RomRaider Logo

RomRaider

Open Source ECU Tools
 FAQ •  Register •  Login 

RomRaider

Documentation

Community

Developers

It is currently Wed Dec 24, 2025 9:45 am

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 44 posts ]  Go to page Previous  1, 2, 3
Author Message
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Sun Aug 28, 2016 10:16 am 
Offline
Experienced
User avatar

Joined: Wed Nov 10, 2010 7:56 am
Posts: 418
Sasha_A80 wrote:
- mode 22 and mode 22 batch logging


What do you meen with "batch logging" ?
I can tell, what to do to use the DAQ-list for mode 0x22 logging..
"Normal" Mode 0x22 polling is very easy and is done via stand-alone-logger allready:

there is an example for logging water temp on CAN via Mode 0x22:
Code:
W: 03 22 00 05
R: 04 62 00 05 40


translation:
Code:
W: 03 22 00 005


03 - 3 bytes following
22 - mode 22 is used
00 05 - PID for water temp

Code:
R: 04 62 00 05 40


04 - 4 bytes follwoing
62 - use Mode 22, as relay it is always 0x40 + requested mode, so 0x62
00 05 - PID of sended value
40 - 0x40 -> via calculation formula of PID 05: 24°C

Take a look here:
https://subdiesel.wordpress.com/generic ... ed-obd-ii/


Quote:
- mode 23 ecu reading


Take a look here:

https://subdiesel.wordpress.com/2015/11 ... ad-memory/

If I know the seed-an-key algothumen, I can try to access extended diagnositic section first and start to request any of the RAM addresses of the application part of the RAM.
Without, access was denied

_________________
performence based on engineering..


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Sun Aug 28, 2016 10:26 am 
Offline
Experienced
User avatar

Joined: Wed Nov 10, 2010 7:56 am
Posts: 418
gnif wrote:
Jochen_145 wrote:
Forced regeneratios is only possible, if the smoos ration is lower then 130%.


Incorrect, this is an artificial limit imposed by the SSM3 suite, the car will do a forced regeneration at any level.


NO not:
there is a threshold in application, with restrics the maximum allowed smoos rate to enter a active regeneration. It is set to 130% for GEN2 E4 and E5 diesels.
Froced regeneration will be denied, if the level is higher

GEN3 maybe chanced, but for GEN2 for sure.



If the smoos level on GEN2 is higher then 130%, you can flash a special SW.
With this software, driving is not possible, but the levels are set to 170%.

The limit is in ECU-software, I know the addresses..

Quote:
also believe the following code can be used to poll the forced regeneration status
Code:
31 03 80 02

Do you check this ? With values are sent, when you start ?
I remember, there are values, but don´t know witch.. (Smoos for sure..)

_________________
performence based on engineering..


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Sun Aug 28, 2016 10:29 am 
Offline
Newbie

Joined: Thu Nov 19, 2015 12:23 am
Posts: 30
Jochen_145 wrote:
gnif wrote:
Jochen_145 wrote:
Forced regeneratios is only possible, if the smoos ration is lower then 130%.


Incorrect, this is an artificial limit imposed by the SSM3 suite, the car will do a forced regeneration at any level.


NO not:
there is a threshold in application, with restrics the maximum allowed smoos rate to enter a active regeneration. It is set to 130% for GEN2 E4 and E5 diesels.
Froced regeneration will be denied, if the level is higher

GEN3 maybe chanced, but for GEN2 for sure.


Perhaps, but I have had the differential sensor disconnected since this all started and the ECU was reading a soot level of 40% when I issued the regeneration, it is a 2010 Euro5, no idea which generation though.

I also have not checked that value, but I have it in a dump from a regeneration performed by the service center, it was polled literally thousands of times until the regeneration finished and the return value changed form a 1 to a 0.


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Sun Aug 28, 2016 10:39 am 
Offline
Experienced
User avatar

Joined: Wed Nov 10, 2010 7:56 am
Posts: 418
gnif wrote:
Perhaps, but I have had the differential sensor disconnected since this all started and the ECU was reading a soot level of 40% when I issued the regeneration, it is a 2010 Euro5, no idea which generation though.

This is the manual way, if you do not have the froced regeneration special SW and need to start one above 130% ;)
It is also used at Workshops and provied by Subaru themself :D

Quote:
I also have not checked that value, but I have it in a dump from a regeneration performed by the service center, it was polled literally thousands of times until the regeneration finished and the return value changed form a 1 to a 0.

If it is polled for 12,5 minutes, it may the same then PID 0x125B ?!

_________________
performence based on engineering..


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Mon Aug 29, 2016 1:22 am 
Offline
Newbie

Joined: Thu Nov 19, 2015 12:23 am
Posts: 30
Unsure, I wont know until the car needs another regeneration, which I hope to avoid.

