Australian 2007 Liberty GT 2.5 - "Tuned by STi"

[htpcoz]

Hi,

I've been trying to read the ECU contents on the above car, however have been unsuccessful.

I'm using an openport 3, and ECU Flash 1.30 and constantly get the following;

[02:14:29.078] Version 1.30.1095
[02:14:29.078] 8 memory models read.
[02:14:30.750] 145 ROM metadata models read.
[02:14:30.750] checksum module "subarudbw" loaded.
[02:14:30.750] flashing tool "wrx02" loaded.
[02:14:30.750] flashing tool "wrx04" loaded.
[02:14:30.750] flashing tool "sti04" loaded.
[02:14:30.750] flashing tool "sti05" loaded.
[02:14:30.750] flashing tool "mitsukernel" loaded.
[02:14:30.750] flashing tool "mitsukernelocp" loaded.
[02:14:30.750] flashing tool "mitsubootloader" loaded.
[02:15:49.375] SSM2 init
[02:15:49.640] [FF] A2 10 11 4B 52 58 A0 07 F3 FA C9 8C 0B 83 FE AC
00 00 00 66 CE 54 FD B0 60 00 1F 20 00 00 00 00
00 DC 00 00 5D 1F 30 80 F0 E6 00 00 40 FB 00 F5
C1 86 00 00 00 01 ED F1 80 00 81 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
[02:15:49.656] SSM2 ECU ID is 4B 52 58 FFFFFFA0 07
[02:15:49.656] SSM2 cmd_0x81

No matter what I do I can't seem to get past this.. I have connected the green connector in the passengers side footwell, which puts the car into the cycling fan on - fan off sequence, but no matter what I do on timing the ECU flash just can't make it any further than the cmd_0x81.

There is a green connector in the drivers footwell, which was already connected. This connector however only has one wire in it. There was another pair of connectors in the drivers footwell that was disconnected (white single pin connectors). I tried to connect these, and all that it managed to do was flash the interior light on and off repeatedly (very strange!).

From reading the forums I can see that some people talk about 2 sets of test connectors on the LGT, in my case there appeared to be only one, in the passengers footwell.

It appears that the connectivity is OK, as I've managed to get TARI ECU explorer to connect and monitor perfectly well, and is able to monitor information perfectly well. As shown in the log following;

21:17:27.942 - ecuExplorer (Version 3.0.25)
......
21:17:29.134 - serial view build complete...
21:17:29.134 - using comm port 6 [\\.\COM6]
21:17:29.197 - using SSM trace file [28-05-2007 21h17m.ssm.ptf]
21:17:29.213 - comms modules started...
21:17:29.213 - --> 80 10 F0 01 BF 40 - .....@
21:17:29.213 - to ECU : QueryECUType
21:17:29.244 - <-- 80 10 F0 01 BF 40 - .....@
21:17:29.479 - <-- 80 F0 10 69 FF A2 10 11 4B 52 58 A0 07 F3 FA C9 - ...i....KRX.....
21:17:29.479 - <-- 8C 0B 83 FE AC 00 00 00 66 CE 54 FD B0 60 00 1F - ........f.T..`..
21:17:29.479 - <-- 20 00 00 00 00 00 DC 00 00 5D 1F 30 80 F0 E6 00 - .........].0....
21:17:29.479 - <-- 00 40 FB 00 F5 C1 86 00 00 00 01 ED F1 80 00 81 - .@..............
21:17:29.479 - <-- 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................
21:17:29.479 - <-- 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................
21:17:29.479 - <-- 00 00 00 00 00 00 00 00 00 00 00 00 00 CA - ..............
21:17:29.479 - from ECU : QueryECUTypeResponse
21:17:29.479 - semaphoreWrite returned...
21:17:29.479 - AddLiveQueryItem [0xE] [0xF]
21:17:29.479 - AddLiveQueryItem [0x0] [0x12]
21:17:29.479 - AddLiveQueryItem [0x0] [0x11]
21:17:29.479 - AddLiveQueryItem [0x0] [0x10]
21:17:29.495 - AddLiveQueryItem [0x0] [0x30]
21:17:29.495 - AddLiveQueryItem [0x0] [0x3B]
21:17:29.495 - AddLiveQueryItem [0x0] [0x41]
21:17:29.495 - AddLiveQueryItem [0x0] [0x40]
21:17:29.495 - AddLiveQueryItem [0x0] [0x3F]
21:17:29.495 - AddLiveQueryItem [0x0] [0x3E]
21:17:29.495 - AddLiveQueryItem [0x0] [0x3D]
21:17:29.495 - AddLiveQueryItem [0x0] [0x3C]
21:17:29.495 - AddLiveQueryItem [0x0] [0x46]
21:17:29.511 - AddLiveQueryItem [0x0] [0x63]
21:17:39.662 - LiveQuery [0xE] [0xF]
21:17:39.662 - LiveQuery [0x0] [0x12]
21:17:39.662 - LiveQuery [0x0] [0x11]
21:17:39.662 - LiveQuery [0x0] [0x10]
21:17:39.662 - LiveQuery [0x0] [0x30]
21:17:39.662 - LiveQuery [0x0] [0x3B]
21:17:39.662 - LiveQuery [0x0] [0x41]
21:17:39.662 - LiveQuery [0x0] [0x40]
21:17:39.662 - LiveQuery [0x0] [0x3F]
21:17:39.662 - LiveQuery [0x0] [0x3E]
21:17:39.662 - LiveQuery [0x0] [0x3D]
21:17:39.662 - LiveQuery [0x0] [0x3C]
21:17:39.662 - LiveQuery [0x0] [0x46]
21:17:39.662 - LiveQuery [0x0] [0x63]
21:17:39.662 - --> 80 10 F0 2F A8 00 00 00 0F 00 00 0E 00 00 12 00 - ................
21:17:39.662 - --> 00 11 00 00 10 00 00 30 00 00 3B 00 00 41 00 00 - .......0..;..A..
21:17:39.662 - --> 40 00 00 3F 00 00 3E 00 00 3D 00 00 3C 00 00 46 - @..?..>..=..<..F
21:17:39.662 - --> 00 00 63 32 - ..c2
21:17:39.662 - to ECU : LiveQuery
21:17:39.788 - <-- 80 10 F0 2F A8 00 00 00 0F 00 00 0E 00 00 12 00 - ................
21:17:39.788 - <-- 00 11 00 00 10 00 00 30 00 00 3B 00 00 41 00 00 - .......0..;..A..
21:17:39.788 - <-- 40 00 00 3F 00 00 3E 00 00 3D 00 00 3C 00 00 46 - @..?..>..=..<..F
21:17:39.788 - <-- 00 00 63 32 - ..c2
21:17:39.851 - <-- 80 F0 10 10 E8 00 00 57 80 00 00 00 00 00 18 18 - .......W........
21:17:39.851 - <-- 32 32 80 80 E3 - 22...
21:17:39.851 - from ECU : LiveQuery
21:17:39.851 - semaphoreWrite returned...

