The Thread That Started It All from RS25.com

[oldhat]

Let's reverse engineer a Subaru ECU. No, really, let's do it.  

oldhat    09-11-2008 08:27 PM
Let's reverse engineer a Subaru ECU. No, really, let's do it.
 
I'm sitting here bored and waiting for spaghetti to boil, looking at a Z4 ECU out of my old WRX.

Let's figure out a way to grab all of the data/ROM off of the circuit board. Then we can see how these brains actually think and work. It will demystify a lot of the ECU voodoo for us and it will be fun. Right?

I have absolutely no idea where to start other than cracking open the case and taking pictures of the board.

Any computer or software engineers? Or someone with training/experience with electronics? Or just a really curious person? Does YesItsDrew still post here? I remember he knows circuits. Also, rob might be good with this stuff.

RS25.com = The Mother Brain. I am 100% confident that we can figure out how to do it if we put our heads together because everyone here is HELLA smart. Who's with me? Post in this thread if you're interested or just want to watch the trainwreck.

PROJECT UPDATE 9/14/08: >>>>>>>> SubieSMART.com <<<<<<<<

Please register!

offspringpunk14    09-11-2008 08:42 PM
Subscribed. I have no clue how to do any of that but ill watch the fun

Trix    09-11-2008 08:44 PM
I think member Storm might have a lot of knowledge with ECU's. I was going to have him make my 97 2.2L ECU have an increase redline but never had the chance to go through with it.

andrewarm    09-11-2008 08:50 PM
I don't know much about ecu's, but I've designed a few circuit boards, and my stepdad used to do that for a living. I'll do a little research and see what I can come up with...

joefitz    09-11-2008 08:51 PM
Count me in. Ive thought about doing some this to some degree for my RHD V5 swap. Utilizing labview seemed the quickest way that came to my mind. Check this project out:
http://vishots.com/2007/12/13/labvie...y-of-waterloo/

themattcole    09-11-2008 08:54 PM
worlds greatest thread. i know nothing about ecus so im excited to see where this goes.

oldhat    09-11-2008 08:58 PM
Quote:
Originally Posted by joefitz (Post 1460997)
Count me in. Ive thought about doing some this to some degree for my RHD V5 swap. Utilizing labview seemed the quickest way that came to my mind. Check this project out:
http://vishots.com/2007/12/13/labvie...y-of-waterloo/
Awesome, it's a guy posting a link like that within 5 minutes of starting the thread which blows me away about this place every time.

What do you know about Labview?

joefitz    09-11-2008 09:03 PM
I use it all the time for work! Its basically an engineering controls language, very quick to develop and test.

Black01scoobyrs    09-11-2008 09:05 PM
Quote:
Originally Posted by offspringpunk14 (Post 1460991)
Subscribed. I have no clue how to do any of that but ill watch the fun
^^^Yeah what he said!

oldhat    09-11-2008 09:07 PM
Quote:
Originally Posted by joefitz (Post 1461010)
I use it all the time for work! Its basically an engineering controls language, very quick to develop and test.
Interesting. Go on...

:naughty:

joefitz    09-11-2008 09:14 PM
heres another video of the waterloo project which shows their interface...http://zone.ni.com/wv/app/doc/p/id/wv-348/upvisited/y

Ill get some more information together tomorrow.

Jefff    09-11-2008 09:23 PM
i r have teh computer engineering degree...i thought about doing this a while back while i was still in school and had all the equipment....

decided against it simply because it's just not worth the time and effort you'd have to put in.....

BBBUTTTT i do have my old ecu just sitting in a box under my bed....and it would be a fun little project....

maybe when i get my car back on the road and have a little more free time i'll help out...

oldhat    09-11-2008 09:26 PM
Quote:
Originally Posted by Jefff (Post 1461024)
decided against it simply because it's just not worth the time and effort you'd have to put in.....
Dude, MOAR POWAR is always worth the time and effort.

This will go hella quickly since it's everyone working together. Like a bunch of worker bees.

defghui    09-11-2008 09:28 PM
interesting...SUBBED

Jefff    09-11-2008 09:32 PM
Quote:
Originally Posted by oldhat (Post 1461025)
Dude, MOAR POWAR is always worth the time and effort.

This will go hella quickly since it's everyone working together. Like a bunch of worker bees.

ahhaha man it's not that simple....you really cant just open it up and reproduce the circuit.....

the circuitry is just supporting the microcontroller(s) where all the magic happens....you MAY be able to pull the code off the μC but who knows....question of having the necessary equipment as well as what type of μC they used.....

im not trying to be a downer...just saying people might spend a lot of time and get nowhere

Aphex28    09-11-2008 09:34 PM
all we'd need is a ROM reader

Supers587    09-11-2008 09:36 PM
We could use this knowledge to make a Subaru Superuberpowerfulawesomelycool ECU for all the N/A Impreza owners!! +50hpz +45lbs/tq +mpgs!!!

oldhat    09-11-2008 09:39 PM
Bill from iSpeed seems to have figured it out with his 2.5RS reflash but he's not sharing his secrets (obviously). I think if he can do it, so can we.

But it's knowledge exactly like this:

Quote:
Originally Posted by Jefff (Post 1461029)
the circuitry is just supporting the microcontroller(s) where all the magic happens....you MAY be able to pull the code off the μC but who knows....question of having the necessary equipment as well as what type of μC they used.....
...that will make this project possible!

Trust me, I know this won't be easy and it won't be overnight (might take months or a year) and this will involve some l33t-level hacking but I think it's doable. It's just a circuit, it's not magic, right?

And that's the REAL ULTIMATE POWER!!!!!!!!!!!!!!!!!!!!!!!!! !!!!

http://i120.photobucket.com/albums/o...merman/rup.jpg

Jefff    09-11-2008 09:40 PM
Quote:
Originally Posted by Aphex28 (Post 1461030)
all we'd need is a ROM reader
i heard somewhere it was all surface mount in subaru ecus? must have heard wrong....
i need to do my research it seems..

but no timmmeee...must ...get...car..back...on....roa d...sick...of...taking....bus

oldhat    09-11-2008 09:44 PM
Could we somehow modify an OBD code reader? Aphex, what's a ROM reader and how do they work?

impreza2002    09-11-2008 09:47 PM
:corn:

i don't know shit about computers but i'm here if you need me .

Jefff    09-11-2008 09:50 PM
Quote:
Originally Posted by oldhat (Post 1461037)
Could we somehow modify an OBD code reader? Aphex, what's a ROM reader and how do they work?
a rom reader reads the info off the memory chips (EEPROM, EEPROM)..the maps and other things are stored there for processing by the μC...so to be able to change parameters a reader/programmer could work...however i'm not sure if thats enough to completely reverse engineer the ECU and alter it to do things like knock-retard, launch control etc (what i would want to do)....i kind of doubt it...

aspect    09-11-2008 09:50 PM
Quote:
Originally Posted by oldhat (Post 1461033)
It's just a circuit, it's not magic, right?
It's NOT just a circuit, that's the point. The circuits inside are the stuff that is irrelevent.

What Jeff is saying is that 95% of the components inside the ecu casing are just there to support the actual microcontroller, just like most of your car is designed to facilitate the engine applying force to the wheels in order to drive around.

If you dismantle and reverse engineer the car, you won't learn anything about how the inside of the engine works. If you dismantle and reverse engineer your PC, you won't learn anything about how the software stored on the hard drive works.

In the same fashion, if you dismantle an ecu, you won't learn anything about how the code works. All of the actual functions are stored in the software that the microcontroller is executing.

It is hypothetically possible to copy the code off, and then build a replica system that would actually run it, but why? It's not worth the time and effort to launch into a "from scratch" analysis of the ecu code because many people have already done the same thing to produce software like openecu (which is free).

Jefff    09-11-2008 09:50 PM
and no an obd II reader wouldn;'t help any

joefitz    09-11-2008 09:52 PM
To actually reverse engineer the ECU would mean getting dumps of the roms, learning alot about the particular assembly languages involved and recreating the programming language from that information. Quite a serious endeavor.

Another way would be more of a top down approach to try to separate and characterize every aspect that the ecu is controlling. You'd have to spend a lot of time figuring out how to reproduce signals. Im sure some are quite basic and others are quite complex. I believe this is why they talk about building a breakout box in the videos posted.

Id guess a healthy mix of both styles and a group of talented and motivated people is a good way to start.

Basic tools like an oscilloscope and vehicle to test are a must to get this started. So the real questions is should be do a normally aspirated ECU or a turbo charged ECU.

I vote turbo.

Jefff    09-11-2008 09:54 PM
Quote:
Originally Posted by aspect (Post 1461043)

It is hypothetically possible to copy the code off, and then build a replica system that would actually run it, but why? It's not worth the time and effort to launch into a "from scratch" analysis of the ecu code because many people have already done the same thing to produce software like openecu (which is free).

cause i spent 5 years in school learning the crap and dont use any of it in my job....lol....(i electrically engineer buildings :wtf:)

but exactly...no open ecu for our ecus.....so nobodies done it for us lol....maybe if im hella bored and feeling adventurous i'll take a look....lol

aspect    09-11-2008 09:56 PM
Well, you could also just build a megasquirt rig for a couple hundred bucks that is fully programmable.

I just don't see what the point is

Jefff    09-11-2008 09:58 PM
Quote:
Originally Posted by joefitz (Post 1461046)

Another way would be more of a top down approach to try to separate and characterize every aspect that the ecu is controlling. You'd have to spend a lot of time figuring out how to reproduce signals. Im sure some are quite basic and others are quite complex. I believe this is why they talk about building a breakout box in the videos posted.
this was my original idea a couple years ago....analyze I/O and use a μC (i have a bunch of 68HC12 demo boards i stole from school lol) to basicly make your own ECU.....i think fully reverse engineering the stock ecu(in terms of figuring out their software) would be quite the waste of time.....make something simple, even something that runs in parallel with the stock ecu that handled only what we wanted it to handle..most likely fuel and timing....kinda like a half-standalone....but even this would be a TON of work in itself to keep the stock ecu from shitting bricks and working properly while it was missing half it's inputs...you'd basicly have to fake the inputs....i dunno, a lot of work.....

Jefff    09-11-2008 10:01 PM
Quote:
Originally Posted by aspect (Post 1461048)
Well, you could also just build a megasquirt rig for a couple hundred bucks that is fully programmable.

I just don't see what the point is

true...but essentially thats what you are doing...making your own megasquirt from scratch....(even more scratch than megasquirt..lol)....

to be honest if i were to reverse engineer a subaru ecu i'd most likely just be doing it out of curiousity, boredom and for shits and giggles....like you said if you're looking for something to run your car then there's much easier and faster options....but theres nothing wrong with knowledge

to be honest anyone looking to do this will most likely spend a hundred hours researching on the interwebs before even cracking the ecu case...no point in re-discovering the already known.,..

oldhat    09-11-2008 10:01 PM
Quote:
Originally Posted by aspect (Post 1461043)
It's NOT just a circuit, that's the point. The circuits inside are the stuff that is irrelevent...

In the same fashion, if you dismantle an ecu, you won't learn anything about how the code works. All of the actual functions are stored in the software that the microcontroller is executing.
I see. So what you're saying is the PCB is totally irrelevant BUT if we pwn the microcontroller, we pwn the entire ECU?

Quote:
Originally Posted by aspect (Post 1461043)
It is hypothetically possible to copy the code off, and then build a replica system that would actually run it, but why? It's not worth the time and effort to launch into a "from scratch" analysis of the ecu code because many people have already done the same thing to produce software like openecu (which is free).
Well, what I was thinking is that Bill from iSpeed (posts as "skywalker" on this forum) has somehow figured out how to copy the stuff off the microcontroller, alter it and then dump it back onto the chip. And his results are impressive. Check out this thread:

http://www.rs25.com/forums/showthread.php?t=34974

He's working some kind of weird juju and making it come out real nice.

And OpenECU isn't that great, no? Why not at least try to make something better? If nothing else, we'll know a little more in the end, and knowing is half the battle.

Jefff    09-11-2008 10:03 PM
Quote:
Originally Posted by oldhat (Post 1461055)

Well, what I was thinking is that Bill from iSpeed (posts as "skywalker" on this forum) has somehow figured out how to copy the software off the microcontroller, alter it and then dump it back onto the chip. And his results are impressive. Check out this thread. He's working some kind of weird juju and making it come out real nice.
i beleive he only changes fuel and timing(not sure though)...these are most likely just arrays of values stored in the memory...he found the memory locations for these arrays and is simply altering what is in those locations....not touching the μC

oldhat    09-11-2008 10:06 PM
Quote:
Originally Posted by Jefff (Post 1461054)
to be honest anyone looking to do this will most likely spend a hundred hours researching on the interwebs before even cracking the ecu case...no point in re-discovering the already known.,..
200 hrs / 100 men = 2 man/hours



aspect    09-11-2008 10:17 PM
Quote:
Originally Posted by Jefff (Post 1461050)
this was my original idea a couple years ago....analyze I/O and use a μC (i have a bunch of 68HC12 demo boards i stole from school lol) to basicly make your own ECU.....i think fully reverse engineering the stock ecu(in terms of figuring out their software) would be quite the waste of time.....make something simple, even something that runs in parallel with the stock ecu that handled only what we wanted it to handle..most likely fuel and timing....kinda like a half-standalone....but even this would be a TON of work in itself to keep the stock ecu from shitting bricks and working properly while it was missing half it's inputs...you'd basicly have to fake the inputs....i dunno, a lot of work.....
That's what a piggyback does

1999impeza2.5RS    09-11-2008 10:26 PM
so, you would need something to extract the info off the microchip, put it into tables or graphs that people could read, make whatever adjustments, then upload it back onto the chip?

oldhat    09-11-2008 10:31 PM
Quote:
Originally Posted by 1999impeza2.5RS (Post 1461061)
so, you would need something to extract the info off the microchip, put it into tables or graphs that people could read, make whatever adjustments, then upload it back onto the chip?
I'm prolly talking out of my ass but yeah.

When I was messing around with my Power FC and reading up on Datalogit, I had this weird "AHA!" moment when I realized that all the PFC was doing was basically reading off a big spreadsheet with a bunch of columns and rows

if rpm = x
and boost = c
then injector duty cycle = y

and so on. Obviously way more complicated than that but I gather that's the gist of it.

1999impeza2.5RS    09-11-2008 10:46 PM
well I supose if you could figure that out the rest would be "easy." and that's if everything else inside the ecu is just connections and resistors.

on a side note, I always wondered why they never made a "hondata s200" type system for subarus.

Jefff    09-11-2008 11:10 PM
Quote:
Originally Posted by aspect (Post 1461059)
That's what a piggyback does

not entirely true.....something like the SAFC tricks inputs to make the ECU adjust fuel accordingly....the emanage ultimate intercepts the output of the ECU and alters the signals to the injectors, etc.....

what i would want to do would be to take fuel and timing control completely out of the hands of the ecu....so the circuitry i built would not use the ecu at all....would take input from sensors and send output directly to injectors/coils/whatever.....

like it's been said though, its not worth it.....especially since i have hydra lol...

but hey stuff like thats kind of fun..and basicly free (u can get the microcontrollers for free(samples woot)....stuff like circuit boards and random components are cheap.....so maybe one day when im trying to save money up for something(not spending any money) and have nothing to do(not like now :_sure:) i'll give it a try....

[oldhat]

oldhat    09-11-2008 11:31 PM
Guys, I popped open the box and I think I found the main microprocessor (on a Z4):

JECS (looks like the company logo)
A12-212 705
M37791E4TJ
102 502100

Plus the serial number on a sticker? F52RC0201

Based on some googlez, it looks like the A12-212 XXX chip is used in Nissans, but their last 3 digits are different than ours

http://eccs.hybridka.com/viewtopic.php?f=2&t=138

I bet we could all swarm over to this messageboard and start picking their brains.

http://eccs.hybridka.com/

There's also another chip of the same size that might work as a slave to the main one but that's a WAG (wild ass guess). Looks like a Jecs as well, based on the nomenclature printed on the chip:

A19-257 025
445101

Check this out though (warning, PDF):

http://www.calumsult.com/calumsu/dis...0interface.pdf

This is some kind of diagram from a GC8. Looks like this guy has been trying to disassemble Subie ECUs for a while. Check out this page:

http://www.calumsult.com/calumsu/disassembler/SVX/

I already grabbed all of those files for safekeeping in case this goes away.

If you go higher up in the hierarchy, you can see he's been messing around with a bunch of different brains. S14s and S13s. Looks promising? But the top domain is forbidden for some reason. I want to email this dude!

PhyrraM    09-11-2008 11:36 PM
He is what I know. It's bits and pieces for now, but tomorrow I'll try to follow up with links.

