Any programmers capable of writing software for the OBD-II JECS reflash?

[oman]

I think the topic says it all.

Any competent coders with a 2.5RS that want to do this project?

[kochiro]

oman,
  I'm not sure if you've followed everything we have going on here, but that is one of our eventual goals.  It's not a project to be taken lightly and will require significant research in order to do it right.  We are still in the research phase at this point, gathering resources, information and doing various tests. 

Thanks,
Jay

[oman]

I've done all the research and have all the info.

In fact, I've done it already I just can't give out the code since it's not mine.

All we need is someone to code it.

[kochiro]

I'm confused...if you already have code then why don't you have a finished product that you can use?  Are you referring to the Prodrive software that was released to a few individuals?

Additionally, we aren't just aiming at being able to flash 98-01 2.5 RS models.  We're working on all OBD2 GC chassis cars to start with.  From there we're going to expand to other models.  So if you've done all the research on every variation of those cars I'd love to see what you have.

Thanks,
Jay

[bubba2533]

Bump for some answers. If this is true post everything you got!

[oman]

Sorry if this information is spotty/incomplete... It's been a long time since I worked on any of it.


Ok.  Most of the JECS subaru OBD-II ecus use the Mitsubishi M32R cpus.
I put a couple of pdfs on my personal web space: 

http://mongo.ducker.org/~oman/M32150Manual.pdf
http://mongo.ducker.org/~oman/rej09b0112_32fpusm.pdf

Roms can be dumped off of these ECUs by using the normal memory read commands... just add 0x700000 to the address you want to read.

The 2.5 RS rom is 262,144 bytes long so valid memory ranges are from 0x0000 to 0x3FFFF   (use 0x700000 to 0x73FFFF to dump)





I use IDA Pro to disassemble these files so be aware that the disassembly engine in IDA has a bug with this CPU.
(I think it's in the ld24 immediate instruction)   It may be fixed in later versions of IDA so you might want to verify this.

For example:    in the AF402-T3 rom at address

ROM:BCF0                 ld24    R2, #byte_10C   ; Load 24-bit immediate

IDA shows that you're loading the immediate value 0x10C in to register R2 but this is incorrect.
The instruction binary encoding is this

E2 01 01 0C

This is really loading the value 0x1010C       So be aware.




Ok the magic Select Monitor command you need to know is

0xAF



0xAF 0x11 - Enter Flash Mode
0xAF 0x31 - Erase Flash
0xAF 0x61 - Program Data


To enter flash mode send the command

0xAF 0x11 0xP1 0xP2 0xP3 0xP4 0xP5 0xA1 0xA2 0xA3



the P bytes are the password and the A bytes are the address (size of flash)

use 0x04 0x00 0x00 for the address

The password is different for each ecu and is the ID that is read from Select Monitor parameters 1 - 5




Once the ECU enters flash mode the baud rate changes to 0x19200



NOTE: When you execute the Erase and Program commands the ECU may (will) come back with a "command not completed yet" error.   
When you receive this just wait for a new response and when you get that it will either be another "command not completed yet" response
or "success" or "error"    -  This is behavior that is unique to flash mode and is something you won't see during normal select monitor commands

Program data command is like this:

0xAF 0x61 0xA1 0xA2 0xA3 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD 0xDD



A1 - A3 are the address and there are 16 data bytes.




Now inevitably you will kill the ECU even if you do everything correctly.
The first thing you need to get working before you try to erase an ECU through the select monitor commands is the reset serial flash.
check out the sections in the M32150 document on Operation modes, MOD0 and MOD1 pins, and "Programming of internal flash memory"

***

In the case of (1), first the software for programming the flash memory is transferred to the internal RAM
using the dedicated serial I/O, RSIF (RAM Serial InterFace). The RSIF becomes available by applying
+12 V (VPPH) to the MOD1 pin after the VPP pin (power supply to the flash memory) is pulled to VPPH.
This state is called the RSIF mode, for the period of which the M32150F4TFP is held reset.
After the software for programming is transferred to the RAM in the RSIF mode, VPPH is removed from
the MOD1 pin to allow the M32150F4TFP exiting the reset state. Then, the FENTRY bit of the flash control
register (FCNT) is set to 1, and the M32150F4TFP enters the flash mode. In this mode, the reset vector
entry moves into the starting address of the internal RAM (usually it is at the starting address of the flash
memory). Thus, the software for programming transferred to the RAM begins to program the flash memory.

