RomRaider

I want to try and help any way I can with the BRZ OS rom. I know the community is still trying to get a complete image off the ECU.

It seems that maybe a close look at the ECU may be needed to try and get a better idea at what needs to be done to communicate properly to the ECU. I wouldnt be opposed to cracking the ECU to take a look at the insides if that is what is needed.

I am picking the car up tomorrow, and will start looking for the ECU's whereabouts shortly after.

Any advice from the Pros on what to look for or what to document that could help with getting the files loaded off the Micro would be helpful. I am a computer engineer, so I am comfortable digging into this where others may have been uncomfortable.

See the renesas hardware manuals for the specific chip (SH72XX?) after you open it up. It will probably require some hacking with AUD/boot modes at the least, or unpublished backdoors at the worst.

Id like to avoid boot strapping through hardware (bit-banging or anything of the sort, and/or bench flashing), but hopefully once we know what kind of chip it is, we can make one of the communication protocols work. If there is no way around this then we will investigate further. I am not opposed to doing it if it is a last resort.

I think its going to be necessary to pull out the handshaking code.

More info/partial dumps here: viewtopic.php?f=34&t=9461
and: viewtopic.php?f=8&t=9453

Anybody have any idea on what will be needed in terms of the cable for bootstrapping? Would it just be a serial tx/rx or is it a hacked usb cable to do it. If I can find the location of the ECU I can start tinkering with this. I understand I will have to power the ECU on the bench and then try to communicate via Terminal. I have seen this done on older ECUs (like 04/05 STi ecus) to recover a bricked ECU but I havent dont it in person.

Once I locate the ECU ill try and snap a few pics for you guys, and then we can discuss on how to proceed.

Full dump is already provided.
That means you can use SH boot mode writing.
UART-USB dongle or k-line cable hacked with an applicable watchdog timer fills the bill.

I can make USART/USB cable from work. So all I would need next is some help figuring out what needs to be powered and the rest of the procedure for dumping the memories off the Micro. Im assuming when you are talking K line that is more along the lines of using the OP2.0 to read? Would that be as simple as modding the OP2.0 cable? or do we need more info from the ECU to make the changes to the OP2.0?

I never recommended to remanufacture\rebuild\broke OP2. I am not a Tactrix dealer...

No hardware changes to the OP2.0 are needed.

I wasnt saying it was broken you just mentioned modding the WDT, which in my experiences usually involves reflashing fuse bits in most microcontrollers. That was more so what I was referring to when it came to modding the OP 2.0, but I think you meant to say that the WDT of the ECU must be known otherwise it will reset in between reading pages or however the memory architecture is read.

So wait, I am starting to get conflicting info? If a full dump is available then I shouldnt need to get anything off the ECU? Or is the image we have encrypted, and I need to offload the image unencrypted? Its not that I dont understand what is going on here, I just have never actually gone through the process of reverse engineering this kind of data.

Im fine with everything up to using a USART/USB cable and bench powering the ecu. But from there I would need assistance if we still need to pull data from the ECU. Maybe somebody with more insight can give me their email so I could try not to clutter up threads with questions?

For WDT a simple 555 timer can be made to meet the criteria in the hardware manual. 705X chip wdt circuit is detailed in the shbootmode pdf, might be the same for this one.

As for a full dump, maybe Sasha can clear that up. I thought there was only a partial dump (all except bootloader), but it was mentioned that you could hack it to get it working without that and just clobber the original stuff using boot mode.

Merp,

You are quite correct that incomplete ROM functionality may be restored without having the actual initial bootloader.
But.
Currently the full ROM image is available that simplifies the things dramatically.

SHbootmode solves the rest.

So would SHbootmode be needed just for the initial flash? I am curious why it is needed. Is it just to bypass handshaking? or is there some stuff that needs to be figured out for the handshaking to be done through OBD2 port.

Your oppotunities are as follows:

- use SHbootmode any time
- use SHbootmode to substitute the current bootloader by your own one with applicable protocol
- hack the protocol or security holes from the code and use those by your own software

The last two cases give you the ability to use OBD connection.