[OzFalcon]

hi guys,
i have found a mongoose by drewtech to buy at what seems like an ok price but still not what i would call cheap..
i want to use to access my australian eec-v equiped AU falcon 6 cylinder..
i am not sure what software i will need to use? am i correct in assuming BE can do it?
what about tunerpro? what flash devices does that support? ... other software options?

what i want to know is, is there a std basic way to extract (and write) the roms from the eec-v ecus and what sort of hardware to use to do it.. i have heard that KESS is used to do this but also a lot of people reporting issues which is off putting..

i once read somewhere that the eec-v can be flashed thtough the J3 port using moates QH but that it hasnt been publicly documented.. anyone care to confirm/deny this as a possibility?

now that moates is dead as a future option (i was going to buy another j3 chip for another project, but that i cant even purchase now and makes me want to find another option) (jeez can u even get the driver now that the website has been completely nuked!!) ...

eec-v is flashable, so this is the way of the future for me it seems.. what are people using?

[jsa]

hi guys,
i have found a mongoose by drewtech to buy at what seems like an ok price but still not what i would call cheap..

Too right, not cheap at all.

i want to use to access my australian eec-v equiped AU falcon 6 cylinder..
i am not sure what software i will need to use? am i correct in assuming BE can do it?

BE has a license option for Mongoose and the BE help says is can read and write tunes with the Mongoose.
I expect a definition is required.

what about tunerpro? what flash devices does that support?

Not much from looking at the hardware support list on their site.

... other software options?

No doubt, but do they have definition support for your catchode?

what i want to know is, is there a std basic way to extract (and write) the roms from the eec-v ecus and what sort of hardware to use to do it..

J2534

i have heard that KESS is used to do this but also a lot of people reporting issues which is off putting..

Lot of people using kess made by copywong LOL!

i once read somewhere that the eec-v can be flashed thtough the J3 port using moates QH but that it hasnt been publicly documented.. anyone care to confirm/deny this as a possibility?

Read the rumour also. Would have to be hacked to make it work.

now that moates is dead as a future option (i was going to buy another j3 chip for another project, but that i cant even purchase now and makes me want to find another option)

Right now SCT 6600 and TI performance are two chip options.
Plenty of noise around the web from people trying to fill the Moates gap, so I think more options will surface in time.

(jeez can u even get the driver now that the website has been completely nuked!!) ...

The info is available on web archive.org, though splintered. We need a way to consolidate it for future reference.

[OzFalcon]

BE has a license option for Mongoose and the BE help says is can read and write tunes with the Mongoose.
I expect a definition is required.

so u cant use BE to flash a tune if you dont have a BE definition?.. ive got definitions but they are to suit tunerpro..
for one of my projects all im wanting to do is turn off PATS (can do that with tunerpro but tuner pro cant flash the ecu - as far as i know)
so i may need to get a BE definition? but i dont think there are any for the 6 cyl versions only seen them for the v8... can i make my own BE defs if i know the addresses of the tables found from the tunerpro ones?

... other software options?

No doubt, but do they have definition support for your catchode?

same issue? i have used tunerpro previously.. at this stage just being able to write a bin is a win.. not concerned about defs

what i want to know is, is there a std basic way to extract (and write) the roms from the eec-v ecus and what sort of hardware to use to do it..

J2534

so basically u just need a J2534 tool.. there are cheap ones but the issue is you need software to support it...

Lot of people using kess made by copywong LOL!

yes i suspect that they are clones.. and me buying one could just end up being a waste

now that moates is dead as a future option (i was going to buy another j3 chip for another project, but that i cant even purchase now and makes me want to find another option)


Right now SCT 6600 and TI performance are two chip options.

ive used Ti chip before and it wasnt very reliable and also cause weird issues with the AC, Ti say they have fixed these problems (i dont trust them anymore)..

[OzFalcon]

so i suppose the question is, what J2534 tools does tunerpro and BE support?
any cheap tools?

[jsa]

so u cant use BE to flash a tune if you dont have a BE definition?.. ive got definitions but they are to suit tunerpro..

You have to open a definition before opening a BIN, so yes a definition is needed even if minimal.

so i may need to get a BE definition? but i dont think there are any for the 6 cyl versions only seen them for the v8... can i make my own BE defs if i know the addresses of the tables found from the tunerpro ones?

Yes a BE definition can be created from data in an TP XDF file.
Sailorbob has some definitions to purchase for Aussie Fords.

so basically u just need a J2534 tool.. there are cheap ones but the issue is you need software to support it...

Yep, software and hardware.

yes i suspect that they are clones.. and me buying one could just end up being a waste

That's it, buy something that works or experiment with stuff that may/not work.

ive used Ti chip before and it wasnt very reliable and also cause weird issues with the AC, Ti say they have fixed these problems (i dont trust them anymore)..

ok.