The pre-OBDII Subaru ECUs can use eproms to store the program code and the data variables. Even if the original data is stored in the microcontroller itself, most of the ECUs can have that internal (to the controller chip)data "bypassed" by plugging eproms with new data into the sockets and cutting a jumper on the circuit board to "activate" the socket.

These pre-OBDII ecus had what Subaru called a Select Monitor Port. It was basically Subaru's diagnostic port before they were standardized by OBDII. There are a few guys out there that have been able to hack the Select Monitor protocol. Vikash on Legacy Central, the VWRX guy and a team on one of the SVX boards, to name a few. The SVX team is actually working on making the JECS SVX ecu into a programmable ECU of sorts by using an emulator instead of an actual eprom.

What we need to concern ourselves with is that the SVX guys (I think) know how to get the ECU to dump it's own code to us through the Select Monitor interface. That's the first step. Once you have a copy of the code, then you can go about the process of seperating the program from the tuning data. The program then gets decompiled/reverse engineered to figure out how the ecu works and possibly change subroutines and such. The tuning data/tables, once identified, can be immediatley changed to suit engine mods.

There are a few monkey wrenches. Early cars had both Hitachi and JECS ECUs. While both have Select Monitor interfaces, there appears to be a slight difference the actual protcols. And, while I've spent some time reading up on this stuff, I have zero programming skills. So, while I'm confident that I could get the ECU to dump it's data, I wouldn't have a clue how to start digging into it.

I'd start with a google search on SSM, Select monitor, VWRX, SVX ecu project, etc. I'm sure most of the sites I've been to will be uncovered pretty fast. If we get the RS25ers with the right skills to read them, I'm sure we could make alot of progress fast. Probably be just about caught up with others.

Hope this helps. And also subscribed.

oldhat    09-11-2008 11:42 PM
Quote:
Originally Posted by PhyrraM (Post 1461105)
Hope this helps.
You kidding? :banana: Please keep coming back to this thread!

I saw a bunch of SVX stuff when I was googling, any idea why the SVX guys are so into this kind of tuning?

PhyrraM    09-11-2008 11:42 PM
Here's the SVX site. Lots of links to peruse. The EJ20G and Early Legacy ECUs are supposedly very close to the SVX ECU.

http://www.alcyone.org.uk/ssm/

PhyrraM    09-12-2008 12:01 AM
Quote:
Originally Posted by oldhat (Post 1461111)
......., any idea why the SVX guys are so into this kind of tuning?
Not really. I would guess that they are really into thier cars to the point that need engine management, but with only about 25K sold worldwide (14K in NA) the market for Link or Autonic isn't there.

It really only takes one motivated guy with the right background to get something like this off the ground. To bad that guy has an SVX instead of a V2 STI swap. Of course once it's rolling, you get more help (and alot of waiters and wanters).

PhyrraM    09-12-2008 12:05 AM
One quick link before bed. Looks like the SVX site already has a EJ20G ECU dump. Looks to be a Z4 ECU dump. Last one in the ECU list. Anybody know machine language?

http://www.alcyone.org.uk/ssm/roms/index.html

Olson    09-12-2008 12:29 AM
SO.... do the subies run an Eprom ecu?
if they do couldnt we make our own eprom chips for them like th dsm guys do??

oldhat    09-12-2008 01:21 AM
Yeah, from what little I've read, the early ECUs used EPROM but I don't know about the later ECUs. I don't see any reason why we couldn't write our own like the DSM guys.

I think we need to start by reading up on this thread and borrowing their techniques:

http://www.subaru-svx.net/forum/showthread.php?t=38685

I sent an email to Phil, the guy who started that thread because he asked on his site for anyone with a new project to get in touch with him. Hopefully he'll respond, but for now, I'm going to start reading the thread and try to make sense of it. I'm not much of a programmer so this is pretty tough to understand on the first pass. Anyone with some programming experience want to take a look?

1999impeza2.5RS    09-12-2008 01:36 AM
subielink sounds good. lol. if you could do that I would deffinatly buy one. my buddy was showing me his dsmlink on his laser. that thing was awsome. he was turning the fuel pump on and off with one click of the mouse and stuff. it looks to be a very powerful tool. I guess he was saying you can install that on any eprom ecu. I guess there were people that installed it in other cars. you might want to look at dsmlink.com and check out what info they have on there.

bugman1964    09-12-2008 03:04 AM
easy they to are in need of tuning. there isn't a whole lot of support for those sex rockets. maybe we should try teaming up with them.

Does no one make a unit for the nissan that uses the same chips and maybe we could take a look at that unit?

We also need a unit that works on the stuff from obdII times ie: the 96-01 na's

b3lha    09-12-2008 03:41 AM
Hi from the SVX team!:)

Thanks for letting me know about your project. Maybe I can point you guys in the right direction to help you get started.

The first thing you need to do is build a cable to connect your PC to the yellow 9-pin select monitor plug on your car. Using the cable and various bits of software you can read and write data from the ECU (and TCU if you have an automatic gearbox).

The car talks over a serial protocol, like the 9-pin serial port on older computers. But the voltage levels are different. For this reason you need an "RS232 to 5V TTL converter". With a more modern computer you can use a "USB to 5V TTL converter". On the end of the cable, you put a radio harness connector for a 1st gen Legacy, it's a perfect match for the Select Monitor connector.

Having built or bought a suitable cable, you can amuse yourself by running various bits of datalogging software. Have a look at www.limitless.co.nz or www.vwrx.com.

For reverse engineering, you need to learn a bit about assember language programming. You also need to learn the principles of how engine management systems work. More than anything, you need a lot of time and patience.

You will need to download the ECU ROM to a file and disassemble the machine code into assembler langauge. Use the Polaris Snowmobile software from www.rensu.net. These snowmobiles are made by Fuji Heavy Industries and they use the same type of ECU.

I'll do my best to answer any questions that you have. My website will be updated sometime in the next week or so and much of the information presented will be relevant to your project.

Phil Skuse.

offspringpunk14    09-12-2008 05:47 AM
This is kind of pointless but Ill say it anyways, I used to be into the dsm scene when i was younger. Well im only 18, but still a little bit ago. But dsmlink is an awesome program, I never had it on any of my cars but it is like stated a very powerful program and you get and eprom chips made for what mods you have like injector size and that. Its a very cool program. It would be awesome if we could get something like that!

squared away    09-12-2008 06:40 AM
There are plenty of piggyback and stand alone ECUs out there with more than enough clout to do what anyone is looking for. And much easier, might I add.

Build me a black box that will mimic the ECU and give any OBD-II reader an "ALL CLEAR" signal and allow me to pass through emissions/inspection testing without any problems, and I'll listen. Plug the black box into the OBD-II port and run whatever the hell you want underneath and program to your heart's content via 3D A/F maps, accurate datalogging and a host of other traits available with aftermarket ECUs.

The wheel rolls, why reinvent it?

Carisma    09-12-2008 06:43 AM
oldhat - Talk to member "rob". He could probably help you.

oldhat    09-12-2008 11:34 AM
Quote:
Originally Posted by squared away (Post 1461186)
The wheel rolls, why reinvent it?
Because we're nerds?

Also, like offspring said, DSMLink is powerful (I read more about it last night -- sounds basically like it turns you into a car God-- some guys were running 8s on it). Maybe we can write some software that would be even better than the standalones or reflashes on the market for free and we can get into uncharted territory as far as ECU tuning goes.

Big YES on trying to figure out how to crack the '96-'01 NA ECUs.

And thanks Phil for showing up and pointing us in the right direction. This is coming together real nicely for less than 24 hours into it. :banana:

oldhat    09-12-2008 11:53 AM
Oh my.

LOL. A very generous anonymous just sent me a very, very powerful piece of ECU tuning software that we can modify or just hack around through and steal ideas from. Heh, this is getting interesting.

Dudes, we're kinda getting right down to business here. PFC and ECUTek ain't got nothing on RS25.com. For real.

Skidd    09-12-2008 11:56 AM
The idea of working with the older Subaru Unisa/JECS ECU is not a new one
http://forums.openecu.org/viewforum....2ea288fdfdb745
But, as you can see on that board, nobody actually made any head way. The 02+ guys all have the OpenSource flashable DENSO ECUs. Nobody has yet cracked the JECS one. Or atleast, cracked and made it public.

Talking the SSM protocol to our cars (00RS) is not new either. The Tactrix OBD2 cable is a RS232->TTL converter. I've myself already written software that can monitor engine sensor values through the SSM protocol. JDash. I'm currently working on a "Lite" version that runs on mobile devices JDashLite.

However, I know nothing about using the SSM protocol to extract the ROM data. The SSM protocol is not public domain, so what we know about it, is what's been figured out by the guys at VWRX and Colby (author of ECUExplorer). I used their reference material to write JDash. The Denso guys know the correct SSM protocol procedures required to do a ROM dump, and to re-write also. Nobody seems to have figured out how to do the same on the JECS ECUs.

I tried extracting all the data from my JECS ECU byte-by-byte with the basic SSM protocol. But, at 4800baud, it was taking a REALLY long time, so I gave up. Plus, I didn't know if it was even getting me anything usefull. It seemed to repeat the byte pattern every few thousand bytes. I'm pretty sure this was not the correct way to extract the ROM image.

As for I-Speed. As I understand it, they didn't crack the JECS ECU Either. They are using a bit of commercial hardware/software from a company out of the UK that can tweak the ECU ROM. I don't believe that company even sells it any more. So, I-Speed and Yoshi have a nice corner on the JECS market. I-Speed and Yoshi did however dyno-tune cars to create maps for this software.

Regardless of what worked or failed with our ECUs... I'm game to help out where/when I can!

oldhat    09-12-2008 12:04 PM
This piece of software that anonymous just sent me is a game changer as far as this project goes, I think.

Any programmers, please PM me so I can show you what it is.

http://i120.photobucket.com/albums/o...merman/22b.jpg

Skidd    09-12-2008 12:27 PM
Here is a link to a guy what is/was working on decyphering the JECS SVX ECU. Which, "should" be compatible with our RS JECS ECU.

http://www.alcyone.org.uk/ssm/

Looking at his findings, it appears that the tedious and slow process I was using to get each byte of ROM memory might have been correct.
And although its slow, I can try again for any of you assembly code guys.

jakeachy    09-12-2008 12:35 PM
wow this thread blew up fast.

oldhat    09-12-2008 12:37 PM
Quote:
Originally Posted by Skidd (Post 1461397)
Here is a link to a guy what is/was working on decyphering the JECS SVX ECU. Which, "should" be compatible with our RS JECS ECU.

http://www.alcyone.org.uk/ssm/

Looking at his findings, it appears that the tedious and slow process I was using to get each byte of ROM memory might have been correct.
And although its slow, I can try again for any of you assembly code guys.
Yeah, I emailed him and he posted in the thread! His name is b3lha.

jakeachy    09-12-2008 12:38 PM
Quote:
Originally Posted by Skidd (Post 1461397)
Here is a link to a guy what is/was working on decyphering the JECS SVX ECU. Which, "should" be compatible with our RS JECS ECU.

http://www.alcyone.org.uk/ssm/

Looking at his findings, it appears that the tedious and slow process I was using to get each byte of ROM memory might have been correct.
And although its slow, I can try again for any of you assembly code guys.
thanks alot for that link!!!

oldhat    09-12-2008 12:42 PM
Rob's PM inbox is full, if anyone sees him, please let him know about this thread. Also, if you know anyone on the forums who might be good with programming or decompiling or assembly, please let them know, too.

MattB    09-12-2008 12:44 PM
If there is anything I can do to help this along please let me know and I will do my best.

I have a Tactrix cable and can do any extraction/experiments we need.

As of now I am not very knowledgeable when it comes to ECU's and coding but I am working on my bachelors in Computer Science so I have some basic programming knowledge. This is definitely a project I am willing to work with.

Also if we do have a breakthrough here I think we all need to agree to keep this information PUBLIC! I want to make this available to anyone and everyone if we can figure this out.

oldhat    09-12-2008 12:47 PM
Quote:
Originally Posted by MattB (Post 1461417)
If there is anything I can do to help this along please let me know and I will do my best.

I have a Tactrix cable and can do any extraction/experiments we need.

As of now I am not very knowledgeable when it comes to ECU's and coding but I am working on my bachelors in Computer Science so I have some basic programming knowledge. This is definitely a project I am willing to work with.

Also if we do have a breakthrough here I think we all need to agree to keep this information PUBLIC! I want to make this available to anyone and everyone if we can figure this out.
Agreed, this should be 100% open source, it's not fair or ethical otherwise. Matt, send me your email, I have something to show you.

Skidd    09-12-2008 12:59 PM
Dang... There just might be something too all this!!
Could it be possible? OpenSource tuning on the older gen ECU? :clap:
Anybody here speak Assembler? My brain only seems to understand Java and C. :p

MattB    09-12-2008 01:00 PM
I am with you...JAVA and C...beyond that my brain hurts.

oldhat    09-12-2008 01:09 PM
Quote:
Originally Posted by Skidd (Post 1461428)
Dang... There just might be something too all this!!
Could it be possible? OpenSource tuning on the older gen ECU?
If we do it, let's do it RIGHT. Let's make the software look pretty when you fire it up instead of some ugly field with cells to put numbers into, let's make it basically rock solid as far as stability and let's make it support EVERY Subie ECU (both JDM and USDM) flawlessly. Let's aim for as close to perfect as possible. And fully open source so we don't get sued by Fuji Heavy Industries and their Fuji Heavy Lawyers! :lol:

I think supporting every ECU is a good goal so no one is left out of the fun.

Skidd    09-12-2008 01:16 PM
The good news is, we wouldn't have to write the tuning software. Thats what RomRaider does. And it does it well too. It takes ROM files combined with a definition file specific to the ROM, and allows you to tweak the values to your needs. What's missing for the JECS ECU is an accurate map of what the ROM file contains, and the ability to both download the stock ROM, and then upload the modified map.

So.. what's needed (simple version)?
1. Retreive ECU ROM bytes.
2. Reverse engineer ROM to identify parts (RAM, ROM, IO, Interrupts, etc)
3. Reverse Engineer operation codes to find maps in ROM (fuel map, ignition map, DTCs, etc)
4. Define RomRaider definition file to allow tweaks to ROM part.
5. Upload modified ROM map to ECU

Did I miss anything?

MattB    09-12-2008 01:17 PM
It looks like this anonymous software might not be the deal breaker we hoped for.

Under Supported ECU's I found:

http://lh6.ggpht.com/ImprezaSTi01/SM...w/s800/ECU.jpg

jakeachy    09-12-2008 01:19 PM
Quote:
Originally Posted by MattB (Post 1461434)
It looks like this anonymous software might not be the deal breaker we hoped for.

Under Supported ECU's I found:

http://lh6.ggpht.com/ImprezaSTi01/SM...w/s800/ECU.jpg
exactly what i got aswell.

oldhat    09-12-2008 01:21 PM
It's not the holy grail but it's a start...we can at least see what they were doing and borrow/modify. Can anyone decompile it so we can see the guts? We might be able to figure out the architecture of the chips if we can figure out what the software calls/interrupts/pwns, etc.

A huge head start for us is Phil and the SVX guys plus the Nissan Skyline guys have been hacking their Jecs for years. I'm sure they'd love to spread their knowledge. I'll start emailing the Nismo guys and see what they have to say.

[oldhat]

MattB     09-12-2008 01:22 PM
Quote:
Originally Posted by Skidd (Post 1461397)
Here is a link to a guy what is/was working on decyphering the JECS SVX ECU. Which, "should" be compatible with our RS JECS ECU.

http://www.alcyone.org.uk/ssm/

Looking at his findings, it appears that the tedious and slow process I was using to get each byte of ROM memory might have been correct.
And although its slow, I can try again for any of you assembly code guys.
This guy has a download for "ECUDump.tar.gz"

This is exactly why I dualboot linux on my laptop :devil:

I will play with that tonight.

Skidd    09-12-2008 01:30 PM
I run Ubuntu 100% on my lappy, so I'll give that ECUDUmp a whirl also. Won't be for a while though since tomorrow is my wifes birthday, and I also have a set of BC Coilovers to install on Sunday!!
I wrote a similar utility in Java a while ago. It was painfully slow though. Hopefully it was just a bug in my code and this guys C code works faster. I don't like that he forces an ECU reset before fetching the ROM though. It takes my ECU about 2 weeks to optimize itself to my Delta cams as it is. I might disable that part of the code.

Skidd    09-12-2008 01:38 PM
Quote:
Originally Posted by MattB (Post 1461434)
It looks like this anonymous software might not be the deal breaker we hoped for.

Under Supported ECU's I found:

http://lh6.ggpht.com/ImprezaSTi01/SM...w/s800/ECU.jpg
Hopefully we can get into there and disassemble this piece of software and find the magic-bullet. That is, the correct SSM protocol sequence that will allow us to write to the ROM area. Perhaps those SVX or Nismo guys know the JECS trick. Perhaps the Write procedure is universal to all JECS ECUs. That would be way too easy?

