Announcement

Collapse
No announcement yet.

Comprehensive Bosch Motronic M3.3 (HW 0261203075 : M3 E36 3.0L Euro)

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    Comprehensive Bosch Motronic M3.3 (HW 0261203075 : M3 E36 3.0L Euro)

    Hi everybody,

    I've started the disassembling of a Bosch Motronic M3.3 binary (HW 0261203075 & SW 1267358585) because I would like to understand this engine management system. I am working on the 128kb of the external EEPROM (see my link).


    Sign in to your OneDrive cloud storage and Office Online.


    I chose the INTEL 80196 processor. My problem is that I don’t find addresses of data in the program (data space starts at 0xC800). I tried to use different offsets but still don’t understand how data is used in the program. Maybe someone has already worked on this ECU and would help me ?
    Click image for larger version  Name:	0261203075.png Views:	641 Size:	82.5 KB ID:	25453
    Last edited by MpowerE36; 08-01-2023, 12:49 AM.
    https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

    #2
    I'd suggest starting on s/w 357934, it's essentially the same thing, but the non EWS version.
    Granted, you might find a way to disable the immobiliser, but overall the earlier versions without it would make it a little more universal.

    Comment


      #3
      Originally posted by TheEnd View Post
      I'd suggest starting on s/w 357934, it's essentially the same thing, but the non EWS version.
      Granted, you might find a way to disable the immobiliser, but overall the earlier versions without it would make it a little more universal.
      Also try to disassemble the 357934 & 357081 SW but still don't find data offsets in the disassembled program code...
      https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

      Comment


        #4
        Nobody tries to disassemble this DME ?
        https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

        Comment


          #5
          olza good to see you ! Do you try to disassemble this ECU ? I would need some help to start. Thanks
          https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

          Comment


            #6
            I’ve tried with the same results unfortunately

            Comment


              #7
              Is this where you guys are hanging out these days good to see the old gang again.

              Comment


                #8
                If my research are correct, there a piece of the program in the CPU memory. And we need it to merge it with the program of the extern EEPROM in order to correctly disassemble the entire program. Did someone manage to read the internal memory of this CPU or know a reader/programmer for this one ?
                Last edited by MpowerE36; 12-25-2023, 12:14 PM.
                https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                Comment


                  #9
                  Hello
                  I think that i can help you with an example.
                  At DA22 you can see a table of tables listed.
                  Lets suppose that ROM_9C16 is an ignition related subroutine.
                  At 9E62 address, you can see:
                  ld INTMEM_1A, #7Eh
                  7E is the number to add at DA22, to get the pointer to D448 table: Dwell map
                  lcall ROM_3370 should be the table map accessing subrouitine, there are more than one.

                  Comment


                    #10
                    Originally posted by biela View Post
                    Hello
                    I think that i can help you with an example.
                    At DA22 you can see a table of tables listed.
                    Lets suppose that ROM_9C16 is an ignition related subroutine.
                    At 9E62 address, you can see:
                    ld INTMEM_1A, #7Eh
                    7E is the number to add at DA22, to get the pointer to D448 table: Dwell map
                    lcall ROM_3370 should be the table map accessing subrouitine, there are more than one.
                    Thank you for this example. Do you know how it works for single parameters ? I don't think there is a table of parameters.

                    Do you also know if there is a piece of the program in the CPU memory or all the program is in the external eeprom ?
                    Last edited by MpowerE36; 12-25-2023, 01:46 PM.
                    https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                    Comment


                      #11
                      Some progress :

                      C800: Beginning of control data, Rev Limiter, Speed Limiter, Injector Constant, Target AFR...etc

                      C910: Beginning of DTC data, CEL enable, Flash Codes, DTC entry/exit protocols & fail-safes.

                      CA94: Beginning of MAF table, Transfer Functions and MAPs/Tables.

                      DA22: Beginning of Index of MAPS, or known as Table of Tables.

                      DB26: End of all Data, Maps & controls.


                      Click image for larger version

Name:	Data sections.png
Views:	176
Size:	28.0 KB
ID:	247384
                      https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                      Comment


                        #12
                        Hi! Did you find a way to get the internal CPU data? Motronic 5.2 seems to be quite similar. (What a coincidence, as VAG M3.8.3 and M5.9.2 are essentially the same ECU too on the VAG side of things.)

                        Comment


                          #13
                          I am currently doing an obd eprom reader for this ecu. It will read the first 0x2000 bytes of the internal memory and the next 0xE000 bytes (or 0x6000 bytes depending of the software) of the external memory. I don't know if there is more data in the cpu and how to read it.
                          Last edited by MpowerE36; 02-12-2024, 08:13 AM.
                          https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                          Comment


                            #14
                            I've finished the EPROM reader. I think it could be easily adapted for other Motronic of the same generation.

                            https://www.youtube.com/channel/UCwN...zf45mXp6PDOCzA

                            Comment


                              #15
                              Awesome work! Do you think it could read the internal CPU from M5.2? Disassembly unfortunately is quite pointless without the internal CPU data.

                              Comment

                              Working...
                              X