|
RomRaider
Documentation
Community
Developers
|
| Author |
Message |
|
Sasha_A80
|
Post subject: 5EAT TCM JECS ROM Image  Posted: Tue Apr 25, 2017 3:40 pm |
|
 |
| Senior Member |
Joined: Mon Jan 19, 2009 2:31 pm
Posts: 1615
Location: Moscow, Russia
|
|
M32R based 5EAT JECS
JDM TCU ROM added.
You do not have the required permissions to view the files attached to this post.
Last edited by Sasha_A80 on Wed May 17, 2017 9:22 am, edited 1 time in total.
|
|
| Top |
|
 |
|
roadie
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Tue Apr 25, 2017 4:46 pm |
|
|
| Newbie |
Joined: Sun Mar 05, 2017 3:35 pm
Posts: 22
Location: Sweden
|
|
| Top |
|
|
|
utc_pyro
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Wed Apr 26, 2017 12:11 am |
|
|
| Newbie |
Joined: Thu Feb 18, 2010 3:45 pm
Posts: 31
|
|
At long last!
Edit: Anyone found the code entry point on this ROM? I can't get it to fall apart in IDA.
|
|
| Top |
|
|
|
dschultz
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sun Apr 30, 2017 7:14 pm |
|
|
| RomRaider Developer |
Joined: Wed May 20, 2009 9:49 pm
Posts: 7314
Location: Canada eh!
|
|
What MCU part number is this from?
MB431M - 91D1206000
The first four bytes is an instruction to branch:
0x0000 FF 00 00 5E bra.l loc_178
0x0010 FF 00 00 56 bra.l loc_168
0x0020 FF 00 00 53 bra.l loc_16C
0x0030 FF 00 00 50 bra.l loc_170
...
TCU Logger init string = [A61022][91D12060000][100800400000000A1462C000800000000000000DC060009A9C0047E011E003E00000000000080A20000FEFE00000000]
|
|
| Top |
|
|
|
roadie
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Mon May 01, 2017 2:39 pm |
|
|
| Newbie |
Joined: Sun Mar 05, 2017 3:35 pm
Posts: 22
Location: Sweden
|
dschultz wrote: What MCU part number is this from?
Probably wa12212953www but Sasha will have to correct me if Im wrong.
|
|
| Top |
|
|
|
utc_pyro
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Mon May 01, 2017 4:47 pm |
|
|
| Newbie |
Joined: Thu Feb 18, 2010 3:45 pm
Posts: 31
|
|
In the 05-06 USDM TCU at least the MCU is WA12212963WWN.
|
|
| Top |
|
|
|
Sasha_A80
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Tue May 02, 2017 6:04 am |
|
|
| Senior Member |
Joined: Mon Jan 19, 2009 2:31 pm
Posts: 1615
Location: Moscow, Russia
|
|
wa12212953www chip inside.
I think this is pre MY05 5EAT TCU.
I have no plastic case of this TCU thus have no chance to identify OEM number.
If there was an update it is possible to identify MB431M OEM number according to Subaru update list.
Last edited by Sasha_A80 on Tue May 02, 2017 2:19 pm, edited 1 time in total.
|
|
| Top |
|
|
|
dschultz
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Tue May 02, 2017 10:08 am |
|
|
| RomRaider Developer |
Joined: Wed May 20, 2009 9:49 pm
Posts: 7314
Location: Canada eh!
|
|
So it could be a M32170F3 or M32174F3 MCU depending on the RAM inside?
|
|
| Top |
|
|
|
Sasha_A80
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Tue May 02, 2017 2:22 pm |
|
|
| Senior Member |
Joined: Mon Jan 19, 2009 2:31 pm
Posts: 1615
Location: Moscow, Russia
|
|
This is an early version of M32R 144 pin with 384 kB.
SFR table for M32170-174 should be applicable.
To verify M32r generation you need verify interrupt vector table around 0x100
|
|
| Top |
|
|
|
roadie
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sun May 14, 2017 4:25 pm |
|
|
| Newbie |
Joined: Sun Mar 05, 2017 3:35 pm
Posts: 22
Location: Sweden
|
I'm looking for the button/paddle shift delay but I havent found anything yet. (I'm a beginner at dissasembly) Anyway I logged the can-bus today for upshift/downshift Legacy GT 2005 JDM. BIU=514 51482 Upshift 51484 Downshift 
|
|
| Top |
|
|
|
Sasha_A80
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Wed May 17, 2017 9:25 am |
|
|
| Senior Member |
Joined: Mon Jan 19, 2009 2:31 pm
Posts: 1615
Location: Moscow, Russia
|
|
| Top |
|
|
|
roadie
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Wed May 17, 2017 3:07 pm |
|
|
| Newbie |
Joined: Sun Mar 05, 2017 3:35 pm
Posts: 22
Location: Sweden
|
|
Another JDM rom read with ecuMem.
Hitachi 31711AK290 with wa12212953www mcu.
You do not have the required permissions to view the files attached to this post.
|
|
| Top |
|
|
|
Sasha_A80
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Wed Jun 07, 2017 3:09 pm |
|
|
| Senior Member |
Joined: Mon Jan 19, 2009 2:31 pm
Posts: 1615
Location: Moscow, Russia
|
|
AG802 USDM LGT05 TCM
You do not have the required permissions to view the files attached to this post.
|
|
| Top |
|
|
|
Sasha_A80
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Wed Jun 07, 2017 4:05 pm |
|
|
| Senior Member |
Joined: Mon Jan 19, 2009 2:31 pm
Posts: 1615
Location: Moscow, Russia
|
|
AG810 Outback03 USDM EZ30
You do not have the required permissions to view the files attached to this post.
|
|
| Top |
|
|
|
roadie
|
Post subject: Re: 5EAT TCM JECS ROM Image Posted: Sat Jun 10, 2017 2:31 pm |
|
|
| Newbie |
Joined: Sun Mar 05, 2017 3:35 pm
Posts: 22
Location: Sweden
|
|
Found some SSM commands BF, A0, A8, B0, B8.... and 81,83,27?
rom: 91FE207100
00026580 push lr
00026582 push R10
00026584 push R9
00026586 push R8
00026588 add3 R10, fp, #-0x2EF8
0002658C ldi8 R9, #0
0002658E ldi8 R8, #0
00026590 bl.s sub_266E8 || nop
00026594 ldub R0, @(4, R10)
00026598 ldi16 R1, #0xBF ; '+'
0002659C beq R0, R1, loc_265E0
000265A0 ldi16 R1, #0xA0 ; 'á'
000265A4 beq R0, R1, loc_265E0
000265A8 ldi16 R1, #0xA8 ; '¿'
000265AC beq R0, R1, loc_265E0
000265B0 ldi16 R1, #0xB0 ; '¦'
000265B4 beq R0, R1, loc_265E0
000265B8 ldi16 R1, #0xB8 ; '©'
000265BC beq R0, R1, loc_265E0
000265C0 ldi16 R1, #0x81 ; 'ü'
000265C4 beq R0, R1, loc_265E0
000265C8 ldi16 R1, #0x83 ; 'â'
000265CC beq R0, R1, loc_265E0
000265D0 ldi8 R1, #0x27 ; ''' || nop
000265D4 beq R0, R1, loc_265E0
000265D8 ldi8 R1, #0x10 || nop
000265DC bne R0, R1, loc_26680
|
|
| Top |
|
|
Who is online |
Users browsing this forum: No registered users and 1 guest |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
|
|