MattB    09-12-2008 01:39 PM
Quote:
Originally Posted by Skidd (Post 1461457)
Hopefully we can get into there and disassemble this piece of software and find the magic-bullet. That is, the correct SSM protocol sequence that will allow us to write to the ROM area. Perhaps those SVX or Nismo guys know the JECS trick. Perhaps the Write procedure is universal to all JECS ECUs. That would be way too easy?
Yeah that would be WAY too obvious to work...

Is there any software that can read SVX ROMS? If so we should probably give it a go just to see what happens...

Skidd    09-12-2008 01:45 PM
Reading is not the hard part. I've done it (appears to be the same as SVX code).. Deciphering it and being able to write it back is the key!

oldhat    09-12-2008 01:48 PM
Quote:
Originally Posted by MattB (Post 1461458)
Yeah that would be WAY too obvious to work...

Is there any software that can read SVX ROMS? If so we should probably give it a go just to see what happens...
Sorry for the copy and paste but I started reading b3lha's SVX thread, I think he wrote an app and made a hardhack cable to grab the ROM. The coding/ROM dump is mostly Greek to me because I don't write code beyond very basic scripts but check this out:

http://www.subaru-svx.net/forum/showthread.php?t=38685

...and this is b3lha's site:

http://www.alcyone.org.uk/ssm/

...and this, he's another guy affiliated with the SVX guys:

http://www.calumsult.com/calumsu/disassembler/SVX/

...and this from the Nismo guys, they use same era late-80s, early-90s Jecs chips as well:

http://eccs.hybridka.com/viewforum.php?f=41

http://eccs.hybridka.com/

Also, b3lha said we can steal an app used for FHI's Polaris snowmobiles. :wtf:

"Having built or bought a suitable cable, you can amuse yourself by running various bits of datalogging software. Have a look at www.limitless.co.nz or www.vwrx.com.

"For reverse engineering, you need to learn a bit about assember language programming. You also need to learn the principles of how engine management systems work. More than anything, you need a lot of time and patience.

"You will need to download the ECU ROM to a file and disassemble the machine code into assembler langauge. Use the Polaris Snowmobile software from www.rensu.net. These snowmobiles are made by Fuji Heavy Industries and they use the same type of ECU."

:banana:

PhyrraM    09-12-2008 01:49 PM
I think supporting every ECU is a great goal, but will only slow down the project in these early days. I think picking a specific ECU type and getting a good head start on that before clouding things (and dividing effort) with other ECU types.

From what I remember any OBDII ecu has flash capabilites. I'm pretty sure it's part of the spec. What that means is that as far as hardware is concerned, you will only need an interface cable. Possibly the Tactrics cable will do it.

The pre-OBDII stuff is most likely easier to reverse engineer, but will require either an EPROM burner or an EPROM emulator, in addition to an interface cable. The interface cable for these earlier ECUs can be built much cheaper than the Tactrics cable can be bought.

I think finding a conscensus on what ECU to go after is a good next step.

oldhat    09-12-2008 01:52 PM
You're right re: slowing down the project by being too ambitious at the start. Let's start by getting a list of every Subie ECU in our cars and then we can throw a poll up and vote on which one to crack for starters. Sound good? Does anyone have a list of every Subie ECU?

Skidd    09-12-2008 01:54 PM
I think the starting points are 2 fold. One, get someone who knows Assembler to start looking into a ROM file. and two, try and find out how to reflash a JECS ECU from an OBD2 Subaru.

MattB    09-12-2008 02:01 PM
Personally I have a MY01 2.5RS...so if thats not the correct ECU to be pulling information from then I will not be much help. Unless I can somehow get my hands on whatever ECU we decide on. Then I could probably hook it up to a PS in my house and try and read it from there...

oldhat    09-12-2008 02:04 PM
What's the ECU # on your MY01 RS?

Off the top of my head:

Z4 - Mid-90s EJ20G WRX sedan (JDM)
S8 (??) - Mid-90s EJ20G WRX wagon (JDM)

Mods, can you Sticky this thread? About 18 hours later and we already have 80 replies and a ton of email and PMs flying everywhere. :clap:

MattB    09-12-2008 02:06 PM
I would have to pull out my carpet to take a look. If I get a chance I will let you know. Until then I will search the forums and try to find a complete list.

PhyrraM    09-12-2008 02:09 PM
The pre-OBDII cable can be made from a '93 Legacy radio install kit and this:
http://farm3.static.flickr.com/2325/...175c08fd39.jpg
http://farm3.static.flickr.com/2256/...9603585c26.jpg

It's only about $20 for the cable and a few more for the harness adapter.

Some ECUs have what the SVX guys call the '92 problem. Those ones might need a few dollars more in electronic parts. Something to do with voltages not reading right on some cars.

Seeing as the cost of EJ20G Power FCs (and others) is going up, my vote is to start with JECS pre-OBDII ecus. Much of the interface/protocol work has been done (by the SVX guys) and we can get started straight-away on decompiling the code and looking for the tuning tables. There seems to be a lot of EJ20G swaps still running on stock ECUs that could use a few tweaks for our gas/mods.

oldhat    09-12-2008 02:13 PM
Quote:
Originally Posted by PhyrraM (Post 1461491)
Seeing as the cost of EJ20G Power FCs (and others) is going up, my vote is to start with JECS pre-OBDII ecus
Good call. In fact, Apexi is in bankruptcy in Japan (doesn't neccessarily mean they're going out of business) and they totally discontinued the PFC for the EJ20G and EJ20K. Can't get them from the factory anymore.

MattB    09-12-2008 02:14 PM
Well I think its probably best to just have a poll and see what is the most common ECU and start there. Then work our way down on the list if we even get anywhere... Hopefully once one is cracked the rest will be simple

Jefff    09-12-2008 02:20 PM
i know assembler pretty well.....

im just way too busy to give it much time right now .....

but for you other programming guys, assembler doesn't take long to figure out at all...its VERY simple. so get on it

i've put in 60 hours so far this week at work..and im trying to get my car back together...

MattB    09-12-2008 02:22 PM
My vote goes for my car obviously :p

My thinking is guys that aren't OBDII have a much easier time passing inspection. Being OBDII I can't run any sort of standalone ECU or I will instantly FAIL!!!

oldhat    09-12-2008 02:22 PM
Quote:
Originally Posted by Jefff (Post 1461500)
but for you other programming guys, assembler doesn't take long to figure out at all...its VERY simple. so get on it
Got a link to a good site or guide book for n00bs so I can teach myself assembler? I want to learn how to, uh, do assembler.

I have no preference at all on which ECU to tackle first. Because I don't have a car at the moment. :p

Jaxx    09-12-2008 02:57 PM
Quote:
Originally Posted by MattB (Post 1461434)
It looks like this anonymous software might not be the deal breaker we hoped for.

Under Supported ECU's I found:

http://lh6.ggpht.com/ImprezaSTi01/SM...w/s800/ECU.jpg
that looks an awefull lot like the list of supported ecus under ecutek flash99

the early 205s are flash able but have supposedly have a 50%? failure rate

as said above rob started on the ej20G ecu .. maybe a year ago

FWIW the standard 97 wrx came with an S1 (which i can make available soon..pfc is on the way)

kay95    09-12-2008 03:04 PM
Good luck with assembler. You also have to read the book for the microcontroler too. You should start learning the basics of coding in assembler but will end with figuring out exactly how the MC wants its code. There is a reason why they use compilers.


If you want to find some people how know alittle about assembler get on the megasquirt forums. They could help you alot too.




Now instead a certain ecu why dont we look at the socket commonality. For instance are the Z4 and Z6 ecus the same socket? Are all the 1.8 ecus the same socket? Have we looked at how the OBD1 JECs are setup? What I mean by this is the MC and circuit layout close enough that you might be able to crack any one of these ecus and crack them all in the process.

oldhat    09-12-2008 03:05 PM
Quote:
Originally Posted by Jaxx (Post 1461536)
that looks an awefull lot like the list of supported ecus under ecutek flash99
It's not ECUTek, PM me your email and I'll show you what it is.

Quote:
Originally Posted by kay95 (Post 1461541)
Now instead a certain ecu why dont we look at the socket commonality. For instance are the Z4 and Z6 ecus the same socket? Are all the 1.8 ecus the same socket? Have we looked at how the OBD1 JECs are setup? What I mean by this is the MC and circuit layout close enough that you might be able to crack any one of these ecus and crack them all in the process.
Interesting. Can you explain a little more about the socket commonality?

Jefff    09-12-2008 03:07 PM
Quote:
Originally Posted by oldhat (Post 1461505)
Got a link to a good site or guide book for n00bs so I can teach myself assembler? I want to learn how to, uh, do assembler.

I have no preference at all on which ECU to tackle first. Because I don't have a car at the moment. :p
start by understanding the architecture of the microprocessor you are trying to program.....without understanding that assembly will be down right confusing...

http://www.laynetworks.com/assembly%20tutorials.htm

i just found that link^^....should help a bit

if you get some assembler off the ECU send it to me and i'll try to make time to comment it out...but im not promising anything....

EDIT: i havent read much of this thread so if im repeating what's already been said im sorry lol
EDIT EDIT: if you're wondering why im so busy i just got dumped this project: http://www.revelstokemountainresort..../info/own.aspx
...sorry for the OT lol

1999impeza2.5RS    09-12-2008 03:10 PM
Quote:
Originally Posted by MattB (Post 1461503)
My vote goes for my car obviously :p

My thinking is guys that aren't OBDII have a much easier time passing inspection. Being OBDII I can't run any sort of standalone ECU or I will instantly FAIL!!!
that would be my vote also. a lot more people have n/a obd-II cars (here atleast). and the thought of a standalone that will have a fully functioning obd-II port sounds awsome.

Skidd    09-12-2008 03:10 PM
The Pre OBD2 guys at least can use an SAFC with good success. we OBD2 guys are far more stuck with these picky ECUs. I vote for the MY00-01 ECU.

Dojoep    09-12-2008 03:11 PM
Quote:
Originally Posted by joefitz (Post 1460997)
Count me in. Ive thought about doing some this to some degree for my RHD V5 swap. Utilizing labview seemed the quickest way that came to my mind. Check this project out:
http://vishots.com/2007/12/13/labvie...y-of-waterloo/

nice find


subscribed also.

PhyrraM    09-12-2008 03:27 PM
Yay for sticky.

Never realized there was much tuning to do on the N/A Subies. I've got my bro's '01 RS at the house, I'll try and get board/chip shots of it before he picks it up.

I've also got an Early Legacy EG20G ECU to donate code from.

So either way we go, I can contribute something.

PhyrraM    09-12-2008 03:32 PM
Quote:
Originally Posted by Jefff (Post 1461545)
.....basically this dude didn't know how to size conduit, conductors or do an proper load calc...now all the conduit for all the services is too small..and all the conduit is in the slab/trenches...and im trying to figure out how to fix it without costing millions of dollars/my company getting sued.......
Sucks, good luck. I dealt with something like that once, but at a single industrial machine level. Something tells me that our solution of running a higher voltage and having local tranformers won't work for you. :lol:

oldhat    09-12-2008 03:35 PM
Even posting on this thread is contributing. It shows other people you're interested and keeps the enthusiasm level up. I honestly thought this idea was going to get laughed off the board but the response has been fantastic. I am stunned by the depth of experience and knowledge people have brought to the table so far, and it's not even 24 hours old yet.

I registed on subaru-svx.net and eccs.hybridka.com and told them what we're attempting to do here. Hopefully, we can get some people to maybe make their way over here and get some protips from the folks with more experience. Also posted something on Scoobynet.com because the Brits like to tinker and have more experience tuning "Classics" (what they call GCs). If you know any smart people on i-Club.com, invite 'em to take a look. I never lurk or post on i-Club so I don't know.

I think I'm with people on trying to attack the ODBII RS ECU first. Lots of people on RS25 are using those.

And thanks for the sticky and the link to the FAQ on assember. Nerd mode...

silent    09-12-2008 04:12 PM
If you guys were to use an OBDII RS ECU, I have a MY99 RS ECU I could donate to whoever wants to probe it for information. It's a leftover from my STI swap so I have no problem if someone tears it apart in order to help the project.

Also, an interesting read: http://techinfo.subaru.com/html/specialToolInfo.jsp
I'm sure these companies wouldn't divulge much information, but even talking to those involved in the creation of those products would be amazing.

mimesis    09-12-2008 04:34 PM
old hat by socket i think he means roughly the same term as computer processor sockets. They constantly upgrade sockets for better performance and lower wattage pull. However, i'm just taking a guess but i think thats what he means.

Basically if you want Old Hat PM me with exactly what you want done. I have a very close friend of the family that is an amazing mechanic that works at a subaru dealership. He's been working on subaru's for 17 years and there isn't anything he usually can't tell you about them.

So basically if you can give me a quick rundown of what you want to do. Then i will talk to him about it. Ask him whether or not his dealership/garage has diagnostic tools that will do what you ask and possibly if he can delve further into it with me as far as what does what. Maybe even let me borrow some materials they might have on the coding, etc. If in fact that do have it. Which I have no idea if they released that much information to dealerships/garages or not. But it won't hurt to ask i guess.

[oldhat]

oldhat     09-12-2008 04:57 PM
Mimesis, PM'ed you. This project by no means belongs to me or anyone else, so if you have and idea as to what you want to do with this software, by all means post it up in the thread for everyone to see.

Project update: Kochiro has very kindly donated space on his server for a project directory and database. It has a Wiki, blog and tons of room for us to make this project even more of a success. We're working on getting it up and running and making it look nice. This should speed up the workflow and help us keep track of links, files and discussion. If anyone has a cool Subie domain to point to the DB, please let Kochiro or me know!

paulmeisterpk    09-12-2008 05:03 PM
I vote on an OBDII RS ECU. That is what I think would benefit everyone on this forum the most.

silent    09-12-2008 05:04 PM
Quote:
Originally Posted by oldhat (Post 1461641)
Mimesis, PM'ed you. This project by no means belongs to me or anyone else, so if you have and idea as to what you want to do with this software, by all means post it up in the thread for everyone to see.

Project update: Kochiro has very kindly donated space on his server for a project directory and database. It has a Wiki, blog and tons of room for us to make this project even more of a success. We're working on getting it up and running and making it look nice. This should speed up the workflow and help us keep track of links, files and discussion. If anyone has a cool Subie domain to point to the DB, please let Kochiro or me know!
I have www.subie.ca but it might be too Canadian for you yankees

oldhat    09-12-2008 05:05 PM
That's a pretty nice domain! This shit is worldwide. PM Kochiro and let him know?

BTW, I rated this thread five stars because

http://i120.photobucket.com/albums/o...aru_logo_c.jpg

SIX stars wasn't an option. Criminal!

Skidd    09-12-2008 05:40 PM
You might consider a domain that's more in line with the project though. Something that speaks to it being an "Open Source" tune for older JECS ECUs. But.. that's just me babbling. Perhaps some sort of play on the JECS acronym? :wtf:

Hopefully Brydon spots this thread. That guy seems to have a good amount of tuning and subaru sensor knowledge.

As for info that we "might" be able to get from Subaru (fingers crossed). The official SSM protocol spec for the JECS ECU would RULE!! (not holding my breath). Considering Subaru uses the Denso now, it's not like they'd be giving away any trade secrets? But, if it just happened to have the spec on how to send reflashes to the ECU.. well.. jeeze... say no more!!

oldhat    09-12-2008 05:44 PM
I bet if we email the engineering department at Jecs or find an old greybeard retired Jecs engineer who maintains an EE (elec engineering) website, he'd be happy to help us out with specs, diagrams, code, etc. These guys tend to be uber dorks who LOVE to talk about legacy chips and stuff. Maybe even a professor of EE at a college or trade school? Dunno, let's look around...does anyone have access to a college library? Maybe we could dust off some old textbooks or manuals and get a better sense of what we're looking at re: Jecs chips.

EDIT: Is anyone fluent in Japanese? :naughty:

EDIT EDIT: A little background info: http://en.wikipedia.org/wiki/Japan_E...rol_System_Co..

PhyrraM    09-12-2008 06:05 PM
The older Eprom JECS ecus were also used by Nissan. (As mentioned earlier in the thread) Does anybody know if Nissan stuck with JECS during the switch to flash memory/OBDII? If so, there might be some usefull Nissan info out there also.

As an educated guess, I would say the the Select Monitor and Consult protocols are close or maybe even the same. I'll try googling a bit.

How about www.deJECS.com? The "de" meaning deconstructing or de-evolving, or something else like that?

oldhat    09-12-2008 06:10 PM
That's pretty good! Kochiro just registered subiesmart.com and is pointing it to the project site. Check it out, we were thinking of making a backronym for S.M.A.R.T.: Subaru Management And Research Tool, a tool which happens to mean MOAR POWAR. What do you think? We were also thinking of making a mascot for the project. Any artists out there got an idea?