[OzFalcon]

cheers,

so the question is what tool do i buy/ what tools are supported to use with BE?
hopefully, is it clint 86GT?, will answer in this thread.. (or anyone else that has experience)..

[jsa]

A further wrinkle to be aware of, some of the ROM chips are One Time Programmable.
Be wise to pop the lid off the box and see if the ROM part number is an OTP part in the Hardware Manual part list.

[OzFalcon]

was just looking at forscan and it seems they are getting close to offering flashing capability using the Vgate vLinker FS OBD2 USB Adapter
https://www.amazon.com/dp/B094Z7PBLS

this unit has the FEPS 18v voltage output for flashing.. it is very cheap too

if BE was updated to support this product it would go a long way to ensuring future eec-v tuning support..

hopefully clint sees this and responds

[jamie from oz]

I have done read with kess V2 clone ($150} and pcmtuner ($400)
Useing there flash programs.

The saved bin will need to have bank order changed for TP and padding will need to be added to make it 256k.

Not sure if the bank order is the same as BE but size is same file.

I will try and flash a WANA tune into a 12VC box then read back out and compare for a test run.

Jamie.

[jamie from oz]

With pcmtuner (pcm flash) I flashed WANA tune into a 12VC box fine.

Compared the bin files to confirm and they are now both WANA.

Was done on bench with a short loom and obd2 plug but same as in car.

Takes less time than removing chip from j3 to to flash it.

Kess is hit and miss and takes longer.

FYI the AU is a j1850 pwm.
Apparently the JLR clone is j1850 pwm and j2534 just like a mongoose but I don't have one to try.

Jamie.

[OzFalcon]

With pcmtuner (pcm flash) I flashed WANA tune into a 12VC box fine.

Compared the bin files to confirm and they are now both WANA.

cheers .. can u post a link to the prduct you are talking about .. therre is a few different products under those names..
im guessing pcmtuner / pcm flash is that one is the hardware and one is the software..

[jamie from oz]

I purchased Pcmtuner on Aliexpress. (Mainly for other ecu's)
I have a Clone one and there are some genuine units avalable but its hard to tell when you purchase.
The flash file that is downloaded with pcmflash software is in different bank order and can be done with a bit of a work around.
( i only have been using for smart lock off and checksum correction for a couple race cars)


Bin file for reference (pcmflash)

WR2ANA_N9XL1N6-ORI.bin

[OzFalcon]

I have done read with kess V2 clone ($150}
Useing there flash programs.

The saved bin will need to have bank order changed for TP and padding will need to be added to make it 256k.

hi jamie..
you said you have done a read with KESS... i had a look online (https://www.youtube.com/watch?v=BLHZbwTfMy4) and seen a video showing a read on an EECV focus.. the file it created was 2048KB file..

how would u go about getting it down to the usual 216kb/224kb/256kb type file so TP or BE can read it? what else is in that file to make it so large? im also thinking that when you modify the file it well might have a checksum issue (with the 2048kb combined file not the 216/224/256 part because TP BE takes care of that i think)..
why does kess get 2048kb read (that i know of) yet pcmflash doesnt (does it?)

[jamie from oz]

hi jamie..
you said you have done a read with KESS... i had a look online (https://www.youtube.com/watch?v=BLHZbwTfMy4) and seen a video showing a read on an EECV focus.. the file it created was 2048KB file..

how would u go about getting it down to the usual 216kb/224kb/256kb type file so TP or BE can read it? what else is in that file to make it so large? im also thinking that when you modify the file it well might have a checksum issue (with the 2048kb combined file not the 216/224/256 part because TP BE takes care of that i think)..
why does kess get 2048kb read (that i know of) yet pcmflash doesnt (does it?)

TP has padding added to each bank (8k) get 256k.
I was going to have a BE xls with the addresses changed to take the flash read from pcm flash (have not completed it enough yet) as all the data is in one bank.
Can probably rename a copy of TP and put in the offset addersses but found BE easier to change as its a word xls.

I have read a focus with pcm flash and file was 224k but not with kess so i will read it with kess and see if it has added padding.
That link the ecu is a ME9 family ecu.

[jamie from oz]

Example of the 3 different DATA start addresses.

pcm flash 0x0000. = TP 0x12000. = BE 0xE000.

so in my xls i will change adresses starting with E to be 0 and see if it works with the pcm flash bin.

