I read some topics on this site from people who want to read/flash old Mitsubishi ECU's. I become interested in this work.
First I made Kashima H8/ISP adapter and try to speak with CPU. CPU answers on requests, but I can't read flash because protection code has been set on ECU or I do something wrong
. After Certification command (start with 0x00, 6 bytes engine code, 0x28, 0x0C) sended to ECU with clear engine coord/code, ECU lock connection after any 3 bytes sended and echoed to(from) ECU.
There are one way to understand how to read/flash it - read CPU in PROM programmer called "big pain" by Colby
. So, i found InvecsII TCU from Mitsubishi Galant 98 with the same processor and ISP connector. Look at this - It's pure H8/539F! Mitsubishi use this in first ECU's and replace it with MH7202 after.
I made my QFP112->32pin adapter (H8/538 HW manual schematics)
Desolder CPU and solder it to adapter. Insert to PROM programmer.
Select HN28F101 and here is the code
NOW is a good time to learn how ISP boot program works. I am not experience in H8/500 assembler yet (I working with PIC on my job) and expect for help from members of this site to understand ISP protocol and engine coord/code location.
ROM Image in attachement from MD761737 MMC Galant TCU. I think it interesting only for reading/programming protocol information.
Regards, Dmitry.