We could register dejecs.com and keep it if we get so good at cracking the chips, we can start making software for other cars. I really like that name. We were thinking of keeping it Subie specific for now.

Kochiro    09-12-2008 06:16 PM
Hey guys just a request...please don't everyone rush to the new domain. There's literally nothing there yet, I am still in the process of installing the updated application so it's really not ready for anyone to view yet.

Thanks,

Olson    09-12-2008 07:01 PM
SUBIELINK FTW
i love dsmlink.

old hat i could send you dsm link and you could look at the program that way.
or you could search "keydriver" or "keydiver" i cant think of witch one it is. but those are the flashes dsm's use.

oldhat    09-12-2008 08:07 PM
Alright guys, it's almost 24 hours into this little debacle and we already have solid short term and long term goals for the project, well over 100 replies to this thread, a registered domain with a super pimp website, database, Wiki, blog and forum in the works as we speak, several pieces of sick software (thanks to a few guys who shall remain safely anonymous), and an unknown number of members and lurkers on at least two continents all bringing an amazing array of skills and all chomping at the bit to finally accept the last challenge in Subaru tuning: pwning the Subaru ECU.

Ask yourself: If not us, who? If not now, when?

I have tons of more stuff I want to share with you right now but I need a break and I have to go steal some friends' money at a poker game tonight. It's Friday, so crack open a beer or two and smile to yourself, knowing that you are doing something special, original and innovative. :drunk:

This is bleeding edge tuning and you're right in the middle of it. This is what it's all about!

P.S. Please log all of your links, Google searches, chats with buddies, files, anything that might be useful to this project (not matter how unimportant it may seem) as we hack our way through this jungle. With a machete. w00t.

Renegade_    09-12-2008 09:11 PM
If someone were to give me a subie ECU I have a rom reader/flasher right here that I could use... but alas no subie ECU around to butcher anymore...

k2skater    09-12-2008 09:51 PM
subscribedeee

dromango    09-12-2008 10:11 PM
big props when these ecus can be tuned open source!

I have a spare 99rs jecs ecu (automatic) i can open it up and take pictures.

mimesis    09-12-2008 10:47 PM
Some Forum links that might pertain to what we are trying to do or give a little more insight:


http://legacygt.com/forums/showthread.php?t=52937
http://forums.nasioc.com/forums/showthread.php?t=905034
http://forums.openecu.org/viewtopic.php?p=8594 <<We may want to get in touch with this Scott T. guy.
http://forums.nicoclub.com/zerothread/74077
http://forums.evolutionm.net/showthread.php?t=225783


Other possible links that may help :

http://osecuroms.org/
http://www.scoobypedia.co.uk/index.p...ledge/ECUReset

iskitlez    09-12-2008 10:49 PM
this sounds fun. good luck guys. i wish i could help

norbakkinn    09-13-2008 02:26 AM
hi, I just stumbled over a link to this thread. (My nick is NoCtrl at openecu.org)

My conclusion on reverseenginering the -99/00 JECS ECU follows :-)
Disassembling the ROM is doable. (I have written a unfinished disassembler for the M32 cpu)
You can find ROMdumps in the JECS thread at openecu.org (if not I have them)
But, after all that work of digging thru the code, what then?
After reading around a lot it seems like the my99/00 only can be reflashed a few times before they break. (less than 50)

So I have stopped working on the disassembly and Im now looking at Megasquirt. The upcoming sequencer looks like a good fit for subarus.
Some interface electronics is needed of course.
A coordinated effort here will be much more effective and help out many more people with earlier model years as well.

So, what do you think?
:-D

[oldhat]

oldhat     09-13-2008 02:39 AM
Didn't mean to reply and embarrassed that I'm looking at this thread at 2:40.

oldhat    09-13-2008 02:49 AM
Quote:
Originally Posted by norbakkinn (Post 1461893)
My conclusion on reverseenginering the -99/00 JECS ECU follows :-)
Disassembling the ROM is doable. (I have written a unfinished disassembler for the M32 cpu)
You can find ROMdumps in the JECS thread at openecu.org (if not I have them)
But, after all that work of digging thru the code, what then?
After reading around a lot it seems like the my99/00 only can be reflashed a few times before they break. (less than 50)
Make our own boxes using the PCB from the donor ECU and upgrade the chip so you can write to it without it failing. Or flash a new chip externally and cram it on the board? Dunno. All these things are are a lot of ROM and a bit of RAM. I bet the assembly is similar if not exactly the same for JECS. Maybe the Nismo guys know which chips work best. There's a surprising number of compatibilities between Nismo and Subaru.

I was reading that a huge problem with the flashing failure issue was these chips are extremely sensitive to voltage fluctuations. Maybe if we experiment with some kind of tiny UPS with clean power, we would have more success with flashing.

Oh, I was researching prices earlier. This stuff is cheap. $5 out the door.

Double post, this night is just ending in failure.

Got her ph. number though!

Olson    09-13-2008 04:11 AM
go to bed oldhat

Skidd    09-13-2008 06:20 AM
Quote:
Originally Posted by norbakkinn (Post 1461893)
After reading around a lot it seems like the my99/00 only can be reflashed a few times before they break. (less than 50)
Are you sure this is true? I remember reading that, and then also reading that it was a way over exaggeration. And that the number was closer to 10,000. Then I read other info that questioned this concept all together. Something about an electrical engineer chiming in and saying there is no such thing as a limited life span EEProm? Any truth to this <50 thing guys?

Quote:
Originally Posted by norbakkinn (Post 1461893)
So I have stopped working on the disassembly and Im now looking at Megasquirt. The upcoming sequencer looks like a good fit for subarus.
Some interface electronics is needed of course.
A coordinated effort here will be much more effective and help out many more people with earlier model years as well.
The MS has always been of interest to me also. I understand the Subaru 36-2-2-2 crank wheel is not correctly decoded also. I think the MS is a very good idea to keep an open mind about. But, still more $$$ than flashing the OEM ECU.

What might be a good option for a combo is... decipher the maps of the OEM ECU, and use these maps to generate MegaSquirt maps. That way, there would be a factory (or close) starting point for MS installs. Then, come up with a near plug-n-play MS install. Something along the lines of the old Vishnu PEMS (Parallel Engine Management System) where the MS ran along side the OEM ECU doing the engine management tasks. Leaving the factory ECU for the mundane tasks.

norbakkinn    09-13-2008 07:26 AM
Quote:
Originally Posted by Skidd (Post 1461918)
Are you sure this is true? I remember reading that, and then also reading that it was a way over exaggeration. And that the number was closer to 10,000. Then I read other info that questioned this concept all together. Something about an electrical engineer chiming in and saying there is no such thing as a limited life span EEProm? Any truth to this <50 thing guys?
No, Im not shure. Problem is; there is no other way to find out than just starting to do reflashes.
Data sheets for the M32-based chip(s) seems to have gone lost when the Mitsubishi stuff got transfered to Renesas.
Anyway, it is something to have in mind when starting to reflash.
It can be that flash99 (Ecutec?) is just do not do its things properly. Im thinking about programming voltages and timing.
Again this is getting down to documentation if the chips used.
Also, the chip in question can not be compared with the modern flash chips we have today.

Quote:
Originally Posted by Skidd (Post 1461918)
The MS has always been of interest to me also. I understand the Subaru 36-2-2-2 crank wheel is not correctly decoded also. I think the MS is a very good idea to keep an open mind about. But, still more $$$ than flashing the OEM ECU.
hm, yes I saw one of the MS-extra devlopers was asking for testers some time back. I hope this has been solved now.
yes, more cash, but also new tech in active development that open up for very interesting engine modifications.
Quote:
Originally Posted by Skidd (Post 1461918)
What might be a good option for a combo is... decipher the maps of the OEM ECU, and use these maps to generate MegaSquirt maps. That way, there would be a factory (or close) starting point for MS installs. Then, come up with a near plug-n-play MS install. Something along the lines of the old Vishnu PEMS (Parallel Engine Management System) where the MS ran along side the OEM ECU doing the engine management tasks. Leaving the factory ECU for the mundane tasks.
Interesting, are there any info on this on the net ?

oldhat    09-13-2008 07:21 PM
Quote:
Originally Posted by Olson (Post 1461902)
go to bed oldhat
LOL, can't stay away.

Follow the white rabbit...

http://i120.photobucket.com/albums/o...STi_rabbit.jpg

Discovered some interesting things, more coming soon...

Nismo guys are on board:

http://eccs.hybridka.com/viewtopic.p...f6a92c530e410f

Kochiro    09-14-2008 06:59 AM
Sorry for the delay guys, for some reason my domain registrar is taking way longer to change to my new nameservers than they usually do. It should be up in a day or less...I hope.

crispyduck    09-14-2008 07:52 AM
Signing in to monitor this interesting project. Not any help to you guys but I've been involved in a similar project for the Newage Scooby's a few years ago. A few have taken a crack at this over the years, really hope you guys can pick this up. If this continues as an 'opensource' project it would be great to add a few more ECU articles to the Scoobypedia knowledge base specifically for the Classic's (see below):

http://www.scoobypedia.co.uk/index.php/Knowledge/ECU

-Steve.

oldhat    09-14-2008 11:50 AM
Quote:
Originally Posted by crispyduck (Post 1462530)
Not any help to you guys but I've been involved in a similar project for the Newage Scooby's a few years ago.

-Steve.
LOL, you gonna talk that bullshit in this thread? Dude, if you've been working on the 2nd gen. of these things, that's epic.

Huge update coming. Talked to a professional firmware engineer last night at a party. Told me to pick up Peter Norton's assembly language primer. It's out of print but he has a copy. He was super geeking on the project, he wants in on the sandbox.

Taking this shit to the next level. Get pumped.

http://i120.photobucket.com/albums/o...ninjaparty.jpg

SilverSurfer555    09-14-2008 01:25 PM
Have PM'd you from scoobynet, not with this username though :naughty:

Kochiro    09-14-2008 02:50 PM
Ok, looks like the domain has likely been pointed for most everyone. If you still can't access www.subiesmart.com please give it up to another 24 hours.

Again, we're still populating the site with what we have already so the site is quite empty but you're welcome to sign up at this point. If you have any problems with the site or have any questions/suggestions etc...PM myself or Oldhat directly.

Thanks,

pmugabi    09-15-2008 04:45 AM
Looks to me like a lot of the work has already been done for the 1993 to 1995 Imprezas, the ones that have a socket for the 27C1024 in the ECU.

The cables at limitless.co.nz allow someone to download the ECU ROM
alcyone.org.uk has got some information on locations of timing and fuel tables
27C1024 EPROMS are available in prices ranging from $15 to $30 and there are Ebay preburnt ROMS we can use as a reference point for making our own ROMS.
After all, we don't need to be able to do antilag from day 1. We can start with changing the tables and then later on change the code (if it's actually possible).

The only deal breaker so far seems to be that the cost of a 27C1024 programmer is very high, more than $200.

Can anyone more knowledgable please post on the following:
Are there other more available chips that are compatible with the 27C1024?
Are there cheap programmers that can program this chip?
Is it possible to make a custom socket to allow the 27C1024 to be programmed in an ordinary $50 EPROM programmer?

Brydon    09-15-2008 05:25 AM
Quote:
Originally Posted by pmugabi (Post 1463191)
Looks to me like a lot of the work has already been done for the 1993 to 1995 Imprezas, the ones that have a socket for the 27C1024 in the ECU.

The cables at limitless.co.nz allow someone to download the ECU ROM
alcyone.org.uk has got some information on locations of timing and fuel tables
27C1024 EPROMS are available in prices ranging from $15 to $30 and there are Ebay preburnt ROMS we can use as a reference point for making our own ROMS.
After all, we don't need to be able to do antilag from day 1. We can start with changing the tables and then later on change the code (if it's actually possible).

The only deal breaker so far seems to be that the cost of a 27C1024 programmer is very high, more than $200.

Can anyone more knowledgable please post on the following:
Are there other more available chips that are compatible with the 27C1024?
Are there cheap programmers that can program this chip?
Is it possible to make a custom socket to allow the 27C1024 to be programmed in an ordinary $50 EPROM programmer?
Without reading the whole thread!!! What ecu's are we talking about. Most OBDII ecu's can be flashed without "socketing" the chip. Older cars have to be changed to EPROMs and then reflashed. So are we talking about 30 (A wild guess at a number) different chips we are going to redesign?

EDIT: I know nothing about electronics or there design!

bugman1964    09-15-2008 05:29 AM
my vote is for the 00-01 ecu's as thats what alot of people have a need for. I hate not being able to do anything cause of emmisions. I have no programming knowledge so I'm of little use.But I do have a spare 00 ej25 ecu for a manual car I would donate to the cause.

As far as getting no more then 50 flashes on the chip be fore It breaks if there was a common map of settings for timing and what not I think most people would only be flashing once and a while and leaving it there. The only other thing I ask is make it user friendly for those of us with little programming knowledge. the greddy emange is nice but all the fields of empty boxes is just scary. :lol:

edit: just registered at subiesmart to show some support.

pmugabi    09-15-2008 05:56 AM
Brydon,

I have read the whole thread. And it's aim is to decipher and reprogram the 93-01 ECUs. As I said the 93 to 95 ECUs all use the SAME chip (at least for a WRX), not 30 different ones. An example is the Z4 ECU that is the 'holy grail' of early WRXs. And they all have a space for the EPROM, it's just a matter of slotting in the chip.

This EPROM will not be redesigned since it exists already, it will simply be flashed and installed.

For the OBDII people that can reflash, good for them, I'm simply suggesting a strategy for earlier cars.

MattB    09-15-2008 06:35 AM
Hey guys,
Sorry I haven't responded all weekend...I am finally back. My girlfriends grandmother isn't doing so well so I spent the weekend with her/in the hospital and didn't get much time to play with the suby. This afternoon I have a break from school before I go to work so I will play around with the few programs I have in my possession that may be some help to us. I will post back with my results ASAP!

I have that program Oldhat got from a friend that didn't look like it supports our ECU. I will try to read the ECU using each protocol anyways.

Also I have the program called "ecudump.tar.gz" that I will play around with this afternoon. I don't know what it does and I am sort of a Linux noob but I will do my best...

Expect a post back around 3 or 3:30 with my results.

-Matt

Not-Ewrx    09-15-2008 06:44 AM
Quote:
Only 1999 and newer Subarus can be reflashed through the diagnostic port. But I think only Ecutek offers reflashing for the 1999-2000 turbo non-US models. And only I-SpeedUSA offers reflashing for 1999-2004 normally aspirated Imprezas.
From the question I asked here. http://forums.nasioc.com/forums/show....php?t=1585984

Skidd    09-15-2008 06:46 AM
Quote:
Originally Posted by MattB (Post 1463227)
Hey guys,
Sorry I haven't responded all weekend...I am finally back. My girlfriends grandmother isn't doing so well so I spent the weekend with her/in the hospital and didn't get much time to play with the suby. This afternoon I have a break from school before I go to work so I will play around with the few programs I have in my possession that may be some help to us. I will post back with my results ASAP!

I have that program Oldhat got from a friend that didn't look like it supports our ECU. I will try to read the ECU using each protocol anyways.

Also I have the program called "ecudump.tar.gz" that I will play around with this afternoon. I don't know what it does and I am sort of a Linux noob but I will do my best...

Expect a post back around 3 or 3:30 with my results.

-Matt

Just a warning Matt.. that ecudump program performs an ECU reset before pulling your ECU ROM values. If that doesn't matter to you, then no harm, no foul.

MattB    09-15-2008 06:47 AM
I think thats a pretty well known fact. I-SpeedUSA and some guy in Canada...

If they can do it SO CAN WE!

MattB    09-15-2008 06:48 AM
Quote:
Originally Posted by Skidd (Post 1463232)
Just a warning Matt.. that ecudump program performs an ECU reset before pulling your ECU ROM values. If that doesn't matter to you, then no harm, no foul.
Yeah thats okay... I haven't done anything special. I just raised the idle so I can always do that again after. Thanks for the heads up though.

Skidd    09-15-2008 06:51 AM
Quote:
Originally Posted by MattB (Post 1463233)
I think thats a pretty well known fact. I-SpeedUSA and some guy in Canada...
If they can do it SO CAN WE!
That would be Yoshi.

MattB    09-15-2008 08:52 AM
I am in class but I was looking through some of the coding in that ECUDump program and it seems this might take a while...

Quote:
/*-----------------------------------------------*/
/* Dump the ECU address space to file */
/* Takes over 3 hours if you dump the whole lot */
/*-----------------------------------------------*/

[oldhat]

Skidd     09-15-2008 09:28 AM
That's what I noticed when I wrote my "ecu dump" program too... a LONG to get the whole image. Sheesh!! Can't remember how long it took, but it was long. Might not be as bad as the SVX guys though, since the OBD1 SSM protocol was only 1953 baud, to our 4800 baud.

