Ghidra & WinOls Multimap Training

PLEASE BOOK YOUR FREE CONSULTATION,
so I can tailor a training for you
BEFORE PURCHASING ANY COURSE

LOCKED ECU (VOLVO, BMW, VAG...) - consider External Remap

🆕 LAST BLOG/VIDEO (10.03.25)

✨Have you ever dreamed of switching maps in Ghidra?

Ghidra trainings

Unlock your potential as a Ghidra tuner in almost no time!

Are you tired of endlessly scrolling through YouTube and TikTok videos? Well, I've got an exciting, ready-made solution just for you.

From the beginning, we'll guide you through using Ghidra correctly and enhancing it for seamless Tricore or Renesas skills.

Plus, you'll learn how to write your own code, leading to the ultimate achievement—creating your own ECU code, like mapswitching!

✨Don't let others steal your ideas—secure and encrypt them! Make sure they can't easily replicate your brilliance.

Feeling stuck without the answers? Take the initiative and write your solutions!

There's an entire ocean of possibilities waiting for you. Dive in today; you could be a leading expert in your country in just a few years.

Let's take that leap together!

✨I have been doing reverse engineering for almost 30 years (as a youngster, I was a hack for Amiga and Atari 🙂 )

I can teach in English, German (I prefer English), Russian & Polish.

However, all my videos also have subtitles in German and many other languages.

✨Choose Fundamentals Tricore training online + Ghidra ZERO if you start from the beginning.

I recommend it if you need to learn Ghidra for Tricore, Renesas, and PowerPC from the beginning.

Learning aims to make your map switch, tuning within the code rather than maps, securing tuning by assigning it to VIN, encrypting maps, launch control, etc. The imagination can be limitless. 🙂

Feel invited to check blogs, free videos and the community on my page.

Greetings and welcome!

Thomas M. Piro - reverse-engineer, inventor, academic

Flexible Courses

Ghidra, WinOls or mastering in car chiptuning only? No matter what you're doing or where you are, our online courses allow you to learn at your own pace. Any level.

Learn from experts

We've assembled the world's top instructors in car chiptuning & reverse engineering to bring you the most up-to-date content. Ghidra and WinOls are our main tools.

Ghidra & WinOls

Become an expert in Ghidra, map switching, launch control and other add-ons with our deep dive into understanding the concepts behind this advanced skill.

Online courses

Bundles

Knowledge, you can trust

The Intro course is free

We offer a free intro course packed with real-life cases for both: WinOls and Ghidra.
This helps you make sure the program is right for you.
Filter for free lessons.

Get ready

We will help you polish your existing knowledge, get rid of errors and expand it with new topics - perfect, calculated chiptuning and reverse engineering, as long as securing your maps through encryption or VIN-binding.

Soft skills that'll get you rise

There is no doubt about it - your car tuner business will flourish as you offer new solutions and develop further solutions yourself.
You can learn online or come to our academy for trainings.

Community included

If you are feeling stuck or need help with something, we have a thriving community of professionals on our discussion forums who are happy to lend a hand. You won. Always.

Frequently asked questions

What can you offer that others do not?

Simply put - we know reverse-engineering, and at the same time - we know teaching students. We have been doing this for over 25 years, using IDA Pro, Ghidra and WinOls.

Our past students are successfully running large tuning companies, or working in motorsport or with car manufacturers.

Do I need previous experience ?

There’s no need to have any prior knowledge for courses. We'll teach you from the ground up you’ll gain all the knowledge and skills you need to become a car tuner or reverse-engineer in automotive sector.

How can I choose my courses?

We offer a number of different learning paths, which you are invited to read and choose the one that better meets your needs. However if you need any advice or clarifications, we are at your disposal at any time.

Do you offer on-site training?

Yes, training can be provided at the school's headquarters in Kraków, PL, or during away sessions for students at our headquarters in Germany (Cologne) or Austria (Vienna).

Please contact the on-site training assistant: joe@thomasteachestuning.com

Chief trainers

We have a team of instructors made up of professionals from different
fields who share their knowledge to help you get started in ECU tuning & reversing.

Joe Pirowski

ECU Software Engineer

Thomas M. Piro

Head Engineer

Matt Blaine

Race Engineer, Tutor of Students

WinOls

Ghidra

We also teach at universities

Teaching students at technical universities is very important to ensure that new professionals come into the industry in the future. I also enjoy teaching as a lecturer at the universities I work with. Young people want to learn and see their future in the knowledge of WinOls/Ghidra. If you want to create a scientific cadre at the university that teaches reverse-engineering and engine control (also for electric cars) in the future, then I invite you to cooperate in research and training for university teachers.

