FastECU

For the future, these ECUs uses bits for DTC groups, not actual DTC code from memory. If you need to remove air pump codes, it can be done for whole system with one change.

That recovery protocol is basicly sending many requests to connect to ECU, maybe working if ECU software starts normal. When selected, turn IGN on just before pressing OK.

In your case I think it is possible checksum issue as I just noticed that there is a bug on that model if it doesn't know ECU ID... But checksum issue shouldn't make ECU completely bricked as far as I know/remember.

as mentioned in the edit, I had to clean the board with isopropyl alcohol and try to put the clip on multiple times as it wasn't seating on the solter joints well. It eventually worked fine and the car runs great now

MiikaS wrote: Sun May 24, 2026 9:34 pm For the future, these ECUs uses bits for DTC groups, not actual DTC code from memory. If you need to remove air pump codes, it can be done for whole system with one change.

That recovery protocol is basicly sending many requests to connect to ECU, maybe working if ECU software starts normal. When selected, turn IGN on just before pressing OK.

In your case I think it is possible checksum issue as I just noticed that there is a bug on that model if it doesn't know ECU ID... But checksum issue shouldn't make ECU completely bricked as far as I know/remember.

Oh I saw your message just now, didn't realize there was a new page in this thread.

Thank you for the info! As my Forester is down right now I don't really wanna mess with the legacy again. But I might try the recovery flash to flash back the original ROM. I thought it was definitely bricked because the ignition switch didn't do anything and my cluster showed some Error. If I can save it I'd have a backup ECU to play around with heh

I don't care about the 2nd air code right now. I'm starting to get tired of this car to be frank. Pondering about parting it out at this point coz it's just annoying me :^)
We will see, maybe I'll be up to play around with it again once my Forester is running

Hey @MiikaS, thank you for the tip about the single bit flag for toggling SAI again.
I used Claude to go through the process of understanding the M32R assembly in Ghidra. I only understand a fraction to be frank But in the end I concluded that I'd have to change address 0x04E1A4 from 7C to 7F to go from a conditional branch to a forced branch to skip the SAI function.
Does that make sense? Your statement of DTC groups initially sounded to me like there was gonna be a table where I can toggle DTCs.
Also, about the checksum issue, how would I fix the ECU ID issue for detecting checksums? Did I use the wrong flash protocol last time?
Best Regards
Eren

Well, I went over this again coz I didn't have a good feeling and I think my previous findings were wrong. It would not disable all codes, it would stop checking if the valves are closed hence only disabling P2441 technically...

<table type="Switch" name="Secondary Air System (SAI)"
storageaddress="0x7A550" category="Diagnostic Trouble Codes" sizey="3">
<description>Disables Secondary Air Injection related codes. Off-road use only.</description>
<state name="Enabled" data="FD F0 32" />
<state name="Disabled" data="00 C0 00" />
</table>

This is the definition I wrote for RR now. It should disable the SAI DTC group. I'll first try to recover my old ECU before I try this change tho lol

MiikaS wrote: Sun May 24, 2026 9:34 pm.
In your case I think it is possible checksum issue as I just noticed that there is a bug on that model if it doesn't know ECU ID... But checksum issue shouldn't make ECU completely bricked as far as I know/remember.

Well, I can't seem to be able to flash it on my old "bricked" ECU no matter how many tries I give it, no matter if sub_ecu_hitachi_m32r_kline or _recovery, it's always invalid response from ECU, so I think the checksum bricked the ECU idk

I don't wanna try flashing my new ECU to be frank