Here's something so we can start sharing ECU flash images

OpenECU software executables and source code

Moderator: Freon

Here's something so we can start sharing ECU flash images

Postby cboles » Wed Jun 22, 2005 12:29 pm

I've attached a watered down version of my kernel and reflashing executable which is very safe to use and only allows you to read out the contents of your ECU. It cannot accidentally flash your ECU - the code (and the programming connector) just aren't there. I think this is a good starting point so people can test out their OpenPort to see that it is working well and begin to build a library of ECU dumps for future reference. This software runs on WinXP using the OpenPort interface and works with 2002-2005 WRXs. I have tested it on my 2002 and 2004 WRX. To use it:

* unpack the ecuflash.exe and kernel.hex file to a directory
* open a command line window

* for 2002/2003 run

ecuflash /c com5 /m wrx2002 /k kernel.hex /dq test

* for 2004/2005 run

ecuflash /c com5 /m wrx2004 /k kernel.hex /dq test

* where "com5" is the actual com port your OpenPort appears on
* follow the instruction the program gives, and after it is done turn off your car again and unplug the test mode connector

* now you should have two files:

test_cpu.hex
test_tpu.hex

* the *_cpu.hex file is a dump of the main flash memory, like the others on the openecu.org site, with zero padding for the 0x20000-0x27FFF RAM area
* the *_tpu.hex file is a dump of the TPU flash memory, like the others on the openecu.org site. the TPU code doesn't seem to change much, but i'd like to see these dumps anyway just to be sure.

* upload your files to the appropriate "Technical (ECU Reverse Engineering)" forum. Include the firmware revision text located at address 0x200 in the *_cpu.hex file in the filenames you post, along with info about the ECU model text on the ECU case, if you know it (e.g. AF423).

(attachment removed - please download the EcuFlash GUI version instead)
Last edited by cboles on Sat Mar 11, 2006 1:23 pm, edited 3 times in total.
cboles
Site Admin
 
Posts: 1233
Joined: Wed Dec 29, 2004 5:45 pm
Location: Seattle, WA

Postby calvinc » Wed Jun 22, 2005 10:50 pm

colby, is this generic for all market models of that year or only USDM vehicles?

calvin.
calvinc
 
Posts: 163
Joined: Sun Apr 24, 2005 10:18 am
Location: south africa

Postby NeverLies » Thu Jun 23, 2005 1:27 am

Hi Colby,

Seems there is a problem with sti2004 and fxt2004 command. Nothing is sent to the ECU while using these parameters and so no dump can be done.
While checking with wrx2002 and wrx2004, commands are sent to the ECU.

Is there something wrong ?
NeverLies
 
Posts: 179
Joined: Tue Apr 12, 2005 1:49 am

Postby calvinc » Thu Jun 23, 2005 1:48 am

hi colby,

i tried the app and didnt get any success with the dumping. my car is a MY05 AUS/SA STI, ecu type is AJ870-8840.

initially i tried the sti2004 parameter but as neverlies said, its not coded for it. i then tried the wrx2004 parameter and got some different responses but still no dump. then i tried the wrx2002 parameter and it seemed as if the app just queried but couldnt go any further than the 4D command.

i've attached both the console requests/responses and portmon logs for both the wrx2002 and wrx2004 parameters.

let me know if i'm the village idiot that isnt using it right or my ecu type is different. if its different and you want some more detail i'll do whatever i can to help.

regards,
calvin.
Attachments
console.txt
console requests/responses for both wrx2002 and wrx2004
(1.12 KiB) Downloaded 813 times
Portmon_wrx2004.txt
PORTMON log for the wrx2004 parameter
(44.61 KiB) Downloaded 739 times
Portmon_wrx2002.txt
PORTMON log for the wrx2002 parameter
(103.83 KiB) Downloaded 735 times
calvinc
 
Posts: 163
Joined: Sun Apr 24, 2005 10:18 am
Location: south africa

Postby Spiider » Thu Jun 23, 2005 4:18 am

I don't think he has any "STi" or "FXT" parameter, maybe I'm wrong though. You need to select whether you have a 2002-2003 ecu, or a 2004+ ecu, and run that app whether its a STi or WRX doesn't matter.

What I did to get it to work was make a shortcut on my desktop with the correct parameters specified earlier in this thread and clicked it to run the dumper. All I changed was the com port number in it.

Also, you may want to put the application in a more friendly path, like c:\openecu\, I have had trouble with console apps and long paths or paths with odd charactors like "." in them.
Spiider
 
Posts: 191
Joined: Thu Mar 10, 2005 4:16 pm

Postby NeverLies » Thu Jun 23, 2005 4:29 am

Just llok at the online documentation:

flashes WRX Denso ECU plus other functions.

ecuflash {switches}

where switches are:

/k [kernel image file]
/dm [hex start] [hex end] [dumpfile] - dump specified area of memory to a file
/dq [filebase] - quick dump all of flash memory to file(s)
/l [logfile]
/c [comport]
/m {wrx2002,wrx2004,sti2004,fxt2004}

Calvin has tried with 2 first parameters and nothing appears. With sti2004 or fxt2004, nothing is done (you may check with PortMon, nothing is sent on the comm)
NeverLies
 
Posts: 179
Joined: Tue Apr 12, 2005 1:49 am

Postby calvinc » Thu Jun 23, 2005 5:19 am

my original path was d:\openecu.org\ecuflash
i tried a different path of d:\openecu

still nothing...maybe the 05's have a new protocol?

calvin.
calvinc
 
Posts: 163
Joined: Sun Apr 24, 2005 10:18 am
Location: south africa

Postby NeverLies » Thu Jun 23, 2005 5:45 am

On my '03, I've already tried to send 4D command (4D FF B4) at 9600bps and I did not get any answer (with only green test mode connected). Same behavior as Calvin. Will try with your soft and both parameters (wrx2002 & wrx2004).

