I've been having a bit of trouble getting my head around what is happenning of the SPI bus of the Td5 ECU, so I've given in and ordered a Saleae Logic 8 channel logic analyser as a solstice present to myself.
First up on the hit list when the parcel arrives is working out the read and write protocols to the EEPROM that is used to store things like injector codes, logged fault codes and immobliser codes. Ultimately it should be possible to use this information to write a script to dump the EEPROM contents, modify the injector codes, disable the immobilser, etc.
The other task that I have lined up is sorting out the canbus communications with the Autobox. I have identified the routines which process canbus communications, but need to see what data is transmitted over the bus in normal operation. There appears to be a significant amount of configuration information related to the canbus and I'm intrested to see if any of this is sent to the Autobox ECU.
Update:
I've had a quick play with the Logic 8 and it seem to do what it says on the box. I hooked up to the signal lines to the eeprom and triggered off the first rising edge of the clock and captured a big block of reads from the EEPROM. The the first lot of read requests tallied with what I'd worked through on paper so looks good. I'll have to wade through and verify the responses are being decoded correctly.
