uhryniuk
4debdfa518
docs/CONTEXT.md captures the entire reverse-engineering effort in one place: KWP2000 protocol, AES-128 seed/key, the map format (dc decrypt -> flat-ROM unpack -> directory -> fe table pointers), the fuel/ignition table map, the validated SAI/O2 device flags, checksums, hardware, and a per-finding confidence table. docs/ROADMAP.md covers open-sourcing (legal/IP posture on proprietary maps and the AES keys, repo hygiene, packaging/CI, community) and the technical path to tuning the bike (first contact -> ROM dump -> calibration model -> write path -> editor), with immediate next steps and a risk register. Top-level README refreshed to describe the whole project (tool + viewer + research) and point at docs/.
tunie
Open, offline tooling for the Triumph Keihin ECU (2010 Bonneville T100, 865cc, Renesas SH7054, mechanical odometer) — a from-scratch, reverse-engineered alternative to the closed TuneECU app. Read the ECU, decode and view its fuel/ignition maps, understand the device flags, and (eventually) tune it.
Independent interoperability research on hardware I own. Contains no TuneECU source — only original code and documented findings. Proprietary map binaries are never committed (see
.gitignore).
What's here
src/tunie/— a read-only KWP2000 diagnostic tool (K-Line/FTDI or Bluetooth ELM327). Cannot write to the ECU by construction;safety.pyrefuses every flash service before it hits the wire.pip install -e ., thentunie info --port …. Verified frames intests/verify_protocol.py.viewer/tunie-viewer.html— a self-contained page (no server, no deps) that drops in a real map.hex, decrypts and unpacks it, and renders the real fuel/ignition tables with RPM/throttle axes, an A→B diff, and SAI/O2 device checkboxes. Build withviewer/build_viewer.py;download_maps.py+serve.pyadd a catalogue dropdown.research/— the reverse engineering: AES-128 seed/key (keihin_seedkey.py), and the map format — decrypt, flat-ROM unpack, table map, and validated SAI/O2 flags (reference-maps/).docs/— start here for the full picture.
Read the docs
- docs/CONTEXT.md — everything reverse-engineered and built, with per-finding confidence levels. The one file to read.
- docs/ROADMAP.md — open-sourcing plan + the technical path to actually tuning the bike + next steps + risk register.
STATUS.md,viewer/FORMAT.md,research/FINDINGS.md,research/reference-maps/{README,TABLES,DEVICES}.md— deeper per-topic writeups.
Status (short version)
Software + reverse engineering are well along and validated against real map files: the protocol, the AES seed/key, the map decryption, the flat-ROM unpack, the fuel/ignition table locations, and the SAI (confirmed) / O2 (probable) device flags. Nothing has touched the real ECU yet — first contact is blocked on wiring a cable to the Triumph diagnostic connector. The write/flash path is future work (see the roadmap).
Safety
- The diagnostic tool is read-only; it can't brick the ECU.
- The real risk is electrical: confirm the Triumph connector pinout before plugging any cable in (the 2010 twins don't use a standard OBD-II socket).
- Device flags are not a tune on their own — disabling O2 forces open-loop and
needs matching fuel enrichment. Prefer flashing a complete, matching delete map
over hand-toggling a stock one. See
docs/CONTEXT.md§7.