FastECU_OEM: first test version published

[MiikaS]

First test version uploaded to github and made public:
https://github.com/miikasyvanen/fastecu-oem

There could be some bugs etc. but due to little slow development I decide to release the code for people to test read and write capabilities, map editing and so on. Latest update (27.11.2022) adds EcuFlash definition support to software.

Features that are confirmed working so far:

- wrx02 method read and compare (K-Line)
- fxt02 method read/write (K-Line / CAN)
- sti04 method read/write (K-Line / CAN)
- sti05 method read/write (K-Line / CAN)
- Logging of basic ssm values


Features that do not work yet:

- subarucan read/write (CAN)


Features that are under development:

- Logging displays (extra gauges and line log)
- wrx02 write (k-line)
- Subaru Hitachi WA12212970WWW 512kb (CAN)
- sti04/sti05/subarucan ecutek (already known but not yet added/tested)


Features that are on to-do list:

- Subaru Hitachi WA12212920/30/40
- Subaru Denso N/A
- Nissan K-Line/CAN
- EDC15/16 access


Using:

Precompiled folder includes compiled software binaries. For Windows versions unzip and run exe, for Linux version unzip and run 'sh FastECU.sh'.

In 'Edit->Settings' you can change files/folders and select RomRaider or EcuFlash definition is used as primary definition set.

[MiikaS]

Some updates done:

- fxt02 method should fully work now.
- Logging basic SSM parameters work, only need to add ECU ID manually to logger.cfg file.
- Linux precompiled is also standalone, no need to install Qt anymore. Software starts with running FastECU.sh. Both FastECU files needs to be executable.

Some known issues:
- on wrx02 method only ECU read works.
- Some 16-bit ROM data not showing correctly.
- sti05 method should work, still untested.
- Logvalues maybe not updated on GUI.

[MiikaS]

More updates:

- CAN read/compare/write features added to software
- fxt02 and sti04 methods tested now also via CAN. sti05 (K-Line and CAN) and subarucan methods should work, but yet untested.
- fxt02 method K-Line apparently works atleast with OP2 cable on bench, but ECU powering timing is critical. Confirming timing later, but approx. when countdown is at 2s.
- Unknown ECU automatically added to logger.cfg with default parameters. Parameter change works via menu or clicking mouse right button on map/log parameter area.

Some known issues:

- Newest OP2 dll don't work atleast with fxt02 method, maybe others aswell. Known issue also with other ECU softwares. Future releases bundled with older working dll.

Next in TO-DO list:

- Adding EcuFlash definition support
- wrx02 method compare/write
- Logging gauges etc.
- Some Hitachi ECUs

[SergArb]

Hi, ECU powering timing maybe different. My power source have some delay before it's starts fully. So it works with 2s 
Hitachi ECUs will be interesting  8)

[MiikaS]

Yes, try to confirm that later with my ECU too

Hitachis would be really nice add to this, I need to dig one test ECU from somewhere to start reverse engineering it.

[SergArb]

I can share my OP to internet, have some Hitachi 512k CAN ECU. Writing via CAN, reading may be done via K-Line.
I have tested software for sharing 

[SergArb]

MiikaS, do you need access to my OP with connected Hitachi ECU for development?

[MiikaS]

Send you a message regarding this. I think remote access to OP is not the best/easiest way atleast in these first steps of accessing ECU.

[AndrewC]

Hi,

First of all massive praise for doing this, not many people have the aptitude and patience for this type of work.

I have downloaded and installed FastECU_OEM and tried it using my bench harness on a 2006 EU WRX/STi (SH7058) and a 2008 EU WRX (SH7058S) ECU.

I verified read/write on both ECUs using other software and checked that they have OEM images installed prior to trying FastECU.

Here is what I found:

STi05 K-Line - Connects, downloads kernel and reads data, but when I click OK in dialog box "ECU operation was successful, press OK to exit", the program crashes.

STi05 CAN:

[2022-12-10 15:24:32.301]  Read memory with flashmethod  and kernel C:/Users/user/FastECU_OEM/kernels/ssmk_CAN_SH7058.bin
[2022-12-10 15:24:32.301]  Connecting to Subaru 05 32-bit CAN bootloader, please wait...
[2022-12-10 15:24:32.317]  Start in 3
[2022-12-10 15:24:33.332]  Start in 2
[2022-12-10 15:24:34.332]  Start in 1
[2022-12-10 15:24:35.332]  Turn ignition on NOW!
[2022-12-10 15:24:36.473]  Connected to bootloader, start kernel upload
[2022-12-10 15:24:36.473]  Initializing Subaru 05 32-bit CAN kernel upload, please wait...
[2022-12-10 15:24:36.473]  Start sending kernel... please wait...
[2022-12-10 15:24:44.503]  Kernel uploaded, starting kernel...
[2022-12-10 15:24:44.503]  Reading ROM from Subaru 02 32-bit using CAN
[2022-12-10 15:24:44.519]  Page data request failed!
[2022-12-10 15:24:44.519] 

Subarucan CAN:

[2022-12-10 15:50:18.675]  Read memory with flashmethod  and kernel C:/Users/user/FastECU_OEM/kernels/ssmk_CAN_SH7058.bin
[2022-12-10 15:50:18.681]  Connecting to Subaru 32-bit CAN bootloader, please wait...
[2022-12-10 15:50:18.681]  Start in 3
[2022-12-10 15:50:19.681]  Start in 2
[2022-12-10 15:50:20.681]  Start in 1
[2022-12-10 15:50:21.681]  Turn ignition on NOW!
[2022-12-10 15:50:22.822]  Connected to bootloader, start kernel upload
[2022-12-10 15:50:22.822]  Initializing Subaru 32-bit CAN kernel upload, please wait...
[2022-12-10 15:50:22.822]  Start sending kernel... please wait...
[2022-12-10 15:50:30.852]  Kernel uploaded, starting kernel...
[2022-12-10 15:50:30.852]  Reading ROM from Subaru 32-bit using CAN
[2022-12-10 15:50:30.868]  Page data request failed!
[2022-12-10 15:50:30.868] 


I hope this information is of some use to you.

