Show Full Size

• string Hex = ByteArray.ToHex(int First, int Count)
  Converts some or all bytes from ByteArray into a hex string "5C A4 CC 9F".
  The parameters First and Count are optional.
• string Text = ByteArray.ToAscii(int First, int Count)
  Converts some or all bytes from ByteArray into an ASCII text. Invalid bytes are displayed as '?'.
  The parameters First and Count are optional.
• byte[] New = ByteArray.Extract(int First, int Count)
  Extracts some bytes from ByteArray into a new array.
  The parameter Count is optional.
• byte[] New = ByteArray.Append(byte[] Data, int First, int Count)
  Appends some or all bytes from the array Data to the bytes in ByteArray.
  The parameters First and Count are optional.
• byte[] New = ByteArray.ReplaceAt(int Pos, byte[] Replace)
  Replaces the bytes at position Pos in ByteArray with the bytes in Replace.
• bool ByteArray.Matches(params byte[] Data)
  Returns true if all bytes in both arrays are identical.
• bool ByteArray.StartsWith(params byte[] Data)
  Returns true if the array starts with the bytes in Data.
• int ByteArray.Find(int Start, params byte[] Pattern)
  Returns the position in the array where Pattern was found or -1 if no match.
• int ByteArray.DiffBytes(params byte[] Data)
  Returns the count of bytes that are different in both arrays. Zero means they are identical.
• void ByteArray.Fill(byte Value)
  Fills the entire array with the given byte value.

• Macros\Send Logfile\SendLogfile.cs
  This script reads the content of a logfile and sends it to the CAN bus.
• Macros\Honda Sniff\HondaSniff.cs
  This script for the Sniff Terminal switches the baudrate when a firmware is uploaded to a Honda ECU.
• Macros\Deni E1700\E1700.cs
  This script for the CAN Raw Terminal captures the CAN bus traffic of a DENI software while uploading
  calibration tables over a UsbCAN adpater to the E1700 ECU and writes the calibration tables into an XML file.
• ECU\MT05\Emulator\Flashing.cs
  This script for the Emulator automates the upload and download of flash data for the Delphi MT05 / MT05.2.

Download / Upload Flash Memory (MT05 / MT05.2 only)

1. The Bootloader is required to start up the ECU.
   It will never be overwritten when flashing. This is a protected area.
2. The Configuration Data will always change when you turn off the ignition key.
   The ECU stores non-volatile data here when you turn the ignition key off, like:
   fault codes, ignition counter, statistics, fuel learning (BLM), airflow learning and throttle learning.
   HUD ECU Hacker does not write into this area, but you can erase the content of this erea. See Reset EEPROM.
3. The Calibration Tables are used to calculate the optimal operation of the motor depending on
   factors like speed, engine load and temperature, etc. They control fuel injection, spark timing, etc.
4. The Firmware area contains the executable program code.
   You should normally not overwrite this area except you know exactly what you are doing.

Tuning (MT05 / MT05.2 only)

Tuning with Commercial Software

Tuning MT05 with HUD ECU Hacker

Download the flash memory of your ECU into a BIN file, go to the tab "Tuning", select your file and HUD ECU Hacker will auto-detect all calibrations.

Calibration Editor Show Full Size

3D Editor Show Full Size

Hex Viewer Show Full Size

c1768e f2 fc f8 f7     mov        r12,[0xF7F8]
c17692 f2 fd fc f7     mov        r13,[0xF7FC]
c17696 d7 40 01 03     extp       #0x301, #1
c1769a f2 fe 22 29     mov        r14,[0x2922]
c1769e da c1 f8 14     calls      FUN_c114f8
c176a2 f0 c4           mov        r12,r4
c176a4 f6 fc f8 f7     mov        [0xF7F8],r12
c176a8 f2 fd fc f7     mov        r13,[0xF7FC]
c176ac 42 fd f8 f7     cmp        r13,[0xF7F8]
c176b0 fd 08           jmpr       cc_ULE,LAB_c176c2
c176b2 22 fd f8 f7     sub        r13,[0xF7F8]
c176b6 f6 fd f6 f7     mov        [0xF7F6],r13
c176ba e1 12           movb       RL1,#0x1
c176bc f7 f2 e6 f7     movb       [0xF7E6],RL1
c176c0 0d 08           jmpr       cc_UC,LAB_c176d2

