Data Tracing

Mick · Post by **Mick** » Fri Feb 15, 2008 5:35 am

I see in the current software of TunerPro RT there is a feature called ALDL Data Tracing.

I see that this is assocated with the new v2 OSTRICH from Craig Moates.

I was just wondering if anybody was using this feature and what there findings were.

I'm also lead to beleive that Craig's Roadrunner LS1 Real Time PCM has the same capability.

I was wondering if these features would be included into TunerPro in the future.

I'm a very curious sort of guy, I hope I don't ask to much...

Cheers

Mick

Post by **Mangus** » Fri Feb 15, 2008 6:11 am

ALDL data tracing takes the ALDL output and traces any corresponding maps (as defined by the definition). The address hit tracing implemented in the Ostrich 2 is a bit different.

Yes, I have a test app working with address tracing, but do not have it integrated into TunerPro. I will eventually.

Lafuente · Post by **Lafuente** » Sun May 11, 2008 10:31 pm

Mangus wrote:ALDL data tracing takes the ALDL output and traces any corresponding maps (as defined by the definition). The address hit tracing implemented in the Ostrich 2 is a bit different.

Yes, I have a test app working with address tracing, but do not have it integrated into TunerPro. I will eventually.

Hi Sir,

It would be a great news if you do it

Best regards,
Manu

KaliE36 · Post by **KaliE36** » Tue May 13, 2008 12:02 am

this adress tracing will be a great feature for any DIY tuner ... when can we expect to have this in TunerPro?
can we also test this "test" app ?

Lafuente · Post by **Lafuente** » Fri Jun 20, 2008 12:34 am

Mangus wrote:ALDL data tracing takes the ALDL output and traces any corresponding maps (as defined by the definition). The address hit tracing implemented in the Ostrich 2 is a bit different.

Yes, I have a test app working with address tracing, but do not have it integrated into TunerPro. I will eventually.

Hi Mangus.

I wonder if you plant to release this fonction in TunerPro RT. In fact, I am waiting this to get an registered version

Bests,
Manu

Post by **Mangus** » Fri Jun 20, 2008 4:55 am

Yes, it's planned for TunerPro RT.

Lafuente · Post by **Lafuente** » Fri Jun 20, 2008 5:10 am

Mangus wrote:Yes, it's planned for TunerPro RT.

YES !!!

And when do you plant to release it ?

Bests,
Manu

Post by **Mangus** » Fri Jun 20, 2008 5:42 am

Lafuente wrote:And when do you plant to release it ?

When it is ready.

I am working on it. At a varying pace, but I am working on it.

Merci pour votre intérêt!

Lafuente · Post by **Lafuente** » Fri Jun 20, 2008 5:45 am

Mangus wrote: When it is ready.

I am working on it. At a varying pace, but I am working on it. Merci pour votre intérêt!

De rien mon ami => You're welcome !!

Lafuente · Post by **Lafuente** » Fri Jun 20, 2008 6:00 am

If you need any tester, I have an ostrich and a well tuned XDF for my car (siemens ECU fenix1B). I'll have to do my maps soon and can help you to go through with trace fonction if you need/hope.

Bests,
Manu

Post by **Mangus** » Fri Jun 20, 2008 6:06 am

Lafuente wrote:If you need any tester, I have an ostrich and a well tuned XDF for my car (siemens ECU fenix1B). I'll have to do my maps soon and can help you to go through with trace fonction if you need/hope.

Bests,
Manu

Excellent! Could you email me the XDF and matching bin for your Siemens ECU? What year and models is it for? Can I post it on the TunerPro web site?

Lafuente · Post by **Lafuente** » Sat Jul 26, 2008 1:02 am

Mangus wrote: Excellent! Could you email me the XDF and matching bin for your Siemens ECU? What year and models is it for? Can I post it on the TunerPro web site?

Yes you could my friend

In fact, you should !

Bests
Manu

kepsus · Post by **kepsus** » Sun Aug 31, 2008 11:57 am

WOW cant wait to try this... Please let me know if you need any testpilot, to test it

sideways danny · Post by **sideways danny** » Sun Aug 31, 2008 4:01 pm

awesome. Currently have a Ostrich 1.0 but i'll upgrade to 2.0 if tunerpro RT can work with a trace function. I'm running on a Nissan CA18DET with a JECS ECU. Can provide the xdf I have if needed

Six_Shooter · Post by **Six_Shooter** » Sun Aug 31, 2008 5:43 pm

Mangus wrote:ALDL data tracing takes the ALDL output and traces any corresponding maps (as defined by the definition). The address hit tracing implemented in the Ostrich 2 is a bit different.

Yes, I have a test app working with address tracing, but do not have it integrated into TunerPro. I will eventually.

I've been curious why the Ostrich 2.0 firmware would need to be updated for ALDL tracing. The way I understand it works aqnd have seen it work is strickly from the ALDL input and show up in the tables of the current bin shown in TP RT.

What effect is the Ostrich 2.0 going to have? How does this relate to the tune?

Post by **dex** » Mon Sep 01, 2008 12:00 am

ALDL has nothing to do with the Ostrich2 and is the data stream from the ecu.

