panmich
HI, have you got Sigrok pulseview?
You don't need hardware to view logs, just grab the latest version, and you can view the logs attached in the zip file.
I have performed in depth Logic Analysis, for ECU Write, ECU Read, the Dealer YDT Tool ( the V1 Kline (Dash) does not support the tool), and the comms between the ECU/DASH. I have decoded the protocol and marked clearly marked in pulseview what is happening,
I used CLI to tidy up the data to convert it to useable format, which is also included. Along with simple scripts to perform various needed conversions and such.
This photo here, is all the possible ecu modes
- Normal mode
- CO
- Diag
I made a transparent bridge with 2 uarts. Which was able to pass successfully all data, (this would come in handy for the idea of separating the comms, allowing the code to boot into DIAG mode, Whilst retuning fake data to the DASH, to make sure the ER-1 does not occur dash side.
Whist being able to poll the menu in the ECU retrieving all information.
If you have a poke about on my rather messy github, you will find all of my Yamaha stuff. It does need a good tidy up for sure 
Back to your question you want, to save your time and others who may want to know this information
After IMMO/ECU happens, there is a 1280ms delay before the Dash polls the ECU
The First byte the Dash sends regardless of what mode is 0xFE, to which the ECU will always respond 0x00 0x00 0x00 0x01 0x01
Then further Dash Polls Normal mode will be 0x01
Diag will be 0xCD ( which is the user pressing both buttons on the dash)
Normal mode will be:
0x01 : RPM: VSS: ERROR: TEMP: CHECKSUM
Diag/CO mode will be
0xCD: 0x00 0x00 x00 0x01 0x01
For 7 seconds
then YDS menu will open, which in my other logs has been provided for each value
The nested menus are pretty easy to navigate, as you have already found out, the timing is critical to avoid ER1 ER2 ect
To note:
If 01 is polled, there is no further way of entering into the YDS mode, you have to reset the init
- Although you can poll the "hidden" RPM Sub menu under C0, you cannot go elsewhere,
If you're in the YDS menu, and you press your starter button, The YDS will exit, and the ecu will resume normal boot mode.
YOUR CODE must listen for the IMMO poll! (54 byte sequence starting with (0x3e).) ** Use a flag** This immo poll happens 2 times, 1st time at startup, and the second time, when you press the starter button!
Failure to monitor for this will cause your IMMO poll to fail, if you talk to the ECU whilst the immo sequence is happening.
If you need anything further, or you want to know anything, or anybody else wishes to know anything, then please reach out to me, I started off learning this with 0 clue about MCUS, or Ardruino or circuits or code. I read this post a long time ago and did see that there was no updated info for the yamaha, soo my idea was simple, to decode the protocol and publish it to help others out like yourself.
With a lot of time, study and help from @TriB I managed to get to this stage.
If your on facebook, here is my post on the XT 660 forums, there is a full tutorial on how to flash the ECU, how to change and edit the maps, you should feel right at home if you want to cure the harsh low rpm buckeroo. , its not related to Arduino here, so i have not added the guide.
Also some photos for some of the things i managed to learn along the way 
My initial idea of using the USB KKL cable before i made my circuit ( mega + Relay for the IGN switch ) over RDP 
This was my early UART bridge, with sigrok
This was my v2 PCB ( Feather S3 )
Able to Fake the ECU to control the DASH
This is the TX, RX Pads on the Dash PCB,( they are the same lines used for the Kline bus) i was going to go this route, when i decide to upgrade the LDO on the pcb
finally this is my newest PCB, there is still room for the other L9637D, but I'm undecided how to progress further as of yet, I'm still finishing my code.
Cheers
Yamaha Protocol Analysis.zip (1.3 MB)