[MiikaS]

Hi,

First of all massive praise for doing this, not many people have the aptitude and patience for this type of work.

I have downloaded and installed FastECU_OEM and tried it using my bench harness on a 2006 EU WRX/STi (SH7058) and a 2008 EU WRX (SH7058S) ECU.

I verified read/write on both ECUs using other software and checked that they have OEM images installed prior to trying FastECU.

Here is what I found:

STi05 K-Line - Connects, downloads kernel and reads data, but when I click OK in dialog box "ECU operation was successful, press OK to exit", the program crashes.

STi05 CAN:

[2022-12-10 15:24:32.301]  Read memory with flashmethod  and kernel C:/Users/user/FastECU_OEM/kernels/ssmk_CAN_SH7058.bin
[2022-12-10 15:24:32.301]  Connecting to Subaru 05 32-bit CAN bootloader, please wait...
[2022-12-10 15:24:32.317]  Start in 3
[2022-12-10 15:24:33.332]  Start in 2
[2022-12-10 15:24:34.332]  Start in 1
[2022-12-10 15:24:35.332]  Turn ignition on NOW!
[2022-12-10 15:24:36.473]  Connected to bootloader, start kernel upload
[2022-12-10 15:24:36.473]  Initializing Subaru 05 32-bit CAN kernel upload, please wait...
[2022-12-10 15:24:36.473]  Start sending kernel... please wait...
[2022-12-10 15:24:44.503]  Kernel uploaded, starting kernel...
[2022-12-10 15:24:44.503]  Reading ROM from Subaru 02 32-bit using CAN
[2022-12-10 15:24:44.519]  Page data request failed!
[2022-12-10 15:24:44.519] 

Subarucan CAN:

[2022-12-10 15:50:18.675]  Read memory with flashmethod  and kernel C:/Users/user/FastECU_OEM/kernels/ssmk_CAN_SH7058.bin
[2022-12-10 15:50:18.681]  Connecting to Subaru 32-bit CAN bootloader, please wait...
[2022-12-10 15:50:18.681]  Start in 3
[2022-12-10 15:50:19.681]  Start in 2
[2022-12-10 15:50:20.681]  Start in 1
[2022-12-10 15:50:21.681]  Turn ignition on NOW!
[2022-12-10 15:50:22.822]  Connected to bootloader, start kernel upload
[2022-12-10 15:50:22.822]  Initializing Subaru 32-bit CAN kernel upload, please wait...
[2022-12-10 15:50:22.822]  Start sending kernel... please wait...
[2022-12-10 15:50:30.852]  Kernel uploaded, starting kernel...
[2022-12-10 15:50:30.852]  Reading ROM from Subaru 32-bit using CAN
[2022-12-10 15:50:30.868]  Page data request failed!
[2022-12-10 15:50:30.868] 


I hope this information is of some use to you.

Hi,

Thanks! Hope this software will be useful for people in future

Just checked the CAN code and there was kernel addressing bug that loads kernel in wrong address in RAM memory and prevents it from starting. Fixed that, but crash problem might still be present, need to check that too if it is still being present. Just download precompiled and copy binary to software folder and test it.

[MiikaS]

Just successfully tested with 2006 WRX ECU, both K-Line and CAN in Win7 and Linux.

Crash after successful read could be related to definition settings. If in 'Edit->Settings' has both RomRaider and EcuFlash definitions set, make sure you have some definitions where they points to. I will add both definitions in right place in precompiled zip as a base defs to come with software, as I just realized that somehow they are missing... will push new version to github right now.

[AndrewC]

Crash IS definition related, if there is no definition found for the Rom ID in the image read (or file loaded), the program terminates.

I can confirm that 2006 (SH7058) read works in both k-line and CAN.

2008 (SH7058S) CAN read works, I tried a CAN write on this ECU which reported as successful, but the ECU is now 'bricked', I'll recover it and retry, this time I'll save the log.

Not sure if it is relevant as I haven't seen any Windows problems, but I am using Windows 10 Pro, x64.

Andrew...

[MiikaS]

I will try to fix that definition issue asap.

Can you try to test write with sti05 CAN? Somehow I missed writing last time I tested and now test writing fails every time it sends changed bytes to ECU. With sti04 it works fine and they use the same subroutines so I'm thinking that if it is kernel related.

And does the test write work with your 08 ECU? They use the same kernel so need to know if it somehow depends on processor model (SH7058 vs. SH7058S).

[AndrewC]

When I tried 05 CAN test write I got errors so I didn't try an actual write, I will recover my 08 ECU and try a test write with that.

[MiikaS]

When I tried 05 CAN test write I got errors so I didn't try an actual write, I will recover my 08 ECU and try a test write with that.

Found the cause in test write error from the SH7058 kernel. There was difference in writing function that causes it to return fail in test write. I will inform when it is fixed.