Trouble reading ROM on 2003 WRX

[Freon]

A couple of us in Indy got together yesterday to play with the software.

We were not able to read out the ROM from a 2003 USDM WRX. I have a Tactrix cable straight to USB and used Ecuflash. We also tried a Cobb AP cable and EcuExplorer with a Cobb cable with the other guys' laptops, though that was through a serial to USB convertor.

Anyone have ideas? Here are the logs from Ecuflash and PortMon on my laptop with Tactrix USB cable and Ecuflash:

http://freon.shackspace.com/ecu%20and%2 ... ailure.log
http://freon.shackspace.com/ecu%20and%2 ... er-log.log

It seems to set to 39k baud rate ok, but then just dies.

We used the Cobb flashblock connector and connected the green test connector, turned the car to "run" and immediately hit the "ok" button in Ecuflash. I did find that if I waited too long after turning the key, it would just give the "bootloader" message over and over and fail, while the car started to cycle the fans, etc. But it would not go into the test cycle if the Ecuflash was started quickly. So I think we performed the technique correctly at least once out of many tries.

I don't have the logs from the other systems, but I think mine (Tactrix, Ecuflash) should have worked fine. We did get Ecuexplorer/Cobb cable to create a 0kB (.ptf I think, which doesn't make sense to me anyway...) file once, if that means anything.

I'm still a bit fuzzy on battery voltage. Is this a big problem even just reading out the ROM? All the interior lights were left off, but the car was sitting for a while with the door open. I don't think we managed to drain the battery to any notable extent, as the headlights were fine and it turned over like a champ.

[calvinc]

i've posted a reply on the tari forum for you freon. the battery voltage is only a requirement during writing a flash image.

calvin.

[NeverLies]

You may switch to Hex representation of serial frame instead of ASCII in your serial log in order to see if ECU answers are correct.

Have you failed to dl roms of all ECU ? or just one ? Don't you have any others cars to test it ?

[cboles]

Yes, it would be nice to have a better portmon log that shows the hex values being sent / received. Right after the holidays, I'll put a '03 ECU on the bench and make usre everything is running smoothly. I did change the order of some things in the init sequence to allow EcuFlash to indentify that the kernel is already loaded before attempting the standard init, which the ECU could be sensitive to. However, you did get it to load the kernel at least once, and in that case it looked like it got no reponse after that. This is a common result you see when you try to use non-tactrix hardware like the Cobb interface, because it won't do the 39k baud rate correctly (actually, it's you serial port that won't). Is there anything else unusual about this car? Do you have other devices connected to the OBD2 K-line perhaps which could be loading it down and limiting the speed?

[dust12]

I am having a similar problem. On my 2002 wrx it can't load the kernal on my ECU. I am using the openport 1.2 cable. My ECU has been ECUteked so this may be the problem. Colby has looked at the logs and said the cable is fine.

[New2Scoobs]

I dont think it's an ECUTEK "thing". I have downloadad my ECUTEK ROM successfully from a Euro 2001 WRX (Bugeye)

I am having a similar problem. On my 2002 wrx it can't load the kernal on my ECU. I am using the openport 1.2 cable. My ECU has been ECUteked so this may be the problem. Colby has looked at the logs and said the cable is fine.

[Spiider]

I think you may have to check the wiring from the OBD socket to the ecu with a multimeter. There are only a couple of wires to check.

I'm wondering if maybe someone is playing games when they do a reflash.

They could be removing a pin from the ecu plugs or cutting something to make it more difficult for guys like us to read the rom.

[cboles]

Yesterday I checked a stock 02, 03, and 04 USDM WRX ECU on my bench programming setup and all of them worked fine with the GUI EcuFlash app. The point at which you are failing is after the kernel is uploaded and EcuFlash is looking for a response from the kernel. A number of things have to be right for the kernel to be alive and responsive:

* the kernel checksum (or partial checksum) has to be correct
* the interface hardware has to work at 39k baud (the openport does)
* the kernel needs to keep the watchdog timer happy so that the ECU doesn't reboot

It is possible that the ECU has a different TPU code area than other ECUs, which is the code responsible for loading / checksumming the kernel. You can reflash this area just like the rest of the flash in the ECU. I really doubt it though.

