MR2 SpyderChat banner
1 - 20 of 61 Posts

·
Registered
Joined
·
5,069 Posts
ok coupla things.

The later ECU you have is a J2534 Can-bus ECU. The J2534 standard was mandated by the EPA for all cars beginning in 2005. It requires that the ECU be reflashable and that the manufacturer provide tools for reflashing the ECU.

As you've mentioned, there are various third party tools available for downloading the binary and editing it and flashing it back. There is a body of knowledge being gathered independently on the structure of the binary and If you're interested we can talk more about that. Maybe you've seen the various threads here and elsewhere that I and others have devoted to this subject. We owe a lot to Marc Labranche (Gouky) who has been one of the pioneers in advancing our understanding of Toyota ECUs in general and the 2GR and 2AR ecus in particular.

That's the good news.

The not so good news is that all these 1zz ECUs from later years run a Electronic Throttle Control System aka drive by wire and many if not all have an immobilizer on board. These are not insurmountable obstacles but they do affect the usability of this ECU for non-native applications. Also being CANbus there is no possibility of communication with the dash without a conversion - the dash runs on the proprietary Toyota BEAN protocol.

Also if choosing an ECU to toy with you want one from a M/T car not an A/T and fortunately there are plenty of M/T Corolla 1zz's 2005 and later.

One of the exceptions to the ETCS is the 2zz ECU and this one was sold very briefly for one or two years as a J2534/Canbus cable throttle ECU and this ECU in fact has more useful potential than any 1zz ECU.

I am very pleased to see someone else taking an interest in this and I always try to offer as much support and encouragement along with sharing of information with anyone entering this area.
 

·
Registered
Joined
·
5,069 Posts
These ECU's that you are working with have some features that I am not familiar with. Possibly they are transitional ECU's before the full J2534 rollout. I'm not sure if my info corresponds exactly to the ECU's that you are working with.

On the 2005 and later ECU's there is a 20-pin jtag port on the board. You can either solder a connector to the board or use a BDM frame with a compatible adapter. Then you can use a device like the Toyota-Lexus Flasher to dump the binary. The flasher, connectors, and adapters, are available here:

Obviously this is not cheap, but it is affordable if you are dedicated to this hobby.

Last year I found a good quality affordable BDM frame on aliexpress and it's even more affordable now:

If you are good at soldering you don't need this.

Besides the TLF you can use a Kess/Ktag clone or if you have the money you can spring for the real thing from Alientech.

For editing the binary and generating definitions, you can use WinOlS software or you can use TunerPro RT (only $39) or the hex editor of your choice.
 

·
Registered
Joined
·
5,069 Posts
Yeah I was afraid of that I couldn't see the port in your pictures. Probably you know more about this than I do but it appears that every one of these CPU's is slightly different and even thought there is some general documentation available for some of the CPU's in this series, there is no documentation available for the specific CPU's used by Toyota so transporting a CPU from one motherboard to another may not be as straightforward as that. Anyway if you have the skills and the means to do it, it's worth a try, I'll be very interested to see what you can pull off. Ha ha. Meanwhile I suggest that you do a 2zz swap and use the J2534 2zz ECU. Seriously.

PS. More seriously, since we have the ability to edit most of the functional maps, the 2zz ECU should be able to run a 1zz engine perfectly fine, with just some wiring.

PPS. In case you're interested, the two flashable 2zz cable throttle ECUs are 89661-02C50 or 89661-02F80 (Found in the 05-06 Corolla/Matrix XRS).
 

·
Registered
Joined
·
5,069 Posts
Quick photoshoot for reference with the flashable 2zz ECU. Obviously it's a four-row connector ECU. If using this in the Spyder I would make a patch harness. You can see the layout. I'm not able to make out the smaller letters on the CPU. Maybe with some image enhancement? I haven't counted the pins to compare with yours. I have a frame adapter from Russia that is compatible with both Alientech and TLF cables, which I thought it was pretty cool of them to make that.

73183


73184


73185


73186


73187


73188
 

·
Registered
Joined
·
5,069 Posts
I don't know whether my 2zz ECU has an immobilizer or not. But regardless, for the immobilizer I have found a hardware solution that bypasses the immobilizer at the board level. In principle, this solution will work with any ECU of any generation - this includes all CANbus and K-line ECU's. It has been deployed in the field on a large number of different ECU's. It does require that you send your ECU to a technician to fit it with a immobilizer intercept/bypass. Here is what the implementation looks like on my Camry 2GR-FE ECU.