By the way, what is "fs", "fr", "fb", "s" switches in your application ?
NeverLies
 
Posts: 179
Joined: Tue Apr 12, 2005 1:49 am

Postby cboles » Thu Jun 23, 2005 9:05 am

This is a fragment of a larger application, so there are some unlisted switches and features here which won't work or have been stubbed out. Specifically, this app is only intended to work with 02-05 USDM WRX's. There is no STi/FXT support yet, although I will be working to add that. I don't own these cars, so I need to find someone close to me to do some testing. Also, the app will only work with OpenPort hardware, unless you are using a FTDI232BM based USB to serial adapter along with an appropriate ISO9141 interfaace. The reason for this is that there are parts of the 04-05 firmware and my kernel use obscure baud rates which normal UARTs won't hit.
cboles
Site Admin
 
Posts: 1233
Joined: Wed Dec 29, 2004 5:45 pm
Location: Seattle, WA

Postby NeverLies » Thu Jun 23, 2005 9:27 am

OK ;) I'm using your hardware so we have the same configuration. Mine is UK type so perhpas there are some differences on the protocol ??
Let me know if you need to tests some others command. Do you confirm that I only need to connect green connector and use your hardware to go on with this part of the software ?
NeverLies
 
Posts: 179
Joined: Tue Apr 12, 2005 1:49 am

Postby cboles » Thu Jun 23, 2005 9:31 am

This is a '03 USDM WRX? If it is not, it may not work. You not only need to be sending 4D FF B4 to 02/03's, but you also need to precede that with a 200ms pulse and 200ms wait on DTR (if you are using the OpenPort). DTR is connected to an OEM defined pin on the OBD connector much like the L-line in ISO 9141. The proceedure is:

SETDTR (for longish time)
CLRDTR
wait 200ms
SETDTR
wait 200ms
SEND 4D FF B4

listen for 4D 00 B3 in response
... continue with kernel upload



NeverLies wrote:On my '03, I've already tried to send 4D command (4D FF B4) at 9600bps and I did not get any answer (with only green test mode connected). Same behavior as Calvin. Will try with your soft and both parameters (wrx2002 & wrx2004).

By the way, what is "fs", "fr", "fb", "s" switches in your application ?
cboles
Site Admin
 
Posts: 1233
Joined: Wed Dec 29, 2004 5:45 pm
Location: Seattle, WA

Postby cboles » Thu Jun 23, 2005 9:34 am

I have an '03 ECU I can plug into my '02 car to see if it works, but I'm pretty sure it will.
cboles
Site Admin
 
Posts: 1233
Joined: Wed Dec 29, 2004 5:45 pm
Location: Seattle, WA

Postby NeverLies » Thu Jun 23, 2005 9:58 am

cboles wrote:This is a '03 USDM WRX? If it is not, it may not work. You not only need to be sending 4D FF B4 to 02/03's, but you also need to precede that with a 200ms pulse and 200ms wait on DTR (if you are using the OpenPort). DTR is connected to an OEM defined pin on the OBD connector much like the L-line in ISO 9141. The proceedure is:

SETDTR (for longish time)
CLRDTR
wait 200ms
SETDTR
wait 200ms
SEND 4D FF B4

listen for 4D 00 B3 in response
... continue with kernel upload



NeverLies wrote:On my '03, I've already tried to send 4D command (4D FF B4) at 9600bps and I did not get any answer (with only green test mode connected). Same behavior as Calvin. Will try with your soft and both parameters (wrx2002 & wrx2004).

By the way, what is "fs", "fr", "fb", "s" switches in your application ?


That's what I have tried also :( Will try with yours, perhaps my timing was faulty ! (My WRX is UK so perhaps that's why it work different also)
NeverLies
 
Posts: 179
Joined: Tue Apr 12, 2005 1:49 am

Postby ahains » Thu Jun 23, 2005 1:26 pm

So that I'm clear - does this tool burn your kernel to the ECU? Or is it just handled in RAM or something?
More generally, is the ECU modified in any manner when executing this, or is this simply interacting with the default protocol support to slurp down the bits of the ROM?

Ordered my cable today, so I'll be grabbing my image soon. I have an '04 Wagon, so maybe this is identical to your 04...

Thanks!
Adrian
ahains
 
Posts: 83
Joined: Mon Jun 06, 2005 12:59 pm
Location: Renton, WA

Postby cboles » Thu Jun 23, 2005 1:55 pm

no worries - the kernel gets loaded into RAM. once you turn your car off and on again you are no longer running the kernel and everything was as it was. kernel development would have been a painful process otherwise :)
cboles
Site Admin
 
Posts: 1233
Joined: Wed Dec 29, 2004 5:45 pm
Location: Seattle, WA

Next

Return to OpenECU Software

Who is online

Users browsing this forum: No registered users and 8 guests