RomRaider

Hello

Looking for a definition file for ROM ID AE5W101V, taken off a 2017 Subaru STi, Canadian model (USDM?), MT. Binary file attached as read by ECUFlash.

Having read a bit, I know you have done AE5W100V (so quite close numerically) but not sure if that can be taken as "close enough". I have manually tried to edit definition file for this existing file (AE5W100V) and changed both references to it to my ROM ID (find and replace AE5W100V with AE5W101V) and managed to get Romraider to show me the tables, but again not sure if that is the right thing to do. For now, I am just looking to log - no edits.

Any help appreciated - either a new definition file or confirmation I can just go ahead and use the existing one with small edits.

Thank you!
d.

Hello again

Since there was no replies to my post as of yet, I thought I would provide a small update. As I mentioned in original post, I have looked at existing ROM file that another user posted a year or so ago - for AE5W100V ROM. Comparing two HEX files, there are only minimal differences (I do appreciate the fact that those "minimal" differences might turn out to be major problems but still). I am saying minimal differences because at least half of them appear to be tied to things such as revision number, year of the DENSO copyright etc. But I am NOT an expert in Hex, so I could well be wrong.
I also edited existing definition file (for AE5W100V ROM) and manually changed all the instances of AE5W100V to AE5W101V (my ROM number) and so far, I can get Romraider and Ecuflash to show me same tables as AE5W100V does. In fact, the Romraider "Compare images" says the images are same when I use the respective definition files to open both ROM images.

I still don't know enough to mess around with actual editing, but wanted to provide with some updates - still hoping someone way smarter than me can look into my request and either confirm I am OK proceeding as I described here or provide a definition file I can trust.

Thanks!

Hello again -

this is starting to be a conversation of one .

Not sure if anyone had any time to look into definition creation fro this ROM. As I stated before, when I edit existing AE5W100V def fills for both ECUFlash and RR I can get maps showing and everything appears to work. I even managed to create some logs from Romraider logger.
In an attempt to maybe try and be proactive, i have attached here a RR def file for my ROM. It is simple an edit of the td-d's def ole for AE5W100V, but I replaced all instances of AE5W100V with AE5W101V, and wherever I found the ROM number I put in mine instead as read by my image. So PLEASE DO NOT go and use this as accurate - I don't know enough to say if this is correct or not for sure but it appears to work. How well, i can't tell.

Also, I can't seem to get LVT going inside RR - I wanted to run it over the weekend, but it gave me an error that it couldn't find FBKC parameter - my apologies, but I didn't write it down. I will do so next time I try. And I don't know why that would happen. On the other hand, my logs did show Fine learning Knock correction and IAM just fine. If helpful, I can post logs as well - just didn't want to clutter the post.

Any feedback on attached def file much appreciated.

d.

If the 2 files are similar, test write if its successful use the one that is already defined.

for example I know that AZ1G700K are compatible with AZ1G202G which is defined with more tables and supports MerMod. so I am using that instead of the original Rom Car.

BUT don't forget to take backup of your original ROM.

LTV will not work without a full Logger def with extended parameters.
You can try find & replace i your logger.xml file; find all: B02A904007 and replace with: B02A907007
assuming B02A907007 is the correct ECU ID reported by RR Logger.

At first glance the two ROMs are very similar so most tables and extended parameters should work correctly in your definition.

Thank you both -

Yes, the ROM images seem very similar - in HEX at least.
I will try to do to edit logger as suggested. That worked for RR def file, so ...
Will do some more work on this tomorrow and post results.

d.

Just a brief update - just looking through logger.xml file (logger_METRIC_EN_v336.xml to be precise) and I cannot find the B02A904007 ECU ID in it. Is there more up to date logger file version?

d.

I guess I missed adding that one and it's been almost two years...
I'll get to it in the next few days.

