Bench flashing 06 Legacy M32R K-Line WA12212970WWW

[locomoco]

Hello, I have used FastECU to successfully read my ROM and flash it back. I wanted to play around with it and thought I could just zero out something that looked to me like a DTC table (I have no experience with reverse engineering, learning by doing haha). Well, after flashing the ROM and letting FastECU correct the checksum (with no definition, I used the sub_ecu_hitachi_m32r_kline protocol) my cluster shows "Err HC" and the car does not crank. The test mode connector also does not work. The fans don't spin, FastECU cannot communicate with the ECU.

I'm assuming it's not a checksum issue as that should be catched by the bootloader upon flashing, right? The flash should fail?
I guess my only option now is to bench flash it. FastECU-m32r-flasher tool states in the README that it does not yet support the 70WWW MCU. But I noticed that with FastECU 0.1.0 beta.5 there is a new sub_ecu_hitachi_m32r_kline_recovery protocol. Is there any documentation on how to use it?

I am attaching my stock ROM. I set the two bytes at 0x7b500 to "00 00" which bricked the ECU. Does anyone happen to have a definition for it? ECU ID 4544307206 according to RomRaider Logger, should be internal id string D5834EC7 I think (at 0x10529)

2006 Legacy EUDM 2.0R EJ204 5MT dual range.bin.7z

(172.78 KiB) Downloaded 402 times

Appreciate any help or tips

[locomoco]

I have taken the ECU apart to get some pictures of the PCB as that might be useful? I uploaded it on Google Drive for maximum resolution.

[SergArb]

*970 ECU's can't be recovered with FastECU for now. Some time ago we tried to find a cheap way, but still no luck.
Fastest way is replace spare ECU and resolder eeprom chip from original one.

[locomoco]

The MCU on the board has WWW written at the end? What is the difference between WWW and non-WWW?

I have ordered a PCMFlash Dongle with Module 16 which supposedly should be able to bench flash it, we'll see. It's a cheap dongle I found online. I just don't know how I'd wire things up tho. I figured FastECU would use the same method.

Also, what is the new sub_ecu_hitachi_m32r_kline_recovery protocol meant for then?

[SergArb]

*UJ70 = WA12212970WWW, just shorter.
Recovery is only available for UJ20/30 MCU's.
PCMFlash can't recover bricked UJ/WA series.

[locomoco]

Oh no :/
I had done some research today and read something about iProg Pro recovery using a special script that I found for 300-400$. Is that what I would need then? And a iProg Pro (which I saw clones of for 60-90€)?

I guess a used ECU will be easiest yeah... Sad
And then I move the little EEPROM with 8 pins that only stores my immobilizer thing right? I could probably even read and flash it with a CH341 programmer tho, right?

[locomoco]

This is a 500€ beater car that I bought to have fun with. My Forester XT is my main car. I have no problem letting the car sit for a little bit whilst I try to unbrick this ECU. Is there anything I could help you guys figure out how to bench flash this thing?
On ecutools.eu I found the information that WA12212970WWW is a rebranded M32170F4VFP. Is that correct? I found Renesas documentation for that which has some info on flashing. I am pretty sure you guys already have this information and tried flashing it using that method, right? Why did that not work?

[SergArb]

Oh no :/
I had done some research today and read something about iProg Pro recovery using a special script that I found for 300-400$. Is that what I would need then? And a iProg Pro (which I saw clones of for 60-90€)?

This script will work only with ORGIGINAL IProg Pro, not with clones...

I guess a used ECU will be easiest yeah... Sad
And then I move the little EEPROM with 8 pins that only stores my immobilizer thing right? I could probably even read and flash it with a CH341 programmer tho, right?

Yes, easy.

[SergArb]

On ecutools.eu I found the information that WA12212970WWW is a rebranded M32170F4VFP. Is that correct? I found Renesas documentation for that which has some info on flashing. I am pretty sure you guys already have this information and tried flashing it using that method, right? Why did that not work?

Sure we tried it. Not working. They changed bootloader. No one knows how and what changed.
J-tag tests also didn't completed. Now development team in another "stasis" period...

