Classic ECU

Chirpy

I’m a Jaguar enthusiast with a particular interest in preserving and modifying the XK8/XKR cars (X100 model)

AJ27 Firmware Patching (Jaguar AJ27 specific)

5 minute read

Simple modifications to an AJ27 ECU firmware file can be made using Ghidra. Modification of target instructions or memory values can be identified, and alter...

AJ27 Reflash Tool Part 2 (Jaguar AJ27 specific)

11 minute read

This post complements the previous post on an Arduino canbus adaptor for Jaguar AJ27 ECU, and describes a Java implementation of the following processes: ...

AJ27 Reflash Tool Part 1 (Jaguar AJ27 specific)

22 minute read

As analyzed in previous posts, the Jaguar AJ27 ECU can be reflashed using Canbus commands. In order to send these commands and receive the responses, a canbu...

Analyzing reflash routines Part 4 (Jaguar AJ27 specific)

4 minute read

The previous two posts analyzed the canbus commands implemented by CPU1 TPU bootcode, and how to use them to load the 5k byte “MainBoot” program into CPU1 R...

Analyzing reflash routines Part 3 (Jaguar AJ27 specific)

6 minute read

In the last post we analyzed the behavior of the TPU bootcode for both processors, and the procedure to ‘unlock’ CPU1 phase 2 canbus commands, using a securi...