[OzFalcon]

jamie,
what editing software are you using to mod the bins?
AFAIK i only know of 2 which is tunerpro (TP) and BE and of course just a normal bin editor (never done it using a bin editor, as wouldnt have a clue how to calc the checksum)..

i have always just used TP as it was free and also came with definitions off the Ti perf site..
i was thinking of going to BE as it can flash using j2534 tools but now looking at the cost it sure adds up quick..
it looks like i would need to buy a dongle version of BE ($160 usd) plus a strategy ($200) plus if i want to use it with a QH i am up for another $20 (or $100 for the J2534).. add it postage and probably import taxes..
sure gets expensive fast..

well i thought i could maybe justify it if it gave significant improvements in tuning but it seems i still wont be able to see live data (lambse, rpm, ign adv etc) until "patch code" is writen (dont know if it has or ever will be).. also i thought table tracing might be nice (as ive seen it in the TP menus as well as in BE menus), never got it working in TP (no idea why or what is needed) and it seems it might not work in BE..

so long story short it looks like id be up for $380-460 usd +post +tax ($700-800 AUD most likely) just to be able to flash and have no real capability over TP..
im not even sure what the BE defintions contain that are any different to the free TP ones, maybe if they are more comprehensive that might be a bonus..

now add in a mongoose J2534 ($495 usd) which in aus is probably $850 and i am now at over $1600 and things are just outright crazy..

so back to original question .. what are you using to edit and then upload the bin to the EECV?

[jamie from oz]

With WANA eec-v i made up a BE xls and read the eec with QH and found the addresses i needed to change then in a Hex editor (i use hex editor nero) edited the Pcm flash file then flashed it via OBD port (no QH for flash)

Could use TP for this also and once you have your final tune transfer it to hex editor file then flash.

This is a bit of a pain but the point was in a race car we didnt want anything in the J3 port and no BCM / smartlock.

I havent setup data logging on the WANA eec-v at this time as i am still new to this and spending most of my time on EL falcon 6 eec.

[jamie from oz]

i highlighted the address for TP . BE . Pcm . as a example how i kept track of the addresses over the process .
.....this is probably the wrong way but it works for me at the moment....

Screenshot 2023-03-01 220814.jpg

[OzFalcon]

when i look up PCMflash i find this ..
https://ecutools.eu/chip-tuning/pcmflash/

image_2023-03-02_001719566.png

what i find confusing is the reference to modules and the huge list involved.. i dont see the australian eecv ecus listed.. there a lot of different modules and they are all expensive.. im guessing a clone version comes with most of them..

as for the flashing process... does PCMflash use the 216kb arrangement (same as BE)... what do u do about the checksum calc?

[OzFalcon]

in this video you see a mk1 focus being flashed .. using kess .. there is no sound and it is in another language but you can see enough to get the idea .. https://www.youtube.com/watch?v=crcAolkcj2I
can see it is a 216kb bin..
it would seem like that might be possibly a good way to go..
the only thing im not sure is when you first go in, if you have to select a vehicle and most likely it wont list the australian cars.. though it still might find enough info to proceed .. just speculating..

the best thing is that there is a seller on aus ebay and they are priced very cheaply (150 aud).. im not sure if it is compatable with j1850pwm ..

[jamie from oz]

yes there is some reports that the newer clone kess v2 don't work well especially with ford eec-v as they are targeting newer vehicles.
my kess quite often times out on my au xr8 and doesn't read.

kess takes a long time like 20 min to read vs a couple min with pcm tuner or scanmatic2 that it is a copy of .

best way to tune direct from BE dongle edition with a Ford Mongoose.
i only do it this way as i already have kess - ktag - pcm tuner - tactrix .

The genuine pcm tuner you can buy each module/protocol for each ecu type on a dongle.
clone ones come with almost all module / protocol on a dongle.

[OzFalcon]

my kess quite often times out on my au xr8 and doesn't read.

ah.. i didnt know you had that too .. .jeez you got them all!

well at least that answers my doubts on kess sort of.. it does work (sometimes)..
all im mainly wanting to do is do a final flash as i have a QH for fast updates (its about 10 seconds to make changes)

so when using kess which vehicle do you select when in the main car menu or do you go into another menu first (protocols??).. the falcons are not listed in the cars menu im assuming..

..yes mongoose and BE are what i would go for but it is $1000..

[jamie from oz]

With kess i have tried Focus mk1 (has viseon eec-v)
tried Explorer 1996 and 1999 all have the same proticol and it checks id of eec-v and finds the hardware version and software version (eg WR2ALG and NGVB5L2.hex for falcon/Fairlane v8 5.0l eec-v 216K )
but read it once but not since (might be a problem in the kess v2 but others have had simular problems).

pcm tuner dose it every time.

