SH Boot Mode How-to

AudioRuso · **Joined:** Sun Mar 13, 2016 6:59 pm **Posts:** 14

hockey3592 wrote:

I was wondering if anyone has any experience with the 08+ ECU's. The caps shown in the pictures aren't on the board in the same way. Greatly appreciate the help!

I think I answered your question above.

leandrofpim · **Joined:** Wed Jan 04, 2017 4:08 pm **Posts:** 39

I'm trying to recover my ECU (ecuflash recovery), but it gives me this error message, anyone know about?

"there are more memory areas in this CPU that will be erased than the ROM file you have has data for. write process aborted."

SUBARU STI 2015

Sasha_A80 · **Posted:** Sat Apr 08, 2017 2:24 pm

I suspect you are trying to recover SH72531 or SH72546 chip not having all needed ROM\EEPROM sections in your ROM image.

leandrofpim · **Joined:** Wed Jan 04, 2017 4:08 pm **Posts:** 39

Sasha_A80 wrote:

I suspect you are trying to recover SH72531 or SH72546 chip not having all needed ROM\EEPROM sections in your ROM image.

and what i have to do?

dschultz · **Posted:** Sat Apr 08, 2017 3:55 pm

You have a complete un-corrupted image of the ROM for the ECU?
Stock ROMs are listed here.

leandrofpim · **Joined:** Wed Jan 04, 2017 4:08 pm **Posts:** 39

dschultz wrote:

You have a complete un-corrupted image of the ROM for the ECU?
Stock ROMs are listed here.

Yes i downloaded from this page, but its not work (AZ1P000L)
I also have the stock rom (downloaded from my car)
and others roms of my upgrades,

any other help?

dschultz · **Posted:** Sun Apr 09, 2017 8:11 am

You could also try FDT.
As described here: https://forums.nasioc.com/forums/showth ... ?t=2200443

leandrofpim · **Joined:** Wed Jan 04, 2017 4:08 pm **Posts:** 39

Thank you very much, FDT works but i had to select generic boot (not SH7058)

dschultz wrote:

You could also try FDT.
As described here: https://forums.nasioc.com/forums/showth ... ?t=2200443

mrf582 · **Posted:** Tue Jun 20, 2017 6:24 pm

Request : Bricked SH7055 (512KB) ECU (JDM Forester) which read properly using the 04STI flash method. Have the original *.hex file that was read prior to an attempted write during which the laptop BSODed. Can send you the physical ECU and *.hex file. Please let me know if anyone is able and wants to perform this service and an approximate cost which we can send via PayPal.

Anyone in North America want to take this on?

Thank you very much!

OldhaQ · **Posted:** Sat Nov 10, 2018 7:19 am

Interested to know if you took note of the chip inside your dongle?

AudioRuso wrote:

I just wanted to add my experience. Being a computer geek and having some components around (and being haunted by having to drive into work from a remote area in the morning) I had to make do with what I had.

And what I had was a 5 dollar USB to Serial cable from ebay that proved to be very convenient for the job:

Attachment:

s-l1600.jpg

I was able to solder normal header pins (the type that come with arduinos or any other standard breadboard) to the appropriate pins on my ECU (from an 08 wrx that was bricked while tuning). I was able to connect to the pins DIRECTLY so no further circuitry for the in circuit programming portion was needed. There's a resistor in the picture below but I'm fairly certain in the end I removed it.

Attachment:

13680396_1153583337995041_9007814499440630983_o.jpg

The only challenge was the watchdog timer. I didn't want to build a circuit so instead I made another hack and although it was a pain in the ass to get it to work just right, in the end I was able to successfully flash and unbrick the ECU.

I used a waveform generator program on the computer which ran a standard square wave into the audio output (but it was offset to 0v to +10v) so it was never going into the negative range.

I also used a pulldown resistor to ground on the ECU circuit that was also connected to the ground on the power supply.

The power supply was a large 12v brick style power supply (similar to monitor or laptop power supply).

Lastly i had to play with the output volume until it was just enough to keep the circuit online while writing the program.

I realize this is far from optimum, and far from the right way of doing this, but it's A way that worked for me in a pinch with much less circuitry or manual timers and so on.

gernoff · **Joined:** Thu Mar 02, 2006 6:22 pm **Posts:** 21

Anyone willing to rent me their circuitry for accessing my ECU.