Since all the information has been provided here on how to perform this, and opened the door I will now take my leave to work on other projects :).

Thank you all.


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Tue Oct 18, 2016 8:26 am 
Offline
Newbie

Joined: Thu Nov 19, 2015 12:23 am
Posts: 30
Just an update on this...

After performing a forced regeneration a few days later the ECU started reporting an EGR error code, upon removing and inspecting the EGR it was determined that it was seized and required a fair amount of cleaning and manual manipulation of the butterfly before re-fitting. I can only assume that the EGR was seized due to the DPF being so blocked due to daily use of the vehicle while I reverse engineered the ROM (someone better informed might be able to confirm this).

After correcting the EGR issue I discovered that the prior "mechanic" had destroyed the sump plug and rounded it out, and that there was a rather bad oil leak around the sump, upon further inspection it became evident that the "mechanic" had cracked open the seal around the sump to allow the oil to drain as there was two different colors of liquid gasket around 3 edges of the sump, one clearly much newer.

I opted to remove the sump and replace the gasket properly, upon removal of the sump I measured a little over 8 liters of old oil, instead of the 5.5L it should have had. The engine had only done 1,500kms since it's last change, and was black as black. I can only assume that due to the inability to drain the sump properly, the "mechanic" added the 5.5L on top of 3L of the old oil.

After cleaning the sump and block I re-fitted the sump, poured in the correct amount of oil, verified on level ground with the dipstick, reset the oil dilution ratio, and let it stand for a few days to ensure the gasket was fully set (about to take it on a LONG trip, had to be sure).

A trip to Tasmania and 5500kms, power is up, the ECU performed several regenerations while on the road (and lots of dirt roads) with only one minor incident. Oil is still fairly clean, not pitch black. No sump leaks.

I observed one regneration that was less then useful and proves the heuristics in the ECU need improvements. We were heading mostly down hill for about 80kms when the vehicle decided to perform a regeneration. During this time the engine load was low to none for most of the trip and the outside temperature never exceeded 10C. The DPF reached the trigger point of 65% and the ECU started a regeneration, but due to the load load and low ambient temperature, the DPF never got hot enough to burn off. After 12.5 minutes, the DPF was reading 84% soot and regeneration completed.

To resolve the climbing DPF readings we pulled over once we were down the hill and back on level terrain, restarted the engine (and thus the ECU also) and continued, at which point the ECU triggered another regeneration which was successfully able to reduce soot to 10%.

The ECU should clearly take an average reading of the engine load over 5-10 minutes before it decides to perform a DPF burn to ensure that the DPF temperature will reach the desired range for soot burn off.

And finally, today I get a letter from Subaru... a Recall Campaign for the front wiper electric motor that can apparently catch on fire. I wonder if I can get them to send me the part, I don't trust their "mechanics" any more.

Edit: I also was in communication with Subaru about this issue and here is what they had to say about adding a DPF regeneration lamp...

Quote:
The idea of an alert or light to indicate the vehicle is conducting a regen sounds very creative and I will ensure this information is passed onto FHI, manufacturer of Subaru vehicles, in the hope this can be fitted to future generation diesel vehicles.

Again, I have sent a copy of your correspondence to our Chief Engineer who I will ensure relays this message back to FHI Japan, manufacturer of Subaru vehicles.


Really??? It has taken 6 years to figure this one out after how many complaints by people with DPF issues?


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Sun Jan 01, 2017 10:22 pm 
Offline
Newbie

Joined: Fri Jan 17, 2014 2:30 am
Posts: 6
Really good work on figuring this out.
Any info on how to generate a Euro4 forced DPF regen? I havent searched the forums yet to check.

Also - I've spoken to some trustworthy subaru technicians in the past.
Running a forced DPF regen (when past the soot levels where normal DPF regens are disable) may require to replace certain parts + oil . Appearently this is due to the DPF regen and heat that is created in a forced DPF regen.

Other parts may also take damage and require replacement - so be wary when you do a forced DPF regen on your car.

The DPF implementation on Subaru is.. iffy at best. Euro5 is supposed to be better in most ways, but in some ways it's worse.
Euro4 had issues with cold weather , Subaru solved it by leading more heat down from the engine (by added insulations) as an after market workshop fix. The parts required

P1472 fix for cold weather:
Euro 4 diesel: (up to and including 2010)

1 stk 20830AA060 Pipe CP - Exh Press
1 stk 99078AB190 Hose water
1 stk 99078AB200 Hose water
1 stk 44616AA190 Gasket - Exhaust
4 stk 092313102 Hose Clamp


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Sun Jun 25, 2017 11:02 pm 
Offline
Newbie

Joined: Thu Nov 19, 2015 12:23 am
Posts: 30
Norman wrote:
Other parts may also take damage and require replacement - so be wary when you do a forced DPF regen on your car.


