openecu.org

Posted: **Tue May 09, 2006 11:25 am**

I'm releasing a version later today before I go on a 2 day trip...

Posted: **Mon Jul 03, 2006 5:03 am**

I've noticed that the address locations for the 1D maps are also in the ROM in 4-byte chunks like the 3d/2d references (for example, "0x000C0440". I've seen them in the 0x14xxx range, and every 1D map location I've tried is found in the ROM. I can't make out any pattern to the data in-between, so I'm assuming that this area is all "programming logic". Don't know if this useful or not for finding tables, but I was able to find a few 1D tables I needed in an unknown revision by finding similar "in-between" data from a known ROM and then tracking down the address on the unknown ROM.

Posted: **Mon Jul 03, 2006 7:53 am**

Thanks for the info. I'm planning on attacking the Subaru ROMs soon to try and get most of the map addresses for all of the ROMs I have and put them into the next release.

Posted: **Mon Jul 03, 2006 8:15 am**

cboles wrote:Thanks for the info. I'm planning on attacking the Subaru ROMs soon to try and get most of the map addresses for all of the ROMs I have and put them into the next release.

Colby, I haven't checked yet, but does IDA Pro have a built in module for the DBW ecu's or are you using something else?

Posted: **Mon Jul 03, 2006 8:23 am**

I am using IDA Pro Advanced 5.0 - It supports the SH processors.

Posted: **Mon Jul 03, 2006 8:27 am**

cboles wrote:I am using IDA Pro Advanced 5.0 - It supports the SH processors.

I have the SH4B on my IDA Pro 4.9, have you found a good entry point for the 512k/1mb files?

openecu.org

Map offsets for 32bit SUBARU DENSO ECUs (DBW & NON-DBW)