But, that was because the image was being grabbed one byte at a time. The SSM protocol has 2 different types of "read" functions. One allows you to request the data a specific memory location. The other allows you to read a block of ECU memory. The difference is that the first one requires you to send a request one-by-one. This adds a TON of overhead to the 4800baud data pipe.

Reading a single byte memory location rquires sending 10 bytes to the ECU. This includes various header and checksum bytes. Then the ECU responds with 7 bytes. That's 17 bytes to get one byte. This is the method used by that ECU dump program. One by one retreival.

The SSM protocol also has a method to request a 128byte chunk of memory. Meaning, you can ask the ECU to send the 128bytes of data starting at memory location 0x00aabb in a single request. Then, it's a matter of reading the data as it's streamed back from the ECU. I had started writing this procedure to dump my ECU, but never finished it. In theory, the 64K of data could be read back in far less time (in theory). Perhaps I should get off my butt, and finish this dump program. Could prove to be usefull to us. OH yeah, I wrote it in Java too, so you windows users would be able to use it too.

Kochiro    09-15-2008 09:53 AM
Skidd, can you post your resources about the SSM Protocol and the other aspects of baud rate, transferring data and ecu specifics that you mentioned in your last post?

Also, it would be helpful if you guys could register over at subiesmart.com (if you haven't already) and continue this thread on the forums there.

Thanks,

b3lha    09-15-2008 09:53 AM
Wow. This thread moves fast. You guys sure are enthusiastic. :eek:

FYI. I've just updated the SVX ECU website http://www.alcyone.org.uk/ssm and a lot of the stuff there is relevant to this project.

You certainly need to identify which ECU you are talking about because there is a bit of confusion already.

There are probably only four or five different hardware platforms (based on age of manufacture) but lots of different firmware versions that run on them. Even the SVX has at least 6 different firmware versions and they only made 25000 of them.

The hardware platforms can be categorised as:
1) Old stuff, pre 1990 (?) - 1st Gen Legacy etc.
2) JECS with an EPROM Socket (OBD1) - SVX, Impreza Classic, Legacy etc.
3) JECS flashable (OBD2)
4) Denso (OBD2)

Phil.

Skidd    09-15-2008 10:52 AM
I'm pretty sure that this project is going to focus first on the #3 JECS OBD2 ECU. The Denso guys are already taken care of, and the OBD1 guys have much better success with piggy backs than the OBD2 guys. Basically, the JECS/OBD2 is the most limited one of them all. And thus, the one that stands to gain the most.

P.S. Some additional usefull info
http://www.codeplex.com/ssm

Oh yeah.. my SSM resources are my JDash project, ECUExplorer's source code, and the SSM protocol PDF that is floating around the internet.
Try here for a short list of reference material
http://jdash.ludicrous-speed.com/wik...hp?title=Links

MattB    09-15-2008 12:03 PM
I think I need to find some linux drivers for my Tactrix cable. Skidd do you have more info on that? How do I run this file "ecudump.c"

Thats the file that seems to have the code for dumping the ECU data. If this is gonna take a long time I might just lock it in my car overnight with the car in the ON position and hope my laptop doesn't die before the data is dumped...or run an extension cord.

Correct me if I am wrong here -

gcc ecudump.c

that will create a a.out file and i can run that file?

So I have to compile it first?

Skidd    09-15-2008 12:14 PM
Uh.. don't do it! Unless your just kidding. If you leave your car on, but not running, you'll fry your coil. (I suppose you could just unplug it). But, at 4800 baud, it should take under 2 hours to do. (Should)

You don't need Tactrix drivers for Linux. The tactrix cable uses the FTDI USB/Serial chip. The drivers for that are build into the Linux kernel. It will be detected when you plug in the cable. Depending on your distro of course. Then, you should see a new serial device in /dev Likely named /dev/ttyUSB0

As for the ecudump.c file, you'll see that the serial port is hardcoded as "/dev/ttyS0" So, you're going to have to modify the code to meet your serial device needs.

You're welcome to give that "dump" program a whirl. If you can stand the wait. I should get a chance to hack together a version of the dump program that will run in Java and use the 128byte block fetch method. I suppose it's just a matter of "when" I'll get a free minute to do it. I have a lot on my plate. But... I'm also pretty sure that someone has already pulled a 00/01 ECU ROM image. I'm sure I read a post in the RomRaider forums about this. So, there really is no need to jump on it yet.

P.S. I am also sure I read somewhere that some versions of the Subaru ECU had limits to the memory range that the SSM protocol was allowed to read. It's quite possible that our JECS ECUs have this limit.

Skidd    09-15-2008 12:17 PM
There is one HUGE show stopper in this whole thing though. Without the ability to "reflash" the JECS ecu, then none of this matters. Sure, we can extract the ROM image, decode it, make sense of it, define a RomRaider def file, tweak the maps... but... then what? It's all useless without the ability to write it back to the ECU. This entire endeavor is hinged on that single ability. Once/If that can be solved, then we'll be on track.

MattB    09-15-2008 12:17 PM
Yeah I guess it really isn't worth waiting that long to get the dump.

Fry my coil? Hmmm...never knew that. You learn something new every day. Reasoning?

I wish I was better with Java and C and I would work on putting that block fetch together...but I am a programming NOOB!

MattB    09-15-2008 12:18 PM
Quote:
Originally Posted by Skidd (Post 1463462)
There is one HUGE show stopper in this whole thing though. Without the ability to "reflash" the JECS ecu, then none of this matters. Sure, we can extract the ROM image, decode it, make sense of it, define a RomRaider def file, tweak the maps... but... then what? It's all useless without the ability to write it back to the ECU. This entire endeavor is hinged on that single ability. Once/If that can be solved, then we'll be on track.
Worst comes to worst I will have a sweet map......












.....on my laptop

jakeachy    09-15-2008 12:23 PM
Dsm eprom?
 
For my svx ecu, what if i were to send it to a dsm shop and get it socketed? Maybe the parameters are the same and I could use DSMlink or something?

MattB    09-15-2008 12:27 PM
might be worth a shot...

Skidd    09-15-2008 12:31 PM
What year SVX ECU? >96< OBD1 SVX will not help us, Prior to OBD2, the SSM protocol had different memory address for different ROM versions, etc, etc. That's the issue the OBD1 guys have to deal with. "SVX Owner: Can I log my ECU with SSM?.. Answer: depends.. what ECU ROM version you running?". And, since you are planning to have a socket put in, this tells me your likely dealing with a OBD1 SVX.

P.S. jakeachy, lovin' your sig. " We hired you boys to lay some track.. not dance around like a bunch-o...... :p "

oldhat    09-15-2008 12:39 PM
Definitely try it, MattB. You might find out something real interesting.

This thread is getting really unwieldy. Please register on SubieSMART.com and start poking around. Let's start migrating the discussion to over there. We can get multiple threads going on for architecture, disassembly, other ECUs, ideas, general bullshitting. Make suggestions if you think something is missing. Really excited about all of this, y'all are a bunch of HEROES to me. :clap:

MattB    09-15-2008 12:45 PM
I was just told that I have a PROM burner at my work that I can use whenever I want. Does anyone have an ECU I could take apart and experiment with?

I can desolder the chip from the ECU and dump the data that way. Then I can load it back up to the chip and resolder it back in. If it works out I can try and find a socket for the chip and just remove chips, put sockets in and be able to flash them that way for people...

oldhat    09-15-2008 12:48 PM
Quote:
Originally Posted by Skidd (Post 1463462)
There is one HUGE show stopper in this whole thing though. Without the ability to "reflash" the JECS ecu, then none of this matters. Sure, we can extract the ROM image, decode it, make sense of it, define a RomRaider def file, tweak the maps... but... then what? It's all useless without the ability to write it back to the ECU. This entire endeavor is hinged on that single ability. Once/If that can be solved, then we'll be on track.
From what I have read, they are reflashable but they are VERY prone to failure. 50% fail rate and you can only flash them a few times.

I think we should research other types of JECS chips and see if there are more reliable models or a better way to flash them. Apparently, a big issue is these chips are sensitive to voltage fluctuations. Maybe if we look into providing clean power through an UPS when reflashing, it might make them more reliable/stable. Looking into that.

>>>>>>>> SubieSMART.com <<<<<<<<

jakeachy    09-15-2008 12:50 PM
Quote:
Originally Posted by Skidd (Post 1463471)
What year SVX ECU? >96< OBD1 SVX will not help us, Prior to OBD2, the SSM protocol had different memory address for different ROM versions, etc, etc. That's the issue the OBD1 guys have to deal with. "SVX Owner: Can I log my ECU with SSM?.. Answer: depends.. what ECU ROM version you running?". And, since you are planning to have a socket put in, this tells me your likely dealing with a OBD1 SVX.

P.S. jakeachy, lovin' your sig. " We hired you boys to lay some track.. not dance around like a bunch-o...... :p "
its a 92.
" The camptown ladies? Hmm..."

"Uh, sir, excuse me sir, he requested a couple of N*****s. Well to tell a family secret my mother was a Dutch."

oldhat    09-15-2008 01:08 PM
"What about the women and children?"

"Awwww, we rapes the shit out of them!"

EDIT: For those who don't know, we're suddenly doing Blazing Saddles quotes for some reason.

jakeachy    09-15-2008 01:10 PM
I can get a first and a third gen leggy ecu(s)

orthomong    09-15-2008 01:35 PM
OBDII Jecs ECUs
 
If you want to get the roms off of the OBD-II ecus. (2.5 rs)

You should use the SM2 protocol to read it out.

Just add 0x700000 to the address that you are trying to read from the ROM to get the actual contents.

PM me if you need more info or you get this working.

Also flashing these ECUs is unreliable but doable. I can fix toasted 2.5rs ecus (most of the time) if they get messed up during a flash if you cover shipping.

-
John

Skidd    09-15-2008 01:44 PM
SM2 protocol? I wouldn't mind more info on this. All the stuff I've done with SM, and I didn't even know there was an SM2?

mxpunk    09-15-2008 02:20 PM
someone should crack an L's ecu

ckcadavona    09-15-2008 02:40 PM
I'm not sure if this helps but...

http://www.moates.net/

1999impeza2.5RS    09-15-2008 02:40 PM
Quote:
Originally Posted by MattB (Post 1463480)
I was just told that I have a PROM burner at my work that I can use whenever I want. Does anyone have an ECU I could take apart and experiment with?

I can desolder the chip from the ECU and dump the data that way. Then I can load it back up to the chip and resolder it back in. If it works out I can try and find a socket for the chip and just remove chips, put sockets in and be able to flash them that way for people...
i wonder what would happen if you desolder the chip in the 98-01 rs ecu and resolder in a wrx chip? you would be able to flash till your hearts content. i wonder if theres a way to test how it functions without blowing up a motor in the process?

oldhat    09-15-2008 03:08 PM
Wow, I haven't been to moates.net in forever. LOL

orthomong    09-15-2008 03:20 PM
Select Monitor 2 Protocol
 
http://ecuexplorer.googlecode.com/files/ssm.pdf

rob    09-15-2008 03:26 PM
I can add a few tidbits since I have been playing with the EJ20G ECUs for a year or so now.

1) Using the SSM protocol, it is possible extract the entire ECU ROM image through the OBD1 port. Thanks to Phil for the linux dump tool. Phil posted the Z4 image that I sent him on his website, so anyone who wishes to start reversing the code, can start with that. Reading through his SVX code comments can help.

2) These ECUs are not reflashable.

3) It is possible to add an Eprom with alternate maps. The downside is that Subaru used a rare chip for this, and they are hard to find and harder to find a burner for. There are ways around this, but they require a daughter board. Several DIY efforts and official tuners have provided chips over the years (just not in the US). I burn my own Eproms and have sold a couple of OTS tunes to members.

4) I am working my own project to make these ECU reflashable. It will be an add-in board into the Eprom socket and I am designing it to work with open source SW tools. I am in the prototype phase, I expect it to take a few months before anything is available. I don't have any more details to share.

-Rob

Skidd    09-15-2008 03:31 PM
Quote:
Originally Posted by orthomong (Post 1463593)
http://ecuexplorer.googlecode.com/files/ssm.pdf

Ah... That's the SSM document I based my stuff on to begin with. I guess I was dealing with SSM2 all along, I just didn't know it. Can you elaborate on the 0x700000 address location? Is that the memory location of...?? what??

orthomong    09-15-2008 03:48 PM
Quote:
Originally Posted by Skidd (Post 1463600)
Ah... That's the SSM document I based my stuff on to begin with. I guess I was dealing with SSM2 all along, I just didn't know it. Can you elaborate on the 0x700000 address location? Is that the memory location of...?? what??
The software in the ECU blocks access to major areas of the ROM (namely the firmware) They don't however block the higher addresses. If you try and read memory above 0x700000 the cpu ignores the high address bits and returns the rom.

Read memory from 0x700000 to 0x740000

Skidd    09-15-2008 07:20 PM
I follow you, but let me get this straight.

Requesting address 0x700001 will result in returning what in address 0x000001?
Is that a special function of the 0x7? Or just that the ECU ignores that first octet? does 0x06000001 work the same way? Does that mean the there is infact only 0xFFFFF addressable memory locations? Or is your example of 0x040000 an indication that the ECU only has 262K of memory? Hence the value 0x700000 to 0x740000 in your post. So, 0x000010 is the location for the vehicles current KPH. Thus 0x070010 return the same value?

Pardon my repetitive post, I'm just trying to be absolutely sure I understand what your saying.

How did you come to know this info? do you happen to know if these values are JECS specific? Or does it hold true in the Denso models also?

orthomong    09-15-2008 11:04 PM
You're pretty much all correct here although I'm not sure about the 0x0600001 thing. I used 7 in my code and it's been a long time since I wrote it or messed with the RS ecu. I honestly don't _think_ it will work on the Denso ECUs but I'd have to go back and try it to be sure. I had to use a much more complicated method to dump those.

0x000010 is not the same as 0x700010. 0x000010 is mapped to RAM via a table lookup. 0x700010 will return the actual ROM at location 0x10 (which is not RAM)


Quote:
Originally Posted by Skidd (Post 1463783)
I follow you, but let me get this straight.

Requesting address 0x700001 will result in returning what in address 0x000001?
Is that a special function of the 0x7? Or just that the ECU ignores that first octet? does 0x06000001 work the same way? Does that mean the there is infact only 0xFFFFF addressable memory locations? Or is your example of 0x040000 an indication that the ECU only has 262K of memory? Hence the value 0x700000 to 0x740000 in your post. So, 0x000010 is the location for the vehicles current KPH. Thus 0x070010 return the same value?

Pardon my repetitive post, I'm just trying to be absolutely sure I understand what your saying.

How did you come to know this info? do you happen to know if these values are JECS specific? Or does it hold true in the Denso models also?

b3lha    09-15-2008 11:18 PM
Quote:
Originally Posted by MattB (Post 1463439)
I think I need to find some linux drivers for my Tactrix cable.
I'm not familiar with the Tactrix cable. If it is a serial port cable it should just work. If it is a USB to TTL cable then with any luck linux will have a built in driver for the chipset it uses. The FTDI based cables work just fine.
Quote:
Originally Posted by MattB (Post 1463439)
How do I run this file "ecudump.c"
Correct me if I am wrong here -
gcc ecudump.c
that will create a a.out file and i can run that file?
So I have to compile it first?
Yes. That's correct.
gcc -o ssm.o -c ssm.c
gcc -o ecudump ecudump.c ssm.o

But the easiest way is to type "make". The make program will follow the instructions in the "Makefile" to compile the program.

Older ECUs don't support the SM2 block dumping functions that Skidd is talking about. You have to read them 1 byte at a time and it does take a while at 1953 baud. You won't fry the coil. I've dumped my 96 Legacy 2.2 ECU without any problems.

Quote:
Originally Posted by MattB (Post 1463439)
Yeah I guess it really isn't worth waiting that long to get the dump.
LOL. Seriously, 3 hours to get the dump is nothing compared to the hours you are going to spend sitting in front of your PC figuring out what the assember code does. Nobody ever reverse engineered an ECU in an afternoon.

Phil.

[oldhat]

Kaymin     09-16-2008 01:22 AM
Quote:
Originally Posted by rob (Post 1463598)
I can add a few tidbits since I have been playing with the EJ20G ECUs for a year or so now.

1) Using the SSM protocol, it is possible extract the entire ECU ROM image through the OBD1 port. Thanks to Phil for the linux dump tool. Phil posted the Z4 image that I sent him on his website, so anyone who wishes to start reversing the code, can start with that. Reading through his SVX code comments can help.

2) These ECUs are not reflashable.