I built a data logger and have logged both on the road regeneration's and the forced regeneration's to compare. Subaru are being dishonest about this, on the road when the car enters regeneration the DPF and CAT temperatures jump to ~650C in about 10-20 seconds from their average of ~400C, and it remains at this level until the soot % reaches 0 or 12.5 minutes have passed.

The forced regeneration on the other hand follows a very delicate temperature curve to slowly and gently raise the temperature of only the DPF to ~650C.

Step 1) Brings engine up to operating temperatures
Step 2) Begins to raise the DPF temperature by means of post combustion diesel injections until the DPF reaches ~400C
Step 3) Post injections are increased until the DPF reaches ~450C, and held there for ~5 minutes.
Step 4) Post injections are increased until the DPF reaches ~500C, and held there for ~5 minutes.
Step 5) Post injections are increased until the DPF reaches ~550C, and held there for ~5 minutes.
Step 6) Full regeneration is started and the DPF is finally raised to the target of 650C and held there until either soot reads 0% or the cycle has run for 12.5 minutes.

The forced regeneration is very gentle on the DPF by avoiding excessive stresses by not raising its temperature too rapidly, where on the road, it just dumps fuel in until it gets to the ~650C... and even then, only while you are on the power, if the engine is under no load (off the throttle, coasting, idle in traffic) the DPF rapidly cools before it can complete. So instead of a gentle ramp up, burn until finish cycle, you get a very stressful on/off/on/off cycle until it is done or the time has expired.

It should be noted that the soot does not burn at all until the temperature reaches > 600C, so if the car is doing a "Passive" regeneration (which btw is a lie also, there is nothing passive about it) and doesn't maintain a DPF temperature > 600C the extra diesel is just further clogging the DPF making the problem worse.

Those trustworthy techs, I have nothing against, but I know first hand with my dealings with Subaru HQ Australia the technicians are lied to also and are just repeating Subaru BS. Most of them are just wrench monkeys and when there is an issue of this nature Subaru get them to put the SSM tool into data logging mode, and submit all that info to Subaru who then tell the techs what to do to fix it, not what was wrong.


Top
 Profile  
 
 Post subject: Re: Reversing the EURO5 Outback 2.0D ECU (7059)
PostPosted: Mon Jul 17, 2017 12:28 pm 
Offline
Newbie

Joined: Mon Jul 17, 2017 12:18 pm
Posts: 1
gnif wrote:
Some more findings... Once mode 10 is figured out, we will be able to authenticate!!!!!

1) entering service mode 0x01 (0x27 0x01) we already know and I can confirm the method is identical to euro 4.

Test from known good auth from sniffed dump
Code:
Challenge Known    Calculated
099a3329  c9a72ded c9a72ded

2) entering service mode 0x03 (0x27 0x03) uses the same algorithm as Euro4, but with some byte swapping.
Code:
// 0xAABBCCDD -> 0xBBCCAADD
challenge = ((challenge >> 8) & 0x00FFFF00) | ((challenge & 0x0000FF00) << 16) | (challenge & 0xFF);

answer = calcAnswer(challenge);

// 0xAABBCCDD -> 0xDDBBCCAA
answer = ((answer & 0xFF000000) >> 24) | (answer & 0x00FFFF00) | ((answer & 0xFF) << 24);

Test from known good auth from sniffed dump
Code:
Challenge Known    Calculated
11573862  360263d0 360263d0

3) entering service mode 0x05 (0x27 0x05) again uses the same algorithm, but different byte swapping again, I have not bothered figuring this out yet as I have no dumps of this authentication to verify my findings with.

Note, none of these are useful until authentication is unlocked via mode 0x10.

Just realized I have been calling int mode 10 all this time, when there is a mode 10, it is mode 0x10, or mode 16.


I tried to use your source code to calculate key from seed for my Subaru. Your code example calculate right key for CAN message with ID = 0x7E0. I have problems with calculate key,
because some diagnostic messages have ID = 0x752 and in this case I can't use your code example. Does algorithm depend on message ID and how?


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Mon Aug 14, 2017 4:20 pm 
Offline
Experienced
User avatar

Joined: Wed Nov 10, 2010 7:56 am
Posts: 418
If you are talking about EURO5 Diesel, I wounder, why you finde diagnosic setion to ECU on ID 0x752 ?

Sure you are talking SSM-III and no OBD-2 protocoll to your ECU ?