While I am waiting for inclusion into the logger, I was wondering if there is a way for me to figure out what are actual differences in ROM images between already defined AE5W100V and my AE5W101V.
I don’t have disassembler and I wouldn’t know how to use it efficiently. In Hex editor, there are 24 differences which I summed up when comparing two images below. The side notes slightly removed from main text are my identification of what the difference refers to when I could figure it out. It turns out 9 out of 24 differences are just referring to “admin” tasks of incrementing year and copyright info, so the definition of my ROM should be really close to the one td-d posted on AE5W100V.

I suppose there is no guide that tells me what each hex offset contains in similar ROM someplace?

ROM differences AE5W101V when comapred to AE5W100V:

1: Replace 1 byte at offset 0x200a with 1 byte This is “1” in AE5W101V
2: Replace 2 bytes at offset 0x2024 with 2 bytes Unknown - space before copyright “Copr. DENSO”
3: Replace 1 byte at offset 0x2034 with 1 byte “6” in year of ROM copyright DENSO2016
4: Replace 1 byte at offset 0xc0006 with 1 byte This is “1” in AE5W101V
5: Replace 2 bytes at offset 0xc0020 with 2 bytes Unknown - space before copyright “Copr. DENSO”
6: Replace 1 byte at offset 0xc0030 with 1 byte “6” in year of ROM copyright DENSO2016
7: Replace 1 byte at offset 0xc59fb with 1 byte
8: Replace 1 byte at offset 0xc59ff with 1 byte
9: Replace 2 bytes at offset 0xc5a06 with 2 bytes
10: Replace 1 byte at offset 0xc631d with 1 byte
11: Replace 3 bytes at offset 0xc7af5 with 3 bytes
12: Replace 1 byte at offset 0xc7af9 with 1 byte
13: Replace 2 bytes at offset 0xc7afc with 2 bytes
14: Replace 2 bytes at offset 0xc7b00 with 2 bytes
15: Replace 2 bytes at offset 0xc7b04 with 2 bytes
16: Replace 2 bytes at offset 0xc7b08 with 2 bytes
17: Replace 8 bytes at offset 0xc7b0c with 8 bytes
18: Replace 1 byte at offset 0xc7b15 with 1 byte
19: Replace 1 byte at offset 0xc7b17 with 1 byte
20: Replace 1 byte at offset 0xe4c2a with 1 byte
21: Replace 1 byte at offset 0xe5aef with 1 byte This is “1” in AE5W101V
22: Replace 1 byte at offset 0xffafa with 1 byte Space before H4P
23: Replace 1 byte at offset 0xffafe with 1 byte This is P in “H4P”
24: Replace 4 bytes at offset 0xffb88 with 4 bytes

The two ROMs are virtually identical. The differences as you noted are descriptive. Anything above address 0x0c0000 is tuning related (not code), and the last couple of changes are related to the checksum for the ROM.

Try Logger def version 345: viewtopic.php?p=139530#p139530

Thank you dschultz -

Didn't have much time to play with the car this weekend but I did try to log learning table view and managed to get it going with 345 version. Your edits to it on short time notice are much appreciated!
I didn't drive around with it, just logged the idle while car was stationary - and I have reset the ECU by disconnecting the battery only yesterday due to my fuel switching from 91 to Ultra94 - so not much to see in the tables. One thing that did stick out is the RPM ranges - it seems to go over 12,000 RPM and in last two rows (11,000-11,999 RPM, and 12,000+ RPM range) I get some weird values (see attached image).

My car obviously does not go to those RPM ranges, and I don't have these RPM ranges in any of my tables that I can tell, so is this something that I am doing wrong? Only reference I have seen to this is a post about old Learning view utility where solution was to rename one's ROM to tune.hex and put it into Learning View directory.... But this is not learning view app, and I am not sure if the same trick applies.

Thank you for help!

In the Editor, do the FLKC Load columns and RPM rows show correctly?

It seems they do, although there is only one table with that RPM range:

So LTV is reading the column and row values correctly.
Some code analysis is required to see if those ranges are short circuited before the end of the table is reached.