RomRaider

Hi @Tugsay. These are the base (normal mode) tables. There are different tables for different drive modes. And OL/CL does change which table is selected. And there is lots of other logic in the ROM that affects how it behaves (1292 functions to be exact!). At this stage I'm just aiming to change the base tables. Once that is working we can look at more complex items.

@MiikaS - thanks for the bug fixes! I'll include that code next time (not included in latest exe).

@riksk - could you try a dump using the Kline approach in FastECU_b8.exe. I would be surprised if this works, but worth a try. It will try to dump 0x400 bytes, one byte at a time. The first 0x200 are the ssm get functions. It will be interesting to see what you get for addresses 0x200 to 0x400. The ROM I have indicates it will dump ROM values. This isn't how the b8 command works on ECUs, but maybe it is different on TCUs. Can you then post up the log.txt and default.bin files.

@ajayel - have you had a chance to try the FastECU_Kline_RAM_dump.exe? You can also try the Kline approach using FastECU_b8 if you like.

@AJ08H65EAT - kernel access and dumping is definitely working for your ROM. What is odd is that default.bin doesn't seem to be decrypted. It works for me, but strangely not for you. It might be a cross-platform issue... I've changed a few things, so could you try the CAN approach in FastECU_b8.exe and send me log.txt and default.bin (and check the files are both timestamped at the time you ran the code to ensure they aren't somehow old copies).

Thanks!

Thanks a lot. It will be perfect to have chance to change those parameters.

I just found this thread.

I've got an '05 3.0 5EAT Outback and a tactrix cable if I can help.

I'm really interested in tuning line pressure.

Hi, the k-line download for me produced a default.bin with FF's, same after running CAN access first, files per the PM. I just tried the b8 exe over k-line with the results attached but did stop the process after around read addr 539.

Hi @Blake_Volpex - given the '05 model, we hopefully already have the process to access your TCU ROM. Read back through the thread for instructions on running FastECU and try FastECU_34_short.exe from the repo using the CAN method.

Thanks for trying again @ajayel, looks like they locked down the b8 approach. It seems they made a lot of security improvements from the ~05 TCUs to later models. There is another a0 approach to try - please try FastECU_a0.exe from the repo using the Kline method and see if it works. This incorporates the bug fixes from @MiikaS, so hopefully no crashes.

@riksk - feel free to try FastECU_a0.exe as well

@AJ08H65EAT - how did you go with trying FastECU_b8.exe with the CAN method?

Thanks again!

Hi, just tried with fastecu_a0.exe my stubborn TCU still returning 0xFF's albeit no crashes.

Thanks for trying @ajayel. A shame, that one tried a dump workaround that has worked on ECUs before. Could you please post up the log so I can see the 'conversation'. Still a couple of other things to try...

@rimwall, I have tried _b8 with CAN and log file looks OK, but default looks same as last time (not that I really know what I am looking at).
Files sent via PM.

@AJ08H65EAT - success, decryption worked. Very close to trying a flash now. But first, we can try a full ROM dump and decryption as a stress test. New version to come soon.

I suspect I may have done something wrong.
But I have attached what I got.

@ajayel - there is another possible entry method that *might* work using the b0 command - FastECU_b0.exe (with Kline method) is a quick test to see if the b0 command is recognised and enabled in your TCU. If this works I can try the other entry method. Can you try this please & post up the results. Would also be good to see the log from the _b8 attempt.

@AJ08H65EAT - for full ROM dump via kernel please try FastECU_b0.exe (with CAN method) and post up the results.

@Blake_Volpex - you don't seem to be getting any response from the TCU. Have you checked that FastECU works first (see my post on p5 of this thread where it starts with "To start step 1..."? You could also try the Kline method in FastECU_b0.exe, that will also test whether Kline comms works.

Hi, please find files attached for a0,b0 and b8 all via k-line

@rimwall, Done - full ROM dump via kernel appeared successful - and Fast ECU did not crash - great progress.

I just haven't updated yet because I don't have the car at home, I'll update as soon as I have it again.

@ajayel - thanks, looks like b8 locked down too. All a0/b8/b0 attempts have been via KLine so far. Let's try via CAN. Sorry for the shooting in the dark, but I haven't got a ROM file to look at, so we're in 'guesswork' territory. Please try FastECU_a0_a0_b8.exe in the repo and post up the log. This is just a spot test of a few addresses to see what happens.

@AJ08H65EAT - good news, onto the next step...