Problem Reading ROM w/ ECUFlash

[shiznit013]

I have an '03 Galant GTZ (V6 AT). I can data log w/ ECU Edit, and connect with ECUFlash. Below is an excerpt from the read log:

[23:07:52.468] Version 1.29.906
[23:07:52.484] 8 memory models read.
[23:07:55.015] 140 ROM metadata models read.
[23:07:55.015] checksum module "subarudbw" loaded.
[23:07:55.046] flashing tool "wrx02" loaded.
[23:07:55.046] flashing tool "wrx04" loaded.
[23:07:55.046] flashing tool "sti04" loaded.
[23:07:55.046] flashing tool "sti05" loaded.
[23:07:55.046] flashing tool "mitsukernel" loaded.
[23:07:55.046] flashing tool "mitsukernelocp" loaded.
[23:07:55.046] flashing tool "mitsubootloader" loaded.
[23:24:48.484] sending init sequence 1 (0001)
[23:24:51.718] sending init sequence 1 (0003)
[23:24:52.734] got 0x05 response
[23:24:52.734] sending init sequence 2
[23:24:52.750] got 0x1B response
[23:24:52.750] sending init sequence 3
[23:24:53.171] entering bootloader
[23:24:53.187] sending kernel size (3424)
[23:24:53.203] sending kernel load address (0xFFFF6000)
[23:24:53.234] uploading kernel
[23:24:53.796] verifying kernel checksum response
[23:24:53.796] kernel valid
[23:24:54.015] kernel get version
[23:24:54.031] kernel version is : OpenECU Mitsubishi SH7055 Kernel V0.21
[23:24:54.046] Dumping ECU memory...
[23:24:54.078] kernel read area: addr: 00000000 len: 0400
[23:24:54.265] kernel read area: addr: 00000400 len: 0400

...

[23:26:21.171] kernel read area: addr: 0007F800 len: 0400
[23:26:21.359] kernel read area: addr: 0007FC00 len: 0400

When this is done, I get the following prompt:



Selecting "Defined from scratch" gives:



If I select either of the other options, I have to select a definition from the drop down. None of the options in the drop down seem valid (only Subaru and Evo). I can't save the ROM at any point. I can't finish, and if I cancel, it just disposes of the ROM.

Does anyone know what I have to do to get a readable ROM? I hope that I'm just being stupid.

[mtcavity]

FIRST! Rename your ROM Image and end it in ".hex" or ".bin". Post the ROM image on this website and let the guys look it over.

I had seen way to many Eclipse V6 ROMs to think that the Galant V6 is definable.

[shiznit013]

Well that's part of the problem... I don't have the option to save the ROM. Those system modal dialogs popup and won't let me access the save feature. If I cancel out of the dialogs, then the ROM is discarded.

[mtcavity]

S*$T! I did this so long ago I overlooked your real problem.

You need to Inherent From the EVO 7 (use memory model SH7055 if asked, try any others if issues), It will allow you to at least save the ROM and post for a personal XML definition to be made. (There is no definition for your car yet)

You will not screw up anything by pulling the ROM, so mess around a little to get through the definition setup. Just get it to the point you can save (like you need this advice).

I spent 6 months to crash course this and build a definition for my ride because no one else would. I would absolutely LOVE to see the mapping of your ECU and suggest you download the Eclipse V6 ROMs/XMLs posted for ROM comparisons.

I think you will be surprised by the results of a little tweaking.

Please let me know of your outcome.

[shiznit013]

I read the ROM successfully in 2 ways. For the first read, I selected 2003 Eclipse AT. I was not given the option of evo7base, so I selected evo9base. For the second read, I used EVO 7-8 and evo7base.

The first read was 512KB, and the second was 256KB (I'm assuming that corresponds to the flash memory size on the SH7055 and SH7052 chips, respectively). The files are identical until the second read ends at 3FFFF.

My question now is, which ROM is valid? Did the program just read past the flash memory boundary and pickup other data on the first read? I'm not even sure if that is possible with this micro-controller, but it is with others.

I'm in the process of trying to disassemble the ROMs with gcc utils. This should make finding memory addresses simple.

[mtcavity]

I think both are valid and remember reading something about this in the developing posts.

It should resemble the Eclipse V6 ROMs structure but different offsets for each in hex viewer. I did not run across many similar ROMs throughout all of the Galant/Eclipse line-up.

You'll only need up to 08000 to get the maps and scales (the beginning), as long as both look the same up to 3ffff on both ROMs, then both should be useable. Personally though, I would use the Eclipse flash model ROM with the EVO 7 base, than the EVO flash model for the obvious.

If you post the ROMs, I could look them over and get an XML together in a few hours. Even if you decide to disassemble yourself, please post the ROM eventually. I have yet to see the V6 Galant maps, and would like to be able to give the other GTZ owners some proof that they can flash there rides.

Need any questions or help, ask.

[shiznit013]

The disassembly worked, but the mix of instructions and static data that the program attempted to convert to instructions is confusing as hell. To load a value into a register you might need an offset to an offset to the value. I don't really know if it is worth it to keep going on or not... but I probably will until I get angry.

I read in another thread that ECUFlash only flashes the areas of the ROM that have changed. If this is true, it shouldn't matter which ROM I write back. I am kind of curious what affect the kernel has. The evo9base uses mitsukernelocp, and evo7base uses mitsukernel.

[mtcavity]

I used the bigger ROM as it is the same as the other Galants on file. This is somewhat similar to the Eclipse, but has a lower MAF setting (turn it up to 358.8 to run the same as Eclipse). The Open Loop settings will be a must also. I made NO changes to the ROM!

Set your user level to developer to view all maps.

I still am looking over all questionable maps (maybe learned ECU settings), I'll keep you updated.

You'll need to look through some threads to read on the mitsukernel and how it works, but it's in the development posts somewhere.

Let me know how everything turns out.

[shiznit013]

My MAF Size is currently 305.6 g/s. I shouldn't be adjusting that value without physically changing the size of the mask on the honeycomb, right?

[salex]

My MAF Size is currently 305.6 g/s. I shouldn't be adjusting that value without physically changing the size of the mask on the honeycomb, right?

MAF size usually has to do with MAF inner diameter. If you change that, you have to change the size.
The honeycomb is just an airflow straightener for more accurate readings.

[mtcavity]

I took it for granted that both would run the same MAF, but parts are different for each model.

Sorry guys.

[shiznit013]

Is there a way to change the MAF inner diameter without actually changing the MAF? Those things are quite expensive. I've heard of people taking material off themselves, but then how do you determine what the new airflow value is?

[mtcavity]

I am adding a turbo to my 4G64 and am pretty sure the MAF can be rescaled to compensate for added airflow (7 lbs). Has anyone done this? I don’t see a problem until I get into high psi boost and run into major restriction problems. I have a hot-wire MAF and should not have turbulence issues like Karman MAF.

Why get a MAF translator when it can be "re-translated" (to a point)?