Hex Viewer

Delphi Calibration Data

Completing Auto-Detection Results

Editing Calibrations

Working with Patches

Adapting to other ECU's

Step 1a. Sniff Data internally

Step 1b. Sniff Data externally

Show Full Size

Show Full Size

K-Line Show Full Size

CAN Bus Show Full Size

Step 2. Test the ECU Emulator

K-Line Show Full Size

CAN Bus Show Full Size

Step 3. Simulate the ECU

Step 4. Enter the XML Commands and Parameters

Step 5. Enter the XML Names and Descriptions

Download and Installation

Install USB Drivers

Show Full Size

Trouble Shooting

• The ignition key must be on.
• The kill switch must be in the position where it allows the motor to run.
• Some motorbikes (Benelli) require the side stand to be up otherwise the ECU will not respond.
• It is not necessary to start the motor to establish a connection.
• Check that you have connected the three wires correctly as shown in the connector diagram.
• If you have a MT05 ECU verify that the seven voltages are correct that are marked red in the MT05 diagram.
• The voltage at the K-Line wire MUST be +12 Volt while the adapter is connected to the ECU.
  Some adapters do not enable the pull up resistor when they are in power safe mode.
  Measure the voltage while clicking the "Connect" button in HUD ECU Hacker which will activate the adapter.
• If you use a K-Line or J2534 adapter ecxecute the Echo Test to check the adapter.
• There are 2 types of timeout errors which indicate different errors:
  • Timeout waiting for echo means always that you have a hardware problem or the wrong COM port.
  • Timeout waiting for response (or received garbage characters) with ELM327 adapter may mean that the baudrate is wrong.
    You can change the baudrate in the window "Configure Adapter". Normally ELM327 adapters use 38400 baud or 115200 baud.
  • Timeout waiting for response with K-Line / VAG adapter may happen rarely.
    The reason is that the ISO 14230 protocol is very time critical. It demands 50 ±1 ms for the fast init.
    But Windows as a multitasking OS is not very precise and the interval seen on an oscilloscope may vary from 45 ms up to 70 ms.
    If the interval between fast init and the command 'Start Communication' exceeds the limits the ECU does not respond.
    K-Line adapters are the only adapters where timing depends on the computer. J2534 and ELM327 adapters create a precise timing.
    If you get this type of timeout error, try the following:
    1. Click 'Connect' several times until it works. It may work 8 of 10 times.
    2. Some adapters (e.g. some SiliconLabs chips) do not support the way how HUD ECU normally generates the fast init pulse.
       Try switching Fast Init Mode 1 / Fast Init Mode 2 in the window "Configure Adapter".
    3. For slow computers you can enter in the same window a K-Line timing correction which is added to the 50 ms interval:
       
       ATTENTION: If you enter an invalid value here you may screw up the fast initialization forever.
       If changing this value did not solve your problem, reset the correction to zero otherwise you may never be able to connect.
       To verify the timing you need a digital oscilloscope, otherwise it is pure try and error.
• BUSINIT: ERROR from an ELM327 adapter means that the adapter did not receive a valid response from the ECU.
• You can also change the configuration in "Autodetect OBD2.xml". Some older ECU's use 9600 baud.
• If you have tried everything and the ECU still does not respond, test your adapter: Connect HUD ECU Hacker to it's own emulator.
  Therefore you need a second adapter. See Emulator

Appendix

Delphi MT05.3

HiSun MT05

Delphi MT05.3 Show Full Size

HiSun MT05 Show Full Size

Rongmao MT05 and RM08

Harley Davidson MT05

Delphi MT05 Show Full Size

Rongmao MT05 + RM08 Show Full Size

Harley MT05 Show Full Size

Chinese Fake MT05

Real Delphi MT05 Show Full Size

Fake Delphi MT05 Show Full Size

Chinese MT05 Clones

Overheating Risk

1. The first damaged part will be the cylinder head gasket. As a result coolant will enter into the cylinders and vaporize.
   You will lose coolant through the exaust pipe. A vicious circle accelerating the damage.
   Replacing the gasket is expensive because the motor must be opened.
2. If you drive longer with an overheated motor the cylinders will be ruined and you need a new motor.

IACV Calibration

• The engine cannot be started
• The engine goes off alone while running idle (especially when it is cold)
• The idle speed is irregular
• The ECU may generate fault code P0505.

Position 0	Position 255

• Position 0:    The valve is fully closed. Air can only enter through the throttle into the intake manifold.
• Position 168: The valve is in the parking position for the next cranking. (Defined in the calibration IAC Park Position).
• Position 200: The maximum position that the ECU will use. (Defined in the calibration IAC Position Max).
• Position 255: The valve is fully open.

1. Take the IACV out so you can see the pintle position.
2. Connect HUD ECU Hacker.
3. In the Data Slewing window move the IACV to the absolute position 255.
4. Now disconnect the battery so the ECU cannot store this position in the flash memory.
5. Reconnect the battery. You should hear the fuel pump running. Now the ECU assumes the IACV in parking position.
6. Repeat steps 2 to 5 until the pintle does not move anymore. The spring must be completely compressed.
7. Now you have the pintle in the real mechanical position 255.
8. In the Data Slewing window click Reset all presets in ECU which moves the pintle to the parking position.
9. Turn off the ignition key. Now the ECU stores the correct parking position in flash memory.
10. Mount the IACV back into it's place.
11. When driving the next time the airflow self-learnig will adapt to the new conditions.