[OzFalcon]

ive found a seller on ebay that will let me return it if it doesnt do what i want.. so i might go for it..
ive seen in the youtube video that they say not to connect the laptop to the internet when using kess .. else i think the software dissables ... dont know how true that is .. but it also makes it lame as you have to dedicate a laptop to it then ..
dont know if any of that has anything to do with why it would work one time then fail forever after..

[jamie from oz]

I probably didnt turn off internet...
I know that they say not to update the software .

[OzFalcon]

found this on a reddit carhacking page..
the question was :

"Remap Ford EEC-V, is it possible?"

answer was :
USER = dposea
Yes, it can be done. You will need a device and a program, and its just easier to reflash via obd-ii. Ford used an RCON to reflash via the J3. A modified EECSUCKA that raises the FEPS pin to 18v will be needed, and something to write the data. With a 32 bit micro you can bit bang the SCP data to make an obd-ii device. Programming follows SAE exactly.

You should be able to restore a bricked ECM with IDS. Raising FEPS swaps to a bootloader memory map, which allows reflashing. You do need the right flavor of binary. There was 88k, 112k, and 216k flavors.

this guy dposea is vary knowledgeable, seen some of his other answers, seems he was in the tuning business working with SCT (or a company like that)..

ive never seen details of the circuit to make an EECSUCKA but im sure it was quite simple.. im surprised this didnt catch on in a bigger way leading to FEPS-EECSUCKA flashing.. actually there is a page here which has the original eec-iv eecsucka schematic as well as the dos exe u need http://www.kvitek.com/ford/ .. there is a similar simpler one on eectuning also..

as for the RCON J3 flash that must be the same as the mentions of the QH being able to reflash via the J3... guessing moates didnt want that getting out else it would have lost them sales of their jaybirds..

jeez this guy makes it sound so easy .. just get a 18v feps pin active and use SAE SCP protocol to communicate..

this part i dont quite follow "Ford used an RCON to reflash via the J3".. is he saying the eec-iv is also rewriteable but via the J3 only? or does only the eec-v have rewriteable memory?

[jsa]

https://github.com/OpenEEC-Project/EECSucka-Archive

Reprogramming over J3 requires the ROM chip to be electrically eraseable and programmable. The programming pins need to have traces run to the J3 port. EEC-IV boxes typically do not have these hardware features.

[bmasencup]

I have BE and I have several eec-v pcms from American Explorers. I have not really tuned them yet since my project is not ready, but from just playing around with them, this is what i have learned. I have a QH. I can read a 1997 pcm (xgd2) and 1999 pcms (eqe1,eqe3,fln0) with BE through the QH.

I also have a clone Kess v2. It will read and write all the above pcms through the obd2 port. I have read an eqe3 and programmed an eqe1 and it is then an eqe3 when I check it so I know it is writing the software. The kess is not a j2534 programmer and BE does not recognize it. The kess also reads the banks in a different order and different size than BE so the files cannot be opened directly in BE.

I wanted to update the pcms to the latest calibration from Ford before tuning (fln0) so I ordered a VCX SE j2534 adapter to use the Ford IDS tool to update. After buying it, I found out it does not have the feps voltage to program the older pcms. My bad. They clearly state it is for 2004 and newer. I tried to read a pcm with it through BE (it does show up as a j2534 device in BE) but it says it can’t activate the 18v. I tried wiring in 18v on the FEPS line but it didn’t help.

So then I bought this adapter:
OBD2 Diagnostic Scanner for VNCI MF J2534 Diagnostic Tool Replacement for Ford IDS V127 Software https://a.co/d/a74HuTP

It has the feps voltage, and I was able to use the IDS tool to update my pcms to the latest calibration from Ford. BE still will not read or write using this adapter.

I have read somewhere that someone was able to use BE with a GM MDI2 device in J2534 mode, but I guess I will be buying a Mongoose since I know it is supported.

[OzFalcon]

I have BE and I have several eec-v pcms from American Explorers.

I also have a clone Kess v2. It will read and write all the above pcms through the obd2 port. The kess is not a j2534 programmer and BE does not recognize it. The kess also reads the banks in a different order and different size than BE so the files cannot be opened directly in BE.

thanks for the post.. sounds like you have already gone down the path before me ...

from the looks of it kess is the way to go..
it does what you need it to (ie read and write the bins)
the only issue is the differing bank orders ... though that just means you will have to reorder them yourself .. or maybe there is a script out there to do it.. that is if you want to edit the bins (which is pretty much the entire point) in BE or tunerpro

[bmasencup]

I am pretty sure you cannot use bins created with BE with the kess. If I am not mistaken they are encrypted. At least they are if you have a purchased strategy. The only way to write the BE bin is with BE, so the kess is no good. Maybe soneone else knows something different, but I am 99% sure that is the case.