The Ostrich2's data tracing is independant of the ecu and tracks calls to rom addresses only.

Post by **Mangus** » Wed Sep 03, 2008 7:59 pm

sideways danny wrote:awesome. Currently have a Ostrich 1.0 but i'll upgrade to 2.0 if tunerpro RT can work with a trace function. I'm running on a Nissan CA18DET with a JECS ECU. Can provide the xdf I have if needed

I'm always interested in adding definitions to the web site if you'd allow. Feel free to email it to me along with vehicle compatibility list to mark at tunerpro dot net

kepsus · Post by **kepsus** » Mon Oct 06, 2008 11:17 am

Do we hve any time estimate (if) this fuction get in to tunerpro rt

kepsus · Post by **kepsus** » Mon Nov 03, 2008 12:36 pm

Sorry to keep ask , i know you do all this for free (almost), but it would really be a cool feature

sideways danny · Post by **sideways danny** » Tue Dec 30, 2008 6:39 pm

Any news on a data trace yet?

audichap · Post by **audichap** » Wed Jan 07, 2009 3:56 am

Greetings all - I am a noob on here. Regsitered user of the RTPro package and I have the mighty Ostrich 2.0 up and running...

I too would really love to know when any kind of trace functionality will be available via RTPro. I will happily take Alpha or Beta test builds.

I need tracing to do a couple of basic things -

1. Create a sequenced list of address hits from power up of the ECU - until its shut down, or when it hits some sort of limit - file size or timer. This is going to be a huge help in reverse engineering undocumented ECUs. I would happily take a standalone hack/application that can do this now - I just need all the address hits so I can sanity check my disassembly and attempts to understand my ECU a lot better.

2. Highlight address hits in real-time while viewing maps graphically. This will be a revelation for RT mapping with visual confirmation of where the ECU is working inside a live map view - much less guesswork - especially when the map scales are not yet known.

PS - RT TunerPro is great... I have spent a long time building XDFs for the ECUs I work with - it has been a bit labourious but the stability of the package and ease of operation is fantastic.

Getting the trace function up and running will be so cool - it is the reason I bought Ostrich and this software as my best hope for progression.

audichap · Post by **audichap** » Tue Jan 20, 2009 2:32 am

BUMP - Any update from the makers of TunerPro RT on the availability of a trace function ?

Sorry to moan on about this, but even a message that said its 6 months away is better than hearing nothing.

I've been trying to get some direct connectivity with Ostrich for its claimed trace command set using various serial port programs but its proving pretty tedious as it seems I need TunerPro to initialise the comms properly, but then it hogs the COM port making it impossible to get reliable comms with another package to attempt some trace commands.

Even if a quick / dirty dialog box could be grafted onto TunerPro as a means to exercise the trace commands before any graphical or tabular support is provided - that would be awesome for people like me trying to reverse engineer some of these undocumented Bosch Motronic ECUs.

Post by **Mangus** » Tue Jan 20, 2009 5:22 am

The next version of TunerPro will not ship w/o tracing. The plan is to have two forms of tracing data visualization availble:

1) a raw list of address hits in an arbitrary window that the user specifies. This will be the most performant means of getting data from the unit, and the method least likely to miss data

2) visual tracing bubble on the active table. The user opens up a table to visualized, clicks "trace", and address hits are highlighted in the table.

I'm fixing a couple of hardware interfacing issues at the moment with the Roadrunner, and as soon as that's done, I'm moving on to tracing (for the love of God =). I've finally got my test bench back, which is what I've been waiting on to get this implemented.

I appreciate everyone's patience.

audichap · Post by **audichap** » Tue Jan 20, 2009 6:41 am

Mark,

Thanks for the update on this one... I really appreciate it.

I think the two methods you suggest are just what I need - Method 1 to help reverse engineer an unknown ECU and Method 2 to give visualisation of where the ECU is hitting a specific map in real-time.

My only request for Method 1 would be that it should be possible to specify a range of the entire address space and have a sequence dump of all the address hits into a text file for offline investigation - thats going to be a big help to confirm the behaviour of any reverse engineered / disassembled code... Watching how the chip is accessed at startup/reset for example or it traverses multiple maps, making various calculations to obtain a final result for injector times or whatever... Spare a thought for any of us trying to unlock some of the Bosch Motronic secrets. We need all the help we can get !

Really looking forward to support for trace, and only too happy to offer any services as an Alpha / Beta tester if it helps the wider userbase.

Rogue_Ant · Post by **Rogue_Ant** » Tue Feb 10, 2009 9:17 pm

audichap,
I'm also working on the motronic. I'm dealing with my 86 Porsche 944 Turbo which uses the motronic 3.1. What version are you working on?

And yes the data-tracing will help a lot! I'm really looking forward to its release

-Rogue

audichap · Post by **audichap** » Wed Feb 11, 2009 1:17 am

Cool - we should compare notes on moates then

Mine is Bosch DME 2.3.2 - I'm not 100% sure on that but its an 8051 based thing that is keeping me awake at night with code disassembly.

I have written a PHP script for finding maps - if you like I can parse your Porsche binary for maps - assuming you know what labels to look for... I don't think they are the same across different applications.

