2004 Baja MT

Discussion about ECU protocols

Moderator: Global Moderator

scooobydu
Newbie
Posts: 4
Joined: Thu Dec 19, 2024 5:51 pm

2004 Baja MT

Post by scooobydu »

I have an A2ZJ500L ECU, which should be the same as the 2004 Forester FXT MT. I can't seem to read from it though:

Code: Select all

[2024-12-19 05:16:45.634]  Read memory with flashmethod 'sub_ecu_denso_sh7055_02' and kernel 'kernels/ssmk_kline_sh7055.bin'
[2024-12-19 05:16:48.370]  Connecting to Subaru 02 32-bit K-Line bootloader, please wait...
[2024-12-19 05:16:49.112]  Sent to bootloader: 4d ff b4 
[2024-12-19 05:16:49.316]  Response from bootloader: 
[2024-12-19 05:16:49.318]  Bad response from bootloader
[2024-12-19 05:16:49.320]  Cannot connect to bootloader, testing if kernel is alive
I tried sub_ecu_denso_sh7055_04 as well. I am using a Tactrix on Linux.

Now this ecu probably has been flashed before, is that an issue? How do I flash over whatever is in there? I have no idea what the previous owner did.
scooobydu
Newbie
Posts: 4
Joined: Thu Dec 19, 2024 5:51 pm

Re: 2004 Baja MT

Post by scooobydu »

Ok I hadn't known about the green flashing plug :oops:. I now get a different error:

Code: Select all

[2024-12-20 06:11:48.421]  Read memory with flashmethod 'sub_ecu_denso_sh7055_04' and kernel 'kernels/ssmk_kline_sh7055.bin'
[2024-12-20 06:11:50.946]  Connecting to Subaru 04 32-bit K-Line bootloader, please wait...
[2024-12-20 06:11:51.124]  Checking if kernel is already running...
[2024-12-20 06:11:51.825]  Kernel NOT running, requesting access
[2024-12-20 06:11:51.981]  Initializing bootloader
[2024-12-20 06:11:51.982]  SSM init
[2024-12-20 06:11:52.492]  ECU ID = 3712485006
[2024-12-20 06:11:52.534]  Start communication ok
[2024-12-20 06:11:52.588]  Request timing parameters ok
[2024-12-20 06:11:52.649]  Seed request ok
[2024-12-20 06:11:52.662]  Sending seed key
[2024-12-20 06:11:52.745]  Seed key ok
[2024-12-20 06:11:52.802]  Start diagnostic session ok
[2024-12-20 06:11:52.816]  Initializing Subaru 04 32-bit K-Line kernel upload, please wait...
[2024-12-20 06:11:52.819]  Unable to open kernel file for reading
I talked to a tuner and he claimed it was stock and not locked. CVN is 433CAF44/2F5E6197, although I doubt I have anyone to compare this checksum against.
Last edited by scooobydu on Sat Dec 21, 2024 6:41 am, edited 1 time in total.
MiikaS
Administrator
Posts: 912
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: 2004 Baja MT

Post by MiikaS »

Hi!

It looks ok otherwise, but it's not finding kernel file ssmk_kline_sh7055.bin to upload.

In Linux, it should be found on users home folder -> .config/FastECU/<version>/kernels

Can you please check if it is found? And what version of FastECU?
scooobydu
Newbie
Posts: 4
Joined: Thu Dec 19, 2024 5:51 pm

Re: 2004 Baja MT

Post by scooobydu »

I got it working.

Yes the file was here: ~/.config/FastECU/0.1.0-beta.2/kernels/ssmk_kline_sh7055.bin

It was dated Dec 17 so I think it was already present on the first attempt.

I ended up cloning the git repo and placing the appimage there, where another copy of the kernel is present. Then I ran

Code: Select all

./FastECU-0.1.0-beta.2-linux-x86_64.AppImage
and it seemed to find it when it was in the same directory as the appimage.

I got a strange ecu image out of it, doesn't seem to match the stock rom "tomsbaja.hex" on romraider at all with lower boost values and really strange zeroed tables (zeroed idle c? negative base timing values?). I'd attach it but it seems the forum doesn't allow bin or hex extensions.
scooobydu
Newbie
Posts: 4
Joined: Thu Dec 19, 2024 5:51 pm

Re: 2004 Baja MT

Post by scooobydu »

Ah it seems gz is an allowed extension.
Attachments
strangebaja.bin.gz
(277.09 KiB) Downloaded 4812 times
MiikaS
Administrator
Posts: 912
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: 2004 Baja MT

Post by MiikaS »

Good you got it working! I need to check dirs again to make sure that it looks for right place as it was working when I test it some time ago. I'll take a look at the ROM tomorrow.
MiikaS
Administrator
Posts: 912
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: 2004 Baja MT

