5EAT TCM JECS ROM Image

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Probably faster to abort and start again!

SergArb · **Posted:** Sat Mar 23, 2024 11:43 pm

Yes, you are right! Recompiled with 0x8000, starting again

SergArb · **Posted:** Sun Mar 24, 2024 12:30 am

Got it!

Attachment:

8000_Z5D3F080_B1D3F08000.zip

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Good work!

Command 0xb7 encrypts with words 0x7bf2, 0xa8b4, 0x4492, 0x6587. To decrypt, reverse the order of the words.

SergArb · **Posted:** Sun Mar 24, 2024 1:54 am

Cool! I will try it. Thank you again!

SergArb · **Posted:** Sun Mar 24, 2024 4:38 am

Victory

Rom downloads and saves fine.

One thing. If i set length=80000, then it somehow add 7F00 to the end address.
If i set length=7800, then it reads with normal size.

Now need to try implement writing

P.S. Rimwall, sent to you modified source with working download.

SergArb · **Posted:** Sun Mar 24, 2024 9:50 am

Writing is also working now.

But TCU rejects E1 37 and checksum command between blocks.

Code:

[2024-03-24 21:34:08.771]  Sent: 00 00 07 e1 b6 00 ff 80 1c 87 6a ae 94 68 56 30 25 ea 5e d3 7d c2 c1 54 38 9c 5f b5 96 a2 4e 8f 67 c3 d7 29 ae ef d2 1f 72 00 b2 eb 1d a6 44 ff dd 41 cf 89 4b fc 06 cb 88 a7 93 0a f4 69 28 89 e3 da 2c d0 a8 ec 90 ce 29 cf 58 cd ab 42 e3 59 35 d6 2e 91 c2 dd bb a7 69 9b ea 5d 83 6b f8 a4 c4 85 5c 09 02 a6 cb 90 e4 73 62 af a2 38 4e 5a 62 86 ff ca 55 39 31 7d 84 b0 2f a2 8c c2 ac 41 bd d5 d3 24 96 a2 4e 8f 
[2024-03-24 21:34:08.803]  Closing out Flashing of this block...
[2024-03-24 21:34:08.803]  Sent: 00 00 07 e1 37 
[2024-03-24 21:34:09.005]  0: 0x37 response: 00 00 07 e9 7f 37 22 
[2024-03-24 21:34:09.005]  No or bad response received
[2024-03-24 21:34:09.115]  Verifying checksum...
[2024-03-24 21:34:09.115]  Sent: 00 00 07 e1 31 01 02 02 01 
[2024-03-24 21:34:09.317]  0: 0x31 response: 00 00 07 e9 7f 31 22 
[2024-03-24 21:34:09.317]  No or bad response received

After all blocks are written, it accepts checksum command "31 01 02 02 01" and closes writing.

Code:

[2024-03-24 21:44:11.057]  Sent: 00 00 07 e1 b6 07 ff 80 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 68 fc 4e 1c 3c 56 d7 d6 
[2024-03-24 21:44:11.087]  Closing out Flashing of this block...
[2024-03-24 21:44:11.087]  Sent: 00 00 07 e1 37 
[2024-03-24 21:44:11.287]  0: 0x37 response: 00 00 07 e9 7f 37 22 
[2024-03-24 21:44:11.287]  No or bad response received
[2024-03-24 21:44:11.387]  Verifying checksum...
[2024-03-24 21:44:11.387]  Sent: 00 00 07 e1 31 01 02 02 01 
[2024-03-24 21:44:11.587]  0: 0x31 response: 00 00 07 e9 71 01 02 02 
[2024-03-24 21:44:11.587]  Checksum verified...
[2024-03-24 21:44:11.587]  Block 10 reflash complete.

Rimwall, can you modify the code to download all rom at once, not by blocks?

SergArb · **Posted:** Wed Mar 27, 2024 4:31 am

Successfully download a rom with FastECU from CVT MH8111 1536kb.

For writing need to define flash blocks, like with 512kb.

