Ghidra & WinOls Multimap Training

FREE CONSULTATIONS BOOKING

A word from the school's founder

🔥 Are you ready to become the ultimate chiptuner? Unlock the secrets to precisely boosting car power, creating multimaps in ECUs, and mastering WinOls and Ghidra like a pro!
Did I hit the nail on the head? If so, you’re in the right spot. Welcome to the Chiptuning Academy, where I’ve been empowering aspiring tuners for twenty years! As an authorised EVC WinOls instructor and a former software engineer for VW Racing and Kia Racing, I bring a wealth of experience to the table. Join my Car Tuning Academy today! 🔥 PS: I believe in the importance of personal interaction, which is why every online course includes 2 hours of one-to-one tuition at no extra cost.
Thomas M. Piro

🔥 If you look for on-site trainings in Europe, please contact the on-site training assistant: joe@thomasteachestuning.com

Flexible Courses

Ghidra, WinOls or mastering in car chiptuning only? No matter what you're doing or where you are, our online courses allow you to learn at your own pace. Any level.

Learn from experts

We've assembled the world's top instructors in car chiptuning & reverse engineering to bring you the most up-to-date content. Ghidra and WinOls are our main tools.

Ghidra & WinOls

Become an expert in Ghidra, map switching, launch control and other add-ons with our deep dive into understanding the concepts behind this advanced skill.

Knowledge, you can trust

The Intro course is free

We offer a free intro course packed with real-life cases for both: WinOls and Ghidra.
This helps you make sure the program is right for you.
Filter for free lessons.

Get ready

We will help you polish your existing knowledge, get rid of errors and expand it with new topics - perfect, calculated chiptuning and reverse engineering, as long as securing your maps through encryption or VIN-binding.

Soft skills that'll get you rise

There is no doubt about it - your car tuner business will flourish as you offer new solutions and develop further solutions yourself.
You can learn online or come to our academy for trainings.

Community included

If you are feeling stuck or need help with something, we have a thriving community of professionals on our discussion forums who are happy to lend a hand. You won. Always.

Chief trainers

We have a team of instructors made up of professionals from different
fields who share their knowledge to help you get started in ECU tuning & reversing.

Joe Pirowski

ECU Software Engineer

Thomas M. Piro

Head Engineer

Matt Blaine

Race Engineer, Tutor of Students

Online courses

GHIDRA BUNDLE

Ghidra Complete

All you need to be an expert in Tricore/Aurix.
Map switching, launch control, maps ciphering and protection. From zero to HERO.

Our App

Soon available.

Write your awesome label here.

Frequently asked questions

What can you offer that others do not?

Simply put - we know reverse-engineering, and at the same time - we know teaching students. We have been doing this for over 25 years, using IDA Pro, Ghidra and WinOls.

Our past students are successfully running large tuning companies, or working in motorsport or with car manufacturers.

Do I need previous experience ?

There’s no need to have any prior knowledge for courses. We'll teach you from the ground up you’ll gain all the knowledge and skills you need to become a car tuner or reverse-engineer in automotive sector.

How can I choose my courses?

We offer a number of different learning paths, which you are invited to read and choose the one that better meets your needs. However if you need any advice or clarifications, we are at your disposal at any time.

Do you offer on-site training?

Yes, training can be provided at the school's headquarters in Kraków, PL, or during away sessions for students at our headquarters in Germany (Cologne) or Austria (Vienna).

Please contact the on-site training assistant: joe@thomasteachestuning.com

Enter your email for early access. Our team will get in touch with you for a personal onboarding

Thank you!

Ghidra

Calls instead of jumps

Have you thought about exploring an alternative method for adding custom code to an existing program? Using the CALL instruction can be a fantastic option compared to traditional jumps! While jumping techniques often involve inserting code into the processor’s FLASH memory and carefully managing register contents, the CALL instruction streamlines this process and makes it more efficient. By utilizing the correct registers in the UPPER CONTEXT, we can avoid the hassle of manual register management, making our code cleaner and easier to work with. It's true that while we can overwrite the original CALL instruction, we should be mindful of the potential address misalignment. A simple fix is to adjust the address accordingly to keep everything on track. Additionally, it’s vital to protect the LOWER CONTEXT registers, which are essential for passing variables and feedback, as this helps maintain system stability and prevents crashes. Overall, the CALL instruction method simplifies operations significantly, and with a bit of attention to register contexts, we can ensure smooth and effective functionality in our programs. Let’s embrace this method and boost our coding adventures!