Post by MiikaS »

scooobydu wrote: Sat Jan 11, 2025 10:27 pm I got a strange ecu image out of it, doesn't seem to match the stock rom "tomsbaja.hex" on romraider at all with lower boost values and really strange zeroed tables (zeroed idle c? negative base timing values?). I'd attach it but it seems the forum doesn't allow bin or hex extensions.
Looked at the ROM and what I see, looks normal. Base advance values are many times negative on high load/low rpm area. That corner is an area where it would never be, so basicly it doesn't matter what the values are but it looks nicer that way :) Idle Target C table shows normal idle values for me. All other tables also looks quite normal.
scooobydu
Newbie
Posts: 4
Joined: Thu Dec 19, 2024 5:51 pm

Re: 2004 Baja MT

Post by scooobydu »

I guess I got confused by this view in Romraider, which I guess is a diff view that I couldn't seem to turn off even after closing the other file.
Screenshot at 2025-01-13 05-43-12.png
Screenshot at 2025-01-13 05-43-12.png (129.65 KiB) Viewed 25789 times
Renaming and reopening it resulted in this more normal view:
Screenshot at 2025-01-13 05-41-51.png
Screenshot at 2025-01-13 05-41-51.png (55.02 KiB) Viewed 25789 times
Tbh I thought the colors in Romraider were cooler lol that's why I used it :oops:
Cortin
Newbie
Posts: 12
Joined: Sun Dec 01, 2024 9:25 pm

Re: 2004 Baja MT

Post by Cortin »

Hi
I have an A2WD012B ECU.
read - ok.
Write:

Code: Select all

	A302772B	A302772B	YES
[2025-04-06 02:39:41.688] (DD) Response: 
[2025-04-06 02:39:41.703] (II) FB15	0x00070000	0x00010000[2025-04-06 02:39:41.703] (DD) Sent: be ef 00 09 02 00 07 00 00 00 01 00 00 c0 
[2025-04-06 02:39:41.735] (DD) Response: be ef 00 05 42 93 aa b2 77 5a 
[2025-04-06 02:39:41.735] (DD) ROM CRC: 0x93aab277 IMG CRC: 0xef2009a1
	93AAB277	EF2009A1	NO
[2025-04-06 02:39:41.944] (DD) Response: 
[2025-04-06 02:39:41.949] (II) Different blocks : 10, 13, 15,  (total: 3)
[2025-04-06 02:39:41.949] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-06 02:39:41.949] (II) Check max message length[2025-04-06 02:39:41.949] (DD) Sent: be ef 00 01 05 b3 
[2025-04-06 02:39:41.955] (DD) Response: be ef 00 05 45 00 00 02 00 f9 
: 0x0200
[2025-04-06 02:39:41.955] (II) Check flashblock size[2025-04-06 02:39:41.956] (DD) Sent: be ef 00 01 06 b4 
[2025-04-06 02:39:41.960] (DD) Response: be ef 00 05 46 00 00 10 00 08 
: 0x1000
[2025-04-06 02:39:41.960] (II) Test write mode off, perform actual flash write
[2025-04-06 02:39:41.961] (DD) Sent: be ef 00 01 20 ce 
[2025-04-06 02:39:41.964] (DD) Response: be ef 00 03 7f 20 06 55 
[2025-04-06 02:39:41.964] (EE) Wrong response from ECU
[2025-04-06 02:39:41.964] (II) Block 10 reflash failed.
MiikaS
Administrator
Posts: 912
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: 2004 Baja MT

Post by MiikaS »

Cortin wrote: Sat Apr 05, 2025 11:43 pm Hi
I have an A2WD012B ECU.
read - ok.
Write:

Code: Select all

	A302772B	A302772B	YES
[2025-04-06 02:39:41.688] (DD) Response: 
[2025-04-06 02:39:41.703] (II) FB15	0x00070000	0x00010000[2025-04-06 02:39:41.703] (DD) Sent: be ef 00 09 02 00 07 00 00 00 01 00 00 c0 
[2025-04-06 02:39:41.735] (DD) Response: be ef 00 05 42 93 aa b2 77 5a 
[2025-04-06 02:39:41.735] (DD) ROM CRC: 0x93aab277 IMG CRC: 0xef2009a1
	93AAB277	EF2009A1	NO
[2025-04-06 02:39:41.944] (DD) Response: 
[2025-04-06 02:39:41.949] (II) Different blocks : 10, 13, 15,  (total: 3)
[2025-04-06 02:39:41.949] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-06 02:39:41.949] (II) Check max message length[2025-04-06 02:39:41.949] (DD) Sent: be ef 00 01 05 b3 
[2025-04-06 02:39:41.955] (DD) Response: be ef 00 05 45 00 00 02 00 f9 
: 0x0200
[2025-04-06 02:39:41.955] (II) Check flashblock size[2025-04-06 02:39:41.956] (DD) Sent: be ef 00 01 06 b4 
[2025-04-06 02:39:41.960] (DD) Response: be ef 00 05 46 00 00 10 00 08 
: 0x1000
[2025-04-06 02:39:41.960] (II) Test write mode off, perform actual flash write
[2025-04-06 02:39:41.961] (DD) Sent: be ef 00 01 20 ce 
[2025-04-06 02:39:41.964] (DD) Response: be ef 00 03 7f 20 06 55 
[2025-04-06 02:39:41.964] (EE) Wrong response from ECU
[2025-04-06 02:39:41.964] (II) Block 10 reflash failed.
Test with this:
https://drive.google.com/file/d/1ublgG9 ... p=drivesdk
Cortin
Newbie
Posts: 12
Joined: Sun Dec 01, 2024 9:25 pm