Can you get another portmon log with the hex data mode turned on?

[Freon]

Unfortunately I haven't been able to test further since it wasn't my car. We're having another meet in town and I'll see if I can talk the guy into letting me try reading it out again. I'll try to get a hex mode log.

Spider, the guys car works fine with his AP, so I'm pretty darn sure everything is physically ok.

I can understand why the Cobb cable wouldn't work with the USB to serial convertor, but I think my setup should be fine (Openport 1.2 cable straight into laptop USB port). My laptop is only USB 1.1 and Windows 2000 if it really matters, but I am doubting that. Other than that, my laptop is very bare.

Colby, did you test with the Openport 1.0 or 1.2 cable? I have the newer 1.2.

[ride5000]

here's a portmon capture:

Code: Select all

0   0.02182596   ecuflash.exe   IRP_MJ_CREATE   VCP0   SUCCESS   Options: Open    
1   0.00000978   ecuflash.exe   IOCTL_SERIAL_SET_QUEUE_SIZE   VCP0   SUCCESS   InSize: 16384 OutSize: 16384   
2   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_BAUD_RATE   VCP0   SUCCESS      
3   0.00000223   ecuflash.exe   IOCTL_SERIAL_GET_LINE_CONTROL   VCP0   SUCCESS      
4   0.00000223   ecuflash.exe   IOCTL_SERIAL_GET_CHARS   VCP0   SUCCESS      
5   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_HANDFLOW   VCP0   SUCCESS      
6   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_BAUD_RATE   VCP0   SUCCESS      
7   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_LINE_CONTROL   VCP0   SUCCESS      
8   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_CHARS   VCP0   SUCCESS      
9   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_HANDFLOW   VCP0   SUCCESS      
10   0.00179967   ecuflash.exe   IOCTL_SERIAL_SET_BAUD_RATE   VCP0   SUCCESS   Rate: 4800   
11   0.00288081   ecuflash.exe   IOCTL_SERIAL_CLR_RTS   VCP0   SUCCESS      
12   0.00299954   ecuflash.exe   IOCTL_SERIAL_SET_DTR   VCP0   SUCCESS      
13   0.00304145   ecuflash.exe   IOCTL_SERIAL_SET_LINE_CONTROL   VCP0   SUCCESS   StopBits: 1 Parity: NONE WordLength: 8   
14   0.00000196   ecuflash.exe   IOCTL_SERIAL_SET_CHAR   VCP0   SUCCESS   EOF:0 ERR:0 BRK:0 EVT:0 XON:11 XOFF:13   
15   0.00286629   ecuflash.exe   IOCTL_SERIAL_SET_HANDFLOW   VCP0   SUCCESS   Shake:1 Replace:80000000 XonLimit:2048 XoffLimit:512   
16   0.00000196   ecuflash.exe   IOCTL_SERIAL_SET_TIMEOUTS   VCP0   SUCCESS   RI:-1 RM:0 RC:0 WM:50 WC:0   
17   0.00294758   ecuflash.exe   IOCTL_SERIAL_SET_WAIT_MASK   VCP0   SUCCESS   Mask: CTS DSR    
18   0.00000251   ecuflash.exe   IRP_MJ_FLUSH_BUFFERS   VCP0   SUCCESS      
19   0.00295457   ecuflash.exe   IOCTL_SERIAL_SET_DTR   VCP0   SUCCESS      
20   0.00000419   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
21   0.00195584   ecuflash.exe   IOCTL_SERIAL_SET_DTR   VCP0   SUCCESS      
22   0.00001006   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
23   0.00000447   ecuflash.exe   IOCTL_SERIAL_SET_QUEUE_SIZE   VCP0   SUCCESS   InSize: 16384 OutSize: 16384   
24   0.00000223   ecuflash.exe   IOCTL_SERIAL_GET_BAUD_RATE   VCP0   SUCCESS      
25   0.00000251   ecuflash.exe   IOCTL_SERIAL_GET_LINE_CONTROL   VCP0   SUCCESS      
26   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_CHARS   VCP0   SUCCESS      
27   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_HANDFLOW   VCP0   SUCCESS      
28   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_BAUD_RATE   VCP0   SUCCESS      
29   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_LINE_CONTROL   VCP0   SUCCESS      
30   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_CHARS   VCP0   SUCCESS      
31   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_HANDFLOW   VCP0   SUCCESS      
32   0.00306911   ecuflash.exe   IOCTL_SERIAL_SET_BAUD_RATE   VCP0   SUCCESS   Rate: 39473   
