5EAT TCM JECS ROM Image

jimihimisimi · **Joined:** Tue Apr 05, 2022 12:57 pm **Posts:** 58

Working for me with v0.27, thanks rimwall!

The max/min temp basis in the pdf are 70 for some charts and 90 for the others... any idea what the bounds for the temp basis (and other correction values) are? Does the TCU do a sanity check on the values entered?

Thanks!

My Values: Default, Logged, Written:

Code:

Direct Clutch Pressure Correction
DC, 75, 71,71

High Low Reverse Clutch Pressure Correction
HLRC, 74, 73,73

Input Clutch Pressure Correction
IC, 81, 83,83

Front Brake Pressure Correction
FB, 195, 191,191

Forward Brake Pressure Correction
FwdB, 183, 188,188

4WD Pressure Correction
4WD,170,162,162

Line Pressure Correction
PL 189, 181,189

Temperature Basis for Above Corrections
Temp, 100, 107,107

AWD torque Correction;
AWD,?,?,0

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Good stuff, glad it's useful!

The bounds are the upper / lower values in the pdf because the table lookup function defaults to the boundary value if the attempted lookup is beyond the boundary.

I have updated the repo with v0.28 which fixes a bug in the ROM dump code.

With 5EAT TCU ROM access, dumping, flashing, adjusting shift curves, shift durations and 'hidden' SSM parameters all now possible, I'm not sure of the next step for TCU tuning. Folks can get in touch with me if they have any suggestions...

jimihimisimi · **Joined:** Tue Apr 05, 2022 12:57 pm **Posts:** 58

rimwall wrote:

Good stuff, glad it's useful!

The bounds are the upper / lower values in the pdf because the table lookup function defaults to the boundary value if the attempted lookup is beyond the boundary.

I have updated the repo with v0.28 which fixes a bug in the ROM dump code.

With 5EAT TCU ROM access, dumping, flashing, adjusting shift curves, shift durations and 'hidden' SSM parameters all now possible, I'm not sure of the next step for TCU tuning. Folks can get in touch with me if they have any suggestions...

Really impressive job on putting this all together! Great work

As far as whats next... manual swaps? :shock:

jimihimisimi · **Joined:** Tue Apr 05, 2022 12:57 pm **Posts:** 58

So, after 2000 miles of driving I did some logging, and the line pressure variable is still the updated value.

Unfortunately it did not solve any of the hard shifting issues. I think it's just clutch wear from the previous owner not swapping the fluids out regularly. I am going to put some 'transmission honey' in and see if that gets us through the winter.

With that plan, I reflashed the line pressure back to its original value.

V6er · **Joined:** Wed Oct 16, 2019 2:25 pm **Posts:** 53

I haven't fully read and used it new developments yet (bringing back Tribeca to be fully used

is it possible to adjust gear switching points?

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Gear switching is generally determined by graphs of Accelerator Pedal Angle and Speed. Like the one below.

Once these graphs are located in the TCU ROM, they can be changed, the ROM checksum updated and then flashed back to the TCU.

Attachment:

Excel View of Shift Curves.JPG

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Comer352L, who currently manages the repo for FreeSSM, has very kindly updated the FreeSSM source code to enable changes to the 'hidden' parameters on 5EAT TCUs. The code is in the the branch "e5at-permanent-adjustments" of the FreeSSM repo. I haven't yet tried to build it.

You will need a Denso TCU with SysID of A21022 in order to see the new settings. And the increases / decreases to the pressure corrections are made in 'steps' instead of kPa values to make it simpler to use.

I haven't tried to build the beta version myself because I can't test it (I don't have an AT car). Is there anyone who wants to test the updated FreeSSM?

jimihimisimi · **Joined:** Tue Apr 05, 2022 12:57 pm **Posts:** 58

rimwall wrote:

Comer352L, who currently manages the repo for FreeSSM, has very kindly updated the FreeSSM source code to enable changes to the 'hidden' parameters on 5EAT TCUs. The code is in the the branch "e5at-permanent-adjustments" of the FreeSSM repo. I haven't yet tried to build it.

You will need a Denso TCU with SysID of A21022 in order to see the new settings. And the increases / decreases to the pressure corrections are made in 'steps' instead of kPa values to make it simpler to use.

I haven't tried to build the beta version myself because I can't test it (I don't have an AT car). Is there anyone who wants to test the updated FreeSSM?

I can give it a shot. I have FreeSSM on my laptop already, will just need to grab the branch.