Ghidra

WinOls

🆕 CAN vs Ghidra vs WinOls

You often ask me for one more piece missing from the whole puzzle once the map switch is prepared and everything is written. It would be to take and identify where the button press information is located. It could be the steering wheel button responsible for cruise control, the air conditioning button, or even the details on pressing the brake or accelerator pedal. You also very often ask where to get information about the car's revs or speed so that, for example, you can only switch the programme selection when the vehicle is stationary or at low revs. As is always the case with life, there are three possibilities: easy, moderately challenging, and most difficult.

Ghidra

Join and split windows in Ghidra

Repeated question over and over again: How to split windows in Ghidra and how to switch them back to the main screen of the tool (e.g. Code Browser). This short video clarifies any doubts.

Ghidra

Calls instead of jumps

Have you thought about exploring an alternative method for adding custom code to an existing program? Using the CALL instruction can be a fantastic option compared to traditional jumps! While jumping techniques often involve inserting code into the processor’s FLASH memory and carefully managing register contents, the CALL instruction streamlines this process and makes it more efficient. By utilizing the correct registers in the UPPER CONTEXT, we can avoid the hassle of manual register management, making our code cleaner and easier to work with. It's true that while we can overwrite the original CALL instruction, we should be mindful of the potential address misalignment. A simple fix is to adjust the address accordingly to keep everything on track. Additionally, it’s vital to protect the LOWER CONTEXT registers, which are essential for passing variables and feedback, as this helps maintain system stability and prevents crashes. Overall, the CALL instruction method simplifies operations significantly, and with a bit of attention to register contexts, we can ensure smooth and effective functionality in our programs. Let’s embrace this method and boost our coding adventures!

Ghidra

WinOls

Free Guidance via Zoom

Ghidra and WinOls are not just topics, but essential tools that can significantly enhance your work. If you're unsure about what to learn, these are the ones you should be focusing on. If you are starting with Ghidra, choose the Ghidra Fundamental Course. Don't let the lack of guidance hold you back. You can always take advantage of our free online meetings. These meetings are designed to help you find the right training path and clear your doubts, all from the comfort of your own space. Haven't you spoken to me online yet? I'm eagerly looking forward to our Zoom meeting. Book an appointment, and I'll be there, ready to assist you in your learning journey!

Ghidra

Tricore code protection - obfuscating

Hello, fans of chip tuning and Ghidra. Today, I'd like to discuss securing your code from the curious. Once you've written your code for map switching, launch control or any other KAN-related function, you'd probably really like it to be secure enough that it doesn't immediately find its way into the offerings of others who instead of arriving at concrete solutions, just try to copy the ideas of others. Securing your solutions is essential. I added a lesson on securing code to the introductory G-Hydra course for Tricor, and there, I presented one of the more interesting and practical ideas for ensuring your code from unwanted analysis. I'm sure you've heard the words "code obfuscating." Securing programmes written for mobiles or PCs is necessary to prevent information leakage. The same is valid here. Also, a short video introducing the idea of obfuscating code in Tricore will soon appear here. For a full version, I invite you to my Ghidra Tricore training.

Merry Christmas & Happy Coding in New Year!

Ghidra

Avoid destroying the contents of registers. Or the program will die.

If you are adding your own code in Ghidra, you will, of course, need to install a jump out from the factory programme code into your code. A common method is to override mov instructions, as they update registers with new values and these registers can be freely used in your own code (e.g. mapswitching). In this example, overwriting two movs with the ‘J My_code’ command allows us to use the d15 and a2 registers. One thing to keep in mind - we need to put the piece of original code we ‘destroyed’ at the very end of our program, so that the d15 and a2 registers regain their correct factory content. If we need more registers (in fact, we always need them), having one data register and one address register is enough to store another in RAM and rebuild their contents at the end. It is essential to remember this, reverse-engineering geeks. 😉

Ghidra

Idea for Ghidra - WinOls mapswitching addresses synchronization

If you are doing a mapswitching project in Ghidra, try to mark important addresses in the programme code or maps by creating 4-byte ‘maps’ (or the size of the area being overwritten with your code). Also mark the beginning of your code (at a minimum), or even each function individually (e.g. read_buttons, display_on_dashboard, change_address_map_TQlimit_01, etc.). In turn, mark the maps as the entire area occupied by them, including their axes and lengths (for Ghidra purposes), and a second time with the initial text ‘MAP_’ as maps for editing in WinOls. This way you won't have a mess. I have been doing this for a long time and it works perfectly.

WinOls

Can zeroing the regeneration maps damage the EV engine?

I often read on forums that disabling regen (resetting the regen current maps to coast in the chosen car mode, be it Tesla, Nissan, Kia, Taycan etc.) can lead to engine damage. The manufacturers' recommendation not to tow an EV car on wheels is cited as an additional argument. Of course, we can imagine the phenomenon of auto-induction as a result of unleashing a deactivated engine (although this too is not so obvious and depends on its design) - this also comes up as an argument. However, this is flawed thinking, as the engine can operate in coasting mode during operation if only when the gear is shifted to the ‘N’ position. Nothing bad will happen. Why? Well, because the engine is still powered and controlled because the car is on. So you can tow the car running (preferably in N mode), and you can also reset the regen current maps, because they are used when the car is running, not when it is off. Also - no fear!

