring:
38 replies on “M3C siemens contitech ECU flash/remapped on Monster 1100 / Scrambler / KTM300 tpi”
Hello Morris
You have done a great work. As I can understand you wanted to convert a ducati standard m3c for a 1100 to a DP one. I worked on these Ecus some time ago joined to a group of hobbyist , breaking one of these and researching about the BDM pads. I had not the necessary Freescale interface but a group’s member had one and could read the memory content to a file. Someone of those knew very well the Winols software but noone could know where the maps were.
After that I bought a different interface wich read and write on the m3c by its can bus. I could modify sucessfully some thing on the m3c as its wellcome message on the dashboard, but when I tried change others bytes at random mode, then the m3C didn’t work. I thought it was cause of a CRC byte or something else.
I would like know if you can tell me about the memory zone where the rpm limit is and also if it is possible how the mapp is built.
Thanks in advance.
Hi,
Pratically i’ve saved all Flash memory and with winols in 2d/3d way i see some possible map . . I try to edit it and rewrite with success.
With this change (i think air/fuel ratio) termignoni work well, but i dont know where is rpm limit parameter or others data.
Aniway i’ve located where DP ecu is modified and it isnt in the Block_1s, where i work, but in block_0.
Hello Morris,
I have M3A synerject ECU can you help to connection pinout with S12 programmer.,
these MCU family is MC9S12Q128MFUE16.
Bkgd signal is in pin 15, and reset at pin 30.
Look at page 45 of manual.
For 5 volt you need to find it into pin + of a big capacitor and ground near a screw of pcb or same capacitor.
Use a voltmeter to find power supply.
Read this for CW:
https://community.nxp.com/thread/377765
By
Hi,
Have you located where the immobilizer check is in the map? I’m new to this, but looking to disable my immobilizer in my m3c (monster 696). Apparently DP ecus have the immobilizer disabled.
Thanks
Hi, i dont know where immo byte is located, i dont focused this project for it.
Bye
Ok, thank you for the quick reply. Reason I’m looking to disable it is because my crashed bike destroyed my speedometer, so I bought another used one and now it won’t start due to immo error.
Is there someone read a DP mapping for Monster 1100 and 696?
I never tried on 696, but is 99% probably same. . . For a Scrambler was same, bye
Congratulations on your site and thanks for this tutorial, I tried the whole procedure egira too
codewarrior 5.1 works only on win32bit not on 64bit, but also runs on virtual machine, used
Oracle virtualbox virtual machine, and winxp 32 pro serviced pack2, sp1 does not work.
thank you
The reason why you could change the Flash memory content and it still works, it is that the ECU does not implement any Flash memory check using any checksum.
In most recent ECUs for cars, in order to avoid tampering, ECU manufacturers implement Flash Checksum check. In case any person modify any part of the Flash memory, the checksum value does not match anymore, and the ECU does not start the engine.
This countermeasure also have the purpose to detect any Flash memory corruption and avoid ECU becoming “crazy”.
What you say is right, it was probably a fortune.
Regarding the checksum I think that if it were implemented, it is possible to restore it in some way.
In any case, every single line of the S19 file presents its checksum as the last bit, which is recalculated by Srecordizer.
Hello
Have you ever try to dissasemble this file?I am trying to fix the segments for ida to get correct dissasemble results.
I’ve never tried to disassemble it, if you have success talk me.
Good luck
Hi all,
I happened on this blog that I find very interesting and out of curiosity I tried to read an ecu coming from an M696.
In your opinion this USBDM interface is OK?
https://www.amazon.it/gp/product/B07KSD2SFF/ref=ppx_yo_dt_b_asin_title_o00__o00_s00?ie=UTF8&psc=1
and instelled this CW: CodeWarrior_HC12_v5.1_SPECIAL.exe
I connected all the stuff but after writing this command in Hiwave – Command page “SAVE 0x0780000’G..0x079FFFF’G block_1s.sx” and pressing “reset button” I can only read folllowing comments:
“File does not exist: reset.cmd” and
“Reset Vector undefined”. What’s wrong?
Can I send you some pic to your email please?
Thank you for your support
Cheers, Marco
Hi Marco, i’ve used another usbdm adapter, you can find link in m3c ecu page.