Self Learning

Reset EEPROM (NVRAM)

1. Erase the fuel self-learning data (BLM Table). All correction factors will be reset to 1.0 (no correction).
2. Erase the airflow self-learning data (Airflow Table). All correction factors will be reset to 1.0 (no correction).
3. Erase the throttle self-learning data (Auto-Zero). The throttle zero will be set to the default in the scalar 'TPS Raw Intercept'.
4. Erase all statistics. This will reset all time counters (except total runtime), max temperature, max batt voltage, max speed,...
5. Erase all historic DTC fault codes
6. Reset the IACV pintle position

1. Turn the ignition key off while pin 5 of the ECM plug is connected to ground (pin 2), then wait 10 seconds.
   This will only work if the scalar 'J1-16 Input Usage' is 1.
2. Or turn the ignition key off, wait 10 seconds, turn the key 5 times on/off within 5 seconds, then (while off) wait another 10 seconds.
   This will only work if the scalar 'J1-16 Input Usage' is not 1.

Rescue a bricked MT05

Show Full Size

Crankshaft Position Sensor

Show Full Size

Battery

Plugin for Bosch PSG 5 (Injection Pump)

Additional Operations

Connection

• K-Line: All operations over K-Line require a VAG KKL or VAG K+CAN adapter because
  the old KW 1281 protocol is neither supported by J2534 (Tactrix) adapters nor ELM327 / OBDLink adapters.
• CAN bus: All operations over CAN bus require a J2534, UsbCAN or VAG K+CAN adapter.

Details about the operations

Purchasing the PSG 5 Plugin

High Quality Software  from  ElmüSoft

Desktop Organizer & Event Calendar My program PTBSync (in english + deutsch) has an event calendar / scheduler with lots of features, calculates the holidays of 70 countries, can display multiple gadgets on the desktop (current weather, birthdays, moon phase, menstruation calendar, world clocks,...) pins notes on the desktop, replaces the primitive Windows trayclock and adds a detailed tooltip, synchronizes with an atomic clock, and much more.

ECU Scanner, ECU Hacker, ECU Tuner for motorbikes, cars, trucks, vessels connects to ECU's (Engine Control Units) from motorbikes, cars and trucks, shows parameters, clears DTC's, has tuning for a Delphi ECU, has an ECU emulator, can analyze the CAN bus using cheap adapters, supports many protocols, has a sniffer and manual data injection for K-Line and CAN Bus, allows you to write your own macro scripts that communicate over K-Line and CAN Bus.

Oscilloscope Waveform Logicanalyzer displays oscilloscope waveforms and has A/D converters, noise suppression, precise time measurement, logic analyzer with decoders for UART, SPI, I²C, CAN bus (also CAN FD) and chip-specific decoders. Can split half-duplex communication. Transfers signals over USB (SCPI) from the oscilloscope to the computer and remote controls the oscilloscope. It is open-source and you can extend it with new features.

Subtitle Tuner calculates the display duration of the subtitles based on the count of characters in the text. This avoids that badly created subtitles disappear before you could read them. Can remove deaf texts, lyrics, italic/bold. Can resynchronize a subtile to a movie with different framerate or change the subtitle offset.

Secure Doorlock with RFID Cards is a project with an RFID antenna and a Teensy processor that opens a door with Mifare Desfire cards. The RFID cards of up to 64 users can be stored in the flash memory. It is extremely secure because it uses strong encryption. A big battery assures that the door can be opened during a power failure.

Remote Control your Computer with Infrared An infrared receiver and a Teensy processor allow to remote control the music player on your computer with any old remote control that you have from a TV, amplifier, DVD player, SAT tuner or whatever. The Teensy simulates a keyboard and sends keystrokes to the music player.

3D Render and Editor Control in C# A .NET control that can be easily implemented into System.Windows.Forms applications to display 3D graphs. The user can move and rotate the graph with the mouse and edit single points. Many display modes are available: 3D surface, 3D shapes, 3D lines, 3D objects, also animated 3D objects.

CAN FD adapter - CANable 2.5 Firmware Update - Candlelight & Slcan I wrote two completely new firmwares for the CANable adapter with the STM32G431 processor (for example from MKS Makerbase). The official Slcan firmware has several issues and the official Candlelight firmware is complete crap. I fixed a ton of bugs and added several new features. HUD ECU Hacker fully supports these new features and comes with a firmware updater.

USB HID Touchscreen A Teensy processor emulates keyboard, mouse and touchscreen at the same time to remote control a computer for automation purposes.

You can write me in english, oder auf deutsch, o en español.