Ghidra

WinOls

Free Guidance via Zoom

Ghidra and WinOls are not just topics, but essential tools that can significantly enhance your work. If you're unsure about what to learn, these are the ones you should be focusing on. If you are starting with Ghidra, choose the Ghidra Fundamental Course. Don't let the lack of guidance hold you back. You can always take advantage of our free online meetings. These meetings are designed to help you find the right training path and clear your doubts, all from the comfort of your own space. Haven't you spoken to me online yet? I'm eagerly looking forward to our Zoom meeting. Book an appointment, and I'll be there, ready to assist you in your learning journey!

Ghidra

Tricore code protection - obfuscating

Hello, fans of chip tuning and Ghidra. Today, I'd like to discuss securing your code from the curious. Once you've written your code for map switching, launch control or any other KAN-related function, you'd probably really like it to be secure enough that it doesn't immediately find its way into the offerings of others who instead of arriving at concrete solutions, just try to copy the ideas of others. Securing your solutions is essential. I added a lesson on securing code to the introductory G-Hydra course for Tricor, and there, I presented one of the more interesting and practical ideas for ensuring your code from unwanted analysis. I'm sure you've heard the words "code obfuscating." Securing programmes written for mobiles or PCs is necessary to prevent information leakage. The same is valid here. Also, a short video introducing the idea of obfuscating code in Tricore will soon appear here. For a full version, I invite you to my Ghidra Tricore training.

Merry Christmas & Happy Coding in New Year!

Ghidra

Avoid destroying the contents of registers. Or the program will die.

If you are adding your own code in Ghidra, you will, of course, need to install a jump out from the factory programme code into your code. A common method is to override mov instructions, as they update registers with new values and these registers can be freely used in your own code (e.g. mapswitching). In this example, overwriting two movs with the ‘J My_code’ command allows us to use the d15 and a2 registers. One thing to keep in mind - we need to put the piece of original code we ‘destroyed’ at the very end of our program, so that the d15 and a2 registers regain their correct factory content. If we need more registers (in fact, we always need them), having one data register and one address register is enough to store another in RAM and rebuild their contents at the end. It is essential to remember this, reverse-engineering geeks. 😉

Ghidra

Idea for Ghidra - WinOls mapswitching addresses synchronization

If you are doing a mapswitching project in Ghidra, try to mark important addresses in the programme code or maps by creating 4-byte ‘maps’ (or the size of the area being overwritten with your code). Also mark the beginning of your code (at a minimum), or even each function individually (e.g. read_buttons, display_on_dashboard, change_address_map_TQlimit_01, etc.). In turn, mark the maps as the entire area occupied by them, including their axes and lengths (for Ghidra purposes), and a second time with the initial text ‘MAP_’ as maps for editing in WinOls. This way you won't have a mess. I have been doing this for a long time and it works perfectly.

WinOls

Can zeroing the regeneration maps damage the EV engine?

I often read on forums that disabling regen (resetting the regen current maps to coast in the chosen car mode, be it Tesla, Nissan, Kia, Taycan etc.) can lead to engine damage. The manufacturers' recommendation not to tow an EV car on wheels is cited as an additional argument. Of course, we can imagine the phenomenon of auto-induction as a result of unleashing a deactivated engine (although this too is not so obvious and depends on its design) - this also comes up as an argument. However, this is flawed thinking, as the engine can operate in coasting mode during operation if only when the gear is shifted to the ‘N’ position. Nothing bad will happen. Why? Well, because the engine is still powered and controlled because the car is on. So you can tow the car running (preferably in N mode), and you can also reset the regen current maps, because they are used when the car is running, not when it is off. Also - no fear!

Ghidra

Ghidra does not start - you need Java.

If right after installing Ghidra it doesn't want to work, then you probably don't have the JRE (Java Runtime Environment) installed and after all Ghidra is written in Java. All you need to do before running Ghidra (by running ghidrarun.bat) is to open the page: https://www.oracle.com/java/technologies/javase/jdk17-archive-downloads.html and download Java. I recommend downloading DMG Installer (Mac) or Windows Installer (MS Windows). Installing this package should solve the problem.

Ghidra

Renesas: Strange commands with an underscore sign. Watch out!

If you are working on mapswitching in Ghidra, you are probably also doing something for Japanese cars, where very often the ECU is based on a Renesas microcontroller (various models). My students make their own attempts before they start learning with me. I have noticed that the most common problem and cause of failure is not understanding the commands preceded by an underscore: ‘_nop, _add, _mov, _extu, _mulr’ etc.). Often the first attempts were made on drivers from Tricore, or others with purely sequential writing. What is above - is done first. Here, unfortunately, it is different. To speed up the processor, Renesas added the following possibility to the core - two commands can be processed at once (some), whereby if the second one is written with ‘_’, it will be executed first. So if the second one is ‘_nop’ it doesn't change anything, of course. Any other function, on the other hand, does. We have to treat it as if it were written above its predecessor. Watch out for this - it's a really common error with Renesas analysis!