3) It is possible to add an Eprom with alternate maps. The downside is that Subaru used a rare chip for this, and they are hard to find and harder to find a burner for. There are ways around this, but they require a daughter board. Several DIY efforts and official tuners have provided chips over the years (just not in the US). I burn my own Eproms and have sold a couple of OTS tunes to members.

4) I am working my own project to make these ECU reflashable. It will be an add-in board into the Eprom socket and I am designing it to work with open source SW tools. I am in the prototype phase, I expect it to take a few months before anything is available. I don't have any more details to share.

-Rob
http://engr.smu.edu/~kaytaz/77.gif
I love this guy....


No homo, of course.

bugman1964    09-16-2008 03:03 AM
just to toss this out there and wether or not it would work is a different matter but. I was watching an episode of trucks last night and they were working on a first gen lightining that they added a turbo kit onto. to run EM The created a piggy back board that connected between the wiring harness and the ecu that looked to only have 1 flashable chip on it. They didnt really state how the chip worked or what exactly it did but they removed the board and hooked it up to a laptop to tune it each time. Dont know if thats of any use to any one.

MattB    09-16-2008 07:00 AM
Quote:
Originally Posted by b3lha (Post 1463971)
LOL. Seriously, 3 hours to get the dump is nothing compared to the hours you are going to spend sitting in front of your PC figuring out what the assember code does. Nobody ever reverse engineered an ECU in an afternoon.

Phil.
I didn't mean it as "not worth it" I meant if there is a way we can dump it using the 128byte dump then I will just wait until we get that compiled and do it that way. If not I will gladly let my car sit idling in my driveway for 3 hours while it dumps...

EDIT - just read that part about not supporting block dumping...guess I will get to dumping it...

rob    09-16-2008 07:58 AM
Quote:
Originally Posted by MattB (Post 1464104)
I didn't mean it as "not worth it" I meant if there is a way we can dump it using the 128byte dump then I will just wait until we get that compiled and do it that way. If not I will gladly let my car sit idling in my driveway for 3 hours while it dumps...

EDIT - just read that part about not supporting block dumping...guess I will get to dumping it...
You can grab the Z4 image from Phils page, no need to go through the pain yourself. That is, unless you want to have fun building the cable and waiting for the dump.

A couple of tips;

-The car doesn't have to be running, just ignition switch turned on. I would recommend throwing on a trickle charger.

-You can save a little bit of time by starting at address 0x8000 instead of 0x000

-If you don't have a dedicated Linux laptop, you can try MSFTs Virtual PC and setup a virtual machine with Linux installed on it. I'm not sure if the serial port control will work as expected, but it would be fun to try

-Rob

rob    09-16-2008 07:59 AM
Quote:
Originally Posted by Kaymin (Post 1464009)
http://engr.smu.edu/~kaytaz/77.gif
I love this guy....


No homo, of course.

:run:










MattB    09-16-2008 09:12 AM
Quote:
Originally Posted by rob (Post 1464130)
You can grab the Z4 image from Phils page, no need to go through the pain yourself. That is, unless you want to have fun building the cable and waiting for the dump.

A couple of tips;

-The car doesn't have to be running, just ignition switch turned on. I would recommend throwing on a trickle charger.

-You can save a little bit of time by starting at address 0x8000 instead of 0x000

-If you don't have a dedicated Linux laptop, you can try MSFTs Virtual PC and setup a virtual machine with Linux installed on it. I'm not sure if the serial port control will work as expected, but it would be fun to try

-Rob
Good Idea on the trickle charger. I actually have one so I will use it. I am gonna unplug my coil just to be safe because now im paranoid. Also I do have a dedicated Linux laptop cause it runs so much better on my laptop...

mxpunk    09-16-2008 09:32 AM
"nico turbine" on legacy central has a chipped ej22t ecu..but his is very weird and rare..no other ej22ts are chippable except for his. his isnt even jdm either, its USDM too (or whatever canada gets)

it will be nice if someone does crack it but its unlikely, theres not really alot of call for flashing these old cars. just a few and far in between

its too bad in a way that subarus arent as popular as hondas cause we would have alot more opt's

MattB    09-16-2008 01:54 PM
Quote:
Originally Posted by mxpunk (Post 1464195)
if it has wheels or tits, it's a problem
just a correction on your quote... or sig or whatever. It goes like this:

If it has TITS or TIRES, its trouble.

PhyrraM    09-16-2008 02:01 PM
Quote:
Originally Posted by mxpunk (Post 1464195)
"nico turbine" on legacy central has a chipped ej22t ecu..but his is very weird and rare..no other ej22ts are chippable except for his. his isnt even jdm either, its USDM too (or whatever canada gets)

it will be nice if someone does crack it but its unlikely, theres not really alot of call for flashing these old cars. just a few and far in between

its too bad in a way that subarus arent as popular as hondas cause we would have alot more opt's

The Ej22t ecu is Hitachi, not JECS (nor Denso). While it follows the basic SSM protocol, it's very unlikely that any of the code or table locations is applicable to the EJ20G JECS ECUs. I've only had two EJ22t ecus apart, but both had sockets for EPROMs. They were a very wide pattern though. Basically a strip on each side of the factory PROM. It appears that they take some sort of adapter to place a new EPROM above the original one.

If I'm not mistaken, I believe Nico has one that actually had an EPROM installed. I'm not sure if he was ever able to discover if it was a dealer item (ie. software update) or an actual aftermarket chip.

I can post pics of mine if anybody is interested.

mxpunk    09-16-2008 02:33 PM
Quote:
Originally Posted by PhyrraM (Post 1464407)
The Ej22t ecu is Hitachi, not JECS (nor Denso). While it follows the basic SSM protocol, it's very unlikely that any of the code or table locations is applicable to the EJ20G JECS ECUs. I've only had two EJ22t ecus apart, but both had sockets for EPROMs. They were a very wide pattern though. Basically a strip on each side of the factory PROM. It appears that they take some sort of adapter to place a new EPROM above the original one.

If I'm not mistaken, I believe Nico has one that actually had an EPROM installed. I'm not sure if he was ever able to discover if it was a dealer item (ie. software update) or an actual aftermarket chip.

I can post pics of mine if anybody is interested.
yeah..what he said:) i vaguely remember reading it and thought it was cool.

didnt he have some nissan tuner tune it or some shit?

rob    09-16-2008 03:30 PM
Quote:
Originally Posted by PhyrraM (Post 1464407)

I can post pics of mine if anybody is interested.
I'd be interested to see what the board looks like.

PhyrraM    09-16-2008 09:20 PM
Quote:
Originally Posted by rob (Post 1464491)
I'd be interested to see what the board looks like.

USDM EJ22T, Hitachi
http://farm4.static.flickr.com/3172/...b37eba0d23.jpg


JDM Legacy EJ20G, JECS
http://farm3.static.flickr.com/2220/...0d935b9c93.jpg


And just for fun, EJ20G Apexi Power FC
http://farm4.static.flickr.com/3204/...da9656764a.jpg

Photo album with many more pics is here: http://www.flickr.com/photos/2329149...7607336718969/ You can access them in original resolution if you wish. Just click on the 'All sizes" button.

oldhat    09-16-2008 09:28 PM
Awesome pics but can you pull the model #s off of the chips? Resolution isn't quite high enough on the Flickr stream to read them.

PhyrraM    09-16-2008 09:49 PM
Quote:
Originally Posted by oldhat (Post 1464897)
Awesome pics but can you pull the model #s off of the chips? Resolution isn't quite high enough on the Flickr stream to read them.
JDM Legacy EJ20G, JECS
http://farm4.static.flickr.com/3128/...f3202a8d9d.jpg
http://farm4.static.flickr.com/3166/...bde458ae56.jpg

USDM EJ22T, Hitachi
http://farm4.static.flickr.com/3198/...a073b141fb.jpg
http://farm4.static.flickr.com/3275/...e08d9f5654.jpg


Again, more pics in the gallery. http://www.flickr.com/photos/2329149...7607336718969/

b3lha    09-17-2008 02:52 AM
From the photos:

The JDM Legacy EJ20G JECS uses a Mitsubishi 37790 cpu (7700 family). I know some Nissans use JECS ECUs with that chip. I wonder if the ECU hardware is the same with different firmware.

The USDM EJ22T Hitachi uses a Hitachi HD6303 cpu (6300 family). I think this is a clone of the Motorola MC6800 series. Also used in Nissan JECS ECUs.

Disassembler software is available for both of these architectures.

The best news is that they are both clearly designed to be upgradeable. The Hitachi has the blue socket for an eprom daughterboard and the JECS has an EPROM socket.

Time to compare some photos of Nissan ECUs.

Lots of Nissan info here http://eccs.hybridka.com/index.php, including datasheets etc. for the above chips.

oldhat    09-17-2008 01:45 PM
OT but dude, what kind of camera are you using? Incredible macro shots.

ImprezaRSC    09-17-2008 02:51 PM
(I can speed some of this along for you. However, don't take all of this as gospel. I'm going off of memory in the middle of doing my homework.)

The JDM and EU ECU's are good for references, but you're chasing you're tail if you think they're the same. Yoshio-san was kind enough to point me to the right people to get the equipment I needed to do reflashes myself. Needless to say, $10,000 is a steep investment for the right equipment! I still want to help you guys, though. I've been wanting a cheap re-flash option for this car for a long time. Getting the instructions back IN is the problem, and that's where all that pricey equipment came into play. You will be hard pressed to get technical information of this sort from Bill, Yoshio, or the ONLY electronics supplier for this stuff in California, Technosquare. Techtom is good stuff and I can only dream at this point of being able to use Mighty Map.

For the 00-01 ECU, here is what I have. My car was purchased in Dec. '99 as a 2000 model, so there is possibly some overlap from 99. Pay close attention to manufacturer dates and models as they WILL be different among the 00-01 chassis. As far as I know, the main chipset is a relative of the Motorola 6800. These chipsets are from robotic assembly lines and use a RISC architecture. Our ECU's on 00-01 cars were actually made in Japan, not the U.S. I wrote down the following numbers from every chip I could read the writing on. Unfortunately, my links to better information went the way of the dodo bird with my server crash a few months ago.


External ECM box codes

M2 2611 AFJ82 A18-000 D3P 9X06

Mitsubishi M59551FP931101 (rare + old chip mentioned earlier M59551FP)


Main Chip
U.J.-WA12212930WWW 932c101


Motherboard
A19-001 DT3 N

Other chip names on the motherboard:
9H2T
5233
TA932
HC08
940
8909BF

NEC Japan
PA1559H
PA1556AH
K928B
K925B

NEC Japan history
http://en.wikipedia.org/wiki/NEC

Motorola 6800 architecture notes.
http://www.cpu-world.com/Arch/6800.html

Home of expensive equipment..technosquare.
http://www.technosquareinc.com/techtom.htm

Mighty Map is the name of the software used to rewrite the ECM maps.

A bit of Japanese Business History-- "Unisia", "JECS", and "Unisia JECS" are considered three different ventures in Japan. In the case of Unisia JECS, Unisia would be the "teacher" and JECS would be the "student." When you're picking apart the names and work of Japanese companies, be wary of these cultural differences in names and structures.

Another thing, you're at the mercy of what is available to be tweaked in these N/A ecu's. That means no anti-lag. You could reprogram the ECU to use a different MAP sensor that can read boost, though. Being so early in this game, you're a bit of a ways away from re-writing any of those functions. We could all be reprogramming our ECUs right now if we wanted to spend $10,000 on all the software and hardware to do it. You don't have to reinvent the wheel by tying to write ALL of your own stuff. See what you may be able to piece together from third party vendors like the one's I mentioned.

[oldhat]

mxpunk     09-17-2008 02:54 PM
Quote:
Originally Posted by ImprezaRSC (Post 1465468)
(I can speed some of this along for you. However, don't take all of this as gospel. I'm going off of memory in the middle of doing my homework.)

The JDM and EU ECU's are good for references, but you're chasing you're tail if you think they're the same. Yoshio-san was kind enough to point me to the right people to get the equipment I needed to do reflashes myself. Needless to say, $10,000 is a steep investment for the right equipment! I still want to help you guys, though. I've been wanting a cheap re-flash option for this car for a long time. Getting the instructions back IN is the problem, and that's where all that pricey equipment came into play. You will be hard pressed to get technical information of this sort from Bill, Yoshio, or the ONLY electronics supplier for this stuff in California, Technosquare. Techtom is good stuff and I can only dream at this point of being able to use Mighty Map.

For the 00-01 ECU, here is what I have. My car was purchased in Dec. '99 as a 2000 model, so there is possibly some overlap from 99. Pay close attention to manufacturer dates and models as they WILL be different among the 00-01 chassis. As far as I know, the main chipset is a relative of the Motorola 6800. These chipsets are from robotic assembly lines and use a RISC architecture. Our ECU's on 00-01 cars were actually made in Japan, not the U.S. I wrote down the following numbers from every chip I could read the writing on. Unfortunately, my links to better information went the way of the dodo bird with my server crash a few months ago.


External ECM box codes

M2 2611 AFJ82 A18-000 D3P 9X06

Mitsubishi M59551FP931101 (rare + old chip mentioned earlier M59551FP)


Main Chip
U.J.-WA12212930WWW 932c101


Motherboard
A19-001 DT3 N

Other chip names on the motherboard:
9H2T
5233
TA932
HC08
940
8909BF

NEC Japan
PA1559H
PA1556AH
K928B
K925B

NEC Japan history
http://en.wikipedia.org/wiki/NEC

Motorola 6800 architecture notes.
http://www.cpu-world.com/Arch/6800.html

Home of expensive equipment..technosquare.
http://www.technosquareinc.com/techtom.htm

Mighty Map is the name of the software used to rewrite the ECM maps.

A bit of Japanese Business History-- "Unisia", "JECS", and "Unisia JECS" are considered three different ventures in Japan. In the case of Unisia JECS, Unisia would be the "teacher" and JECS would be the "student." When you're picking apart the names and work of Japanese companies, be wary of these cultural differences in names and structures.

Another thing, you're at the mercy of what is available to be tweaked in these N/A ecu's. That means no anti-lag. You could reprogram the ECU to use a different MAP sensor that can read boost, though. Being so early in this game, you're a bit of a ways away from re-writing any of those functions. We could all be reprogramming our ECUs right now if we wanted to spend $10,000 on all the software and hardware to do it...
This is why this project will probably never get off the ground. No one is gonna drop $10K on this shit, there just isnt any call for it..

How many RICH people are driving L's, RS's and or WRX's for that matter? :flame:

Piggybacking is much more viable choice.

ImprezaRSC    09-17-2008 03:13 PM
I also don't put ANYTHING past creative Americans . I'll be using an Autronic when the money permits it, but this project could be kind of fun! If they can get past the issue of putting the instructions back on the board and making the different chips talk with each other nicely then that would be a good thing.

orthomong    09-17-2008 05:15 PM
I've got all the info you need on how to reflash the OBD-II JECS Ecus.
I gave everyone info on how to dump the ROMs off and once someone gets that done I can show them where the flash code is and how it works.

As far as cracking ECUs goes this is a fairly easy platform.

(I can speed some of this along for you. However, don't take all of this as gospel. I'm going off of memory in the middle of doing my homework.)

The JDM and EU ECU's are good for references, but you're chasing you're tail if you think they're the same. Yoshio-san was kind enough to point me to the right people to get the equipment I needed to do reflashes myself. Needless to say, $10,000 is a steep investment for the right equipment! I still want to help you guys, though. I've been wanting a cheap re-flash option for this car for a long time. Getting the instructions back IN is the problem, and that's where all that pricey equipment came into play. You will be hard pressed to get technical information of this sort from Bill, Yoshio, or the ONLY electronics supplier for this stuff in California, Technosquare. Techtom is good stuff and I can only dream at this point of being able to use Mighty Map.

PhyrraM    09-17-2008 06:18 PM
Quote:
Originally Posted by oldhat (Post 1465411)
OT but dude, what kind of camera are you using? Incredible macro shots.

El cheapo, Target special.:naughty:

Cannon PowerShot A550. It says 7.1 Mp, but my wife's Cannon SD 630 take better pics @ 6.0 Mp.

Skidd    09-17-2008 07:58 PM
Quote:
Originally Posted by orthomong (Post 1465569)
I've got all the info you need on how to reflash the OBD-II JECS Ecus.
I gave everyone info on how to dump the ROMs off and once someone gets that done I can show them where the flash code is and how it works.

And that's why this thread is still going!! There is hope!

oldhat    09-17-2008 08:05 PM
Honestly, we haven't even started. I've been pretty busy this week, but it's on like Donkey Kong this weekend. Gonna nerd out at the UC Berkeley School of Engineering liberry.

ImprezaRSC    09-17-2008 09:17 PM
Go for it Orthomong! I've had one class on assembler code, but several years with coding websites and databases. Corporate networks are boring compared to this stuff. I gave up trying to hack these ECUs on my own once I tracked down the equipment and its price tag. If you guys can do it cheaper then more power to you!