33   0.00297496   ecuflash.exe   IOCTL_SERIAL_CLR_RTS   VCP0   SUCCESS      
34   0.00297775   ecuflash.exe   IOCTL_SERIAL_SET_DTR   VCP0   SUCCESS      
35   0.00305458   ecuflash.exe   IOCTL_SERIAL_SET_LINE_CONTROL   VCP0   SUCCESS   StopBits: 1 Parity: NONE WordLength: 8   
36   0.00000196   ecuflash.exe   IOCTL_SERIAL_SET_CHAR   VCP0   SUCCESS   EOF:0 ERR:0 BRK:0 EVT:0 XON:11 XOFF:13   
37   0.00287076   ecuflash.exe   IOCTL_SERIAL_SET_HANDFLOW   VCP0   SUCCESS   Shake:1 Replace:80000000 XonLimit:2048 XoffLimit:512   
38   0.00000223   ecuflash.exe   IOCTL_SERIAL_SET_TIMEOUTS   VCP0   SUCCESS   RI:-1 RM:0 RC:0 WM:50 WC:0   
39   0.00294702   ecuflash.exe   IOCTL_SERIAL_SET_WAIT_MASK   VCP0   SUCCESS   Mask: CTS DSR    
40   0.00000279   ecuflash.exe   IRP_MJ_FLUSH_BUFFERS   VCP0   SUCCESS      
41   0.00000251   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
42   0.00080401   ecuflash.exe   IRP_MJ_WRITE   VCP0   SUCCESS   Length 6: BE EF 00 01 21 CF    
43   0.00000391   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 1: 3C    
44   0.00000363   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 3: CE 00 FC    
45   0.00000223   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
46   0.00000279   ecuflash.exe   IOCTL_SERIAL_SET_QUEUE_SIZE   VCP0   SUCCESS   InSize: 16384 OutSize: 16384   
47   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_BAUD_RATE   VCP0   SUCCESS      
48   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_LINE_CONTROL   VCP0   SUCCESS      
49   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_CHARS   VCP0   SUCCESS      
50   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_HANDFLOW   VCP0   SUCCESS      
51   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_BAUD_RATE   VCP0   SUCCESS      
52   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_LINE_CONTROL   VCP0   SUCCESS      
53   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_CHARS   VCP0   SUCCESS      
54   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_HANDFLOW   VCP0   SUCCESS      
55   0.00292495   ecuflash.exe   IOCTL_SERIAL_SET_BAUD_RATE   VCP0   SUCCESS   Rate: 9600   
56   0.00297580   ecuflash.exe   IOCTL_SERIAL_CLR_RTS   VCP0   SUCCESS      
57   0.00297803   ecuflash.exe   IOCTL_SERIAL_SET_DTR   VCP0   SUCCESS      
58   0.00297608   ecuflash.exe   IOCTL_SERIAL_SET_LINE_CONTROL   VCP0   SUCCESS   StopBits: 1 Parity: NONE WordLength: 8   
59   0.00000223   ecuflash.exe   IOCTL_SERIAL_SET_CHAR   VCP0   SUCCESS   EOF:0 ERR:0 BRK:0 EVT:0 XON:11 XOFF:13   
60   0.00295261   ecuflash.exe   IOCTL_SERIAL_SET_HANDFLOW   VCP0   SUCCESS   Shake:1 Replace:80000000 XonLimit:2048 XoffLimit:512   
61   0.00000223   ecuflash.exe   IOCTL_SERIAL_SET_TIMEOUTS   VCP0   SUCCESS   RI:-1 RM:0 RC:0 WM:50 WC:0   
62   0.00296406   ecuflash.exe   IOCTL_SERIAL_SET_WAIT_MASK   VCP0   SUCCESS   Mask: CTS DSR    
63   0.00000223   ecuflash.exe   IRP_MJ_FLUSH_BUFFERS   VCP0   SUCCESS      
64   0.00000279   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
65   0.00189410   ecuflash.exe   IOCTL_SERIAL_SET_DTR   VCP0   SUCCESS      
66   0.00328533   ecuflash.exe   IOCTL_SERIAL_CLR_DTR   VCP0   SUCCESS      
67   0.00291853   ecuflash.exe   IOCTL_SERIAL_SET_DTR   VCP0   SUCCESS      
68   0.00765349   ecuflash.exe   IRP_MJ_WRITE   VCP0   SUCCESS   Length 3: 4D FF B4    
69   0.00000950   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
70   0.00000279   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
71   0.00000419   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 3: 4D FF B4    
72   0.00000251   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 3: 4D 00 B3    
73   1.39764551   ecuflash.exe   IRP_MJ_WRITE   VCP0   SUCCESS   Length 1459: 53 02 00 00 05 AC F5 5D 39 41 65 65 84 41 2A 35 40 4B 20 26 10    
