Tooling for the Mazda MX-5 NC (NC1/2/3), released here as binaries.
Everything is Windows, 32-bit on purpose: most J2534 drivers are 32-bit only. The builds are self-contained — no runtime, no redistributable, no extra DLLs.
This is a work in progress. The source will be published later; for now each tool ships as a binary from Releases.
| Tool | What it is |
|---|---|
| mx5rw | read and write the ECU, and deal with its password |
Read and write the ECU (PCM/ECM) of a Mazda MX-5 NC1/2/3. It contains my own implementation of the Secondary Boot Loader. It reads the ECU faster than any other tool. It can set or reset the password in the ROM, and unlock an ECU whose password is not the stock one (if you know it).
A write that does not finish can brick the ECU. Bench work first. Recovery over CAN depends on the boot blocks, which this tool never erases.
- read the ROM from the ECU, and write it back
- write a ROM image with a loader that checksums every block
- validate and correct ROM checksums
- show, change or reset the SecurityAccess password stored in the ROM
- unlock an ECU whose password is not the stock one, if you know it
- knows the MazdaEdit password, so an ECU locked with that one opens too
Windows, and a J2534 adapter. Any J2534 adapter — the vendor DLL is the only driver involved.
Download the archive from Releases and unpack it anywhere. Nothing is installed and nothing is written outside your own profile.
mx5rw.exe— the GUI, the default toolmx5rw-cli.exe— the terminal tool
The flash loader is built into both binaries; there is no separate blob to place beside them.
The first run shows the licence; you must accept it once.
Pick an adapter, open a ROM, and use the buttons. The text size and the light/dark palette follow the ones at the top of the window and in Windows.
Both front ends keep their files in %LOCALAPPDATA%\mx5rw: mx5rw.log,
mx5rw.ini, the CLI's session logs, and the CAN traces under can_dumps\.
The GUI shows the log's full path under the log pane.
Writing needs the confirmation checkbox ticked, and then a dialog that names what is about to happen; Escape backs out of it. "Read back and verify after writing" is on by default and compares the ECU against the ROM byte for byte.
mx5rw-cli read [out.bin] [--output PATH] [--device N] [--key-file PATH]
mx5rw-cli write --image rom.bin [--diff current.bin] --dry-run
mx5rw-cli write --image rom.bin [--diff current.bin] --write
mx5rw-cli write --image rom.bin --postmortem
mx5rw-cli show-key --image rom.bin
mx5rw-cli set-key --image rom.bin [--salt S | --lfsr H] --out new.bin
mx5rw-cli reset-key --image rom.bin --out new.bin
mx5rw-cli --help, mx5rw-cli help <command> and --version all work. What a
command produces goes to stdout, what it is doing goes to stderr, so
mx5rw-cli read > path.txt gives you the path and nothing else. Exit status:
0 done, 1 the command did not finish, 2 wrong usage, 3 the ECU is locked out,
4 the write stopped with the flash part-written, 130 stopped by the operator.
Pass the ECU's password with --key-file, not --key: a password on the
command line reaches the shell's history and every process list on the machine.
Ctrl-C ends a read at the end of the current block. It will not stop a write: stopping mid-erase is what leaves an ECU unable to boot.
If a write stops part-way, leave the ignition on and run --postmortem
first. It reads the record the loader leaves in ECU RAM, which a power cycle
destroys.
See LICENSE. The binaries are free to use and to pass on unchanged. The source will be published under the MIT licence later.
Issues. Quote the first line of mx5rw-cli --version, or the
file version of mx5rw.exe (right-click, Properties, Details), and attach
%LOCALAPPDATA%\mx5rw\mx5rw.log.