SergArb · **Posted:** Wed Feb 21, 2024 11:28 pm

Something wrong with updated brunch. Older one compiles fine ((

Attachment:

FreeSSM_ERR.jpg

SergArb · **Posted:** Fri Feb 23, 2024 7:19 am

Idents from Subaru CVT

Attachment:

uNOIcHWJESU.jpg

SergArb · **Posted:** Tue Feb 27, 2024 2:55 am

Fresh GIT build of FreeSSM with 5EAT additions.
https://drive.google.com/file/d/1Em4Anj ... sp=sharing

SergArb · **Posted:** Tue Mar 19, 2024 7:54 am

Hello All!

Trying to manage with Subaru CVT Melco, MH8104/512KB. Need help.

Changed some commands in Rimwall sources, now it request bytes for seed key calculation. But my skills not enough to find algorithm.

Code:

[2024-03-19 17:22:50.501]  Trying TCU Init...
[2024-03-19 17:22:50.501]  Sent: 00 00 07 e1 aa 
[2024-03-19 17:22:50.516]  0: 0xAA response: 00 00 07 e9 ea a4 10 40 b1 e5 f0 82 00 01 00 80 04 00 00 00 00 8d 02 00 00 00 00 00 00 00 00 00 00 9c 06 00 0a 21 c0 00 00 05 1f 00 80 00 00 00 00 00 00 00 16 e1 c0 00 00 00 04 20 00 00 00 40 00 00 00 00 00 00 bb 7e 40 00 00 00 00 00 00 00 80 
[2024-03-19 17:22:50.516]  Init Success: CAL ID = B1E5F08200
[2024-03-19 17:22:50.516]  Trying 0x09 0x04...
[2024-03-19 17:22:50.532]  Sent: 00 00 07 e1 09 04 
[2024-03-19 17:22:50.532]  0: 0x09 0x04 response: 00 00 07 e9 49 04 01 5a 35 45 35 46 30 38 32 00 00 00 00 00 00 00 00 
[2024-03-19 17:22:50.532]  Init Success: TCU ID = Z5E5F082
[2024-03-19 17:22:50.532]  Initializing bootloader...
[2024-03-19 17:22:50.532]  Send msg: 00 00 07 e1 10 43 
[2024-03-19 17:22:50.750]  Received msg: 00 00 07 e9 50 43 
[2024-03-19 17:22:50.750]  Starting seed request...
[2024-03-19 17:22:50.750]  Send msg: 00 00 07 e1 27 01 
[2024-03-19 17:22:50.953]  Received msg: 00 00 07 e9 67 01 0e 45 7a 5f 
[2024-03-19 17:22:50.953]  Seed request ok
[2024-03-19 17:22:50.953]  Sending seed key...
[2024-03-19 17:22:50.953]  Send msg: 00 00 07 e1 27 02 1d c5 de e2 
[2024-03-19 17:22:51.156]  Received msg: 00 00 07 e9 7f 27 35 
[2024-03-19 17:22:51.156]  Bad response to seed request

I have couple requests and calculated seed keys:

Code:

00 07 E1 27 01 - command 27 01 
00 07 E9 67 01  *D8 39 3B 06* - answer with 4 bytes for seed key calculation.
00 07 E1 27 02  *41 38 18 79* - last 4 bytes is calculated seed key.
00 07 E9 67 02 - Positive answer, seed key is OK.

And another one:

Code:

00 07 E1 27 01
00 07 E9 67 01  *E8 62 72 AF*
00 07 E1 27 02  *1D C5 DE E2* - Seed key.
00 07 E9 67 02

Can we somehow find the algorithm for them?

I can't find any datasheet on internet.

But i think they using M32R language.

In IDA we should make this settings for starting points. I don't know what RAM segments to use.

Attachment:

IDA1.jpg

And choose device:

Attachment:

IDA2.jpg

Then we have some code:

Attachment:

IDA.jpg

Here my CVT ROM.

Attachment:

Z5D3F080_B1D3F08000-20240218-141156.zip

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Hi, the ROM will need to be reverse engineered to find the algo. I will have a look when I find some spare time.

SergArb · **Posted:** Wed Mar 20, 2024 6:19 am

Thank you, will be waiting

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Same algo. Different words...

Code:

    const uint16_t keytogenerateindex[]={
        0x9E99, 0x685C, 0x874D, 0xF11E,
        0x27D4, 0xA967, 0xB63B, 0x7A37,
        0xE23B, 0xA8D0, 0x9B82, 0xAC43,
        0xE874, 0x7FC5, 0x7141, 0x8B44
    };

This will allow passing 0x27 access to make a kernel jump possible.

The ROM dump is all 0xff from address 0x0 to 0x8000, so this region didn't dump properly. This is where the onboard kernel resides. The kernel usually uses different encryption words to upload / download a ROM. Ideally you find some way of dumping from this address space (eg: boot mode). Or, the encryption words might be able to be figured out from sniffing original ROM -vs- encrypted ROM during an upload / download.

RomRaider

5EAT TCM JECS ROM Image

Who is online