Code:

const struct flashblock fblocks_M32R_512KB[] = {
    {0x00000000,    0x00004000},
    {0x00004000,    0x00002000},
    {0x00006000,    0x00002000},
    {0x00008000,    0x00008000},
    {0x00010000,    0x00010000},
    {0x00020000,    0x00010000},
    {0x00030000,    0x00010000},
    {0x00040000,    0x00010000},
    {0x00050000,    0x00010000},
    {0x00060000,    0x00010000},
    {0x00070000,    0x00010000},
};

Can't find any datasheet on MH8111

jimihimisimi · **Joined:** Tue Apr 05, 2022 12:57 pm **Posts:** 58

SergArb wrote:

Successfully download a rom with FastECU from CVT MH8111 1536kb.

Can't find any datasheet on MH8111

Picture? How many pins?

SergArb · **Posted:** Wed Mar 27, 2024 9:46 am

That's was enough for writing. We almost done with it.

Code:

const struct flashblock fblocks_M32R_1536KB[] = {
    {0x00000000,    0x00040000},
    {0x00040000,    0x00020000},
    {0x00060000,    0x00020000},
    {0x00080000,    0x00100000},
};

SergArb · **Posted:** Sat Mar 30, 2024 8:24 am

Thanks to MiikaS for good base! Rimwall for discovering algo's, code for CAN M32R TCU's, keywords and many many other.

Thanks to you All, I was able to adapt it for reading and writing Subaru CVT TCU's with MH8104(512kb) and MH8111(1536kb).

Next step is for separate topic, i think it's time to finish with Hitachi K-line & CAN ECU's reading and writing.
Need to order few test ECU's for bench tests

jimihimisimi · **Joined:** Tue Apr 05, 2022 12:57 pm **Posts:** 58

jimihimisimi wrote:

rimwall wrote:

Comer352L, who currently manages the repo for FreeSSM, has very kindly updated the FreeSSM source code to enable changes to the 'hidden' parameters on 5EAT TCUs. The code is in the the branch "e5at-permanent-adjustments" of the FreeSSM repo. I haven't yet tried to build it.

You will need a Denso TCU with SysID of A21022 in order to see the new settings. And the increases / decreases to the pressure corrections are made in 'steps' instead of kPa values to make it simpler to use.

I haven't tried to build the beta version myself because I can't test it (I don't have an AT car). Is there anyone who wants to test the updated FreeSSM?

I can give it a shot. I have FreeSSM on my laptop already, will just need to grab the branch.

So got around to compiling and plugging this one in and it's not connecting to the TCU, loading up Qt Creator to see if I can get it in debug mode because there's no logging in the program

jimihimisimi · **Joined:** Tue Apr 05, 2022 12:57 pm **Posts:** 58

Code:

SSMP2communication::run():   operation: readCUdata
SSMP2communication_core::SndRcvMessage(...):   sending message:
   00 00 07 E1 AA
PassThruReadMsgs(): received 1 J2534-messages:
  PASSTHRU_MSG #0: protocol id 0x6, rx status 0x9, extra data index 0:
  00 00 07 E1
  => message is transmit confirmation message
SSMP2communication_core::readFromInterface():   error: timeout while reading from interface !
SSMP2communication::run():   communication operation error counter=1
SSMP2communication_core::SndRcvMessage(...):   sending message:
   00 00 07 E1 AA
PassThruReadMsgs(): received 1 J2534-messages:
  PASSTHRU_MSG #0: protocol id 0x6, rx status 0x9, extra data index 0:
  00 00 07 E1
  => message is transmit confirmation message
SSMP2communication_core::readFromInterface():   error: timeout while reading from interface !
SSMP2communication::run():   communication operation error counter=2
SSMP2communication::run():   communication operation finished.
SSMP2communication::run():   operation: readCUdata
SSMP2communication_core::SndRcvMessage(...):   sending message:
   80 18 F0 01 BF 48
PassThruReadMsgs(): received 2 J2534-messages:
  PASSTHRU_MSG #0: protocol id 0x3, rx status 0x2, extra data index 0:
  => message indicates that an incoming message transfer has commenced.
  PASSTHRU_MSG #1: protocol id 0x3, rx status 0x1, extra data index 6:
  80 18 F0 01 BF 48
  => message is loopback message
SSMP2communication_core::readFromInterface():   error: timeout while reading from interface !
SSMP2communication::run():   communication operation error counter=1
SSMP2communication_core::SndRcvMessage(...):   sending message:
   80 18 F0 01 BF 48
PassThruReadMsgs(): received 2 J2534-messages:
  PASSTHRU_MSG #0: protocol id 0x3, rx status 0x2, extra data index 0:
  => message indicates that an incoming message transfer has commenced.
  PASSTHRU_MSG #1: protocol id 0x3, rx status 0x1, extra data index 6:
  80 18 F0 01 BF 48
  => message is loopback message
SSMP2communication_core::readFromInterface():   error: timeout while reading from interface !
SSMP2communication::run():   communication operation error counter=2
SSMP2communication::run():   communication operation finished.
SSMP2communication::run():   operation: readCUdata
SSMP2communication_core::SndRcvMessage(...):   sending message:
   80 01 F0 01 BF 31
PassThruReadMsgs(): received 2 J2534-messages:
  PASSTHRU_MSG #0: protocol id 0x3, rx status 0x2, extra data index 0:
  => message indicates that an incoming message transfer has commenced.
  PASSTHRU_MSG #1: protocol id 0x3, rx status 0x1, extra data index 6:
  80 01 F0 01 BF 31
  => message is loopback message
SSMP2communication_core::readFromInterface():   error: timeout while reading from interface !
SSMP2communication::run():   communication operation error counter=1
SSMP2communication_core::SndRcvMessage(...):   sending message:
   80 01 F0 01 BF 31
PassThruReadMsgs(): received 2 J2534-messages:
  PASSTHRU_MSG #0: protocol id 0x3, rx status 0x2, extra data index 0:
  => message indicates that an incoming message transfer has commenced.
  PASSTHRU_MSG #1: protocol id 0x3, rx status 0x1, extra data index 6:
  80 01 F0 01 BF 31
  => message is loopback message
SSMP2communication_core::readFromInterface():   error: timeout while reading from interface !
SSMP2communication::run():   communication operation error counter=2
SSMP2communication::run():   communication operation finished.
Error: selected protocol is not supported

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Looks like the software is not getting any response from the cable. It tries a CAN protocol first, no response. Then it tries iso14230, no response.

I've not attempted to compile FreeSSM myself, so will struggle to help. Perhaps it might be a 32bit -vs- 64bit issue?

Does FreeSSM work if you use a pre-complied version from (eg) SourceForge?

jimihimisimi · **Joined:** Tue Apr 05, 2022 12:57 pm **Posts:** 58

rimwall wrote:

Looks like the software is not getting any response from the cable. It tries a CAN protocol first, no response. Then it tries iso14230, no response.

I've not attempted to compile FreeSSM myself, so will struggle to help. Perhaps it might be a 32bit -vs- 64bit issue?

Does FreeSSM work if you use a pre-complied version from (eg) SourceForge?

FreeSSM comms work; I can connect to the ECU no problem and pull the ID/etc. It's the TCU portion that's not connecting/working. The OpenPort driver does not like to be ran in Debug mode with QT creator - I think I got it working(ish) but it makes debugging the comms a pain. I spent several hours with the Tribeca trying to solve this and ended up running the battery flat - oops. This wipes out the TCU magic values... fun!

Below is a code chunk from SSMprotocol2.cpp. Before this point 'CUaddress = 0x18;' is executated to set the TCU address as the target. (the SSM2_ISO14230 type being used) But then, after the getCUdata returns 'fasle'... the CUaddress gets swapped to 0x01 (or 0x02 if ECU)... i don't understand what's going on here. I am wondering if there needs to be further special handling for these later model ECUs

Code:

// Get control unit data:
   if (!SSMP2com->getCUdata(_ssmCUdata))
   {
      if (_diagInterface->protocolType() == AbstractDiagInterface::protocol_type::SSM2_ISO14230)
      {
         SSMP2com->setCUaddress(0x01);
         if (!SSMP2com->getCUdata(_ssmCUdata))
         {
            if (CU == CUtype::Engine)
            {
               SSMP2com->setCUaddress(0x02);
               if (!SSMP2com->getCUdata(_ssmCUdata))
                  goto commError;
            }
            else
               goto commError;
         }
      }
      else
         goto commError;
   }

I will be out of town for the next week, but will pick back up on it.

RomRaider

5EAT TCM JECS ROM Image

Who is online