I think your adpter is not compatible with codewarrior suite.
If hw connection to ecu and adapter are compatible ok you can see some response from ecu simply pressing Reset button..
When you start CW suite your usbdm adapter is correctly recognized?
Hi, Do you know if this process will work without the ECU connected to the bike, just with 12v and GND applied to the relevant pins?
I have found info suggesting that 12v goes to A4 and B4 and GND goes to M4… do you know if this is correct or if it will work for this process?
Thanks for the great info!
Hi Dave, i never tried but i think you can work with ecu on the table.
Sure you have to give Power supply in the correct pin of ecu connector and try.
If you have success give me notice and then i publish here.
Bye
Hi Morris, yes it worked OK… I applied 12v to A4 and B4 and GND to M4.
I have been able to save and convert the block_1s and block_0 files however when I load block_1s.s19 into WinOLS it does not have any checksums… is this normal?? Also, the data appears in WinOLS but it will not auto find any maps. I am wondering if theres something I am missing? Any suggestions? Thanks for your info so far!
Nice Work! Is more easy now.
Yes is normally, checksum value is unknow for Winols, it dont have this file in the database.
Winols can show you in graphics the contents of your file, but it not discover maps alone.
Go to address E1B000, bye.
very good job.
Does your method permit to show the new label on the dashboard ( when you switch to the DP map) like it’s possible to do with the iaw 5am.
Yes, is possible to change startup message on Dashboard, is necessary to edit original text in the sx file.
But i never tried to do it.
Bye
ola
alguem poderia me informar se este adaptador esta correto? https://www.ebay.com/itm/Freescale-USBDM-Programmer-BDM-OSBDM-OSBDM-Download-Debugger-Emulator-Downloader/152693523296?ssPageName=STRK%3AMEBIDX%3AIT&_trksid=p2057872.m2749.l2649 estou utizando o driver USBDM mas nao sei se isso esta correto,meu MCU é s9s12xs128
Hi, i dont know that adapter…
This one :
https://m.it.aliexpress.com/item/477224835.html?trace=wwwdetail2mobilesitedetail&productId=477224835&productSubject=FREESCALE-S12-BDM-programmer#!
im sure work well.
Bye
ola
voce poderia me informar qual Driver voce esta utilizando ?a minha intercace na aparece na lista de dispositivos no CW
minha interface e USBDM_JS16CMJ v1.0
Hello.
Is possible to clone my m3c ecu to another one in order to have a real copy of it?
I have a Scrambler icon 2019 model.
I want to play whit one m3c in order to deactivate service oil or desmo, and (if possible) activate/deactivate ABS or another options. For example, Scrambler DS 2019 have a ABS off option and this is not available on my bike.
Hi Jordi, of course you can copy your m3c ecu, you have to follow my tutorial.
Im sorry, but with this way you can modify air/fuel ratio or how above write all flash with another.
By
hi, may I ask, the driver for S12 BDM V1.3
where do i get that ??
thank you
Added Driver on the post
What are the diferences to make all of this but for KTM ECU?
Anybody tried?
Thank you.
Hi, i dumped flash memory of KTM300 tpi ecu, but it is not exactly equal at M1100 dump.
I tried to mod map but with no significant changes (only one attempt available).
User Dave, (you can see on the comments), as his words, it succesfully modded ecu of KTM 300 Tpi for resolve some issues, but it never shared to me files…
Thank you Mr morris for your answer, could you send me the map that you have for me to compare? Thank you
Sended at your email
Hello, can help me anything for reset motor hours for this model of ECU M3C for a CanAm ? I tried to reset and after put on atv lost moore data like coding of DPS, immo data etc…
Im unable to help you, i dont have enough know-how about immo or dps .
Hi
I’ve been dealing with a KTM tpi and have been successful extracting the file. Even partial editing but I’m trying to figure where the fueling table is as well as the oiling table. Do you know how to figure out which table does what?
John
Hi, a user “Dave” as you can see in previous comments , boast to succesfully edited a KTM 300 tpi , but it never shared to me address of fuel table or other . .
However, i’ve founded something from address E1BA00 to E1BE8F, but i didn’t have opportunity to test it.