EFIDynoTuning Forum

I haven't been able to find any schematics or really anything more than a mention of the Son-of-EECSucka hardware anywhere so far. The 74HC373 latch chip is tri-state capable but the design I'm using right now has its OE/ pin1 simply grounded. Thank you again for your input I'll do some more looking at this. This design not tri-stating the way it is now is probably why the pull-down resistors are so fiddly. I think the SUCKIT program has the LPT outputs (PD0-PD7) only jumping back and forth between 0 and 255. I don't think it's giving any address info to the EEC just strobing the data out of it into nibbles read by the status register of the LPT port and using the control port to change the bank select lines. My intentions are to move on to more modern tactics but for now I'm trying to learn by available examples and original thoughts from the beginning or near to it.

***Correction*** I realized after writing about the tri-stating up above it’s not the 74HC373 latch chip that needs to tri-state for the MBUS it the 74LS157 mux chip that is connected to the MBUS MB0-MB7. I’ll look to see what can be done with that.

I have a couple Rasbery pi Pico units I will start messing with eventually and they have some state machines built in with programmable I/O that may come in handy, plus they can clock to I think like 225Mhz.
***correction*** Dual ARM Cortex-M0+ @ 133MHz still impressive.

I'm having a lot of fun borderline obsessing over this lately.

Thank you
J.W.S.

More good progress, I now have my bread board ECCSUCKA using a 74LS157 and found with 4.7K pull downs on MB0-7 I'm getting consistent good reads. I also changed the circuit some. The ECCSUCKA design I was following had MB5 not pulled down and instead going through a 10kohm resistor and to pin2 of the latch chip 74HC373. I read a detailed narrative on an Andrew March web page from the year 2000 that explained loading $20 and $00 into the EEC. My changes include disconnecting the MB5 from the latch and pulling it down like all the other MBUS lines.

Quote from an Andrew March web page
"The hardware design of the dumper is a little bit sneaky. Notice that initialising the Slave Program Counter involves writing either the value 0x00 or 0x20 on to the MBUS at various times. In other words, the dumper only has to control just one bit (MB5) to generate these two values. This is achieved by a single latch output that sets the value of MB5 via a 10K resistor while the remaining bits (MB0-4, 6, 7) are held at logic zero by pulling them down through 10K resistors."

So far, I'm concluding that the "EECSUCKA II EEC ROM DUMPER revison 5.01" that I have built is not the correct design that Craig Motes was using when he wrote his QuickBasic SUCKIT.EXE program that I'm trying to use. Like I mentioned above I also had to pull down a little harder on the MB0-MB7 lines by going to 4.7K pulldown instead or the 10K. The SUCKIT program reads for the full 64K for each bank and outputs 4 separate files one per bank. I've learned a new word (Concatenate) that simply means to link or chain the HEX files together and then I get a 256K file. I found on Decipha's disassembly write up page the instructions for getting this back down to the 112KB it should be.

It helped having the real PLX3.bin file from sailorbob to understand what I was cutting out of the file to make it a good 2 Bank 112K file. I also found a shortcut that works because I'm getting 2 completely blank 64K banks filled with 00s why add those in to just have to cut them back out. Banks 1 and 8 are reading out with 00s from address 0 to $1FFF, the actual data starts and address $2000 with the identifiers that Decipha also mentions in his disassembly writeup (27,FE,0C,20 for Bank1 and FF,FA,E7 for Bank8). If you only concatenate banks 1 and 8 you first delete $0 to $1FFF then delete $E000 to $FFFF and your done the file should now end at $1BFFF. After the file is fixed up it has start with the bank 1 identifier at address $0 (27,FE,OC,20) and the Bank8 identifier FF,FA,E7 is at $E000 and the file ends at address $1BFFF.

I would still like to know what the skipping bank numbers is all about and why Ford did this if anyone know or has a theory.

Thank you
J.W.S.

Thank you guys I'll do some more checking and try that disassembler as well as compare with the BIN file from sailorbob. I think the corruption may be level matching to the MBUS because I used 74HC157 instead of 74LS157. I've seen the different EECsucka designs going back and forth between LS and HC chips. Also,inthe different designs I've studied the MB0-MB7 sometimes get pull up or sometimes pull-down resistors. I've thought some more about the Bank numbering and seeing the bank selecting BS-0 and BS-3 on the J3port I'm wondering why no BS-1 or BS-2 that seems weird. But if I think of BS-0 thru BS-4 like a 4bit binary number then BS-0 would be the 1s and BS-3 would be the 8s. All possible combinations of only these two lines being on and off would give us Banks 0,1,8, and 9. Why would Ford do this or are banks 2 thru 7 inside the RAM or ???

Thank you
J.W.S.

Thanks Decipha!

I soldered all of those wires right onto the J3 but if nobody has the PLX3 handy that is exactly what I'll do. I have BE but I'm thinking I'll have to get TunerPro RT in order to use the QH to read out a file. Not sure BE supports this?? Can BE show the HEX file, that would be nice too?

Thank you
J.W.S.

Some success maybe, having some fun either way. I'm really more interested in the GUFx EECIVs but didn't want to chance hurting one of these and so the 1995ish v6 mustang EECV PLX3 is offered as the sacrifice to the EEC GODS. This is a two bank EECV and I'm confused about the banks and read a bunch of Decipha's info here on this forum but still don't quite understand.

