Motoshop,
Thanks for posting. As Gimpster has not responded I will with what I know. He has been maintaining another thread and Katflap has continued to work on this problem. My understanding the main missing link to a low-cost ECU remapping is the reflashing of the ECU MAPS. The problem seems to be some combination of cheap USB convertors and the flash software.

You mention that the download is not stable. My guess is it is the cheap Chinese USB to serial conversion chips. I don't have any specific experience with the Delphi MT05 but have programmed USB to RS-232 in the past and has problems using adapters with clone chips. Basically, it drops bits and is otherwise unstable.

I think Gimpster has success using a genuine ELM327 although I don't think he has been able to reflash??? Considering the cost of alternatives even a $40 adapter is very cost-effective if it allows for a MAP reflash.

Keep us posted on progress using the tacktrix openport J2534.

Hopefully, Gimpster or Katflap can provide updates/corrections to my understanding.

Posplayr,

thanks for the reply. My cable is original VAG K-line cable +€200,- so i wont think this could be the problem, still waiting on my openport. I found that the pin-out from different brands of scooter on the obd connector is different. Some use only 4 pins K-line, some 3 etc. If anybody needs extra background info to help let me know.

Also working on the bullit series 125cc with succes in remapping.

Looking for a way to extract .bin from bosch mse 6.0m for the zontes G125, U125, U-1 125, CF moto 650 series.

Greetings

The only way reading bin for Bosch MSE6.0 is using WinOls and you will be swimming in data :)

Hunitori,

Can i extraxt the complete bin with WinolS? And flashback edited?

Thanks

Do you have Whatapps? add me +84931865713

Hello. help with the map definition file Delphi mt05.2

Hello
I also have such a store in Poland.
I failed to connect via Ecu hacker to my private bike keewaay rks E4 with Yeson ECU
I am trying to connect to the 50cc E5 bike as they are very weak now. Unfortunately, to no avail.
I do everything Raptorix wrote in help.
I am using elm327.
My bike has an ECU not a delphi but a Yeson, and this other bike has some Chinese invention.
I also have an application that reads errors and parameters and has a terminal !. Once connected to these vehicles, I typed the commands 81 and AT DPN, and typed the appropriate values into the xml file for the Ecu Hacker.
For the E5 vehicle I should enter the Ecu 11 and protocol 05 address for elm327. The protocol number gave progress, but the ECU address 0x11 gives nothing, the ecu hacker works best on the ECU 0x33 and protocol 0x05, but it disconnects. Something else is missing, can you help me?
Screenshot for ecu 0x11 and ecu 0x33
did you manage to connect to other ecu than delphi?

What is the latest version of hud hacker
 

What is lastest version of hud hacker I see a 4.7 on other sites iare those lagit.. if not where can I find 3.8

In the link that you pass is the latest improved version and you should be fine if you have any questions, contact the author and he will be able to give you the oldest version, but you should not have problems using version 4.7 because it is fine

https://netcult.ch/elmue/HUD%20ECU%20Hacker/

You can also use TunerPro. Maps on MSE6.0 are located near address 0x140000 and the best thing of MSE is the bin structure. Unlike Keihin ECUs the maps are separated from OPCODE and they are easily recognized. Every map has a kind of header where X and Y breakpoints number is indicated. Also X and Y breakpoints value are given in some of them.

The bad news - these binaries from MSE6.0 has near 3000 different routines ISO of 900-1000 for any Honda Keihin ECU. And the worst thing of all - address offsets are relative. r13 and r2 values are used as a reference for address offsets - this registers are writen at the inition of 2 binary sections with OPCODE. r2 and r13 values can be found searching for r2 and r13 operand usage in opcode window. But the 90% of routines still need to be executed in order to found which address it uses (maybe there is another way to do it, I don't know).

It means that Ghidra doesn't detects references to addresses unless you execute this particular routine and creates a references to all addrsses it W/R. A true PITA cos it's veery difficult to create decent memory map. And without memory map theere is no way to analyse the routines.

Personally I'm stuck with this ECU - of course I can see the maps, create xdf and so on but can't analyse the OPCODE as I'd like to.

P.D. Just sorted the reference problem - now all references to RAM are correct!