73191


There is an alternative solution that relies on flashing the immobilizer chip with the content from a non-immobilized ECU. This solution has been proven only on a very small number of ECU's. Potentially, in principle, it could be applied to other ECU's that are available in both immo and non-immo versions, but to my knowledge nobody has tried that.
 

·
Registered
Joined
·
5,069 Posts
Nice work. I've quickly checked the file. Everything looks ok. It has many of the characteristic maps of other ECU's. For reference, the calibration ID is 89663-0F030-C. This is a 512K file. Later files for other vehicles are 736K and more recent files are even larger. I have a 2011 file which is 992K. I don't know what are the features that require a larger binary.

The immobilizer board was done by Yury Baranov at All4swap. He develops engine swap supporting products including MPX/Bean translators, transmission emulators, and other mostly focused on UZ and JZ swaps. You can find his product descriptions and info in his facebook group:

Working with the immobilizer chip directly is beyond my technical ability. It's my understanding that you can "use a low voltage programming mode to avoid powering up the rest of the ECU without needing to desolder that chip."

The only 2005+ vehicle that I know of with a cable throttle is the 2zz Matrix/Corolla.
 

·
Registered
Joined
·
5,069 Posts
I'm surprised that your immobilizer chip turned out blank. There's some useful info about the Spyder immobilizer chip here:


This has a different architecture from the 2005+ which have an external key transponder ECU, so I don't know if it is directly relevant.
 

·
Registered
Joined
·
5,069 Posts
We're thinking along the same lines. Related thoughts:

The Spyder final year in US is 2005. This is the year of the J2534 standard mandate. Question: Was the 2005 Spyder ECU exempted from J2534 for end-of-life reasons, or do 2005 cars have the new ECU, like the 2zz Matrix, which was transitioned? These 2005 cars are rare, only a few hundred sold. But we can get a few VINs from the fine fellow who is making a database of these cars on this site, and put it into toyodiy.com to see what equipment the car came with, including the ECU. The same applies to Spyders sold in Europe/UK 2005, 2006 and later. With a VIN, it is possible to check the part number of ECU.

For the patch harness I use some ready made sources like this:

It would be necessary to patch two patch harnesses together, header from Spyder, and plugs from 4-row ECU.
 

·
Registered
Joined
·
5,069 Posts
I've learned today that Wiregap (an engine swap/wiring harness company here in US) has recently found a way to de-immobilize the Caldina ST246 Gen5 3sgte ECU, which is a four plug four row ECU like the ones we're looking at. Part number is 89661-21410. I don't have details on the methods used.

PS> Straight from the horse's mouth "I remove and reflash some of the board components." The guys in this business are all the same. Ha ha. Ha ha ha ha.
 

·
Registered
Joined
·
5,069 Posts
I am going to revisit this journey again as I have a 2zz-ge now, and a japanese ECU.
There must be some data blocks for changing the lift point and the rev limiter just like all the other ECU's we modify.

They can all be flashed with the Toyota techstream tool via OBD/CAN so ideally this wants sniffing and reverse engineering so a simple tool can be formed for doing it all via the port.
The ECU's that support CANbus can be flashed through the DLC with a tool like Tactrix Openport 2.0 and PCMflash.

You cannot reflash select blocks, you must reflash the entire binary from beginning to end.

The binaries cannot be read from the DLC. They can be read only from the J-tag port on the motherboard. This requires more advanced tools, like Toyota Lexus Flasher, or Alientech. As an alternative you can get binaries from BItBox, or you can convert CUW files.

Accurate definition files for most of the binaries are available from BitEdit.

The Canbus ECU's for 2zz-ge and 1zz-ge are not directly compatible with the Spyder. They require extensive rewiring. Spyder body functions will not be supported.
 

·
Registered
Joined
·
5,069 Posts
I've learned today that an engine swap/wiring harness company here in US has recently found a way to de-immobilize the Caldina ST246 Gen5 3sgte ECU, which is a four plug four row ECU like the ones we're looking at. Part number is 89661-21410. I don't have details on the methods used.

