FORScan PCM reprogramming (as-built) RX-8 (+other Mazdas...)

[rxdns]

Hello JamieM,

Congrats for this deep analysis, I am really impressed. I have a Mazda 3 1.6 diesel car, and we figured out by comparing AsBuilt data of non-CC and CC equipped cars that we have to change the very same bit as for RX8 in PCM 2 data line to activate cruise control. I gonna paste my PCM data below:

PCM Module
PCM 1 FFFF FFFF 0310
PCM 2 3D0D A4FF FFFE
PCM 3 9641 FFFF FFE7
PCM 4 FFFF FFFF FF0F
PCM 5 FFFF FFFF FF10
PCM 6 FFFF FFFF FF11
PCM 7 FFFF FFFF FF12
PCM 8 FFFF FFFF FF13
PCM 9 FFFF FFFF FF14
7E0-01-01 0140 4110 FE79
7E0-02-01 207E F003 7B
7E0-03-01 E043 D107 E6
7E0-04-01 D09F EFEB 35

So the bold highlighted part is FEFD for a cruise control.. What do you think, your tool is going to work with this data or not? I really would like to make just a trial, but not brave enough, as for Mazda 3 we have more bytes in the 7E0 lines, first I'd like to ask your opinion. Many thanks in advance!

*** Update

I was wondering that nothing could go bad, worst case some checksum or security code will not match and the tool will not be able to change ABD on my car. So I plugged in my ELS27 and hit the enter: the tool was able to read out PCM lines, tried to modify but security key was invalid, neither 'MazdA' nor 'mazdaEdit' was not working. Any idea? (Tried multiple times with the hope that actually the byte was changed, but not, every time read back original FF, so it was not changed to FE)

[JamieM]

Thanks everyone It's been quite a lot of reverse engineering work, research and developement behind the scenes to get to this point!

I was about to post saying that I think the above should work - the data looks close enough, and no need to worry about the 7E0 lines as my program doesn't touch those. The only thing I wasn't sure about was if the VIN block will look the same - but that's easy to check: just run the program with --disable (or -d for short) then it'll just read your data, see that cruise is already disabled and then exit with nothing to do (won't change anything on the car). But it will have read the VIN block. If you also run it with --log (or -l) you'll get a comms log of the CAN data appear in the same directory as the program - then we can see the VIN block it read.

Rxdns, I would recommend running it again with the --log option, then posting your comms.log text file so we can see what went on

After the first 2 keys are tried which are the most likely for RX-8s, it then goes through a big list of other keys I found from IDS. Every stock key for every Mazda should be in there! It looks like the car is not responding at some point to the repeated tries, rather than not having the correct key - it could be that I'm not leaving long enough between each try, or the Mazda 3 only lets you have a certain number of tries. The log will tell us more, and also let us see the VIN block - I think it may still work yet!

Also if you know the shared secret key (you can sometimes find them on the internet somewhere...), you can use the --secret option (-s) to specify it to speed things up. Run --help for for info (-h).

[rxdns]

I am amazed that you not only develop the tool but give support, big big thank! So here is the log:

Code: Select all

>ATWS

ELM327 v1.3a

>ATE0
ATE0
OK

>ATL1
OK

>ATR1
OK

>ATS0
OK

>ATH0
OK

>ATBRD08
OK
ELM327 v1.3a
OK

>ATCAF1
OK

>ATAL
OK

>ATST96
OK

>ATAT0
OK

>ATTA30
OK

>ATTP6
OK

>ATSH7E0
OK

>220000
7F2231

>1085
5085

>2100
082
0:61004A4D5A42
1:4B313459323731
2:353437303037FF
3:FFFFFF2AFFFFFF
4:FF033D0DA4FFFF
5:9641FFFFFFFFFF
6:FFFFFFFFFFFFFF
7:FFFFFFFFFFFFFF
8:FFFFFFFFFFFFFF
9:FFFFFFFFFFFFFF
A:FFFFFFFFFFFFFF
B:FF0000FFFFFFFF
C:FFFFFFFFFFFFFF
D:FFFFFFFFFFFFFF
E:FFFFFFFFFFFFFF
F:FFFFFFFFFFFFFF
0:FFFFFFFFFFFFFF
1:FFFFFFFFFFFFFF
2:FF36C9FF300000

>2701
6701FEFFFF

>2702E349F0
7F2735

>2701
67017F6934

>2702DC3A59
7F2735

>ATST02
OK

>2701
NO DATA

>

For me looks like after 2 trials there is no response from ECU. In this case would it be useful to manually try the security codes with the -s option? Could you please share the list of possible codes with me (as I could not find keys on the net)? Thank you in advance!