Re: 2004 Baja MT

Post by Cortin »

another laptop on win7.
sub_ecu_denso_sh7055_04:

Code: Select all

[2025-04-06 12:15:56.652] (DD) Response: 
[2025-04-06 12:15:56.668] (II) Different blocks : 10, 13, 15,  (total: 3)
[2025-04-06 12:15:56.668] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-06 12:15:56.668] (II) Check max message length[2025-04-06 12:15:56.668] (DD) Sent: be ef 00 01 05 b3 
[2025-04-06 12:15:56.668] (DD) Response: be ef 00 05 45 00 00 02 00 f9 
: 0x0200
[2025-04-06 12:15:56.668] (II) Check flashblock size[2025-04-06 12:15:56.668] (DD) Sent: be ef 00 01 06 b4 
[2025-04-06 12:15:56.668] (DD) Response: be ef 00 05 46 00 00 10 00 08 
: 0x1000
[2025-04-06 12:15:56.668] (II) Test write mode off, perform actual flash write
[2025-04-06 12:15:56.668] (DD) Sent: be ef 00 01 20 ce 
[2025-04-06 12:15:56.668] (DD) Response: be ef 00 03 7f 20 06 55 
[2025-04-06 12:15:56.684] (EE) Wrong response from ECU
[2025-04-06 12:15:56.684] (II) Block 10 reflash failed.
sub_ecu_denso_sh7055_densocan:

Code: Select all

[2025-04-06 12:16:52.466] (DD) Response: 
[2025-04-06 12:16:52.481] (II) Different blocks : 10, 13, 15,  (total: 3)
[2025-04-06 12:16:52.481] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-06 12:16:52.481] (II) Check max message length[2025-04-06 12:16:52.481] (DD) Sent: 00 00 07 e0 be ef 00 01 05 
[2025-04-06 12:16:52.481] (DD) Response: 00 00 07 e8 be ef 00 05 45 00 00 02 00 
: 0x0200
[2025-04-06 12:16:52.481] (II) Check flashblock size[2025-04-06 12:16:52.481] (DD) Sent: 00 00 07 e0 be ef 00 01 06 
[2025-04-06 12:16:52.481] (DD) Response: 00 00 07 e8 be ef 00 05 46 00 00 10 00 
: 0x1000
[2025-04-06 12:16:52.481] (II) Test write mode off, perform actual flash write
[2025-04-06 12:16:52.481] (DD) Sent: 00 00 07 e0 be ef 00 01 20 
[2025-04-06 12:16:52.481] (DD) Response: 00 00 07 e8 be ef 00 03 7f 20 06 
[2025-04-06 12:16:52.481] (EE) Wrong response from ECU: Not a valid answer
[2025-04-06 12:16:52.481] (II) Block 10 reflash failed.
MiikaS
Administrator
Posts: 912
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: 2004 Baja MT

Post by MiikaS »

Can you get kernel from development branch, there was a problem that those were changed to older versions for some unknown reason. Kernels from development branch should work.
Cortin
Newbie
Posts: 12
Joined: Sun Dec 01, 2024 9:25 pm

Re: 2004 Baja MT

Post by Cortin »

MiikaS wrote: Sun Apr 06, 2025 8:47 am Can you get kernel from development branch, there was a problem that those were changed to older versions for some unknown reason. Kernels from development branch should work.
https://github.com/miikasyvanen/FastECU ... nt/kernels
these?
MiikaS
Administrator
Posts: 912
Joined: Sat Jul 04, 2020 7:13 pm
Location: Mikkeli, Finland

Re: 2004 Baja MT

Post by MiikaS »

Cortin wrote: Sun Apr 06, 2025 9:00 am
MiikaS wrote: Sun Apr 06, 2025 8:47 am Can you get kernel from development branch, there was a problem that those were changed to older versions for some unknown reason. Kernels from development branch should work.
https://github.com/miikasyvanen/FastECU ... nt/kernels
these?
Yes
Cortin
Newbie
Posts: 12
Joined: Sun Dec 01, 2024 9:25 pm

Re: 2004 Baja MT

Post by Cortin »

MiikaS wrote: Sun Apr 06, 2025 9:01 am
Cortin wrote: Sun Apr 06, 2025 9:00 am
MiikaS wrote: Sun Apr 06, 2025 8:47 am Can you get kernel from development branch, there was a problem that those were changed to older versions for some unknown reason. Kernels from development branch should work.
https://github.com/miikasyvanen/FastECU ... nt/kernels
these?
Yes
no changes.
At the same time ecuflesh and ecuedit write without problems
Attachments
12.JPG
12.JPG (159.25 KiB) Viewed 23569 times
Post Reply