The hardware I've kludged up in these pictures is my best attempt of what I think was called EECsukaJR or maybe Son of EecSucka. It's using Andrew March drawing revision 5.01 titled EECSUKA II EECV. I'm using WIN98SE on an old Pentium3 1G computer with a built in parallel port (This is being done with standard LPT (not bi-directional). I'm using a program written by Craig Motes called SUCKIT.exe that reads for all four banks each getting their own output file. I would love it if anyone can help me determine if my reads are working. I'm using an old hexeditor called Hxd on the old WIN98 box and looked through the BIN files.

Bank 0 reads out all zeros from $0 to $FFFF
Bank 1 starts with zeros then at $2000 it has 27, FE, 0C, A0, E5 and other data including a bunch of $FF in blocks and $80 in block near the end.
Bank 1 also has promising looking info in the ASCII just before the weird block near the end CDAN4PX.HEX and Copyright Ford Motor Co. ends at $FFFF
Bank 8 starts with FF, 3E, 0F, 20, 03 and has other data all the way to $FFFF
Bank 9 same as bank 0 it reads out all zeros from $0 to $FFFF

The beginnings of Bank 1 and Bank 8 don't match up with what Decipha has in one of his writeups so I concerned if this is a good read????

Can anyone verify my read? Can anyone explain the reasons behind Bank numbering 0,1,8,9? Should be in a different thread I'm gettin way out in weeds here, please let me know but since this is a sub-category of Moates support, I thought maybe here is ok.

Thank you
J.W.S.

Reminder: Attached BIN files are form CDAN4 EECV calibration PLX3

I finally got a used Quarter horse, I had to buy it from a guy in Texas and send PayPal and trust him to send it. I was thinking for sure I was about to loose 250 bucks but it arrived.

So although I appreciate the offer of pictures for that I’ve now got one of those in hand.

Thank you
J.W.S.

I finally got a used Quarter horse, I had to buy it from a guy in Texas and send PayPal and trust him to send it. I was thinking for sure I was about to loose 250 bucks but it arrived.

So although I appreciate the offer of pictures for that I’ve now got one of those in hand.

Thank you
J.W.S.

wwhite,

That sounds awesome, I've been digging around the same documents, a couple githubs (one by JSA), and Internetarchieve.org. I ordered a couple J3 straight and a couple of 90-degree connectors from random evilbay places. I can wait to see what you come up. I also would like any closeup photos of Moates Jaybird front and back as well as the F2A and F2E adapters for the Moates Burn1 or Burn2.If anybody can post them here or PM them to me. The more I study this stuff the more I realize how closely we are following in the footsteps of enthusiasts from 20 plus years ago. Furthermore, I'm so impressed by Moates' design work and how compact their stuff is. I'm assuming Craig Moates was a computer nerd/motorhead/electronics PCB engineer/genius. I'm curious if this work was really all his, I'm sure he had all the same info we been digging thru but still I'm super impressed. I'm also curious how much soldering and or assembly work the Moates crew did in-house or did they have it all assembled at the PCB manufacturers?

Keep up the good A9L and other GUFX lifesaving efforts.
Thank you
J.W.S.

Both although anything I can come up with would mostly be copying Craig Moates, Andrew March, Kevin Timmermann, Tom Cloud and I'm sure a bunch of other Ford enthusiasts as well as a few unscrupulous Ford engineers. I think it may be possible to UV erase the chip in circuit and program it. There is an offset that has to be set along with the binary, but this would most likely be just a learning experience. I would much rather make a modern replacement ROM like what "xd4.1efisc" posted on page 5 in this thread. Understanding the old Eprom and more importantly the behavior between it and the CPU would help understand how the F3V2 and Jaybird work. I bought a neat little 16 channel DS logic analyzer and I'm learning how to use it still. Can you post some more pictures of the Jaybird and some shots of the back too.

Anyone who has Moates hardware within reach please send close-up pics of anything that might be useful.

Thank you
J.W.S.

xd4.1efisc

I would sure like to know more about that internal EEC4 Rom Chip you have, could you send me a bunch of close-up pictures. I would like to know more about the BURN2 custom firmware, and the Ziff socket adapter pictured in your post. I'm curious if you have the firmware as a separate file or if your special BURN2 came shipped with it already loaded? Do you solder that replacement chip into you EEC after programming it or solder in a socket or even ziff socket? I've been intrigued with the old ford EPROMs in the EEC4 for a long time and could not justify jumping down this rabbit hole to learn how it works because I though well when I get more ready, I just order up some stuff off the Moates website.


efloth/wwhite/sailorbob/ Anyone else

I've got my bread boards out and have bought a bunch of electronic junk off Ebay lately including some CPLD dev. boards as well as the JTAG programmers for them. I would also like to find someone with the adapters for the BURN2 to program the F3V2 chips as well as the adapter with that ribbon cable to read out the EPROM of the EEC4. I think those adapters are the F2A and F2E but I'm not sure. I would like to copy these as well as get PCBs made and share the Info by posting Gerber PCB files incase others want to assembly any of this.

I attached a picture that shows I'm motivated right now. Let me know your thoughts and if you have the time and desire to help me copy some Moates stuff for the relatively small group or EEC4 guys out there (maybe it's not that small). I don't think everyone is ready for Holley Sniper upgrades and the like.


Thank you
J.W.S.