Page 1 of 2
2004 Baja MT
Posted: Fri Dec 20, 2024 5:02 am
by scooobydu
I have an A2ZJ500L ECU, which should be the same as the 2004 Forester FXT MT. I can't seem to read from it though:
Code: Select all
[2024-12-19 05:16:45.634] Read memory with flashmethod 'sub_ecu_denso_sh7055_02' and kernel 'kernels/ssmk_kline_sh7055.bin'
[2024-12-19 05:16:48.370] Connecting to Subaru 02 32-bit K-Line bootloader, please wait...
[2024-12-19 05:16:49.112] Sent to bootloader: 4d ff b4
[2024-12-19 05:16:49.316] Response from bootloader:
[2024-12-19 05:16:49.318] Bad response from bootloader
[2024-12-19 05:16:49.320] Cannot connect to bootloader, testing if kernel is alive
I tried sub_ecu_denso_sh7055_04 as well. I am using a Tactrix on Linux.
Now this ecu probably has been flashed before, is that an issue? How do I flash over whatever is in there? I have no idea what the previous owner did.
Re: 2004 Baja MT
Posted: Sat Dec 21, 2024 6:40 am
by scooobydu
Ok I hadn't known about the green flashing plug
. I now get a different error:
Code: Select all
[2024-12-20 06:11:48.421] Read memory with flashmethod 'sub_ecu_denso_sh7055_04' and kernel 'kernels/ssmk_kline_sh7055.bin'
[2024-12-20 06:11:50.946] Connecting to Subaru 04 32-bit K-Line bootloader, please wait...
[2024-12-20 06:11:51.124] Checking if kernel is already running...
[2024-12-20 06:11:51.825] Kernel NOT running, requesting access
[2024-12-20 06:11:51.981] Initializing bootloader
[2024-12-20 06:11:51.982] SSM init
[2024-12-20 06:11:52.492] ECU ID = 3712485006
[2024-12-20 06:11:52.534] Start communication ok
[2024-12-20 06:11:52.588] Request timing parameters ok
[2024-12-20 06:11:52.649] Seed request ok
[2024-12-20 06:11:52.662] Sending seed key
[2024-12-20 06:11:52.745] Seed key ok
[2024-12-20 06:11:52.802] Start diagnostic session ok
[2024-12-20 06:11:52.816] Initializing Subaru 04 32-bit K-Line kernel upload, please wait...
[2024-12-20 06:11:52.819] Unable to open kernel file for reading
I talked to a tuner and he claimed it was stock and not locked. CVN is 433CAF44/2F5E6197, although I doubt I have anyone to compare this checksum against.
Re: 2004 Baja MT
Posted: Sat Dec 21, 2024 8:54 am
by MiikaS
Hi!
It looks ok otherwise, but it's not finding kernel file ssmk_kline_sh7055.bin to upload.
In Linux, it should be found on users home folder -> .config/FastECU/<version>/kernels
Can you please check if it is found? And what version of FastECU?
Re: 2004 Baja MT
Posted: Sat Jan 11, 2025 10:27 pm
by scooobydu
I got it working.
Yes the file was here: ~/.config/FastECU/0.1.0-beta.2/kernels/ssmk_kline_sh7055.bin
It was dated Dec 17 so I think it was already present on the first attempt.
I ended up cloning the git repo and placing the appimage there, where another copy of the kernel is present. Then I ran
Code: Select all
./FastECU-0.1.0-beta.2-linux-x86_64.AppImage
and it seemed to find it when it was in the same directory as the appimage.
I got a strange ecu image out of it, doesn't seem to match the stock rom "tomsbaja.hex" on romraider at all with lower boost values and really strange zeroed tables (zeroed idle c? negative base timing values?). I'd attach it but it seems the forum doesn't allow bin or hex extensions.
Re: 2004 Baja MT
Posted: Sat Jan 11, 2025 10:30 pm
by scooobydu
Ah it seems gz is an allowed extension.
Re: 2004 Baja MT
Posted: Sat Jan 11, 2025 11:18 pm
by MiikaS
Good you got it working! I need to check dirs again to make sure that it looks for right place as it was working when I test it some time ago. I'll take a look at the ROM tomorrow.
Re: 2004 Baja MT
Posted: Sun Jan 12, 2025 8:42 pm
by MiikaS
scooobydu wrote: Sat Jan 11, 2025 10:27 pm
I got a strange ecu image out of it, doesn't seem to match the stock rom "tomsbaja.hex" on romraider at all with lower boost values and really strange zeroed tables (zeroed idle c? negative base timing values?). I'd attach it but it seems the forum doesn't allow bin or hex extensions.
