RomRaider

I'm stuck and need help. My 2018 Subaru WRX STi is dead - turning the key to the on position produces flashing dash lights and a couple beep bumps. Fuel pump seems to persistently engage. This all happened as a result of uploading an edited version of my stock ROM but accidentally using EUROPEAN definitions instead of USDM. I was able to turn off my check engine codes for a TGV delete and uploaded the modified ROM to the car. Everything seemed to go fine, however, I can't seem to interface to the ECU any longer and the car is in the state mentioned above where it won't start and dash lights flash / beeps.

I've tried to reach out to Tactrix but I'm not getting replies to my emails so I'm hoping someone here can tell me where I'm at with this. Is the ECU bricked? Is my Tactrix bad? I don't know where to go from here. Here's a portion of the log file for ECUFlash:

[14:31:22.720] J2534 API Version: 04.04
[14:31:22.720] J2534 DLL Version: 1.02.4870 Feb 3 2017 23:36:31
[14:31:22.720] Device Firmware Version: 1.17.4877
[14:31:22.720] Device Serial Number: TAamG$JM
[14:31:22.720] interface close
[14:31:37.322] opening rom file C:/Users/RJ 2018 USDM Subaru WRX STi OG TGV deleted.bin
[14:35:27.111] 1048576 byte image read.
[14:36:31.638] using metadata XML ID AE5Z000V from file rommetadata/AE5Z000V.xml
which inherits XML ID AE5Z321V from file C:/Program Files (x86)/OpenECU/EcuFlash/rommetadata/subaru/Impreza STi/AE5Z321V 2017 USDM STi.xml
[14:36:31.778] using metadata XML ID AE5Z000V from file rommetadata/AE5Z000V.xml
which inherits XML ID AE5Z321V from file C:/Program Files (x86)/OpenECU/EcuFlash/rommetadata/subaru/Impreza STi/AE5Z321V 2017 USDM STi.xml
[14:36:58.065] J2534 API Version: 04.04
[14:36:58.065] J2534 DLL Version: 1.02.4870 Feb 3 2017 23:36:31
[14:36:58.065] Device Firmware Version: 1.17.4877
[14:36:58.065] Device Serial Number: TAamG$JM
[14:37:01.356] kernel get version
[14:37:03.680] interface close
[14:37:03.680] interface close

I'm a little confused as I thought a bricked ECU is caused from a failed write but I had no failures at all.

It seems like the ECU is bricked . By using the wrong defs you modified wrong areas of the rom and "corrupted" it.
You may have a slight chance if you:
1. reset your ECU using the fuse from the engine compartment
2. try to write your original and unmodified rom right before, after or when you put ignition on
3. repeat steps 1 & 2 several times with slight timing variations between when you put ignition on and you initiate writing as you must get the right moment just after ECU booted and accepts connections but before the "corrupted" area makes it non responsive

Many thanks & I'll give this a try. I searched online and think I've located which fuse to pull (#5) from the engine compartment fuse box so that seems pretty straightforward. (It's not really obvious looking at the fuse box cover names "SBF No. x" but I'm assuming it's an acronym for Slow Blow Fuse of something similar?) Would this be a 2 person type operation between pulling / inserting the ECU fuse, key ignition on and initiating a write? I'm trying to conceptualize the process to get it right the first time; while also understanding it could take several attempts to pull it off. Also, another member "The Lorax" not only agreed with your advice but mentioned using "ecuEdit" to write the ROM image back to the ECU. Is ECUFlash okay to use? I'm going out to pull the fuse now and hopefully make some progress on this speed bump.

Disconnecting the battery also works.

Timing interval can be a bit hit an miss/trial and error, but I've done it by myself, so you do have seconds when re-connecting both battery and tactrix (have you laptop ready to roll before commencing the process though).

I’m wondering if there’s something else going on. Pulling the fuse didn’t work so I decided to do the battery. Numerous attempts and it’s always the same. It’s more like the Tactrix can’t access the ECU at all. ECUFlash shows getting version and then immediately interface closed message. I even got my son to pull the negative battery cable and sped up the process with no luck.

I’d doubt the ECU has any alternate power so I should have been booting when attempting the write each time. For now I’ve just left the negative battery cable disconnected. I’ll try again but if there’s any suggestions - I’m wide open.

write DimeSPb. restore ecu remotely.
https://vk.com/ecuresearch

Cool - thanks man

Dimitry probably is going to have some magic to get you back and running.