With the same cable/laptop I have connected successfully to a Aus 2002 Impreza STi, and read the ROM successfully, so I think the laptop and cable combination are fine. Connection to the two cars was done back to back, so there was no change between the two test runs.

Any ideas about how to get things talking? I'm pretty keen to compare the maps on the "STi Tuned" ECU vs the standard ECU.

The fact that connectivity is OK, but ECU reading is not makes me think that perhaps the setup of the test connectors is different resulting in the inability to read.

[htpcoz]

Reading the other posts regarding J2534 has me a little worried that perhaps the mechanism utilised by EcuFlash to communicate with the new subaru DBW ECUs no longer works.

Has anyone encountered the same issue (communication ends with cmd_0x81) on a Liberty/Legacy and managed to resolve the issue?

I still think that as I seem to have some basic connectivity (for monitoring) then some portion of the protocol is working fine. The fact that the full functionality is not available could be because I've got something wrong with the test connectors. If someone has managed to get this working it would be appreciated to hear how they have done it.

Alternatively if someone knows this is a current and real limitation, then I'll stop wasting my time on it.

[BoxerFan]

Mine is a SG Legacy MY2004 which should be the same as the Liberty sold in AU. Just need to connect the passenger green connector to pull/reflash the ROM.

Do you have "SI Drive"? If you do, then the above will not work at all. The new "SI Drive" model is CAN based, and so far no luck in pulling/reflashing the ROM using open sourced tools.

[htpcoz]

Yep, definitely the SI Drive model, so that probably explains it then...

Will not worry about working on it then, and focus on the '02 Impreza (the Liberty is the wife's car anyhow, and she has been getting progressively more worried the more time I spend tinkering on her car).

Interesting thing is that ecuexplorer can communicate to some extent to read sensor values, just can't read the ROM. Perhaps they've changed the command sequences required to read this information, or just simply removed the functionality from this interface alltogether, and put it on the CAN interface instead.

Thanks for the heads-up.

[BoxerFan]

Believe that is the case. The logging uses the SSM protocol, which is still available in the SI Drive model.

However, the new SI Drive model has the CAN interface exposed at the OBD2 port. Subaru may have transferred the flashing functionality to the CAN interface.

[chriskan]

Hi Guys, just bringing up an old thread. I'm trying to pull the rom from my aus-spec 07 tuned by STI too, same result as htpcoz. Is it still the case that the SI-Drive's ROM can't be read with open source tools?