Looked at the ROM and what I see, looks normal. Base advance values are many times negative on high load/low rpm area. That corner is an area where it would never be, so basicly it doesn't matter what the values are but it looks nicer that way
Idle Target C table shows normal idle values for me. All other tables also looks quite normal.
Re: 2004 Baja MT
Posted: Mon Jan 13, 2025 3:47 pm
by scooobydu
I guess I got confused by this view in Romraider, which I guess is a diff view that I couldn't seem to turn off even after closing the other file.
- Screenshot at 2025-01-13 05-43-12.png (129.65 KiB) Viewed 25787 times
Renaming and reopening it resulted in this more normal view:
- Screenshot at 2025-01-13 05-41-51.png (55.02 KiB) Viewed 25787 times
Tbh I thought the colors in Romraider were cooler lol that's why I used it
Re: 2004 Baja MT
Posted: Sat Apr 05, 2025 11:43 pm
by Cortin
Hi
I have an A2WD012B ECU.
read - ok.
Write:
Code: Select all
A302772B A302772B YES
[2025-04-06 02:39:41.688] (DD) Response:
[2025-04-06 02:39:41.703] (II) FB15 0x00070000 0x00010000[2025-04-06 02:39:41.703] (DD) Sent: be ef 00 09 02 00 07 00 00 00 01 00 00 c0
[2025-04-06 02:39:41.735] (DD) Response: be ef 00 05 42 93 aa b2 77 5a
[2025-04-06 02:39:41.735] (DD) ROM CRC: 0x93aab277 IMG CRC: 0xef2009a1
93AAB277 EF2009A1 NO
[2025-04-06 02:39:41.944] (DD) Response:
[2025-04-06 02:39:41.949] (II) Different blocks : 10, 13, 15, (total: 3)
[2025-04-06 02:39:41.949] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-06 02:39:41.949] (II) Check max message length[2025-04-06 02:39:41.949] (DD) Sent: be ef 00 01 05 b3
[2025-04-06 02:39:41.955] (DD) Response: be ef 00 05 45 00 00 02 00 f9
: 0x0200
[2025-04-06 02:39:41.955] (II) Check flashblock size[2025-04-06 02:39:41.956] (DD) Sent: be ef 00 01 06 b4
[2025-04-06 02:39:41.960] (DD) Response: be ef 00 05 46 00 00 10 00 08
: 0x1000
[2025-04-06 02:39:41.960] (II) Test write mode off, perform actual flash write
[2025-04-06 02:39:41.961] (DD) Sent: be ef 00 01 20 ce
[2025-04-06 02:39:41.964] (DD) Response: be ef 00 03 7f 20 06 55
[2025-04-06 02:39:41.964] (EE) Wrong response from ECU
[2025-04-06 02:39:41.964] (II) Block 10 reflash failed.
Re: 2004 Baja MT
Posted: Sat Apr 05, 2025 11:49 pm
by MiikaS
Cortin wrote: Sat Apr 05, 2025 11:43 pm
Hi
I have an A2WD012B ECU.
read - ok.
Write:
Code: Select all
A302772B A302772B YES
[2025-04-06 02:39:41.688] (DD) Response:
[2025-04-06 02:39:41.703] (II) FB15 0x00070000 0x00010000[2025-04-06 02:39:41.703] (DD) Sent: be ef 00 09 02 00 07 00 00 00 01 00 00 c0
[2025-04-06 02:39:41.735] (DD) Response: be ef 00 05 42 93 aa b2 77 5a
[2025-04-06 02:39:41.735] (DD) ROM CRC: 0x93aab277 IMG CRC: 0xef2009a1
93AAB277 EF2009A1 NO
[2025-04-06 02:39:41.944] (DD) Response:
[2025-04-06 02:39:41.949] (II) Different blocks : 10, 13, 15, (total: 3)
[2025-04-06 02:39:41.949] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-06 02:39:41.949] (II) Check max message length[2025-04-06 02:39:41.949] (DD) Sent: be ef 00 01 05 b3
[2025-04-06 02:39:41.955] (DD) Response: be ef 00 05 45 00 00 02 00 f9
: 0x0200
[2025-04-06 02:39:41.955] (II) Check flashblock size[2025-04-06 02:39:41.956] (DD) Sent: be ef 00 01 06 b4
[2025-04-06 02:39:41.960] (DD) Response: be ef 00 05 46 00 00 10 00 08
: 0x1000
[2025-04-06 02:39:41.960] (II) Test write mode off, perform actual flash write
[2025-04-06 02:39:41.961] (DD) Sent: be ef 00 01 20 ce
[2025-04-06 02:39:41.964] (DD) Response: be ef 00 03 7f 20 06 55
[2025-04-06 02:39:41.964] (EE) Wrong response from ECU
[2025-04-06 02:39:41.964] (II) Block 10 reflash failed.