Ghidra

Ghidra does not start - you need Java.

If right after installing Ghidra it doesn't want to work, then you probably don't have the JRE (Java Runtime Environment) installed and after all Ghidra is written in Java. All you need to do before running Ghidra (by running ghidrarun.bat) is to open the page: https://www.oracle.com/java/technologies/javase/jdk17-archive-downloads.html and download Java. I recommend downloading DMG Installer (Mac) or Windows Installer (MS Windows). Installing this package should solve the problem.

Ghidra

Renesas: Strange commands with an underscore sign. Watch out!

If you are working on mapswitching in Ghidra, you are probably also doing something for Japanese cars, where very often the ECU is based on a Renesas microcontroller (various models). My students make their own attempts before they start learning with me. I have noticed that the most common problem and cause of failure is not understanding the commands preceded by an underscore: ‘_nop, _add, _mov, _extu, _mulr’ etc.). Often the first attempts were made on drivers from Tricore, or others with purely sequential writing. What is above - is done first. Here, unfortunately, it is different. To speed up the processor, Renesas added the following possibility to the core - two commands can be processed at once (some), whereby if the second one is written with ‘_’, it will be executed first. So if the second one is ‘_nop’ it doesn't change anything, of course. Any other function, on the other hand, does. We have to treat it as if it were written above its predecessor. Watch out for this - it's a really common error with Renesas analysis!

WinOls

Diesel tuning? Beware of cubic milimeters!

A common mistake in calculating the correct diesel ECU maps is failing to notice that the injection timing map (alternatively - injection duration) has the engine load axis scaled not in mg/cycle, but in millilitres/cycle (cubic millimetres). Since diesel fuel's density is less than that of water, one litre of diesel fuel weighs less (0.82kg) than one litre of water (1kg). By ignoring this fact and treating millilitres as milligrams, we are making a significant error. Some tuners know this, but claim that it is not a big difference when millilitres are treated as milligrams. However, this is an illusion. The error is (100/82)*100% = about 20%. Very bad :( Such an assumption means that the tuned, modified injection will start at a lower engine load, and we haven't added air then, because the boost pressure map has the load mostly just in mg/cycle (or in Nm). To correct this, remember to check the Damos/A2L files for the load unit in the Duration map. EDC17 is mostly in millilitres, and MD1 is already in milligrams (but not all). If you notice that they are, however, millilitres (mm^3) then instead of a factor of 0.01 (as for mg) enter 0.0082 and you already have milligrams. Simple and effective. Use this and you will avoid momentary smoke when kicking the accelerator, resulting from a lack of air for the increased fuel dose. Good luck!

Enter your email for early access. Our team will get in touch with you for a personal onboarding

Thank you!

We are a Car Tuning Academy centred around the Thomas Teaches Tuning project. We will teach you how to chip-tune your cars from the basics to the master level.

We will also teach you how to reverse-engineer ECUs and add your code to them.

Find out more. Will you join?

vtechtuning.eu/powerchip

CAN PID, Ghidra & WinOls methods

Car Tuning Academy

Who we are

✨Have you ever dreamed of switching maps in Ghidra?

Flexible Courses

Learn from experts

Ghidra & WinOls

Online courses

Bundles

Knowledge, you can trust

We offer courses in WinOls, car chiptuning and reverse engineering, also for electric vehicles. 🔥Even online courses always include 2 hours of one-to-one tuition in the price. We also have an award-winning team of experts who will teach you what you need to know to be the best.

The Intro course is free

Get ready

Soft skills that'll get you rise

Community included

Frequently asked questions

What can you offer that others do not?

Do I need previous experience ?

How can I choose my courses?

Do you offer on-site training?

Get to know us

Chief trainers

Joe Pirowski

Thomas M. Piro

Matt Blaine

Blog posts

We also teach at universities

🆕 CAN vs Ghidra vs WinOls

Join and split windows in Ghidra

Calls instead of jumps

Free Guidance via Zoom

Tricore code protection - obfuscating

Merry Christmas & Happy Coding in New Year!

Avoid destroying the contents of registers. Or the program will die.

Idea for Ghidra - WinOls mapswitching addresses synchronization

Can zeroing the regeneration maps damage the EV engine?

Ghidra does not start - you need Java.

Renesas: Strange commands with an underscore sign. Watch out!

Diesel tuning? Beware of cubic milimeters!

Ready to get started?

FEATURED LINKS

WRITE TO US

Unsure where to start with Ghidra?

Crypto Accepted

We offer courses in WinOls, car chiptuning and reverse engineering, also for electric vehicles.
🔥Even online courses always include 2 hours of one-to-one tuition in the price.
We also have an award-winning team of experts who will teach you what you need to know to be the best.