My experience has been that ECUFlash is too 'fussy' when you have a bricked ECU, but ECUedit is less so and has enabled me to get things back to running (still have to restart ECU).

You're going to have to shell out some cash as this point, whether that be for software, Dimitry's (DimeSPb) solution, SHboot mode either from someone else or getting some components and doing it yourself.

Good luck.

I did download ECUEdit but tried with ECUFlash. Of the choices to get the ECU un-bricked; does anyone have any idea on what's the best? I went to the website but was in Russian so I'll give it another go when I can turn on translation. UPDATE - I ended-up connecting with Dime and was informed only 08-15 can be re-flashed via the OBDII port. Ultimately money is tight so I may be sitting on this for a while until the budget (e.g. wife) will allow it.

I have had this question, sort of off topic, but maybe I could get some input on it as well. While I'd love to be able to tune my car, it's going to take some time to build up the knowledge necessary so I don't end up with situations like I'm in now. My real goal here was to just turn off the TGV codes since I've done the TGV delete and have a constant CEL and all the fun that comes with that. I had hoped to simply disable the TGV codes on the stock ROM and then go back to my COBB Accessport V3 while I work on educating myself. I'm assuming this is possible and I can unmarry the COBB again when the time comes. I've also reached out to a couple of tuners in the area where one didn't seem very knowledgeable on Subaru and the other was but only uses COBB. That's my other thought is maybe going the etune route or if there's a reputable local shop that does open source. I love my little Subie but have always felt it's underpowered / like the performance is lacking for what it has. Just curious if anyone has suggestions once I finally get my ECU unbricked.

SH Boot mode
https://forums.nasioc.com/forums/showth ... ?t=2200443

Or someone with kess ktag or similar tool. Of course, these usually also costs some money.

Not entirely sure what went wrong, but if you upload the ROM you flashed (zipped) I can have a look - there may still be a functioning CAN bootloader you can access.

This is both the log file and the modified ROM. When I open the ROM I get a checksum error and Yes / No option to correct it. I clicked yes assuming the checksum error was fixed. When I look at the log file, I can see checksum errors on the test write, however, the actual write reports accurate checksum values. I don't recall getting any errors on the test write despite the log showing the checksum errors - which is why I proceeded to write the ECU thinking everything was okay. It seems like ECUFlash should have thrown an error during the test write based on what I see in the log. You can see I was using the wrong definition file, however. I' m guessing I would have used the corresponding RomRaider definition file as well to edit the file and disable all TGV error codes.

[21:00:33.536] using metadata XML ID AE5Z000V from file rommetadata/AE5Z000V.xml
which inherits XML ID AZ1S000G from file C:/Program Files (x86)/OpenECU/EcuFlash/rommetadata/subaru/Impreza STi/AZ1S000G.xml
[21:00:33.676] using metadata XML ID AE5Z000V from file rommetadata/AE5Z000V.xml
which inherits XML ID AZ1S000G from file C:/Program Files (x86)/OpenECU/EcuFlash/rommetadata/subaru/Impreza STi/AZ1S000G.xml

I just re-read this and maybe I'm not doing it correctly. When you say reconnecting both battery and tactrix are you saying you remove the tactrix from the ODBII port as well? I was just leaving that connected, laptop primed to write with mouse cursor on the OK button to let it rip. I tried many different timing intervals but all came back the same.

IIRC, I have always left the tactrix connected, laptop ready to run. It may be worth noting that I have an 08+ model too, and I think the communication is slightly different. This will also probably play out in the ability to get it up & running.

Of course, you can always try the above, but I unfortunately I think you’re clutching at straws.

Good luck & if you do have some success, let us know.

From what I’ve heard from Dime, this is going to be a bench reflash. Seems easy enough - essentially 5 pins between the ECU and OP2.0. No ECU disassembly or soldering. Seems similar to the karmanauto ECU clone video I watched a while back.

I’m not sure if you saw the log file and ROM I posted but I definitely see the checksum mismatch on the test write but the actual ECU write showed proper checksums and successful write. I’m still at a loss, despite edm definitions, why it would have bricked so hopefully I’ll understand this better at some point. It doesn’t make sense to me the rom would be vastly different by market. Also worth noting the ECUFlash test write executed absent any errors despite the log clearly showing checksum mismatch and the test write reporting success. It seems like it should have given a failed condition on the test write or prompted to compare the loaded ROM.

In any event, it seems like it I can do the pinout connections and use Dime’s software to recover it I’ll be golden and less apprehensive about dealing with “mistakes” in the future.