1996 Impreza EJ15 ECU "Z1"

[seport]

Phil,

referring to your web site http://www.alcyone.org.uk/ssm/eavesdrop.html, regarding the formula (y=mx+c) to get the SSM conversion, why do we need to find m and c? If the value displayed by the SSM is linear isn't enough to divide the value of the SSM by the decimal value sent by the ecu?

Attached is an xl file with the readings, I think some of them are not good especially those which are continuously changing. Have a look and tell me your opinion.

[b3lha]

Hi Alexander,

I'll take a look at the xl file tomorrow. I don't have xl on this computer I am using.

When I wrote the page about eavesdropping, I assumed that the parameters would all follow a simple linear formula. The reason for calculating m and c was because an ecu value of 0 might not equate to an ssm reading of 0 in some cases. But in fact I was wrong about the parameters following a linear formula. I've started looking at the SVX select monitor rom and it is more complex than that. I have a lot more work to do, but I suspect in some cases, there is no exact formula. The select monitor uses an interpolated lookup table, like reading the value from a graph. I'll post more information about that when I confirm it.

I wanted to ask you about your select monitor, because I have never used one. Do you have cartridges for all Subarus, or only for the EJ15? I had an idea to connect a select monitor to a laptop instead of the car. The laptop will pretend to be an ECU and will send back the expected rom id for each cartridge, then record all of the parameter addresses that the select monitor asks for. It could also send back fixed values to the SSM to make it easier to find the formula for things which constantly change on the real ecu. Do you think that would work?

Phil.

[seport]

I wanted to ask you about your select monitor, because I have never used one. Do you have cartridges for all Subarus, or only for the EJ15? I had an idea to connect a select monitor to a laptop instead of the car. The laptop will pretend to be an ECU and will send back the expected rom id for each cartridge, then record all of the parameter addresses that the select monitor asks for. It could also send back fixed values to the SSM to make it easier to find the formula for things which constantly change on the real ecu. Do you think that would work?

Phil.

You are thinking exactly the same as I am doing

My model have a serial port with the symbol [10101] it should be RS232 port, and I already started to do some investigation about this SSM tool, so far I have nothing because the first problem I found is that the serial port is like an RJ45 but smaller and it couldn't be RJ11 because it has 6 terminals and RJ11 has only 4.
So far I have no documentation about this SSM tool. (it is the same as pictured in your web site http://www.alcyone.org.uk/ssm/ports.html)
I have various cartridges, I will list them this afternoon.

[seport]

Phil,

These are the SSM cartridges which I have:

24082AA070  Legacy, Impreza, SVX, E12 and Vivio  -'97 (this is the one which I am using)
24082AA130  All models  '98MY - '00MY
24082AA210  All models  '01MY - '03MY 
24082AA190  All models  '01MY - '02MY
24082AA150  All models  '01MY
24082AA110  Subaru  -'99MY
24082AA170  Subaru  -'01MY

This is the exact description which is on each cartridge. Apart from the first one, the others I haven't tried them and I don't know what are they for.

[seport]

So far I haven't found any information about the SSM tool and how to connect it with a pc. Any information would be greatly appreciated.

[seport]

Phil,

Do you think you would be able to do a software to replace the ECU? Then we can connect the SSM tool to the pc and extract what is necessary from the SSM cartridges.

Alex

[b3lha]

Phil,

Do you think you would be able to do a software to replace the ECU? Then we can connect the SSM tool to the pc and extract what is necessary from the SSM cartridges.

Alex

I can do it. I'll start working on it.

[seport]

I can do it. I'll start working on it.
[/quote]

That's great!

If you need to try anything during the process, we can arrange a time frame where I give you remote  access to a pc (via Teamviewer, or something else) where I will connect the SSM tool to that pc and you try whatever you like from your pc.

Alex

[seport]

Phil,

I connected the SSM tool with the pc via FTDI cable and checked what is doing while searching for the ECU. I used the Hex Com Tool sw.

Attached is the received data.

Of course the communication failed after trying 2 times.

Alex

[b3lha]

Excellent. Good work. Thanks Alex.

I'm making progress on a program to emulate the ECU. I don't have much spare time to work on it, so it'll be a couple more days.

Phil.

[b3lha]

Here's the select monitor emulator program. Without a select monitor I can't really test it very well. I really hope it works, but I expect it to fail. Let me know how you get on.

From a linux prompt:

tar -xvf ecuemu.tar
cat README.txt
cc -o ecuemu ecuemu.c
./ecuemu
Enter ROMID:742512
Emulating ROMID: 742512
Enter ECU dump filename if required:ecuram.dat
Load Address:1000
Loaded ecuram.dat at address 1000
Enter COM port name [default:/dev/ttyS0]:
Using COM port: /dev/ttyS0
Starting emulation now

The ROMID you enter is the one it will report when the SSM issues a 00464748. However, in some cases the SSM may read the ROMID bytes directly from the ROM instead. In this case, use a hex editor to modify the relevant bytes of your dump file.

If you don't enter a dump file then the ECUmemory will be all zeroes.

Phil.

[seport]

If you don't enter a dump file then the ECUmemory will be all zeroes.

Phil.

So the dump file for ROMID:742512 is included in this program?

Most probably I might need some help to run this program as I never use Linux

[b3lha]

For testing we can use Andrey's ROM dump. It will save me the trouble of picking through the code to find the parameters. It's a 1990 USSR model Legacy wagon.

ROM ID: 703943
64k dump file attached, load it at 0000

[b3lha]

Version 0.2

[seport]

Here's the select monitor emulator program. Without a select monitor I can't really test it very well. I really hope it works, but I expect it to fail. Let me know how you get on.

From a Linux prompt:

tar -xvf ecuemu.tar
cat README.txt
cc -o ecuemu ecuemu.c
./ecuemu
Enter ROMID:742512
Emulating ROMID: 742512
Enter ECU dump filename if required:ecuram.dat
Load Address:1000
Loaded ecuram.dat at address 1000
Enter COM port name [default:/dev/ttyS0]:
Using COM port: /dev/ttyS0
Starting emulation now

The ROMID you enter is the one it will report when the SSM issues a 00464748. However, in some cases the SSM may read the ROMID bytes directly from the ROM instead. In this case, use a hex editor to modify the relevant bytes of your dump file.

If you don't enter a dump file then the ECUmemory will be all zeroes.

Phil.

I had some problems with Linux this evening, but now it's OK.
I tried your software without connecting the SSM tool because it was very late, I am not sure if I am having a problem while compiling the program, it's giving me several warnings, I don't know if this is normal or not.

I copied everything from the terminal window to a text file to have a look.

I hope that tomorrow I will be able to connect the SSM tool.