Downloading ROM files

User topics relating to software that reflashes or modifes ECU code and data

Moderator: Freon

Downloading ROM files

Postby Visceral » Thu Dec 30, 2004 10:31 am

Seems like some users have had success downloading ROM files off of the ECU. I'm curious what software/procedure was used. I have a serial->OBD II adapter, so I'd like to see if I can pull the ROM file off of my STi ECU.

Thanks,
Mike
Visceral
 
Posts: 23
Joined: Thu Dec 30, 2004 10:21 am

Postby Guest » Fri Dec 31, 2004 9:29 am

Getting the ROMs off is the first step for sure!

How are you guys doing it?
Guest
 

Postby cboles » Fri Dec 31, 2004 10:23 am

There are 3 fundamental ways I know how to get flash data so far, some of which I have tried, some of which I think should work:

1. Read out flash images from Cobb AccessPorts. I have tried this and it is very straightforward. Unfortunately, you are only getting the flash image that Cobb chose to put on the AccessPort, not the one which is actually in your ECU.

2. Emulate the ECU side of the reflashing process on a PC and record what gets sent to you to a file. I have tried this with an AccessPort and it works fine too. I imagine it would also work with the Subaru Select Monitor or the EcuTek tools.

3. Download code to the ECU which you can then communicate with to read out the flash memory. This is the preferrable method going forward. In a reflash process, Cobb downloads what I would refer to as a "flashing kernel" that they then communicate with to reflash the ECU. I am working on creating a similar open source kernel which would support commands to read out flash memory. You can also do it with the Cobb kernel right now, but it is tedious because you do it by repetitively executing a 16-bit checksum command over 2 byte chunks of memory until the whole flash is read. There may be other Cobb commands I don't know about, but I'd rather spend my time writing a new kernel we can all share and use.
cboles
Site Admin
 
Posts: 1233
Joined: Wed Dec 29, 2004 5:45 pm
Location: Seattle, WA

Postby Nemis » Thu Jan 06, 2005 8:20 am

Block Read: Read 128 bytes from address 0x200000 (ecu returned all zeros)

Sent:
0x80 0x10 0xF0 0x06 0xA0 0x00 0x20 0x00 0x00 0x7F 0xC5

so i'm try to write a simple programm to download rom block by block

but i'm not a real programmer and i can see data on screen but i don't know how to write it on a file :-(
Nemis
 
Posts: 66
Joined: Thu Dec 30, 2004 3:58 am
Location: italy

Postby NeverLies » Sat Apr 23, 2005 12:23 pm

Does someone has done some others test ? I've tried to read some block of data and I only get some FF as data in the reply.
NeverLies
 
Posts: 179
Joined: Tue Apr 12, 2005 1:49 am

Postby crazymikie » Sat Apr 23, 2005 10:07 pm

I believe a lot of the ECU cannot be read via the SSM. This could be why you are getting back garbage data. Try reading addresses just above 0x200000. I've found some data in there, and can read it via SSM calls.

Mike
crazymikie
 
Posts: 105
Joined: Mon Jan 03, 2005 6:45 pm
Location: Watertown, MA

Postby NeverLies » Sat Apr 23, 2005 10:59 pm

Ok, will tri it. Does someone has already found some relevant data ? How some guy may already dump ROM files ?
NeverLies
 
Posts: 179
Joined: Tue Apr 12, 2005 1:49 am

Postby NeverLies » Tue Apr 26, 2005 1:20 pm

Ok, I have done some more tests and you are right: there is some information at this adress but I cannot find anymore ...

While having a look at the CPU documentation, it seems that ECU Flash cannot be read directly with SSM protocol without any more operations.

Need to program some CPU register to read other data... have to read more ;)
NeverLies
 
Posts: 179
Joined: Tue Apr 12, 2005 1:49 am


Return to Reflashing Software

Who is online

Users browsing this forum: Google [Bot] and 10 guests