***

This is how you will fix your broken ECU.  You always want to learn to do this part first when cracking a new automotive platform.

[oman]

This script might come in handy for anyone using IDA Pro to look at 2.5 rs roms.


http://mongo.ducker.org/~oman/25RS_Rom.idc

[oman]

When the ECU enters flash mode it copies a program from flash in to RAM and executes it.   The copying code looks like this:

ROM:BCEC                 ld24    R0, #0x802800   ; Load 24-bit immediate
ROM:BCF0                 ld24    R2, #byte_10C   ; Load 24-bit immediate   (bug... this is really 0x1010C)
ROM:BCF4                 bra.s   loc_BD00 || nop ; Branch
ROM:BCF8 ; ---------------------------------------------------------------------------
ROM:BCF8
ROM:BCF8 loc_BCF8:                               ; CODE XREF: HandlePacket+1A2j
ROM:BCF8                 ld      R1, @R2+        ; ROM:1010C : unk_1010C
ROM:BCFA                 st      R1, @R0         ; RAM:00802800 : unk_802800
ROM:BCFC                 addi    R0, #4 || nop   ; Add immediate
ROM:BD00
ROM:BD00 loc_BD00:                               ; CODE XREF: HandlePacket+190j
ROM:BD00                 ld24    R1, #0x10DA0    ; Load 24-bit immediate
ROM:BD04                 cmp     R2, R1          ; Compare
ROM:BD06                 bc.s    loc_BCF8        ; Branch on C-bit
ROM:BD08                 ld24    R1, #0xFFFA00   ; Load 24-bit immediate
ROM:BD0C                 ld24    R0, CAN0CNT     ; Load 24-bit immediate
ROM:BD10                 neg     R1, R1          ; Negate
ROM:BD12                 st      R1, @R0         ; RAM:00801000 : unk_801000
ROM:BD14                 bl.l    JumpToFlashStub ; Branch and link



It's copying the program from 0x1010C - 0x10DA0  to RAM at 802800 and jumping to it.   I would suggest that people work on disassembling that program before attempting any reflash.

(this is on the AF402-T3 ROM)

[bubba2533]

I don't understand any of that, but I hope that we can use this.

Did you come up with this all on your own?
What was your goal?

[b3lha]

Thanks for the information.

Could you post a rom dump for me to look at. I'm just curious to see how it compares to the OBD1 systems I've been working on.

[b3lha]

Thanks for the file. I haven't been able to make any sense out of it yet. Not even the IVT. The OBD2 ECUs seem harder to crack than the OBD1.

I found a very interesting thread about JECS OBD2 ECUs though:

http://forums.openecu.org/viewtopic.php?f=3&t=192

The ROMS posted are 128K, so I presume they are for an older hardware than the 256K one you have.

[oman]

Yeah... mostly just people asking colby to do the work for them

I'm surprised nobody else has even really tried to do anything with these ECUs after all this time.

Thanks for the file. I haven't been able to make any sense out of it yet. Not even the IVT. The OBD2 ECUs seem harder to crack than the OBD1.

I found a very interesting thread about JECS OBD2 ECUs though:

http://forums.openecu.org/viewtopic.php?f=3&t=192

The ROMS posted are 128K, so I presume they are for an older hardware than the 256K one you have.

[bubba2533]

Yeah... mostly just people asking colby to do the work for them

I'm surprised nobody else has even really tried to do anything with these ECUs after all this time.

The time is now and we are those people. I want to see this project come through, I believe if we keep at it then there is nothing stopping us from making this happen.

Branden

[ev28]

I can help, I dealt with M32r at work, I have many tools. I don't own a RS but maybe someone can send me an ECM for r&d ?

[bubba2533]

I can help, I dealt with M32r at work, I have many tools. I don't own a RS but maybe someone can send me an ECM for r&d ?

Where are you located at? I have one from a 99 Legacy Outback, but it is supposed to be almost identical to the 98 RS ECU.