It looks like I need a copy of RomRaider and a tactrix cable to get started. Si? No?

oldhat    09-17-2008 09:29 PM
Oui.

b3lha    09-18-2008 06:24 AM
It's much too early in the project for this, but I thought I would mention it anyway because otherwise I will forget.

Subaru have filed US patents for some of the algortithms used in the ECU. That means you can download the patent application document and use it to help understand what you are looking at in the ECU program code.

Go to http://www.patentstorm.us and search for "Fuji Jukogyo Kabushiki Kaisha".
Go through until you find one with a promising title. Look at the date and make sure it was written before your car was made, not after. Have a read of the text and make sure that the mechanical bits described match up with your engine type. Make a note of the patent number, and then go to www.pat2pdf.org to download it into a PDF file.

There is some really interesting stuff in there, but the formal language is hard to understand.

oldhat    09-18-2008 07:16 AM
Craziness, b3lha.

There are hella otaku on this board. Who speaks Japanese?

Email me if you want to get on the mailing list for the first project update. I've just been grabbing the names off the registered members on subiesmart.com but if you want in, hit me. noahyzimmerman@yahoo.com

ImprezaRSC    09-18-2008 08:26 AM
Just to clarify, you're seeking to build your own interface to adjust the JECS ECU and not actually "reverse engineer the JECS ECU" itself. If you want to stay out of trouble with Fuji or JECS, that needed to be stated .

I'll order a Tactrix next week. Money is tight being in school. BTW, those blowers I was working on got canned so I could go back to school. Open sourced projects like this can work, but not if your into preserving your proprietary information and trade secrets. It's been difficult to straddle both worlds, but I still find open sourced projects appealing.

oldhat    09-18-2008 08:28 AM
Quote:
Originally Posted by ImprezaRSC (Post 1466104)
Just to clarify, you're seeking to build your own interface to adjust the JECS ECU and not actually "reverse engineer the JECS ECU" itself. If you want to stay out of trouble with Fuji or JECS, that needed to be stated .

Open sourced projects like this can work, but not if your into preserving your proprietary information and trade secrets. It's been difficult to straddle both worlds, but I still find open sourced projects appealing.
Very important to know, we'll put that in the disclaimer, don't want to get teh sued.

This project is going to be a totally open book.

orthomong    09-18-2008 12:23 PM
Quote:
Originally Posted by oldhat (Post 1466107)
Very important to know, we'll put that in the disclaimer, don't want to get teh sued.

This project is going to be a totally open book.

Reverse engineering is NOT illegal unless it's for the purpose of circumventing copy protection. (see the DMCA) The laws are so vague that MAYBE a company could claim copy protection circumvention on reflash software (you're copying ROMs) but honestly that's a stretch and nobody cares.

These ECUs are old/obsolete technology. I wouldn't worry about it.

dodubiescoobe    09-20-2008 08:50 PM
Keep it going
 
Quote:
Originally Posted by oldhat (Post 1461065)
I'm prolly talking out of my ass but yeah.

When I was messing around with my Power FC and reading up on Datalogit, I had this weird "AHA!" moment when I realized that all the PFC was doing was basically reading off a big spreadsheet with a bunch of columns and rows

if rpm = x
and boost = c
then injector duty cycle = y

and so on. Obviously way more complicated than that but I gather that's the gist of it.
You were watching MATRIX porn

On a better note.
Finding out what each pin does on the ecu would be better.
Also an OBDII ecu is porbably harder to deal with than the OBDI OBD0 ECU's
I think if you are going to get any of this done it would be on a wide scale. Have some one look at various ecus before they say "Hey this one is simpler to adjust than this one"
EVIL SCRIBE an DSM tuner came to mind.
It would be better to find/make a piggyback made for the Subaru. One that can remove rev/speed limits. Adjust injectors and tune spark per rpm by %'s. :corn: I like this thread

dodubiescoobe    09-20-2008 09:53 PM
Quote:
Originally Posted by rob (Post 1463598)
I can add a few tidbits since I have been playing with the EJ20G ECUs for a year or so now.

1) Using the SSM protocol, it is possible extract the entire ECU ROM image through the OBD1 port. Thanks to Phil for the linux dump tool. Phil posted the Z4 image that I sent him on his website, so anyone who wishes to start reversing the code, can start with that. Reading through his SVX code comments can help.

2) These ECUs are not reflashable.

3) It is possible to add an Eprom with alternate maps. The downside is that Subaru used a rare chip for this, and they are hard to find and harder to find a burner for. There are ways around this, but they require a daughter board. Several DIY efforts and official tuners have provided chips over the years (just not in the US). I burn my own Eproms and have sold a couple of OTS tunes to members.

4) I am working my own project to make these ECU reflashable. It will be an add-in board into the Eprom socket and I am designing it to work with open source SW tools. I am in the prototype phase, I expect it to take a few months before anything is available. I don't have any more details to share.

-Rob
:cool:looks like you have it down enough to start a supply for a market demand.

dodubiescoobe    09-20-2008 10:16 PM
:pi just read the entire thread and it seems like a good idea would be lurking the forums or bluntly asking which boards are not chippable/reflashable and which daughter boards can co exist with certain ecu's. thats all i can help. No point in trying to alter an unalterable ecu

b3lha    09-22-2008 03:17 AM
Quote:
Originally Posted by dodubiescoobe (Post 1468604)
:pi just read the entire thread and it seems like a good idea would be lurking the forums or bluntly asking which boards are not chippable/reflashable and which daughter boards can co exist with certain ecu's. thats all i can help. No point in trying to alter an unalterable ecu
All the ECUs are alterable, either by chip, or by flash. A daughter board can be used on "chip" ECUs if the required chip is not easily available.

SilverSurfer555    09-22-2008 01:09 PM
I have 2 schematics for the 1993-1996 daughterbaord. One uses 27C512, the other 27C256.
Although there is little point making these up as the genuine 27C1028 chips are available from Hong Kong on www.ebay.uk all the time :

http://shop.ebay.co.uk/?_from=R40&_t...3&_nkw=27c1028

Using the original chip, you don't have to worry about splitting the code odd/even accross the 2 devices that emulate the 27C1028 and you also don't have to build the hardware

I've been supplying either the boards or the single chips, mapped, since 2002 to mates, mates mates and mates mates sisters mate (she was the best )

SilverSurfer555    09-22-2008 01:26 PM
Following on from the above, heres a little info that some of you may already have

1993-1996 Impreza Turbo/WRX/STi :

Injector Constant - 800A:800B
MAF - 8080:80FF
Fuel Map Axis (Revs) - 8100 : 810F
Fuel Map Axis (Load) - 8110 : 811F
Fuel Map - 8120 : 821F (16 x 16 Grid)
Ignition Map (Revs) - 84D0 : 84DF
Ignition Map (load) - 84E0 : 84EF
Base Ignition Map - 8500 : 85FF (16 x 16 Grid)
Speed Limiter - 86C6 : 86C8
Ignition Correction - 87C0 : 88BF (this moves slightly on earlier maps, but here on a Z4)
Fuel Cut/Boost Limit - 8918 : 891F (8 levels)
Boost Axis (Rpm) - 8920 : 8927
Boost Axis (TP) - 8928 : 892F
Boost Target - 8940 : 897F (8 x 8 Grid)
Boost Duty Axis (Rpm) - 8990 : 8997
Boost Duty Axis (TP) - 8998 : 899F
Boost duty - 89A0 : 89DF (8 x 8 Grid)
Rev Limiter - 8466 : 846D (3-Stage Endian swapped)

There's more but the above will keep most people going for years, and you obviously have to convert the above Hex data to 'real money' (AFR/psi/bar/DTDC/rpm/%).

b3lha    09-23-2008 02:21 AM
Quote:
Originally Posted by SilverSurfer555 (Post 1469894)
I have 2 schematics for the 1993-1996 daughterbaord. One uses 27C512, the other 27C256.
Although there is little point making these up as the genuine 27C1028 chips are available from Hong Kong on www.ebay.uk all the time :

http://shop.ebay.co.uk/?_from=R40&_trksid=m38.l1313&_ nkw=27c1028

Using the original chip, you don't have to worry about splitting the code odd/even accross the 2 devices that emulate the 27C1028 and you also don't have to build the hardware

I've been supplying either the boards or the single chips, mapped, since 2002 to mates, mates mates and mates mates sisters mate (she was the best )
For me, the biggest advantage of the daughter board approach is that you can burn the 27SF512 chips using a $50 programmer rather than the $500 programmer that you need for the original 27C1028 chip.
The daughter boards that I am using are very low cost and you don't need to split the code odd and even.
Thanks for posting the info on the map locations.

Brydon    09-23-2008 02:32 AM
Quote:
Originally Posted by SilverSurfer555 (Post 1469920)
Following on from the above, heres a little info that some of you may already have

1993-1996 Impreza Turbo/WRX/STi :

Injector Constant - 800A:800B
MAF - 8080:80FF
Fuel Map Axis (Revs) - 8100 : 810F
Fuel Map Axis (Load) - 8110 : 811F
Fuel Map - 8120 : 821F (16 x 16 Grid)
Ignition Map (Revs) - 84D0 : 84DF
Ignition Map (load) - 84E0 : 84EF
Base Ignition Map - 8500 : 85FF (16 x 16 Grid)
Speed Limiter - 86C6 : 86C8
Ignition Correction - 87C0 : 88BF (this moves slightly on earlier maps, but here on a Z4)
Fuel Cut/Boost Limit - 8918 : 891F (8 levels)
Boost Axis (Rpm) - 8920 : 8927
Boost Axis (TP) - 8928 : 892F
Boost Target - 8940 : 897F (8 x 8 Grid)
Boost Duty Axis (Rpm) - 8990 : 8997
Boost Duty Axis (TP) - 8998 : 899F
Boost duty - 89A0 : 89DF (8 x 8 Grid)
Rev Limiter - 8466 : 846D (3-Stage Endian swapped)

There's more but the above will keep most people going for years, and you obviously have to convert the above Hex data to 'real money' (AFR/psi/bar/DTDC/rpm/%).
Now, how about 2000/2001 RS? Then I would be happy.

[oldhat]

SilverSurfer555     09-23-2008 03:06 AM
Quote:
Originally Posted by b3lha (Post 1470610)
For me, the biggest advantage of the daughter board approach is that you can burn the 27SF512 chips using a $50 programmer rather than the $500 programmer that you need for the original 27C1028 chip.
The daughter boards that I am using are very low cost and you don't need to split the code odd and even.
Thanks for posting the info on the map locations.
Agree the EEPROM are easier to re-programme if you are constantly changing the map.
The programmer I use for the 27C1028 was about £150.

The other alternative is the ESL Live mapping interface which allows you to reflash live via laptop. But that is currently only available through dealers, more details are on my website http://www.polarperformance.co.uk/ESLLiveSpec.html

I don't think ESL have any dealerships outside the UK.
I may ask them though in-light of the current climate whether they are considering releasing it for customer tuning.

oldhat    09-24-2008 11:54 PM
I just sent out the first SubieSMART getting-to-know-you newsletter. We're NOT going to be spamming you with bullshit, I personally hate getting stuff like that but it's a necessary evil at this point. But let me know if I missed you, I'll put you on the list! PM me if you want in.

Dear SubieSMART team members and associates,

I told Jay (a.k.a. Kochiro) on instant messenger last week, it seemed like all it took for this project to take off was for one of us to say something. It could have been anyone. The response has been absolutely stunning. I mean, just look at this!

http://www.rs25.com/forums/showthread.php?t=87231

Over 200 responses, plus hundreds of emails and IMs flying everywhere. Remarkable! We're about 10 days into this project and we already have over 25 people from, as near as I can tell, three continents (possibly four). We come from a huge variety of backgrounds: IT, mechanics, graphic design, web design, mechanical engineering, computer engineering and shadetree mechanics with nothing more than insatiable curiosity about their cars. We already have a piece of in-house software from Prodrive (yes, that Prodrive!) to work off of and learn from. We have leads galore on Jecs chips, plus the trails already blazed by the SVX ECU team led by Phil Skuse, as well as the Nissan Skyline and Silvia ECU community, which is fully on-board with us.

And this is only the beginning. If we all put our heads together and work as a team, I am 100% confident this project can be a roaring success, i.e. world famous in tuning circles. A project with the long term goal of this one (mastering as many Subie ECUs as possible) is unprecendented in the Subaru world, as far as I know. Each of us can reinforce others' weaknesses and compliment each others' strong suits. All it will take is determination and cooperation.

The sky is the limit with SubieSMART. We can do basically anything once we crack the ECU open and understand what makes it tick. You want to improve the already impressive torque on your RS? Or do you want to tune for more horsepower in the high end? Do you want to bump up the rev limiter? What about doing that on the fly? Do you want launch control? Do you want to tune for hotter cams and get it tuned just right instead of just close enough? Further down the line, on turbo applications, do you want anti-lag? Or do you just want to tune rich and make your car breathe fire out of the exhaust? If you can dream of it and the ECU controls it, there is no practical reason why we can't do it. Let's go into uncharted territory with our cars and squeeze the most performance and enjoyment out of them possible. After all, why not us? Why not now?

It seems like the consensus is we should start by cracking the OBDII (On-Board Diagnostic II) 2.5 RS ECU, for two reasons. First, there is a big demand among us for some kind of tuning option without a piggyback or mere reflash for this motor and secondly it is relatively simple to start with -- since it's naturally aspirated, we won't have to worry about tuning with a turbo. But this once we master this ECU, I am confident other Subaru ECUs will be relatively easy to master as well. But if you have a case to make for starting with another ECU, let's hear it on the SubieSMART forum.

But first things first. We need a great looking website. We need to get a list of everyone's contact information, skills and experience and languages spoken (we especially need a fluent Japanese speaker who can understand technical terminology). We need to agree on a way to share and disseminate the information that we discover. And we need a project mascot to guide us and give us good luck! Open source projects such as this one will succeed only if we make an agreement among ourselves to be open about anything we learn or discover. Remember that this project doesn't belong to any one of us but it does belong to every one of us.

We are the set of enthusiasts who chose to push the boundaries. We take the initiative instead of waiting for someone else to show how it's done. We don't take "no" or "you can't do that" for answer.

So get excited. This is the first step towards something truly remarkable!

Sincerely,

Noah and Jay
www.subiesmart.com

P.S. Please email me and let me know if you want in. Hit me with your contact information, skills (especially web development at this early stage of the project) and any languages you speak. We're forever making lists!

P.P.S. This is YOUR project! If you see something that needs improvement or come up with an idea about anything related to the project, let everyone know!

b3lha    09-25-2008 02:37 AM
Quote:
Originally Posted by b3lha (Post 1466024)
Subaru have filed US patents for some of the algortithms used in the ECU.

There is some really interesting stuff in there, but the formal language is hard to understand.
Quote:
Originally Posted by oldhat (Post 1466057)
Craziness, b3lha.
There are hella otaku on this board. Who speaks Japanese?
Maybe I didn't explain that very well. The patents are in English but it's "Engineers Textbook English" and I have to read each line several times to figure out what it means:

Quote:
Originally Posted by Fuji Jukogyo Kabushiki Kaisha
An ignition controlling system has a memory storing a plurality of basic ignition timings each of which is a maximum timing for producing maximum torque with low-octane gasoline without causing knocking, and storing a plurality of maximum advance quantities. A learning control system has a memory storing a plurality of learning correcting quantities and rewriting the learning correcting quantity in accordance with occurrence of knocking of the engine. A basic ignition timing, a maximum advance quantity and a learning correcting quantity are derived from the memories in accordance with engine operating conditions. The learning correcting quantity is compared with the maximum advance quantity and smaller one selected. The smaller quantity is added to the basic ignition timing to obtain an ignition timing.

SilverSurfer555    09-25-2008 04:04 AM
Do we have anyone onboard from RomRaider/Enginuity, as i know they have had numerous posts relating to getting things going on the JECs side i.e Pre2001 (just do a search on ROmRaider for JEC's, we're all asking the same questions).
They may not have the time due to further development of RomRaider & 2001>, but they may have some info or know of someone with the info that could be passed down to SubieSMART.

P.S A repository would be good as i have quite a few stock ROM images from 1993-1996 WRX/Turbo/STi/Legacy and a few from Stock 1999-2000 models (inc P1).
2001> are pretty much covered in RomRadier and scoobypedia.

oldhat    09-25-2008 12:31 PM
Quote:
Originally Posted by b3lha (Post 1472690)
Maybe I didn't explain that very well. The patents are in English but it's "Engineers Textbook English" and I have to read each line several times to figure out what it means:
LOL, we're going to have to translate that from technicalspeak in Engrish to plain English!

