RomRaider

The vehicle is a 2010 Forester Base Model with Manual transmission.

EZ1GB10K/6C12188007, which is listed in the stock ROM thread as being for this vehicle as well, is defined and some tables are in similar locations, but the maps are different enough where I don't feel comfortable making the needed adjustments myself. If anyone could add this ROM to the definitions, I would be very grateful!

EZ1GB10K/6C12188007 and idc scripts for IDA are also attached (see zip file - idc extension was not allowed) for convenient reference, in case they prove helpful.

Alternatively, if there is a way to confirm that I can flash the defined ROM to my vehicle without bricking the ECU, I would certainly be willing to do so. I'd be interested in what Subaru changed between these versions though.

On my 2006 WRX I was able to do so, i.e. update from A8DH200X to A8DH202X, despite different ECU IDs applying to each ROM (off by one digit), so I am hopeful that I can here as well, but don't want to risk it without confirmation.

Update: As posted below, I was able to create a definition for the EZ1GB10I ROM, which can be found here: https://www.romraider.com/forum/viewtopic.php?f=35&t=19271&p=164070#p164070

Just FYI, I was able to reflash my ECU, which had EZ1GB10I/6C22188007 installed, with EZ1GB10K/6C12188007 without (much) issue.

My first flash *DID* result in an error (I don't remember what the error was, as I was a bit too panicked in the moment to remember to screenshot it), after a successful test write, but I was able to reflash the exact same map successfully right after the first, failed flash. The key was left on between all flashes and the car was plugged into a battery charger that was set to a "5 Amp Supply" mode while the laptop was also plugged into a charger. Weird, as I've flashed hundreds of times before (probably about 200 or so overall), and never had an error before. The only thing I can think of is that my failure/error may have been due to the outside temps affecting voltage, as it was about 0F out when I flashed the map. Guess that there is a first time for everything!

For now, the only (intentional) change was to the speed limiter (I also accidentally disabled deceleration fuel cut below 4k RPM, was part of a burble tune that I am working on, so that's why fueling at closed throttle is odd in my log), not that I plan on hitting it (the speed limiter - that would take a while in this vehicle...), just hate artificial limits. Just wanted to gain the ability to monitor the extended parameters and Learning View (i.e. I applied the extended parameters patch in ECU Flash), which I am now able to do. I will begin implementing changes in the tune after I'm able to grow accustomed to how the stock tune behaves under a variety of circumstances.

In case anyone is curious, two things did stick out in the logs, once I was able to use the extended features. The first was a fair amount of knock around 1/3-1/2 throttle between 2k-2.5k RPM (1.05 to ~4 degrees of timing pull, but with anything more than 1.05 not being consistent/very intermittent - i.e. once or twice an hour), but the vehicle has at least three loose heat shields being held on with large hose clamps, so I think I know where to start with diagnosing that issue That being said, I was running Sunoco 94 octane at the time the attached log/learning view was taken...

The only other issue that stood out was MAF idle voltage being slightly low, at 1.18-1.20v, or about 2.6-2.8 g/s, whereas I would expect 3 g/s minimum (I believe that a low reading MAF could also cause me to be running a bit higher timing than is called for, which would explain the timing pull - then again, the timing pull isn't much and it's only at fairly low loads, so maybe unavoidable/nothing). I will clean the MAF sensor and see if these values change, if not, I will smoke test the intake for leaks (the intake manifold gaskets were just done a few thousand miles ago when the head gaskets were done, so probably just a vacuum line if it is a leak).

I've attached a log (in excel, with clickable column headers that allow filtering, e.g. by only WOT) and learning view screenshot for anyone who is curious. Next log, I plan on monitoring AF3 learning, AF3 correction, and valve lift on both banks, the AF3 correction and learning values because I plan on testing 0'ing potential candidates for these values in the ROM and want to verify normal behavior beforehand and the valve lift to verify both are operating in sync/the OCV's aren't clogged (seen this on a WRX and it caused really weird cruise timing pull that I spent too long on trying to tune out, so now I always check).