[locomoco]

That sucks. Very unfortunate.
I will be ordering a new ECU then...
Thank you for your efforts tho

[locomoco]

@SergArb I am receiving my new ECU today. Can you tell me which EEPROM contains the immobilizer code? I wanna read it with my CH341A programmer and flash it to the new ECU

[locomoco]

Maybe this one close to the MCU?
https://drive.google.com/open?id=10FvHR ... AAB63S_TP0

[locomoco]

I got my programmer to work and read that 93C66 EEPROM successfully, it looks correct

[locomoco]

Edit:
I got it working nevermind. I tried reading multiple times and it was always different data so I think conneciton was unreliable. The ECU I got was pretty dusty so I had to clean it with isopropyl. I also had to try attaching the clip multiple times. Eventually I was able to read the correct EEPROM with VIN ^^

---
Original message:

Ok so I received my new to me ECU. I read its EEPROM and it looks empty. No VIN, less data.

Here is a diff (with my VIN and part of the immo data redacted)

Code: Select all

[locomoco@locomoco ~]$ diff -y legacy_eeprom.hex.txt legacy_replacement_eeprom.hex.txt 
00000000: 0000 0000 0000 0000 0000 0100 0000 0000  .......... | 00000000: 0000 0000 0000 0100 0000 0000 0000 0000  ..........
00000010: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 00000010: 0000 1000 0000 6b87 0000 ffff ffff ffff  ......k...
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 00000020: ffff ffff ffff ffff bfff feff 0000 0000  ..........
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
00000040: 0000 0000 0000 0010 0000 0000 4124 0019  .......... | 00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
00000050: 1102 8048 2687 a600 XXXX XXXX XXXX XXXX  ...H&XXXXX | 00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
00000060: XXXX XXXX XXXX 0000 0000 0000 0000 0000  XXXXX..... | 00000060: 0000 0000 0000 0000 0000 0000 0000 0010  ..........
00000070: 00ff 0000 0000 0000 0000 0000 0000 0000  .......... | 00000070: 0000 0000 0000 0004 2000 0000 0200 0000  ........ .
00000080: 0000 0080 f651 aa9c 004b 0000 0000 0000  .....Q...K | 00000080: 0000 0000 0000 0000 0820 0000 0000 0000  ......... 
00000090: 0000 0000 464a 4231 3550 4d4c 3634 3047  ....FJB15P | 00000090: 0040 0000 0000 0000 0000 0000 0080 0000  .@........
000000a0: XXXX XXXX XXXX 0000 0000 0000 0000 0000  XXXXXX.... | 000000a0: 0000 0000 0000 0040 0020 0001 0000 0000  .......@. 
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
000000c0: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 000000c0: 0010 0014 0000 0000 0000 0000 0000 0000  ..........
000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
000000e0: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 000000e0: 0000 0000 0003 0000 0000 0000 0000 0000  ..........
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
00000100: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 00000100: 0000 0000 0000 0000 0000 0008 0000 0000  ..........
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 00000120: 0000 2000 0000 0000 0000 0000 0000 1000  .. .......
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 00000130: 0000 0000 0080 0000 0000 0000 0000 0000  ..........
00000140: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 00000140: 0800 0000 0000 0000 0000 0000 0000 0000  ..........
00000150: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   00000150: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 00000160: 0000 0000 0000 0000 0000 0000 0000 2000  ..........
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 00000190: 0010 0000 0000 0000 0000 0000 0000 0000  ..........
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 000001a0: 0008 0000 0000 0000 0000 0000 0000 0000  ..........
000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 000001b0: 0000 0000 0000 0000 0000 0000 8000 0000  ..........
000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  .......... | 000001e0: 0000 0000 0000 0000 0040 0000 0000 0200  .........@
000001f0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........   000001f0: 0000 0000 0000 0000 0000 0000 0000 0000  ..........

Is this a virgin ECU with empty immobilizer EEPROM or did I do something wrong? My IMSProg settings are:
Type 93_EEPROM
Manufacturer MICROCHIP
Name 93C66 (16)
Size 512 B
Page size 16
VCC 3,3V (I modified my board to 5V on 3.3V lane)

[SergArb]

Sometimes, need to desolder chip from board to get a clear reading. If data every times differs, 100% need to do it.