_________________
performence based on engineering..


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Sun Aug 20, 2017 3:39 am 
Offline
Newbie

Joined: Sat Jul 23, 2016 5:43 am
Posts: 8
I am a bit new to romraider, have so far only used it for measuring values & resetting oil dilution counter. So from this it looks there may be a way via romraider to force a DPF regeneration on 2009 subaru forester sh euro 4. Does anyone have the code steps...written for a newbie, when to init/read/write, address block, what code to input, etc...

Would be great to know, so dont have to take to the dealer

thanks


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Sun Jul 15, 2018 6:01 am 
Offline
Newbie

Joined: Sun Jul 15, 2018 4:59 am
Posts: 6
gnif wrote:
SUCCESS! I just triggered a DPF regeneration!

Not sure on this part, it seems to be required but it is not obvious in the assembly
Code:
-> 22 10 31
<- 62 10 31 00
-> 22 10 30
<- 62 10 30 ff


And here is the magic sauce!
Code:
-> 10 03              - Enable mode 0x27
<- 50 03
-> 27 03              - Service mode 3 auth
<- 67 03 aa bb cc dd
-> 27 04 11 c5 20 48
<- 67 04
-> 31 01 80 02        - Start the regeneration
<- 71 01 80 02 00 01


Hi All,

Have just attempted this Force Regen method with my MY10 AU Outback Diesel. I can talk to the ECU, I have the code ready to calculate the seed/key response, but when I attempt to enter mode 0x27 I get a "NO DATA" response as below...

Code:
-> 22 10 31
<- 62 10 31 00

-> 22 10 30
<- 62 10 30 ff

-> 10 03
<- 50 03

-> 27 03
<- NO DATA


I'm sure it's a step i'm missing, but as yet I haven't been able to work it out.

Hopefully someone here has seen this before and can point me in the right direction?

Regards,


Last edited by theunknown on Fri Jul 20, 2018 9:04 pm, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Fri Jul 20, 2018 9:04 pm 
Offline
Newbie

Joined: Sun Jul 15, 2018 4:59 am
Posts: 6
Update:

So the "NO DATA" response was being returned from the ELM137 and not the ECU, I tried maxing out the data receive timeout, but that changed nothing. After plugging in a Tactrix cable, the ECU response is actually an error. See below...

Code:
-> 10 03]
<- 50 03
-> 27 03
<- F7 27 F7


If I query the Auth Flag 0x22 PID 0xF186 I get 0x1 rather than 0x3 as these notes suggest I need to have the extra modes enabled.

The car is not running (<100RPM), battery voltage is normal (12.4V) and car is stationary (<5KPH). Ignition is in the ON position.

Vehicle has been updated to the latest ROM (JE5F231A) tho I had the exact same issue with the old version (JE5F201A).

I've also tried these two commands to clear the memory, but alas no change.

Code:
-> 31 01 FF 00 00 00
-> 31 03 FF 00


At this point I looks like i'm missing a step to enable mode 0x27, but after reading this thread multiple times i'm out of ideas. Any assistance would be greatly appreciated?

If I can get this working, I'd be happy to put together a detailed write up for anyone wanting to do this themself.

Regards,


Top
 Profile  
 
 Post subject: Re: Subaru Euro5 Reverse Engineering! Found new authenticati
PostPosted: Thu Dec 16, 2021 11:45 am 
Offline
Newbie

Joined: Fri Jan 17, 2014 2:30 am
Posts: 6
theunknown wrote:
Update:

So the "NO DATA" response was being returned from the ELM137 and not the ECU, I tried maxing out the data receive timeout, but that changed nothing. After plugging in a Tactrix cable, the ECU response is actually an error. See below...

Code:
-> 10 03]
<- 50 03
-> 27 03
<- F7 27 F7


If I query the Auth Flag 0x22 PID 0xF186 I get 0x1 rather than 0x3 as these notes suggest I need to have the extra modes enabled.

The car is not running (<100RPM), battery voltage is normal (12.4V) and car is stationary (<5KPH). Ignition is in the ON position.

Vehicle has been updated to the latest ROM (JE5F231A) tho I had the exact same issue with the old version (JE5F201A).

I've also tried these two commands to clear the memory, but alas no change.

Code:
-> 31 01 FF 00 00 00
-> 31 03 FF 00


At this point I looks like i'm missing a step to enable mode 0x27, but after reading this thread multiple times i'm out of ideas. Any assistance would be greatly appreciated?

If I can get this working, I'd be happy to put together a detailed write up for anyone wanting to do this themself.

Regards,


Necroing this post, but did anyone find an easy way to force regen on EURO4 Diesels?


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 44 posts ]  Go to page Previous  1, 2, 3

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 8 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
Style based on FI Subsilver by phpBBservice.nl