[JamieM]

Yep, the VIN block looks the same format to me!

Code: Select all

>2100
082
0:61004A4D5A42
1:4B313459323731
2:353437303037FF
3:FFFFFF2AFFFFFF
4:FF033D0DA4FFFF
5:9641FFFFFFFFFF
6:FFFFFFFFFFFFFF
7:FFFFFFFFFFFFFF
8:FFFFFFFFFFFFFF
9:FFFFFFFFFFFFFF
A:FFFFFFFFFFFFFF
B:FF0000FFFFFFFF
C:FFFFFFFFFFFFFF
D:FFFFFFFFFFFFFF
E:FFFFFFFFFFFFFF
F:FFFFFFFFFFFFFF
0:FFFFFFFFFFFFFF
1:FFFFFFFFFFFFFF
2:FF36C9FF300000

It's the same length and everything is in the same places as my break down a few posts back. I assume the checksum calculation is therefore the same.

And more importantly, your OBD adapter seems good enough to read the entire thing, which means the program won't have to guess the bits at the end. The only slight difference seems to be the 0000 on line B of the VIN block - I wonder what that's for. Shouldn't cause any problems though.

As I suspected it looks like the Mazda 3 PCM is a little slower to respond than the RX-8 one - I send an ATST02 (set timeout to 2 * 4ms) command before jumping into the loop to try all the different possible Mazda IDS keys, to speed the process up (there's lots of keys to try). This works fine on the RX-8 and whizzes through the key list rather quickly, but it looks like this is too short a delay for your car - hence the "NO DATA" response at the end:

Code: Select all

>2701        <--- Seed request
6701FEFFFF   <--- Seed response "FE FF FF" from PCM

>2702E349F0  <--- Send key "E3 49 F0" calculated from RX-8 shared secret 'MazdA'
7F2735       <--- Error response from PCM: key incorrect (which probably means wrong secret)

>2701        <--- Try again, new seed request
67017F6934   <--- New seed "7F 69 34"

>2702DC3A59  <--- Try calculating key from mazdaEdit's shared secret
7F2735       <--- Key incorrect

>ATST02    <--- Jump into high speed (low delay) mode
OK

>2701
NO DATA    <--- Oops, we didn't wait long enough for the response

>        <--- Program exits with "No response from ECU" error

I might be able to look into it later after work. I think if I just increase the timeout delay it will probably work for you...

[rxdns]

I hope so! Just let me know if I can support you with anything, like a test or making a log, and so on... And thanks in advance!

[JamieM]

Just uploaded a new version (2.1) to my thread on RX8OC.

The delays now automatically increase if no response is received from the ECU, so this version may work for your Mazda 3!

If it works and you post a log I can also tell you the shared secret key for a Mazda 3 if you wish

[rxdns]

Thank you! Quick trial, but Houston, we have a problem.. The new version is not able to communicate with my ELM device. Wrong connection, device or port setup is excluded as the 2.0 version is still working. Log and screesnhot attached:

Code: Select all

>
ATWS

ATWS

ATWS

 ATWS

 ATWS

 ATWS 

But the feeling that we are getting closer to let me have cruise control is gorgeous!

[JamieM]

Try with "--baud 38400", and if that doesn't work try some other values 115200, 500000 etc.?

[rxdns]

No success, I tried all standard baud rates between 38400 and 500k. I also made trials with 2.0 version, that was communicating with ELS27 cable only with 38400 baud.

[JamieM]

Argh that's annoying, just how slow is your ELM to reboot?

I've increased the delays even more (actually, it now loops through several), try this version:

rx8cc.2.1.1.beta.zip

If that still doesn't work, I've added a --timeout option (-t) so you can play around with it yourself - probably easier than me keeping recompiling it - then let me know which values work

Let me know either way so I can update the main version based on your findings