Comprehensive Bosch Motronic M3.3 (HW 0261203075 : M3 E36 3.0L Euro)

[MpowerE36]

Hi everybody,

I've started the disassembling of a Bosch Motronic M3.3 binary (HW 0261203075 & SW 1267358585) because I would like to understand this engine management system. I am working on the 128kb of the external EEPROM (see my link).

https://1drv.ms/u/s!AIYWDjVCL5J4gSI

I chose the INTEL 80196 processor. My problem is that I don’t find addresses of data in the program (data space starts at 0xC800). I tried to use different offsets but still don’t understand how data is used in the program. Maybe someone has already worked on this ECU and would help me ?

[TheEnd]

I'd suggest starting on s/w 357934, it's essentially the same thing, but the non EWS version.
Granted, you might find a way to disable the immobiliser, but overall the earlier versions without it would make it a little more universal.

[MpowerE36]

I'd suggest starting on s/w 357934, it's essentially the same thing, but the non EWS version.
Granted, you might find a way to disable the immobiliser, but overall the earlier versions without it would make it a little more universal.

Also try to disassemble the 357934 & 357081 SW but still don't find data offsets in the disassembled program code...

[MpowerE36]

Nobody tries to disassemble this DME ?

[MpowerE36]

olza good to see you ! Do you try to disassemble this ECU ? I would need some help to start. Thanks

[hobbit382]

I’ve tried with the same results unfortunately

[HybridNz]

Is this where you guys are hanging out these days good to see the old gang again.

[MpowerE36]

If my research are correct, there a piece of the program in the CPU memory. And we need it to merge it with the program of the extern EEPROM in order to correctly disassemble the entire program. Did someone manage to read the internal memory of this CPU or know a reader/programmer for this one ?

[biela]

Hello
I think that i can help you with an example.
At DA22 you can see a table of tables listed.
Lets suppose that ROM_9C16 is an ignition related subroutine.
At 9E62 address, you can see:
ld INTMEM_1A, #7Eh
7E is the number to add at DA22, to get the pointer to D448 table: Dwell map
lcall ROM_3370 should be the table map accessing subrouitine, there are more than one.

[MpowerE36]

Hello
I think that i can help you with an example.
At DA22 you can see a table of tables listed.
Lets suppose that ROM_9C16 is an ignition related subroutine.
At 9E62 address, you can see:
ld INTMEM_1A, #7Eh
7E is the number to add at DA22, to get the pointer to D448 table: Dwell map
lcall ROM_3370 should be the table map accessing subrouitine, there are more than one.

Thank you for this example. Do you know how it works for single parameters ? I don't think there is a table of parameters.

Do you also know if there is a piece of the program in the CPU memory or all the program is in the external eeprom ?

[MpowerE36]

Some progress :

C800: Beginning of control data, Rev Limiter, Speed Limiter, Injector Constant, Target AFR...etc

C910: Beginning of DTC data, CEL enable, Flash Codes, DTC entry/exit protocols & fail-safes.

CA94: Beginning of MAF table, Transfer Functions and MAPs/Tables.

DA22: Beginning of Index of MAPS, or known as Table of Tables.

DB26: End of all Data, Maps & controls.

[sda2]

Hi! Did you find a way to get the internal CPU data? Motronic 5.2 seems to be quite similar. (What a coincidence, as VAG M3.8.3 and M5.9.2 are essentially the same ECU too on the VAG side of things.)

[MpowerE36]

I am currently doing an obd eprom reader for this ecu. It will read the first 0x2000 bytes of the internal memory and the next 0xE000 bytes (or 0x6000 bytes depending of the software) of the external memory. I don't know if there is more data in the cpu and how to read it.

[MpowerE36]

I've finished the EPROM reader. I think it could be easily adapted for other Motronic of the same generation.

[sda2]

Awesome work! Do you think it could read the internal CPU from M5.2? Disassembly unfortunately is quite pointless without the internal CPU data.