Best,
Matt

Somewhat unrelated but I have a 6C22188007 that I am troubleshooting for a P0420 code and so far I have not been able to get RomRaider logger to display "Knock Correction Advance." Do you recall if you were you able to log that parameter before you reflashed?

I recall not being able to monitor any of the SSM enhanced parameters prior to reflashing, including KCA (I think you mean "Feedback Knock" or "Fine Learning Knock Correction" though, but could be wrong). Those required the "Subaru CAN Enhanced RAM Parameter Logging" patch to be applied via ECU Flash, which required a definition xml file that I didn't have.

If you decide to flash EZ1GB10K, I have attached my notes, which include various table addresses that I have found that are not included in the latest defs:

Good luck!

Thank you for the quick reply!

Just a heads up for anyone interested in this thread, I have started working on a definition for this ROM myself, as I am now more comfortable doing so. I am using EZ1GB10J/6C22148007, which is defined, as a template. While some of the tables match up, most are offset somewhat, but in the same general locations, so it shouldn't be too bad. I will post up my definition when ready.

Also, in case anyone is curious, I am doing this because I much prefer BTSSM/Android logging to lugging around my 17'' laptop to run RomRaider, but BTSSM does not support the EZ1GB10K ROM that I found to work on my Forester. It doesn't support EZ1GB10I either, but does support the AT variant, EZ1GB10J. I am fairly certain that I can create an alias in BTSSM between the AT and MT ROMs and get things working. I wish BTSSM was open source, since then it would only be a simple matter of adding the addresses/ROM identifiers, but that is, unfortunately, not the case. Still grateful for the software being put out though!

The XML ECU Flash definition, stock ROM, and an XMLtoIDC script for getting the defined tables into IDA are attached to the following post:
viewtopic.php?f=35&t=19271&p=164070#p164070

I did not want to duplicate the files/use up more storage than necessary, hence the link. Should the link ever fail, please respond here or email/PM me and I'll reupload the files here.

for logging (if you have OpenPort Tactrix) you can configure it to log to sd-card, without having turn on notebook and have it by your side while driving.

Thanks for reminding me of this! I have actually used this option in the past and it works fine, although I do still prefer using BTSSM for the ability to see the logged data on a screen that is within my field of view while driving.

Also, for anyone curious about BTSSM, I actually did have it running mostly fine on an EZ1GB10K ROM, after creating an alias in the app to "BASIC". The fields that were missing from the BASIC profile I added back in as "Custom fields." The primary thing that still didn't work for me was learning view. With BTSSM, while you can add custom fields, you can't change the table locations needed for learning view; it either works or it doesn't. Unfortunately, the timing portion of learning view still doesn't work with EZ1GB10I either... I also still needed to add in some custom fields to see everything that I wanted to.

After running the new ROM for a couple of days, I noted that knock seems to be much less than when running EZ1GB10K, both running the Primary Cruise (AVCS Related) timing in all four tables. IAM is staying at 1. Major differences appear to be a slightly richer CL compensation table in EZ1GB10I and also completely different load compensation tables for the MAF. Otherwise the two ROMs appeared nearly identical.

This has peaked my interest, think i could use btssm on my car?

Absolutely! Unfortunately, the only way that I know of to confirm whether or not your ECU is defined in their app is to email them. Even if it isn't, this shouldn't be a big deal though.

If the ECU is already defined, you should have access to pretty much all of the main fields you'd be interested in logging right away, although the selection is a bit more limited compared to Rom Raider. If it's not defined, you can choose "create alias" and select "BASIC" OR choose the most similar ECUs (e.g. the AT variant for an MT car) at random and you might get lucky and stumble on one that is close enough for most fields/Learning View to work. In either case, you can create custom fields if you need anything that isn't already available, other than the learning view tables, and all of the information you need (i.e. table addresses, data type, equation to convert, multiplier, etc.) can be found in the RomRaider logger XML file by searching your ECU ID and table names, assuming the ROM is defined in RomRaider logger.

Their site is here: https://www.btssm.com/

While you can use a wired Tactrix cable, the wireless OBDLink LX/MX is nice and also reasonably fast, although I don't think quite as fast as the Tactrix.

*I am not affiliated with BTSSM in any way.