K1-K3 GSXR 600-750 K-Line Bootloader Explained

GSX-R ECU bootloader primer by mr_hollywood@cogeco.
ca (Dec 2014)
The K1 to K3 (2001-2003) GSXR 600 and 750 ECUs use either a 68HC16R3 or 68HC916R3 16bit microcontroller (MCU)
to control almost all aspects of the bike’s operation.
The 68HC16R3 uses a mask-rom memory to store the “program” that controls the MCU. This type of memory is
programmed during manufacturing and cannot be altered in any way. The 68HC916R3 however, uses flash-rom memory
to store the MCU “program” and can be erased and reprogrammed. Suzuki (Denso) seems to have used both model
MCUs in these ECUs, and we haven’t been able to figure out which MCU was being used just from the ECU label.
By modifying the “program” in the MCU, it is possible to change the data that affects such ECU functions as air/fuel ratios,
ignition timing, rev limits and much more. This is what makes the idea of “hacking” an ECU so popular…
But, things are a little more complicated than that. Before you can change the program, you have to understand it. This is
where we hear about disassemblers (such as IDA Pro) that are used to help analyze and understand how the MCU
“program” actually works. The better you understand the “program”, the more options you have to change or tweak things
in it…
As key functions of the ECU are uncovered, the info on their location within the program (and their respective values), are
saved in a definition file for that model ECU. These definition files are the templates used by programs such as
RomRaider, to give you an easy way to modify those parameters and save them into a new (and better) MCU program.
This updated program is saved to your computer as a binary (.bin) file. But how do you get this bin file into your ECU? The
OBD K-Line…
Both types of ECU are equipped with the circuitry for an ISO4191 OBD K-Line interface, but if your ECU has a 68HC16R3
MCU it cannot be reprogrammed, ever… period! On these models, the K-Line interface is there, but it doesn’t do
anything...
If you have a 68HC916R3 MCU however, it’s a completely different story. These ECUs use the OBD K-Line to
communicate with the outside world… So what the hell is a K-Line? The K-Line refers to an OBD interface standard for a
9600 baud half-duplex (8N1) serial connection using 0v for a “mark” and 12v for a “space”. Huh? You’re right! Who cares!
The important thing is that you can buy a cheap OBD K-Line interface like the VAG-COM, and use it to talk to your ECU.
Once again, if you have a 68HC16R3 MCU, the conversation will be real short, and one-sided. The ECU won’t say
anything!!! But a 68HC916R3 will answer you… with an “f!” (short for FO?). Anyway, that reply comes directly from our
guest of honor at today’s discussion: the ECU bootloader… So what’s a bootloader?
The bootloader is a small communications program that resides in the MCU’s BE flash (at address$90000). The program
will only run if certain conditions are met during ECU power-up (or reset). The main condition is having ECU pin 30
grounded. This pin usually sits at +5VDC due to an internal pull-up resistor in the ECU. But if this pin is pulled to ground
during power-up the bootloader program will run instead of the normal ECU program (so obviously your bike won’t run).
Ok, so I’m in bootloader mode. What now? Well, now you can upload your own program to the ECU and run it… But there
are limitations; your program can’t be bigger than 1,792 bytes long and will disappear when you power-down…. So what’s
the use?
Well, even with a small program you can do some pretty cool stuff once you take control of the ECU. First, you can
instruct the ECU to send you its program. This is the 96k binary (or bin file) program that controls the whole ECU. Once
you have this, you can start to analyze the ECU and work towards creating definition files to modify it. You can also
upload files with small diagnostic tests to help you better understand the ECU hardware and pin functions without having
to tear the ECU apart (messy business)…
And finally, you can use the bootloader to upload a program to actually re-flash the ECU with your own modified code...
Well, that’s about all I have to say for today. Feel free to drop me an email with any questions or comments. For a more
technical discussion on the bootloader protocol, check this out:
https://sites.google.com/site/mrhollywoodk3/home/obd-bootloader-utilities/K1-K3%20GSXR%20600-750%20K-Line%20bootloader%20protocol.doc
[email protected]

K1-K3 GSXR 600-750 K-Line Bootloader Explained

Uploaded by

Copyright:

Available Formats

K1-K3 GSXR 600-750 K-Line Bootloader Explained

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

K1-K3 GSXR 600-750 K-Line Bootloader Explained

Uploaded by

Copyright:

Available Formats

GSX-R ECU bootloader primer by mr_hollywood@cogeco.

You might also like