RomRaider

this is an area which I think we should get into. I mean, the ECUFlash tools are great, but s*** happens (seems to be happening quite frequently as of 11/15 ), and a bad flash is really hard to recover on 05+ DBW cars with the immobilizer.


using the JTAG interface common to the SH7058 microcontroller used in our ECUs, it should be possible to do a complete read of the ENTIRE ROM so that if we lose power during normal flashing, we have a backup method to get our ECUs back.

for some background info on the JTAG interface:
http://en.wikipedia.org/wiki/Jtag

apparently, there are tons of open-source JTAG programs, most of them dealing with debricking WRT54G routers. Maybe we can get some synergy going among open-source projects?


update 11/15:

possible candidate program found! (tgui found it!)
http://openwince.sourceforge.net/jtag/

parallel (ugh...) jtag cable schematics found!
http://jtag-arm9.sourceforge.net/hardware.html

I am probably gonna order the parts from digikey tomorrow or so and get crackin on this.

again, anyone have just a picture of an open DBW pcb? seriously, I have never even seen one! I have NO idea where it is in the car either...


things that would be a big help:
failing that, a good picture of the entire DBW PCB would be good...
(this is more realistic, anyone have any?)


Thanks.

This post deserves a bump!

Im hoping to use the jtag on the JECS ECUs.. (M32r cpu family)

LGT, you aren't too busy to do this are you? I don't have a clue when it comes to that stuff..

it might be held off a little, with the accident and me just getting a bike, but I'm looking into software that actually supports the superH architecture...

then I can get into making the physical cable.

so far, I have found a british company offering a jtag solution for just the SH7055F
(evo and 04 DBW only, iirc) for 1950 euros (yeah, not gonna happen)

http://www.codescape.com/processors.htm

and this...
about super H jtag support in a linux distro.
but it seems like they are also talking about needing to build a miniboard to do it, which would be a PITA.

http://linuxdevices.com/news/NS5079625122.html

and renesas lists a bunch, but I'm guessing there was some kickbacks involved in this listing process, they are all commercial software packages.

http://eu.renesas.com/fmwk.jsp?cnt=debu ... bug_tools/

so, the search continues.

http://openwince.sourceforge.net/jtag/

Seems to be used in the realm of Wince devices.

cool, it supports superH processors!

now I wonder if it supports the ones we need;

and too bad it hasn't been updated in 3 years


hmmm
I need to construct a cable.
thats the next step here.

I'll see what I need to make one of the supported cables

Do you have a link for cable construction? Maybe I missed it in the above posts.

Also.... splain to me. I've got an 04 STi, which proc is it? SH7058 processor (SH2 family)?

You should update and organize all the info gathered into your first post. I agree this would be one of the most beneficial additions to RomRaider.

I present the macraigor wiggler (rofl, I had typed waggler out of habit ) jtag interface, linked in that jtag tools site tgui found
http://jtag-arm9.sourceforge.net/hardware.html

Huh, cool.

How would something like that cable interface with our ECUs?

it has pins that have to be alligator clipped to our microcontroller chips, most likely.

hopefully (and if I can get some detailed pictures of an open ecu I can confirm...) subaru has unmasked JTAG vias or even pin headers for initial programming. that would simplify things quite a bit.

you have an SH7055, which is essentially the same but only has 512k flash instead of 1024k flash.

Maybe someone on the forums who hasn't gotten into a recent car accident could be kind enough to open up their DBW ECU??

I'll see if we can't get a pic of my buddy's 04 STi.

colby says the functionality for this is ALREADY BUILT INTO ECUFLASH!

this is excellent news!