My idea of the script is to eventually get it to create the XDF file that describes the locations of all the maps found - to save LOTS of time versus building the XDF manually.

Rogue_Ant · Post by **Rogue_Ant** » Fri Feb 13, 2009 4:56 am

Well if your DME is 8051 based as well, then we are looking at similar dis-asm... What are you using to dis assemble? What size is your binary? I'm using a modified version of Dis51 and my binary is 8k.

Does your binary have a jump table? I know the locations of pretty much every map on the binary I have. If you know the jump table location - you just follow the jumps. Then just looking for familiar header information to help identify the table.

Do you have a link to your thread on moates.net?

-Rogue

audichap · Post by **audichap** » Fri Feb 13, 2009 3:19 pm

I have been using DIS8051 - which is OK, but takes a lot of hand coding for good results.

Tonight I got a quick run thru with IDAPro and the quality in output is amazing - it also found all the datablocks automatically - no stupid TAG files here.

Based on the binary I gave it, it called out an 8051 variant that had no internal ROM - which makes sense to me as that would conflict with me finding reset and interrupt routines in one of the two external EPROMs.

Yes some of the code uses jump tables - and that definitely helps a lot locate those maps which don't have the motronic labels.

It will take a while to learn my way round IDA Pro, but it looks great. I can work on your binary if you like... Just send me a PM with an Email address and we'll go from there.

Rogue_Ant · Post by **Rogue_Ant** » Fri Feb 13, 2009 3:54 pm

audichap,
My binary should also be a 8051 variant with no internal ROM.

You have a PM.

-Rogue

audichap · Post by **audichap** » Mon Feb 16, 2009 11:10 am

PM sent back... Since my previous post I have been inside my ECU for a closer look as I couldn't figure how an Intel 8051 (built in 1980) was accessing so much external EPROM space.

Turns out my ECU has an 8051 running from internal ROM, and it also has 2 x AMD/Siemens 80535 micros - one for fuel/timing and the other for boost control. What a beast !

Anybody see why I need the trace function so badly

Seriously though - whilst I have a really nice package for code disassembly, its going to take a long time to completely map out both the external chips and properly understand when each map gets used. The trace function is going to be a vital assistant for that.

soldave · Post by **soldave** » Fri Feb 27, 2009 4:00 am

Am I right in thinking then that the ALDL mapping will not be available for people with the Ostrich 1?

Post by **Mangus** » Fri Feb 27, 2009 1:52 pm

soldave wrote:Am I right in thinking then that the ALDL mapping will not be available for people with the Ostrich 1?

ALDL mapping is irrespective of emulation hardware. If you can get ALDL data, you can potentially set up ALDL tracing.

Address tracing, on the other hand, is an Ostrich 2 and Romulator feature (TunerPro will support the Romulator, but emphasis will beon Ostrich 2).

soldave · Post by **soldave** » Fri Feb 27, 2009 1:55 pm

Mangus wrote:
soldave wrote:Am I right in thinking then that the ALDL mapping will not be available for people with the Ostrich 1?
ALDL mapping is irrespective of emulation hardware. If you can get ALDL data, you can potentially set up ALDL tracing.

Address tracing, on the other hand, is an Ostrich 2 and Romulator feature (TunerPro will support the Romulator, but emphasis will beon Ostrich 2).

Sorry, I meant address tracing. Getting a little confused there.

Well that serves me right for going the cheap route all those months back and picking up an Ostrich 1!

An upgrade may be in the cards when the latest Tunerpro release is out.

moon_walk · Post by **moon_walk** » Wed May 06, 2009 5:42 am

any news on the address tracing yet?

revlimit · Post by **revlimit** » Wed May 06, 2009 9:11 am

moon_walk wrote:any news on the address tracing yet?

address tracing works but it needs more work to get it just right so just wait till the version 5 comes out and don't forget to donate.

moon_walk · Post by **moon_walk** » Wed May 06, 2009 9:35 pm

revlimit wrote:
moon_walk wrote:any news on the address tracing yet?
address tracing works but it needs more work to get it just right so just wait till the version 5 comes out and don't forget to donate.

eny expected eta ? btw already have donated

WhizzMan · Post by **WhizzMan** » Sat Sep 12, 2009 11:48 pm

It may sound a bit dull, but I could really use the address tracing for my ostrich 2. It's been sitting on the shelf for about a year waiting for this feature in tunerpro RT to appear. Is there an update on the time frame, or a (non public) beta I could try?

thecris · Post by **thecris** » Thu Nov 12, 2009 3:23 am

we all are here and waiting for realtime map traking!!!!!!
i really need this. but i need to know if this feature became real in few time or not.

please give me some information about.

a lot of fast cars hope and wait...
if beta version is made, please post it and we try!!!!!!!!!!!!!!!!!!!!!!!!!!!!

CRIS FROM ITALY

Six_Shooter · Post by **Six_Shooter** » Thu Nov 12, 2009 3:40 am

Public Beta has been released, for over a month now, check the main page for the link.

TunerPro User Forum

Data Tracing

Data Tracing

BUMP - Any updates ?