74   0.00001173   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 1335: 53 02 00 00 05 AC F5 5D 39 41 65 65 84 41 2A 35 40 4B 20 26 10    
75   0.00000279   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
76   0.00000335   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 15: F0 64 D5 BF 67 67 A9 82 B2 71 64 B0 6A 72 D8    
77   0.00000279   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
78   0.00000307   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 16: 72 F8 B2 E5 72 09 30 25 72 81 72 98 70 25 82 B2    
79   0.00000307   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 15: 82 8C 62 FB BA BA 82 8C 62 A5 BA BA 82 B2 71    
80   0.00000251   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
81   0.00000307   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 15: 66 52 41 62 A4 52 4F 62 A4 72 70 65 6D 82 8A    
82   0.00000307   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 16: 62 FB 82 8B 62 A5 F1 51 72 F0 E6 85 72 C1 62 A5    
83   0.00000251   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
84   0.00000307   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 15: 72 CF 62 A5 72 F0 C8 FD 72 C1 62 FB 72 CF 62    
85   0.00000307   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 15: FB 72 75 65 64 F3 91 70 45 82 B2 71 64 82 85    
86   0.00000279   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
87   0.00000307   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 16: 62 FB 82 85 62 A5 82 2B 72 F9 62 FB 70 25 82 B2    
88   0.00000251   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
89   0.00000307   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 1: 05    
90   0.00000978   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
91   0.00000363   ecuflash.exe   IOCTL_SERIAL_SET_QUEUE_SIZE   VCP0   SUCCESS   InSize: 16384 OutSize: 16384   
92   0.00000223   ecuflash.exe   IOCTL_SERIAL_GET_BAUD_RATE   VCP0   SUCCESS      
93   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_LINE_CONTROL   VCP0   SUCCESS      
94   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_CHARS   VCP0   SUCCESS      
95   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_HANDFLOW   VCP0   SUCCESS      
96   0.00000196   ecuflash.exe   IOCTL_SERIAL_GET_BAUD_RATE   VCP0   SUCCESS      
97   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_LINE_CONTROL   VCP0   SUCCESS      
98   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_CHARS   VCP0   SUCCESS      
99   0.00000168   ecuflash.exe   IOCTL_SERIAL_GET_HANDFLOW   VCP0   SUCCESS      
100   0.00310235   ecuflash.exe   IOCTL_SERIAL_SET_BAUD_RATE   VCP0   SUCCESS   Rate: 39473   
101   0.00296434   ecuflash.exe   IOCTL_SERIAL_CLR_RTS   VCP0   SUCCESS      
102   0.00297468   ecuflash.exe   IOCTL_SERIAL_SET_DTR   VCP0   SUCCESS      
103   0.00297524   ecuflash.exe   IOCTL_SERIAL_SET_LINE_CONTROL   VCP0   SUCCESS   StopBits: 1 Parity: NONE WordLength: 8   
104   0.00000196   ecuflash.exe   IOCTL_SERIAL_SET_CHAR   VCP0   SUCCESS   EOF:0 ERR:0 BRK:0 EVT:0 XON:11 XOFF:13   
105   0.00295317   ecuflash.exe   IOCTL_SERIAL_SET_HANDFLOW   VCP0   SUCCESS   Shake:1 Replace:80000000 XonLimit:2048 XoffLimit:512   
106   0.00000223   ecuflash.exe   IOCTL_SERIAL_SET_TIMEOUTS   VCP0   SUCCESS   RI:-1 RM:0 RC:0 WM:50 WC:0   
107   0.00278080   ecuflash.exe   IOCTL_SERIAL_SET_WAIT_MASK   VCP0   SUCCESS   Mask: CTS DSR    
108   0.00000279   ecuflash.exe   IRP_MJ_FLUSH_BUFFERS   VCP0   SUCCESS      
109   0.00000363   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 0:    
110   0.00146806   ecuflash.exe   IRP_MJ_WRITE   VCP0   SUCCESS   Length 6: BE EF 00 01 01 AF    
111   0.00000587   ecuflash.exe   IRP_MJ_READ   VCP0   SUCCESS   Length 1: 3C    
112   0.00000391   ecuflash.exe   IRP_MJ_CLEANUP   VCP0   SUCCESS      
113   0.01479853   ecuflash.exe   IRP_MJ_CLOSE   VCP0   SUCCESS      


