RomRaider

Hey guys, quick question regarding a cross flash.

I have a JDM 3.0 2005 outback ecu (D0XJ001Q) flash method sti05
When I successfully flash the EDM 3.0 rom (D2WD701C) to the JDM ecu, I am unable to read the rom back out with ecuflash. I get the "Requesting Seed...,Sending Key...,interface close" error.
Ecu flash and romraider recognize the EDM ecu-id in the JDM ecu after the reflash, and even Romraider logger shows ecu activity (fuel pump and radiator fan duty cycling) in test mode.
SH Booting the original rom back into the ecu, i am able to read the file back out.
Is there something different in the EDM rom stopping the file from being read out in the JDM ecu? Surely the O/I of the coms pins for reflash don't change position or something like that!

This ecu lives on the bench for learning purposes haha

Is it completely stock rom? Sure it hasn't tuned with ecutek or some system that changes seed codes?

The files are completely stock dude. I can open the EDM rom on ecuflash and write the file to ECU. After that i cant read or write the file back out

You can open and flash file to ecu even if the seeds are changed because it uses seeds from ecu, not from the file. After that it is not possible anymore until you flash old rom back to ecu. But if it is really untouched rom, then I have no idea why it doesn't allow you to read/write anything after flashing.

Have you tried with CAN flash method?

Ive tried a different file and definition with the same result. Tried SubaruCAN as well. Although the EDM file was flashed onto the ecu with sti05 method. Something in the security seed must be changing, its the only thing i can put it down to

JDM ROM has no immobiliser

D2WD701C has an immobiliser coding, it will not do it without an immobiliser code on CAN hence unable to read or write again but will till do radiator fans and fuel pump cycle

Cheers for the reply throttlehappy. The JDM 3.0r ecus are immobilized, I acquired the security id for this just incase I needed it in the future
I know flashing an ecu with the first 2 flash blocks being different is a big no no, but was expecting it to brick the ecu but it didn't.

Only thing I can think being different is the seedkey location in the rom. if I knew these I could transfer that info across

can you send me your email please

Btw, how did this end up?

Both ROMs are used with sti05 flash method and both contains the same seed key bytes so either EDM file had changed bytes or there is some other unknown thing that prevents to read/write ECU. Communication works as you said it is requesting seed and sending key, otherwise it fails at the very beginning of connecting ECU.

Put the ecu to the side for the moment. My main objective was to use the D2WD701C file with the merpmod switch mod applied to it. But being unable to get the ecu to reflash afterwards made it useless.
I couldn't find any hew switch builds for ez30 roms so i couldnt do a build for my specific JDM rom.
I still have the ecu sitting here if you have any ideas to try out?
Where abouts in the rom is the seed bytes? PM me if need be
Cheers

In DOXJ001Q seed key calc bytes are found at 0x56FBC and in D2WD701C those are at 0x50910. There is 3 times 32 bytes that are used for calculating keys, if they match in both ROMs, it shouldn't be a seed key problem. Of course to be 100% sure ROM needs to be disassembled and checked algorithms but that should not be the case as they use the same flash method and there is same byte sets.