RomRaider

Finally verified.
M32176F4 M32R ECU chip installed into JECS\Hitachi have no bootloader documented for Renesas M32R family.

WA12212953 and M32176F4 chips are connected differently inside the PCB.
Probably internal flash and powering circuitry are different for those chips.
TCU bootloader code differs for those chips.
Nevertheless TCU executive code should run accordingly for both versions.
TCU bootloader is not updated during reflash and it looks like the same official updates maybe applied to any version of the chip installed.

I am working on bootloader swap to make these TCU ( chip ROM and 92C86 eeprom) to be flashable.

AJ782 uses WA12212953
AG589 uses WA12212953

TCU calibration and code (0x8000:0x5FFFF) most probably is compatible for WA12212953 and M32176F4.
The main difference is inside the loader - FlashInit and FlashWrite procedure.
Subaru reflash software most probably uses the same protocol and does no aware of the M32R chip variant used.

From what programmer you try to connect with this MCU?
I interested to read the Flash from 2003Y Nissan Teana J31 4AT TCU Hitachi 31036-9Y610 A64-000 EA7 with MCU UJ wa12212954www.
EcuMem don't help me, because the diagnistics occur from rx/tx (Consult-1 protocol), not from K-Line.
Thanks

There should be some factory protocol for tcu update.
It may need the ecu being installed in to the car and some initial testing done ( the engine is stopped, the car is not running, battery voltage and temperature is applicable, etc..).
I have to use JECS bootmode protocol to read\write a similar Subaru 5EAT ecu's on the bench.

You may send the ecu to my location for reading.

Hi, I'm totally new to reverse engineering, but managed to decompile in ghidra. Still super confused about a lot. So...

1. What reading you recommend to embedding reverse engineering, specially car systems? (I don't have a deep odb2 bus can understanding, ie: I have set my rom tables with romraider, but live read/writes with many devices like comma.ai still magic to me)

2. Any clue on what to look for? Still not sure how numbers scale here, thus I'm confuse about what to look for. I have see nothing that looks like rpms o current gear. If found a interesting function that switches (al lot of ifs) around a value from 0 to 9 but I'm guessing is some kind of communication or flow control.

I've had a look through the TCM ROM and found the 0x27 security access, encryption algo, on-board kernels for flashing etc.

I can see the various tables, although table structure is different to an ECU ROM.

I can also see the SSM functions that report data which should hopefully enable definition of RAM parameters and, from there, table axes.

It will no doubt take some time to figure it all out. So, the big question is.... is there any point (ie) does anyone want the ability to flash their TCM..??

Would be nice to change shifting points and other thresholds.

Example: Higher Redline for 5EAT cars, etc.

Of course we would like to see this in FastECU if you have already something, just pm me so I could start adding it

Not hearing a lot of interest....

I've been plugging away. Here is a teaser - the 5EAT base case shifting curves. There are 50 sets of these curves. 5 different unknown states x 10 different other unknown states. Any clues on what these 5 and 10 states are?

There should be:

default
cold engine
warm engine
cold ATF
warm ATF
cold catalyst
preheat catalist
quick shift ( or selector RND43L plus winter mode )
hill assist etc.

There are 2-5 driver style adaptation levels for a part or for all variants above.
And for "road curveness".

Kickdown redlines may be defined separately.

VAG may use a configurable map subset from about 60 maps, Ford a couple of sets with 15 maps each, as well PSA with 25 maps in each of a couple of sets.

Try to trace diagnostics variables and\or log TCM variables and maps used.

As an example Volvo Aisin AW55-51SN log is attached.

I used to make default plus quickshift or default plus sport\winter mode sets.
It depends on selector type installed.

You are to define map usage first of all.
It may be useful to start with 4EAT that may use less complicated shift\locks map sets.
A driver adaptation algo is used anyway.
As an example Volvo switches to aggressive maps after the very first gear shift in kickdown.

Thanks Sasha, unfortunately I can’t use logging… no car or TCU to play with. Just the binary file!

I’ve worked out the 5 states relate to fuelling (CL / OL / sensor error states). So the other 10 states must be the ones you have listed. I’ll keep digging away and can hopefully figure out which is which.

Create some logger definitions for those who are interested in.
I personally use to drive Audi80 MT MY88.
Nevertheless this is not an obstacle to hack more recent cars remotely..

I have a 5eat car to test logging and flashing with. But the wife might get pissed if she can’t drive to work cause I bricked the TCM lol


Sent from my iPhone using Tapatalk

Thanks @uprev, that will come in handy for testing.

It will take me some time before I've figured out enough of the ROM to be ready for testing. I'll keep you posted.