RomRaider

Just typed "USB to CAN bus converter adapter" on "Ali", a lot of cheap items

Thanks dschultz, I had USBtin near the top of my list, good to have it confirmed it's a good option. Probably the top candidate now. If only I was better at java coding...!


Yes, but... I understand they come with complications (happy to be corrected if I'm wrong). The complications are:
- I don't think they come with code that can be easily modified to send / receive the specific commands required to interact with the ECU
- They often aren't consistent (eg: many are based on ELM clones that are all differently and partially implement the command set). Official ELM chips might have been an option, but they are shutting down their business in 9 days(!)

You are not limited to Java. Check down the list there are a few other languages used to interface with the unit. Plus a CLI that you can use the ASCII command set with via a serial port.

I was planning to add support for this unit in RomRaider at some point.

Open source access to ~2002 Forester XT SH7055 ECUs is now possible using an ordinary USB to OBD cable*.

Full credit to MiikaS who did all the testing on a ECU. Full credit to fenugrec as the author of the original nisprog / npkern.

The current status is experimental, and it needs a little more testing (volunteers welcome!). I can't do the testing because I don't have one of these ECUs. A summary is:
- ECU access process is described here (in the SH7055 section at the end of the file): https://github.com/rimwall/nisprog/blob ... ruSIDs.txt
- *Note that access requires a method of generating a ~218ms pulse on Line-End-Check 2
- A modified npkern kernel has been successfully loaded to the ECU and used for a successful dump operation. This was done using other comms software, so the nisprog portion has not yet been tested. And using the kernel for flashing has not yet been tested.
- A modified nisprog has been prepared to do the communications, and needs to be tested. There are probably bugs to be fixed.
- the modified npkern kernel is available here: https://github.com/rimwall/npkern/tree/ssm_test with a pre-compiled kernel under /pre-compiled called ssmk_SH7055_02fxt_18.bin
- the modified nisprog is available here: https://github.com/rimwall/nisprog/tree/ssm_test. This needs to be compiled on your platform for use.
- testing has so far only been successful in the car. Testing on the bench has used the minimal connections (power, k-line, ground) but hasn't yet worked - there must be one or two additional connections required that exist when the ECU is in the car.

Testing requested:


Other contribution requested:
- a schematic for a simple circuit to provide the 218ms pulse on LEC2 for example using a 555 timer
- working out what additional pins to connect to get it working for an ECU on the bench

Enjoy!

rimwall Great job!



Hello, can you show how it looks? I want to try it)

Hi!

ECU will accept kernel download with similar to wrx02 method in ecuflash so it needs to only trigger line end check 2 and send command to jump to bootloader, but ECU needs to be in car. I haven't found yet how it can be get work on the bench because ECU refuses to jump to bootloader when not in car.

I did write my own simple qt gui software with code based on nisprog kernels and code to test it and added dtr signal to control line end check 2 and also soldered wire from ftdi chip dtr-pin to obd-pin that is connected to line end check 2. Code for writing is not yet ready, but I will complete it when I have time to test it in my car. And as OP1.3 cable is based purely on ftdi chip, my code will work with it too. I might also add OP2 support at some point.

As far as I know, fenugrec will also add dtr control to nisprog code at some point.. And while my testing is based on nisprog code, nisprog should work straight if you can pulse line end check 2 (approx. 212ms pulse, could be done with 555 circuit or with arduino etc. if you have one) just before running kernel upload.

Great info! I have it on the bench, without car( Can you show, what pin on ecu need to be triggered?

Pdf shows in top connector, line end check 2 in bottom row and second from left.

Thank you)
rimwall Can you share compiled version for Win32?

SergArb thanks for offering to help, that's great.

It will be much faster for debugging if you can compile nisprog on your own platform. I would suggest working through the instructions on how to compile nisprog. They are in one of the readme / doc files under nisprog / npkern.

To get started, I have attached what compiles on my platform - hopefully this works for you.

As MiikaS noted, it wouldn't work on the bench because one of the ECU connections must be important (guesses: neutral switch, security system etc). Better to try in the car first.

I have now tried with neutral and some other switches connected, with all power/gnd lines I know but still doesn't want to jump to bootloader on bench.

May be we can disconnect some B-plugs from ECU in a car, and try jump to bootloader?
It will be more easy to find at what plug it could be? I think so.

Yes, I will try that next time.

Tested today and middle plug is the only one that can be left unconnected. So within the three other plugs there is something that needs to be connected to be able to access bootloader.