WinOls

Diesel tuning? Beware of cubic milimeters!

A common mistake in calculating the correct diesel ECU maps is failing to notice that the injection timing map (alternatively - injection duration) has the engine load axis scaled not in mg/cycle, but in millilitres/cycle (cubic millimetres). Since diesel fuel's density is less than that of water, one litre of diesel fuel weighs less (0.82kg) than one litre of water (1kg). By ignoring this fact and treating millilitres as milligrams, we are making a significant error. Some tuners know this, but claim that it is not a big difference when millilitres are treated as milligrams. However, this is an illusion. The error is (100/82)*100% = about 20%. Very bad :( Such an assumption means that the tuned, modified injection will start at a lower engine load, and we haven't added air then, because the boost pressure map has the load mostly just in mg/cycle (or in Nm). To correct this, remember to check the Damos/A2L files for the load unit in the Duration map. EDC17 is mostly in millilitres, and MD1 is already in milligrams (but not all). If you notice that they are, however, millilitres (mm^3) then instead of a factor of 0.01 (as for mg) enter 0.0082 and you already have milligrams. Simple and effective. Use this and you will avoid momentary smoke when kicking the accelerator, resulting from a lack of air for the increased fuel dose. Good luck!

We are a Car Tuning Academy centred around the Thomas Teaches Tuning project. We will teach you how to chip-tune your cars from the basics to the master level.

We will also teach you how to reverse-engineer ECUs and add your code to them.

Find out more. Will you join?

https://calendly.com/thomasteachestuning/30min

Car Tuning Academy

Who we are

A word from the school's founder

Flexible Courses

Learn from experts

Ghidra & WinOls

Knowledge, you can trust

We offer courses in WinOls, car chiptuning and reverse engineering, also for electric vehicles.
🔥Even online courses always include 2 hours of one-to-one tuition in the price.
We also have an award-winning team of experts who will teach you what you need to know to be the best.

The Intro course is free

Get ready

Soft skills that'll get you rise

Community included

Get to know us

Chief trainers

Joe Pirowski

Thomas M. Piro

Matt Blaine

Online courses

Ghidra Complete

Our App

Frequently asked questions

What can you offer that others do not?

Do I need previous experience ?

How can I choose my courses?

Do you offer on-site training?

Ready to get started?

Calls instead of jumps

Free Guidance via Zoom

Tricore code protection - obfuscating

Merry Christmas & Happy Coding in New Year!

Avoid destroying the contents of registers. Or the program will die.

Idea for Ghidra - WinOls mapswitching addresses synchronization

Can zeroing the regeneration maps damage the EV engine?

Ghidra does not start - you need Java.

Renesas: Strange commands with an underscore sign. Watch out!

Diesel tuning? Beware of cubic milimeters!

FEATURED LINKS

WRITE TO US

Find out more. Will you join?

https://calendly.com/thomasteachestuning/30min

Car Tuning Academy

Who we are

A word from the school's founder

Flexible Courses

Learn from experts

Ghidra & WinOls

Knowledge, you can trust

We offer courses in WinOls, car chiptuning and reverse engineering, also for electric vehicles. 🔥Even online courses always include 2 hours of one-to-one tuition in the price. We also have an award-winning team of experts who will teach you what you need to know to be the best.

The Intro course is free

Get ready

Soft skills that'll get you rise

Community included

Get to know us

Chief trainers

Joe Pirowski

Thomas M. Piro

Matt Blaine

Online courses

Ghidra Complete

Our App

Frequently asked questions

What can you offer that others do not?

Do I need previous experience ?

How can I choose my courses?

Do you offer on-site training?

Ready to get started?

Calls instead of jumps

Free Guidance via Zoom

Tricore code protection - obfuscating

Merry Christmas & Happy Coding in New Year!

Avoid destroying the contents of registers. Or the program will die.

Idea for Ghidra - WinOls mapswitching addresses synchronization

Can zeroing the regeneration maps damage the EV engine?

Ghidra does not start - you need Java.

Renesas: Strange commands with an underscore sign. Watch out!

Diesel tuning? Beware of cubic milimeters!

FEATURED LINKS

WRITE TO US

Unsure where to start with Ghidra?

Crypto Accepted

We offer courses in WinOls, car chiptuning and reverse engineering, also for electric vehicles.
🔥Even online courses always include 2 hours of one-to-one tuition in the price.
We also have an award-winning team of experts who will teach you what you need to know to be the best.