Test with this:
https://drive.google.com/file/d/1ublgG9 ... p=drivesdk
Re: 2004 Baja MT
Posted: Sun Apr 06, 2025 8:40 am
by Cortin
another laptop on win7.
sub_ecu_denso_sh7055_04:
Code: Select all
[2025-04-06 12:15:56.652] (DD) Response:
[2025-04-06 12:15:56.668] (II) Different blocks : 10, 13, 15, (total: 3)
[2025-04-06 12:15:56.668] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-06 12:15:56.668] (II) Check max message length[2025-04-06 12:15:56.668] (DD) Sent: be ef 00 01 05 b3
[2025-04-06 12:15:56.668] (DD) Response: be ef 00 05 45 00 00 02 00 f9
: 0x0200
[2025-04-06 12:15:56.668] (II) Check flashblock size[2025-04-06 12:15:56.668] (DD) Sent: be ef 00 01 06 b4
[2025-04-06 12:15:56.668] (DD) Response: be ef 00 05 46 00 00 10 00 08
: 0x1000
[2025-04-06 12:15:56.668] (II) Test write mode off, perform actual flash write
[2025-04-06 12:15:56.668] (DD) Sent: be ef 00 01 20 ce
[2025-04-06 12:15:56.668] (DD) Response: be ef 00 03 7f 20 06 55
[2025-04-06 12:15:56.684] (EE) Wrong response from ECU
[2025-04-06 12:15:56.684] (II) Block 10 reflash failed.
sub_ecu_denso_sh7055_densocan:
Code: Select all
[2025-04-06 12:16:52.466] (DD) Response:
[2025-04-06 12:16:52.481] (II) Different blocks : 10, 13, 15, (total: 3)
[2025-04-06 12:16:52.481] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-06 12:16:52.481] (II) Check max message length[2025-04-06 12:16:52.481] (DD) Sent: 00 00 07 e0 be ef 00 01 05
[2025-04-06 12:16:52.481] (DD) Response: 00 00 07 e8 be ef 00 05 45 00 00 02 00
: 0x0200
[2025-04-06 12:16:52.481] (II) Check flashblock size[2025-04-06 12:16:52.481] (DD) Sent: 00 00 07 e0 be ef 00 01 06
[2025-04-06 12:16:52.481] (DD) Response: 00 00 07 e8 be ef 00 05 46 00 00 10 00
: 0x1000
[2025-04-06 12:16:52.481] (II) Test write mode off, perform actual flash write
[2025-04-06 12:16:52.481] (DD) Sent: 00 00 07 e0 be ef 00 01 20
[2025-04-06 12:16:52.481] (DD) Response: 00 00 07 e8 be ef 00 03 7f 20 06
[2025-04-06 12:16:52.481] (EE) Wrong response from ECU: Not a valid answer
[2025-04-06 12:16:52.481] (II) Block 10 reflash failed.
Re: 2004 Baja MT
Posted: Sun Apr 06, 2025 8:47 am
by MiikaS
Can you get kernel from development branch, there was a problem that those were changed to older versions for some unknown reason. Kernels from development branch should work.
Re: 2004 Baja MT
Posted: Sun Apr 06, 2025 9:00 am
by Cortin
MiikaS wrote: Sun Apr 06, 2025 8:47 am
Can you get kernel from development branch, there was a problem that those were changed to older versions for some unknown reason. Kernels from development branch should work.
https://github.com/miikasyvanen/FastECU ... nt/kernels
these?
Re: 2004 Baja MT
Posted: Sun Apr 06, 2025 9:01 am
by MiikaS
Re: 2004 Baja MT
Posted: Sun Apr 06, 2025 10:42 am
by Cortin
MiikaS wrote: Sun Apr 06, 2025 9:01 am
Yes
no changes.
At the same time ecuflesh and ecuedit write without problems