PS> Straight from the horse's mouth "I remove and reflash some of the board components." The guys in this business are all the same. Ha ha. Ha ha ha ha.
I did a full-court press on the ST246 Caldina gen5 3sgte ECU to get to the bottom of this nonsense. Despite being a four-row ECU, it turns out when you open it up that this ECU is equipped with two Toshiba microprocessors, mask ROM, one for the engine, one for the transmission. Not flashable. Other four-row ECU's of the same vintage have the NEC microprocessor, and are flashable, so this held out some promise for the gen5 - but no more, this has now been laid to rest. Posted on mr2oc. Related: The immo chip for this ECU is exactly the same as the Spyder, with the same virgin code. This is posted elsewhere.

Also verified that, despite Toyota documents the contrary, the Spyder ECU is not flashable, was not ever flashable, and will never be flashable. I reported this in a related thread on this forum. This has been the subject of a ten year old debate, with no clear resolution - in part due to obfuscation by Toyota. The details are reported in the link below. Now the nail should be in the coffin for that one too.

Also, I've gained access to the complete database of all CUW files for all Toyota, Lexus, and Scion vehicles. I now have every flash file ever issued, through 2017. CUW stands for Calibration Update Wizard. It is a sub-program of Techstream, for flashing the ECU. Needless to say, there were no CUW files ever issued for the Spyder, or for the ST246.

Finally, got in touch with one of the guys who is the driving force behind development of daughter boards for Toyota ECU's. Extremely nice guy, very supportive and helpful. I was led to him by diag-dog's random postings all over the internet. Daughter-boarding is a method for tuning ECU's that cannot be re-written. Right now the author's focus on the Intel generation ECU's, the generation that preceeded the Toshiba ECU's - 4a, early uz, early vz, et cetera If he ever emerges from that, maybe he'll turn his attention to the Toshiba generation. "Hopefully I can get the data off these older chips and then perhaps I'll hit you up for some insight..." Cracking these things is a very long game, sometimes played out over decades. so perhaps it will happen in this lifetime, or perhaps not. Ha ha. Ha ha ha ha.
 

·
Registered
Joined
·
5,069 Posts
Good to see you back here.

Only solution would be dump the mask ROM with the tool I found which is an old dev tool for this line of micros (which would be pretty tough to land on, although not impossible), then clone the blitz/etc daughter board that you've seen on that other thread elsewhere - which again is quite a rare item.
Would you mind sharing a link for the toolkit. Sorting through the available info for the TLCS 900 is like trying to drink from a firehose. I might try to dump the ROM. Just out of academic interest.

PS. Believe it or not, there is stil a lot of interest in this ECU/Processor. You may have seen this, a Russian team has gone to the trouble of unmasking it. The interest is driven by the 1uz-fe/vvti, which is like the LS1 motor for the ROW - people are swapping it into everything
 

·
Registered
Joined
·
5,069 Posts
would a CAN to Bean translator device work for temp gauge?
In theory it should work with any ECU that can be queried and respond with the correct PID for ECT. There are at least three of these CAN-to-BEAN converters on the market and they are all products of reverse engineering so they have inherent reliability and functionalilty issues - they all seem to work part of the time.
 

·
Registered
Joined
·
5,069 Posts
I was thinking if the 1zz ecu that was drive by wire, it might work on my SMT.
There are a ton of reasons why it would not work. The most basic one is the SMT uses a earlier type of electric throttle body with a separate TPS and APS on opposite sides and different motor. This throttle body type was in use with late 90's eary 2000's Toyotas including Supra, Camry, Altezza, Spyder and others. Frankly, it is a primitive piece. This is not the same as the more recent type of integrated throttle body used in the 1zz and many others starting in 2005 model year. Completely different unit and cannot be controlled by the same ECU, or vice versa.
 

·
Registered
Joined
·
5,069 Posts

·
Registered
Joined
·
5,069 Posts
Hello. If you have a CUW database.
Share it:
Calibration: 30525100 50503000
Calibration file: 89663-05251
Catalog number: *-05650
[email protected]
Thank you in advance. Sorry for the Google translation
Not searchable in this way. What is your vehicle year and model and engine code.

magnet:?xt=urn:btih:AEBF58F11736FC55AD4D8937B65A5446D2E7F930&dn=00456-REPRG-001.iso&tr=http%3a%2f%2fbt4.rutracker.org%2fann%3fuk%3dELcmc1XwD9&tr=http%3a%2f%2fretracker.local%2fannounce&tr=http%3a%2f%2fix4.rutracker.net%2fann%3fuk%3dELcmc1XwD9
 
1 - 20 of 61 Posts
Top