ecuflash just says:

Code: Select all

[0.000] kernel flash disable
[0.000] rkrv: preamble 1 error
[1.022] denso02_bootloader_cmd_start
[0.020] 1452 byte kernel read.
[0.000] kernel checksum is valid (n = 2).
[0.200] writing denso kernel area addr: 020000 len: 05AC
[2.854] kernel get version
[0.000] rkrv: preamble 1 error
[0.000] unable to load kernel

any help appreciated!

ken

[cboles]

looks like the subaru bootloader / SSM is still running after the kernel was loaded. maybe you have newer TPU code and it didn't like the kernel checksum. i'll try to patch it up and make another release.

c

[ride5000]

looks like the subaru bootloader / SSM is still running after the kernel was loaded. maybe you have newer TPU code and it didn't like the kernel checksum. i'll try to patch it up and make another release.

c

colby, you rock!

more info perhaps worth noting:

latest usdm wrx utec hardware
original openport cable
wxppro w/sp2 and all patches
1ghz p3 laptop, 384mb ram
i have a late(r) my03

ken

[Spiider]

I wonder if the Utec is blocking the comm's. It would be worth it to reconnect directly to try it out.

I would think that they would have a passthrough for the SSM, but perhaps not for all the wires needed for dump/reflash.

[ride5000]

I wonder if the Utec is blocking the comm's. It would be worth it to reconnect directly to try it out.

I would think that they would have a passthrough for the SSM, but perhaps not for all the wires needed for dump/reflash.

i thought about that too...

the thing is, i know a lot of tuners use the ecutek or cobb reflash underneath the utec hardware, in order to provide the best features of both. i've never heard any of them talk of issues reflashing with the utec in series with the harness(es).

then again, to my knowledge no one has done an openecu dump/reflash yet...

i will give it a try with it disconnected, though i don't know if that will be today or not. hopefully over this 3 day weekend at some point.

ken

[crazymikie]

[quote="ride5000"]

i thought about that too...

the thing is, i know a lot of tuners use the ecutek or cobb reflash underneath the utec hardware, in order to provide the best features of both. i've never heard any of them talk of issues reflashing with the utec in series with the harness(es).

then again, to my knowledge no one has done an openecu dump/reflash yet...

i will give it a try with it disconnected, though i don't know if that will be today or not. hopefully over this 3 day weekend at some point.

ken[/quote]

I've gotten the dump/reflashing to work on a bunch of cars- none of them had UTECs, though.

The 02/03s seem to like the command line version of the flash tool better- I ran into a problem on a v7 ECU, but screwed up and captured the wrong data.

Hopefully the info that ride5000 captured will fix everything

Thanks!
Mike