RomRaider

It might be because that car's BIU expects CAN comms. Does the ECU in that car use k-line comms or CAN comms?

For completeness, these are the commands to customise a BIU setup as described in the FSM. There are a lot of other commands that are not documented, but I'm pausing development here.

This is all for k-line comms. I can expand to CAN comms if someone has a BIU ROM image from a CAN-based BIU...?

Command to change BIU Customisable Times & Temps

Data byte & information
Byte0 bit0, bit1 - 4 values for room lamp off delay time - OFF, Short, Normal, Long
Byte0 bit2 to bit7 - unused
Byte1 bit0, bit1, bit2 - 5 values for auto-lock time - 20, 30, 40, 50, 60 seconds
Byte1 bit3 to bit7 - unused
Byte2 bit0, bit1, bit2, bit3 - 9 values for outside temperature offset - -2.0 to +2.0 in 0.5 degrees C increments
Byte2 bit4 to bit7 - unused


Command to change dealer / country options

Data bit & information
Byte0 bit0 rear defogger op mode
Byte0 bit1 wiper deicer op mode
Byte0 bit2 security alarm setup
Byte0 bit3 impact sensor setup
Byte0 bit4 alarm monitor delay setting
Byte0 bit5 lockout prevention
Byte0 bit6 impact sensor
Byte0 bit7 siren installed
Byte1 bit0 answer back buzzer setup
Byte1 bit1 hazard answer back setup
Byte1 bit2 automatic locking setup
Byte1 bit3 ans-back buzzer
Byte1 bit4 auto locking
Byte1 bit5 initial keyless setting
Byte1 bit6 initial button setting
Byte1 bit7 initial security setting
Byte2 bit0 select unlock switch
Byte2 bit1 passive alarm
Byte2 bit2 door open warning
Byte2 bit3 dome light alarm setting
Byte2 bit4 map light setting
Byte2 bit5 belt warning switch
Byte2 bit6 ---- unused ----
Byte2 bit7 keyless P/W switch
Byte3 bit0 illumination control on/off
Byte3 bit1 A/C ECM setting
Byte3 bit2 P/W ECM setting
Byte3 bit3 center display setting
Byte3 bit4 wiper deicer
Byte3 bit5 rear fog light setting
Byte3 bit6 UK security setup
Byte3 bit7 MT/AT
Byte4 bit0 sedan/wagon setting
Byte4 bit1 double lock
Byte4 bit2 6MT setting
Byte4 bit3 Option code
Byte4 bit4 Option code
Byte4 bit5 Option code
Byte4 bit6 Option code
Byte4 bit7 EK model

I have an ssm3/4 device that I'd loan to you longterm in order to help expand our knowledge. For example if you were logging the communication to the car while performing various tasks in the software. I originally got it to do immobilizer programming and then found out each car has a unique password! I'll send a PM but here's the unit https://vxdiag.com/products/vxdiag-vcx-plus-for-subaru

Hi, thanks. There are various working versions of SSM3/4 available which could be sniffed. That allows replication of commands, but often doesn’t provide a full understanding of the commands, especially undocumented ones. For that, reverse engineering is the only option.