Hello,

I am working on reverse engineering an engine computer for a 91-95 Acura Legend. I am trying to determine what algorithm is used and the checksummed addresses within the ROM. I have no knowledge of programming and a limited knowledge of hex. Any information would be greatly appreciated.

What I know/research:
It is a 16bit arithmetic checksum
It is a word at 0x00

I have an aftermarket ROM chip manufactured by a company that knew the correct checksum routine. All that was modified were 2 ignition maps and a rev limiter. I have the exact same stock ROM chip to compare against. The 32K ROM chip is split into two different parts on the ECU. The first part 0x0000-0x3FFF is for Manual Transmission cars, the Second part 0x4000-0x7FFF is for Automatic Transmission cars. There are various settings and tables that are changed between the two, but the aftermarket company made the EXACT same changes in each ROM. So, I split the stock rom into two portions and the aftermarket ROM into two portions. The engine computer only sees one portion depending on whether it is set up to be automatic or standard by swiching the high memory address (A14) to ground (m/t) or +5 (a/t) with a resistor. Therefore, the checksum is calculated for the indivual 16K portions and not the entire 32K ROM. The split files are available here:

http://users.adelphia.net/~sr5guy/Legend.zip

WORD at 0x00
-----------------------------------------
#1 Stock AT.bin: 0xF8CD
#1 Aftermarket AT.bin: 0xD2A9

0xF8CD - 0xD2A9 = 0x2624
------------------------------------------
#2 Stock MT.bin: 0x0AD7
#2 Aftermarket AT.bin: 0xE4B3

0x0AD7 - 0xE4B3 = 0x2624
-------------------------------------------

The fact that both of these equations have the same sum leads me to believe that an arithmetic, non CRC, 16 bit checksum is used. Please help me to find out what algorithm it is (Plain 16 bit, Little Endian, Big Endian, XOR, ETC) and what memory addresses it references. I think this may be found easily via a brute force method, disassembly, etc. At this stage, it is over my head!


More information:

The ECU's micro is an Hitachi H8/500 series. There is 32KB of masked internal ROM inside of this MCU. I have no access to this internal ROM at this time. I do sincerely hope that this checksum, located in the EXTERNAL ROM, is not a computation of the internal and external ROM put toghether.

The method to disable the checksum routine is at 0x1060. You change the value of 0xCA to 0x80. For certain cars, this method of disabling the checksum causes errors with other systems in the car, namely the traction control system. The only option of repair is to correct the checksum located at 0x00.

Threads:

This thread contains links to the dis-assembler, programming and datasheet for the Micro.
http://forum.pgmfi.org/viewtopic.php?t=12362

This thread contains links to the Acura Legend ECU project, a search of this forum should provide any needed information.
http://www.acura-legend.com/vbulletin...hp?t=93859


Thanks again for taking the time to read this!

-Matt
mattsforeign@adelphia.net