openecu.org

I've attached a watered down version of my kernel and reflashing executable which is very safe to use and only allows you to read out the contents of your ECU. It cannot accidentally flash your ECU - the code (and the programming connector) just aren't there. I think this is a good starting point so people can test out their OpenPort to see that it is working well and begin to build a library of ECU dumps for future reference. This software runs on WinXP using the OpenPort interface and works with 2002-2005 WRXs. I have tested it on my 2002 and 2004 WRX. To use it:

* unpack the ecuflash.exe and kernel.hex file to a directory
* open a command line window

* for 2002/2003 run

ecuflash /c com5 /m wrx2002 /k kernel.hex /dq test

* for 2004/2005 run

ecuflash /c com5 /m wrx2004 /k kernel.hex /dq test

* where "com5" is the actual com port your OpenPort appears on
* follow the instruction the program gives, and after it is done turn off your car again and unplug the test mode connector

* now you should have two files:

test_cpu.hex
test_tpu.hex

* the *_cpu.hex file is a dump of the main flash memory, like the others on the openecu.org site, with zero padding for the 0x20000-0x27FFF RAM area
* the *_tpu.hex file is a dump of the TPU flash memory, like the others on the openecu.org site. the TPU code doesn't seem to change much, but i'd like to see these dumps anyway just to be sure.

* upload your files to the appropriate "Technical (ECU Reverse Engineering)" forum. Include the firmware revision text located at address 0x200 in the *_cpu.hex file in the filenames you post, along with info about the ECU model text on the ECU case, if you know it (e.g. AF423).

(attachment removed - please download the EcuFlash GUI version instead)

colby, is this generic for all market models of that year or only USDM vehicles?

calvin.

Hi Colby,

Seems there is a problem with sti2004 and fxt2004 command. Nothing is sent to the ECU while using these parameters and so no dump can be done.
While checking with wrx2002 and wrx2004, commands are sent to the ECU.

Is there something wrong ?

hi colby,

i tried the app and didnt get any success with the dumping. my car is a MY05 AUS/SA STI, ecu type is AJ870-8840.

initially i tried the sti2004 parameter but as neverlies said, its not coded for it. i then tried the wrx2004 parameter and got some different responses but still no dump. then i tried the wrx2002 parameter and it seemed as if the app just queried but couldnt go any further than the 4D command.

i've attached both the console requests/responses and portmon logs for both the wrx2002 and wrx2004 parameters.

let me know if i'm the village idiot that isnt using it right or my ecu type is different. if its different and you want some more detail i'll do whatever i can to help.

regards,
calvin.

I don't think he has any "STi" or "FXT" parameter, maybe I'm wrong though. You need to select whether you have a 2002-2003 ecu, or a 2004+ ecu, and run that app whether its a STi or WRX doesn't matter.

What I did to get it to work was make a shortcut on my desktop with the correct parameters specified earlier in this thread and clicked it to run the dumper. All I changed was the com port number in it.

Also, you may want to put the application in a more friendly path, like c:\openecu\, I have had trouble with console apps and long paths or paths with odd charactors like "." in them.

Just llok at the online documentation:

flashes WRX Denso ECU plus other functions.

ecuflash {switches}

where switches are:

/k [kernel image file]
/dm [hex start] [hex end] [dumpfile] - dump specified area of memory to a file
/dq [filebase] - quick dump all of flash memory to file(s)
/l [logfile]
/c [comport]
/m {wrx2002,wrx2004,sti2004,fxt2004}

Calvin has tried with 2 first parameters and nothing appears. With sti2004 or fxt2004, nothing is done (you may check with PortMon, nothing is sent on the comm)

my original path was d:\openecu.org\ecuflash
i tried a different path of d:\openecu

still nothing...maybe the 05's have a new protocol?

calvin.

On my '03, I've already tried to send 4D command (4D FF B4) at 9600bps and I did not get any answer (with only green test mode connected). Same behavior as Calvin. Will try with your soft and both parameters (wrx2002 & wrx2004).

By the way, what is "fs", "fr", "fb", "s" switches in your application ?

This is a fragment of a larger application, so there are some unlisted switches and features here which won't work or have been stubbed out. Specifically, this app is only intended to work with 02-05 USDM WRX's. There is no STi/FXT support yet, although I will be working to add that. I don't own these cars, so I need to find someone close to me to do some testing. Also, the app will only work with OpenPort hardware, unless you are using a FTDI232BM based USB to serial adapter along with an appropriate ISO9141 interfaace. The reason for this is that there are parts of the 04-05 firmware and my kernel use obscure baud rates which normal UARTs won't hit.

OK I'm using your hardware so we have the same configuration. Mine is UK type so perhpas there are some differences on the protocol ??
Let me know if you need to tests some others command. Do you confirm that I only need to connect green connector and use your hardware to go on with this part of the software ?

This is a '03 USDM WRX? If it is not, it may not work. You not only need to be sending 4D FF B4 to 02/03's, but you also need to precede that with a 200ms pulse and 200ms wait on DTR (if you are using the OpenPort). DTR is connected to an OEM defined pin on the OBD connector much like the L-line in ISO 9141. The proceedure is:

SETDTR (for longish time)
CLRDTR
wait 200ms
SETDTR
wait 200ms
SEND 4D FF B4

listen for 4D 00 B3 in response
... continue with kernel upload

NeverLies wrote:On my '03, I've already tried to send 4D command (4D FF B4) at 9600bps and I did not get any answer (with only green test mode connected). Same behavior as Calvin. Will try with your soft and both parameters (wrx2002 & wrx2004).

By the way, what is "fs", "fr", "fb", "s" switches in your application ?

I have an '03 ECU I can plug into my '02 car to see if it works, but I'm pretty sure it will.

cboles wrote:This is a '03 USDM WRX? If it is not, it may not work. You not only need to be sending 4D FF B4 to 02/03's, but you also need to precede that with a 200ms pulse and 200ms wait on DTR (if you are using the OpenPort). DTR is connected to an OEM defined pin on the OBD connector much like the L-line in ISO 9141. The proceedure is:

SETDTR (for longish time)
CLRDTR
wait 200ms
SETDTR
wait 200ms
SEND 4D FF B4

listen for 4D 00 B3 in response
... continue with kernel upload

NeverLies wrote:On my '03, I've already tried to send 4D command (4D FF B4) at 9600bps and I did not get any answer (with only green test mode connected). Same behavior as Calvin. Will try with your soft and both parameters (wrx2002 & wrx2004).

By the way, what is "fs", "fr", "fb", "s" switches in your application ?

That's what I have tried also Will try with yours, perhaps my timing was faulty ! (My WRX is UK so perhaps that's why it work different also)

So that I'm clear - does this tool burn your kernel to the ECU? Or is it just handled in RAM or something?
More generally, is the ECU modified in any manner when executing this, or is this simply interacting with the default protocol support to slurp down the bits of the ROM?

Ordered my cable today, so I'll be grabbing my image soon. I have an '04 Wagon, so maybe this is identical to your 04...

Thanks!
Adrian

no worries - the kernel gets loaded into RAM. once you turn your car off and on again you are no longer running the kernel and everything was as it was. kernel development would have been a painful process otherwise