JeeZ_FJT · **Joined:** Thu Jul 09, 2015 4:50 pm **Posts:** 11

thanks for the input of everyone trying to help. the info i found here, on nasioc and some other sites have been a blessing. but still, i'm stuck.

my circuit seems properly built (using DLP-USB232M, 555 timer, 2x1k resistor, 1x 47.5kresistor, 100uf cap, 0.1uf cap)
connected to Pads P405/P407/P409/P411/P413 and on GND side of ''on ecu board'' capacitor
i dont have a scope but my timer circuit outputs 2.5ish volts
i can start the sequence from ecuflash(ver; 1.44.4799, SH-bootloader) but it wont start to write,
ecuflash seems to tell me the file is not large enough for what it will erase. found little info on this (most replies seems to point at a faulty rom)

ecu is from USDM wrx2009 AZ1G401V, ive tried a stock rom from the ''forum's stock rom list'', tried my original saved file without any success, giving me the same message (see log)

ive tried FDT but it doesn't even select a baud rate before failing. i'm less familiar with FDT than ecuflash though

**ECUFLASH LOG**
[13:03:13.882] FTDI Driver Version 2.12.28
[13:03:18.105] sending bit rate sync bytes...
[13:03:18.220] received bit rate adjust response
sending boot command
[13:03:18.730] got boot response
[13:03:18.850] 1 supported device(s):
[13:03:18.850] 1n01 R4F70580S
[13:03:18.850] selecting device 1n01
[13:03:19.090] 1 supported clock mode(s):
[13:03:19.090] 0
[13:03:19.090] selecting clock mode 0
[13:03:19.330] 2 supported clock type(s):
[13:03:19.330] 1 ratios for clock type 1
[13:03:19.330] x8
[13:03:19.330] 1 ratios for clock type 2
[13:03:19.330] x2
[13:03:19.450] 2 supported clock frequency range(s):
[13:03:19.450] 1 40000000-80000000
[13:03:19.450] 2 10000000-20000000
[13:03:19.570] 1 user boot MAT area(s):
[13:03:19.570] 1 00000000-00002fff
[13:03:19.690] 1 user MAT area(s):
[13:03:19.690] 1 00000000-000fffff
[13:03:19.810] programming unit is 128
[13:03:19.930] one MAT programming supported at 00000000
[13:03:19.930] setting baud rate to 62500
[13:03:20.185] there are more memory areas in this CPU that will be erased than the ROM file you have has data for. write process aborted.
[13:03:20.185] interface close

___________________________________________________________________________

*** FDT LOG ***
OS: Windows 7 [Non-Admin]
Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2
Connecting to device 'SH/7058F' on 'COM3'
Configuration:
'BOOT Mode' connection - using emulated interface
Opening port 'COM3' ...
Loading Comms DLL
Loaded Comms DLL
Initiating BOOT SCI sequence
Attempting 9600
Attempting 4800
Attempting 2400
Attempting 1200
Error No 15024: Boot failed

Suba Imp · **Joined:** Thu Sep 17, 2020 9:06 pm **Posts:** 100

Jeez... did anyone help you out dude? I'm about to try this on 2010 impreza 2.5i na, The only thing I'm not certain what ft232 chipset/cable to get for our ECU since they are different I think from 05 models...not even sure what sh70?? model it is.

Suba Imp · **Joined:** Thu Sep 17, 2020 9:06 pm **Posts:** 100

Jeez...I just noticed that you may have used a 100uf cap instead of a 100nf cap causing your clock to be set to high it should be around 125Hz and looking at your FDT clock says 10Mhz. Maybe that's it. :?:

aaa · **Joined:** Wed Apr 21, 2021 9:57 pm **Posts:** 28

Hi, I'm about to try building to unbrick. Is the ground to the cap on the back of the ECU board essential? My board is different than in the photo. It is a 112331-7390 from an 09 USDM Forester NA AT. R4F 70580S

Also, I'm going to try using an arduino UNO to emulate the 555 timer. Any suggestions? And several resistors in series to add up to the 47.5K one (20+20+4.7+2 maybe plus 1 = 47.7K not including line resistance).

Here is the pinout for my cheap VAGCOM cable. I'll connect to pin 1 and 5 for TX/RX: http://www.ftdichip.com/Support/Documen ... FT232R.pdf

EDIT for underlined below: This is not the same pinout.. found correct one at busaru.com.. also GNDs mostly seem to be connected..
Here is a pinout for my ECU, luckily it is the same on a 05 Forester. I may connect the grounds for the "GND (control systems)" also to be safe:
https://www.xcceleration.com/pinouts/20 ... HC_ECM.pdf

RomRaider

Forum rules

SH Boot Mode How-to

Who is online