I was thinking we need a fluent Japanese speaker so we can start emailing the engineers at JECS and pick their brains. Maybe they have old copies of diagrams and manuals laying around.

oldhat    09-25-2008 12:32 PM
SilverSurfer, are you signed up?

oldhat    09-25-2008 01:18 PM
I was thinking last night, what do you suppose the aggregate IQ of everyone involved in the project is so far? 3000 points? 3500 points? 4000 points?

Do you really think the ECU has a chance of staying locked against this worldwide army we've gathered? Psssh! :lol:

silent    09-25-2008 09:11 PM
Quote:
Originally Posted by oldhat (Post 1473046)
I was thinking last night, what do you suppose the aggregate IQ of everyone involved in the project is so far? 3000 points? 3500 points? 4000 points?

Do you really think the ECU has a chance of staying locked against this worldwide army we've gathered? Psssh! :lol:
I have at least 26 IQs.

oldhat    09-26-2008 02:34 AM
Looks like I picked the wrong week to stop sniffing glue.

http://i120.photobucket.com/albums/o...iffingglue.jpg

qstarin    09-26-2008 11:48 AM
Oofta - finally read the whole thread.

I'm having trouble finding info over on the SubieSMART pages. Is it just that nobody's posting stuff there yet? I also seems to see that there's been like a dozen posts but the only one I can find is the general "hello world" post.

Sounds like some folks have downloaded patent info about our ECU's (since I see quotes) - how 'bout some direct links to documents?

SilverSurfer555    09-26-2008 12:53 PM
Quote:
Originally Posted by oldhat (Post 1472983)
SilverSurfer, are you signed up?
OnSubismart yes....
but not as SilverSurfer555...check out my signature for a clue :naughty:

1999impeza2.5RS    09-26-2008 01:25 PM
Quote:
Originally Posted by silent (Post 1473408)
I have at least 26 IQs.
i fink i gots sumof those to

anyway, does anyone think the computers ability to "learn" around inputs would effect anything?

Kochiro    09-26-2008 01:50 PM
Quote:
Originally Posted by qstarin (Post 1473868)
I'm having trouble finding info over on the SubieSMART pages. Is it just that nobody's posting stuff there yet? I also seems to see that there's been like a dozen posts but the only one I can find is the general "hello world" post.
No, we just setup the new forum over at SubieSmart and are going to work out just how we want to divide up the forums this weekend. There are file galleries over on the main site that we will start putting files in. The biggest thing we need to do starting Monday is have all of you start posting over at the SubieSmart forum so that we can start breaking down all of the info that's contained in these 20-odd pages of posts here.

So starting Monday, please please please continue anything that you would have put into this post over on the SubieSmart forum.

Thanks,

oldhat    09-26-2008 02:00 PM
The site will look basically perfect by Sunday night.

Dusting off the HTML handbook, LOL.

It's on, gentlemen. Get ready...

P.S. My firmware engineer Jeff emailed me. We're going to do shit no one thought possible.

Just hang tight for a sec...incoming...

Skidd    09-26-2008 02:01 PM
Just an FYI, you guys are putting a lot of preliminary efforr forward on something that hinges on a single requirement. The ability to "write back" to the JECS ECU. It's really the only thing that needs to be done.

- Reading from the ECU has been done, and is not too hard to do.
- Making map changes is the domain of RomRaider, and there is no need to re-write what it does.
- Writing to the DENSO ECU has been done.
- Writing to the older OBD1 ECU's has also been done.
- Writing to the OBD2 JECS ECU in the OpenSource realm?

So, without the ability to write back, this whole project will end in a puff of virtual smoke. It really needs to be the first thing addressed. It doesn't have to be a ready for release bit of code. It can be nothing more than a throw-away prototype proof of concept on a bench driven ECU. We know it "can" be done with commercial software. But, can it be done in the OpenSource world? That is the lynch pin here.

orthomong claims to be able to write to the OBD2 JECS ECU.
http://www.rs25.com/forums/showthrea...69#post1465569
This is where to MUST start. And, it's can't be as iffy as orthomong claims. If there is even a 25% chance of fubaring yoru ECU with a write, then I hightly doubt many people will risk it.

[oldhat]

oldhat     09-26-2008 02:03 PM
Quote:
Originally Posted by Skidd (Post 1474017)
Just an FYI, you guys are putting a lot of preliminary efforr forward on something that hinges on a single requirement. The ability to "write back" to the JECS ECU. It's really the only thing that needs to be done.
Jeff has a lot to speak on this. I'll post up his email in a bit, this dude is wicked smart. He has one plan of attack...

Skidd    09-26-2008 02:07 PM
Quote:
Originally Posted by oldhat (Post 1474020)
Jeff has a lot to speak on this. I'll post up his email in a bit, this dude is wicked smart. He has one plan of attack...
<-- Count me intrigued then!

PhyrraM    09-26-2008 02:10 PM
Please correct me if I am wrong.

Part of the OBDII spec is reflashing. SO....Subaru must have a reliable way of reflashing the JECS OBDII ECU, correct? (unless a few bricked ECUs is part of Subarus planned costs)

What is the possibility of obtaining such a tool and reverse engineering it? It really would only take a bit of hardware to monitor and record a "proper" reflash and then anylyzing the data and timings in the packets sent over the OBDII connector. Kind of like an "OBDII passthrough".

oldhat    09-26-2008 02:52 PM
Cut and paste:

Noah-

I presume you guys have some hardware engineers involved? i.e. a board guy, who can look at the board and see what's involved. No doubt, the main CPU controls most of the functions, at least at a high level (in hardware land), but there are likely other lower level control pieces such as a CPLD or FPGA... these components are very difficult to understand how they work internally without a spec (e.g. what does register 0xe do?), but hopefully for your project these components act more like a right hand so to speak and do not contain much high level logic/processes. At any rate, what I'm saying is that you need at least 1 solid board guy, not just someone who is familiar with circuits (since as I understand it you aren't doing any soldering), but someone who can look at the chips (and get specs) and how things are connected (including GPIOs, signals, etc). Hopefully this person is adept with a scope and familiar with CAM bus protocol (and possibly I2C bus) since most cars, as I understand it, use CAM bus to communicate between devices due to its robustness.

-Jeff

I've been reading a lot about assembly and circuit design and Jeff's points make a lot of sense. We will most likely need an oscelliscope at some point HOWEVER I went to the UC Berkeley School of Engineering yesterday and was poking around their labs and library. They have an open lab that is with ALL of these tools and an enormous on and offline library. Our tax dollars at work. So this is all "doable," so to speak.

We CAN get all of the JECS specs he's talking about.

So let's ball it up. :banana:

oldhat    09-27-2008 03:44 AM
Delete, sorry.

MattB    09-27-2008 05:59 AM
Sorry I haven't been around to be much help lately guys. I have had a bad few weeks. I will be back as soon as I can. I am still interested in helping but a few things have happened in my life where I haven't been able to spend much time on the forums/playing with my car.

b3lha    09-29-2008 04:52 AM
Quote:
Originally Posted by SilverSurfer555 (Post 1469920)
Injector Constant - 800A:800B
Do you know how to convert the injector constant to an injector size?

The RomRaider maps for the Denso ECUs use 2707090/x but that doesn't seem to work for JECS.

I have the following values but I can't find a formula that fits them all.

0x8608 = 34312 for SVX (275cc/min)
0x85B7 = 34231 for Legacy EJ22 (280cc/min ??)
0x59C2 = 22978 for WRX (420cc/min)

I notice that the value gets smaller as the injectors get larger. Therefore it's an amount of time per unit of fuel.

bugman1964    09-29-2008 05:16 AM
do they all run the same fuel preasure as well. and maybe fuel preasure is figured in there some how?

orthomong    09-29-2008 07:24 PM
Steps to cracking an ECU for tuning:

1) Figure out architecture and dump the ROM. (have to have something to analyze and flash back right?)

2) Figure out how to fix an ECU with a bad or incomplete flash

3) Figure out how to write to the ECU

4) Figure out where all the key values you want to change are and how they work.


Now for step 1 has anyone managed to dump a ROM? I've given the info on how to do it. Do you guys need schematics for a cable or something?
Unfortunately I don't have time to write a bunch of free software right now.



Quote:
Originally Posted by Skidd (Post 1474017)
Just an FYI, you guys are putting a lot of preliminary efforr forward on something that hinges on a single requirement. The ability to "write back" to the JECS ECU. It's really the only thing that needs to be done.

- Reading from the ECU has been done, and is not too hard to do.
- Making map changes is the domain of RomRaider, and there is no need to re-write what it does.
- Writing to the DENSO ECU has been done.
- Writing to the older OBD1 ECU's has also been done.
- Writing to the OBD2 JECS ECU in the OpenSource realm?

So, without the ability to write back, this whole project will end in a puff of virtual smoke. It really needs to be the first thing addressed. It doesn't have to be a ready for release bit of code. It can be nothing more than a throw-away prototype proof of concept on a bench driven ECU. We know it "can" be done with commercial software. But, can it be done in the OpenSource world? That is the lynch pin here.

orthomong claims to be able to write to the OBD2 JECS ECU.
http://www.rs25.com/forums/showthrea...69#post1465569
This is where to MUST start. And, it's can't be as iffy as orthomong claims. If there is even a 25% chance of fubaring yoru ECU with a write, then I hightly doubt many people will risk it.

oldhat    09-30-2008 04:17 PM
Less barebones SubieSMART.com page coming very soon, sorry for the delay, it's been nuts at Chateau Oldhat this week.

skywalker    09-30-2008 06:14 PM
Good Luck!
 
Hi All,

I am sure you never expected me to post here. Well to be honest I wish you all the best on this project and even though I can not give away anything (company policies, plus I am a tuner by trade, not a reverse engineer) I can help with some basic questions you all seem.

1. If you can flash any model Impreza RS between 1999-2004, than you can flash any of the model years Impreza RS between 1999-2004. So do not worry about which one you can dump a ROM off of and then reflash because you will be able to do it with all of them.

2. We have flashed some of the ROM's namely our test mule over 100 times so far with no problems. So no worries about reflashing the ECU and having it break.

3. When you get to the tuning aspect of the reflash let me know, I can not give the farm away but I can help from time to time.

4. Lastly listen very closely to orthomong, he may know a thing or two about this stuff.

Good Luck!
Bill

Skidd    09-30-2008 06:34 PM
^ Now that's a hellofa thing! pseudo support from ISpeed!! Nice... Just goes to prove we're on the right track.

silent    09-30-2008 07:56 PM
My account on subiesmart has been disabled. Fuck it.

Skidd    09-30-2008 08:15 PM
Quote:
Originally Posted by silent (Post 1477281)
My account on subiesmart has been disabled. Fuck it.
:wtf:

Kochiro    10-01-2008 08:04 AM
Quote:
Originally Posted by silent (Post 1477281)
My account on subiesmart has been disabled. Fuck it.
Silent, could you PM either Oldhat or myself with the problem and we can fix it instead of you giving up?

If you're referring to the forum, Oldhat and I decided that the default forum that came with the wiki wasn't good enough for what we wanted to do and we installed a new one. Unfortunately it means that you have to sign up for the forum separately. We are working on putting the two together so you will only have to sign in once and you'll be able to see the wiki as well as the forum but that is very custom work. I checked and you are currently not registered on the forum, so if that's what you were trying to use, please register there with the same username and password that you used for the wiki part of the site and then eventually when the two are fully integrated you shouldn't have to change anything.

Thanks,

b3lha    10-02-2008 02:06 AM
FYI www.subiesmart.com is currently returning a completely blank page unless you follow it with /wiki or /forum

EDIT: I see the problem. You have a javascript redirect and I have javascript disabled. Suggest you add a regular http redirect or something like that.

Kochiro    10-02-2008 03:57 AM
Quote:
Originally Posted by b3lha (Post 1478569)
FYI www.subiesmart.com is currently returning a completely blank page unless you follow it with /wiki or /forum

EDIT: I see the problem. You have a javascript redirect and I have javascript disabled. Suggest you add a regular http redirect or something like that.
The javascript was just a temporary thing while we build a splash page.

I just put up a quick and dirty splash page with link to the wiki page and the forum for those of you with javascript turned off.

Kochiro    10-03-2008 05:25 AM
I seem to remember seeing a page or a list of the ECU names that corresponded to which car they came out of and I can't find it now. I also thought I saw something about the 3 plug versus 4 plug ecu's and which ones were OBD1 versus OBD2. I can't find that info anymore so if someone could repost it that'd be great.

I'm setting up a test bench for various ECU's and there's a couple things I need.

1. ECU pinout diagrams for 3 plug and 4 plug ECU's
2. I actually need the physical plugs for the 3/4 plug ECU's, anyone have any spare connectors or harness pieces or links to where I can buy the connectors?


Also, please head on over to the subiesmart forums to continue this. Oldhat and I have been very very busy lately so we haven't been able to get much of the resources we've collected up on the sites but not everyone from here has registered over there yet. At some point we'll need to lock this thread and I'd like everyone to have gotten over there before we do.

Thanks,

oldhat    10-03-2008 05:32 AM
You're a hero, Kochiro...

oldhat    10-03-2008 05:35 AM
OK, I've been looking for work for a while and I'm 95% sure I found an awesome new job, so once (if, knock on wood) that's locked down, I can focus much more time on SS.

I don't know about you but I'm hungry. Ready to own it.

:borgsmile

silent    10-07-2008 05:14 PM
So is this dead or what?

Skidd    10-07-2008 05:20 PM
Nope... it's just going to be a long process.

bubba2533    10-07-2008 06:15 PM
I'd like to see this thing keep going. I don't know much, but I'm good at researching.

What is the next step?

Storm    10-08-2008 04:40 AM
What file format do you want for ROM dumps? IE, what should I use to extract it....

Skidd    10-08-2008 06:06 AM
I don't think we yet have a good tool for ROM dumps for the JECS ECU.
I had writen a simple one a while ago, but it didn't use the 128byte fetch method, so it was SLOOOO!! Plus, at the time, I knew nothing about the 0x700000 memory address trick to get the actual ROM code, instead of the lookup table.. so... Sorry.. I've been lackin' it lately! I just have had too much on my plate to spend enough time trying to re-write it. If nobody else gets to it soon, I'll do my best to have something before Xmas.

Storm    10-08-2008 07:08 AM
Additionally, if anyone comes up with a way to do it, PM me.

dodger    10-09-2008 05:40 PM
Been following this thread and its going downhill quick, I guess my investment in an Emanage Ultimate was the right move.

2slo4u    10-09-2008 06:29 PM
Just give it time. This thread was just born, it takes a while to get going

Skidd    10-09-2008 07:20 PM
Quote:
Originally Posted by dodger (Post 1486060)
Been following this thread and its going downhill quick, I guess my investment in an Emanage Ultimate was the right move.
Wow.. the impatience of some people. Seriously!
I'm sorry that the FREE work that others are planning and hoping to do for the greater good of the Subie world is not moving at the pace you desire.

orthomong    10-20-2008 11:45 AM
Where we at?
 
Is there anyone with any programming experience willing to spend a few hours and try to dump a ROM?

I'm willing to help someone out if they don't have any obdii or hardware experience. This kind of stuff isn't nearly as hard as it seems.

Skidd    10-20-2008 12:09 PM
I'll do it, but I won't have enough free time at the earliest until this coming Sunday. More than likely not until Halloween weekend at the earliest though. So.. for me, next month is best.

Supers587    10-20-2008 12:12 PM
I got an ECU from a 5mt 00 RS I'm willing to donate to the cause... Let me know if you need one.

Kochiro    10-20-2008 12:18 PM
Supers587, you've got a PM.

bkcomm    10-20-2008 12:31 PM
Is there any possibility that one of the older versions of Ecuflash might
allow for a rom dump? I think I have an early version 1.29 which might work
with the my evoscan cable (OpenPort 1.3U) If any one thinks it would work
and is willing to give me some instruction I'll try.

oldhat    10-20-2008 12:36 PM
Quote:
Originally Posted by bkcomm (Post 1496781)
Is there any possibility that one of the older versions of Ecuflash might
allow for a rom dump? I think I have an early version 1.29 which might work
with the my evoscan cable (OpenPort 1.3U) If any one thinks it would work
and is willing to give me some instruction I'll try.
Yes, certainly. Please visit our NEW forum and board. It looks much better and we're still making improvements. Please register on the board and throw up a topic and we can discuss this.

Skidd, could you please lock this thread? We're done leeching off of RS25.com
for now.

Please visit the new, improved SubieSMART.com to continue this discussion. Thanks for your support!

oldhat    10-20-2008 12:38 PM
Quote:
Originally Posted by dodger (Post 1486060)
Been following this thread and its going downhill quick, I guess my investment in an Emanage Ultimate was the right move.
We've been at this for about 4 weeks. Patience please. It will be awesome.

Visit our new site if you don't think we're serious about this. We WILL succeed.