RomRaider Logo

RomRaider

Open Source ECU Tools
 FAQ •  Register •  Login 

RomRaider

Documentation

Community

Developers

It is currently Sat Feb 21, 2026 9:57 pm

All times are UTC




Post new topic Reply to topic  [ 36 posts ]  Go to page Previous  1, 2, 3  Next
Author Message
 Post subject: Re: JTAG Flash Howto
PostPosted: Tue Oct 28, 2008 10:01 pm 
Offline
RomRaider Donator
User avatar

Joined: Thu Mar 30, 2006 2:38 am
Posts: 5336
Freon wrote:
Well most subroutines hit the stack. Sure you may not need to touch it for your own code, but it is likely the subroutine you are rewriting pushes a value to the stack and then retrieves it before termination.

Most hacks are inserting a hook into the middle of an existing routine. I don't see why you would need to rewrite an entire routine to achieve any of the common hacks out there.


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Wed Oct 29, 2008 4:06 am 
Offline
Experienced
User avatar

Joined: Wed Feb 13, 2008 3:00 am
Posts: 153
Freon wrote:
Well most subroutines hit the stack. Sure you may not need to touch it for your own code, but it is likely the subroutine you are rewriting pushes a value to the stack and then retrieves it before termination.

ECUs have different pinouts. You should check reference material from Subaru to find your power and ground pins.


No doubt, I was wondering if you're using just the IGN and 1 ground or a few others as well.

_________________
06 Wrx Wagon 2.3 longrod in the works


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Thu Oct 30, 2008 1:25 am 
Offline
Experienced

Joined: Wed Jul 26, 2006 7:19 pm
Posts: 650
Location: Connecticut, USA
merchgod wrote:
Most hacks are inserting a hook into the middle of an existing routine. I don't see why you would need to rewrite an entire routine to achieve any of the common hacks out there.
That's probably true for "real-time" hacks. But hacks to incorporate speed/density (Freon) or substituting LC-1 in place of stock AFR sensor (cboles) probably do require the rewrite of an entire routine.


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Thu Oct 30, 2008 1:39 am 
Offline
RomRaider Donator
User avatar

Joined: Thu Mar 30, 2006 2:38 am
Posts: 5336
Jon [in CT] wrote:
That's probably true for "real-time" hacks. But hacks to incorporate speed/density (Freon)

You are only dealing with an alternate method of determining base airflow, leaving everything else unmodified - airflow comp, load calculation, etc. So, not really. Of course, there are a number of ways you can implement any hack, but I'm of the opinion that you should implement them in a way that requires the minimum number of modifications to the existing code to minimize the introduction of bugs. It is much easier to debug a set of standalone routines that you developed than major changes to the existing factory code.


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Mon Nov 10, 2008 4:47 pm 
Offline
RomRaider Developer

Joined: Wed Jul 12, 2006 1:25 am
Posts: 1025
Did I really post this in general discussion?

_________________
AIM: TguiWRX


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Mon Nov 10, 2008 9:00 pm 
Offline
RomRaider Donator
User avatar

Joined: Thu Mar 30, 2006 2:38 am
Posts: 5336
Tgui wrote:
Did I really post this in general discussion?

My bad. I think I meant to move another post.


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Mon Nov 10, 2008 9:50 pm 
Offline
RomRaider Developer

Joined: Wed Jul 12, 2006 1:25 am
Posts: 1025
merchgod wrote:
Tgui wrote:
Did I really post this in general discussion?

My bad. I think I meant to move another post.


Haha, gotcha.

_________________
AIM: TguiWRX


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Mon Nov 17, 2008 3:04 pm 
Offline
Experienced
User avatar

Joined: Thu Mar 30, 2006 3:00 pm
Posts: 237
merchgod wrote:
Tgui wrote:
Doesn't mean it can't happen. I feel ECU hacking is held back partly because of fear, the fear of not being able to recover from a mistake.

Have you ever gone one of these routes?

Also, "brick", should I call it by a more accepted term? :|

None would apply to my 02 WRX. I don't think ECU hacking is held back from fear. It is held back because few really know what they are doing. I would worry more about the results of hack than bricking the ECU.


Would that be "Fear of the unknown" ? :wink:

_________________
Old: '02 WRX
New: '06 STi


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Sat Feb 28, 2009 1:56 am 
Offline
Experienced
User avatar

Joined: Wed Feb 13, 2008 3:00 am
Posts: 153
Bump.

Before I can go any further with my speed density tests, I need to get my spare ecu up and running.

I've narrowed the issue down to either wds issues (p407 on shbootmode diagram), or issues power up the ecu (Proper pins, order of connecting circuit/power/ecuflash).

To check the wds, I was hooking up a headphone with a large resistor, and comparing it to a test tone. Just to be sure, I hooked it up to a scope, and it's coming in around 150hz, not 125hz, as a square wave between 0V and 2V (crossing the 1.5v TTL threshold), this is based on the scope's calibration port.

I found a 555 timer equation and plugged in the schematic, giving 145.8hz, so I'm pretty sure the wds is good enough.

I used the same setup to tap into the send and receive lines of the circuit, and I get an intermittent click whenever ECUflash is sending the boot command, but zero response, which matches the logs.

So, either i'm not powering on the ecu properly, or the wds is off too far. I'm leaning towards the former, specifically the order of doing things. I've tried powering the 5v first, then the 12v, waiting a second, and not waiting, to no avail. I'm really at my wits end here, paying tactrix and buying new ecu's is not an option... any advice would be greatly appreciated.

Forgot to mention, I'm also running a ground wire between the ecu ground the the circuit ground as mentioned on openecu, and I've tried using a battery @ 12.5V and an adapter at 12V.

So, anyone who's successfully shbootmode'd an ecu, which and how man ecu pins did you use for power, and in what order did you apply the 12V, 5V, and WDS, and how fast.

Thanks.

_________________
06 Wrx Wagon 2.3 longrod in the works


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Wed Mar 18, 2009 2:30 am 
Offline
Experienced
User avatar

Joined: Wed Feb 13, 2008 3:00 am
Posts: 153
Here are some pictures of the SHB adapter from the scope.

Pictures!

_________________
06 Wrx Wagon 2.3 longrod in the works


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Sat Mar 28, 2009 2:40 pm 
Offline
Experienced
User avatar

Joined: Wed Feb 13, 2008 3:00 am
Posts: 153
Did some more testing today.

When my adapter isn't hooked up to the ECU, everything reads:
VCC: 5v
GND: 0v
TX/RX: 5v
WDS: 0v - 5v Square Wave @150Hz.

All this looks fine to me, I'm not sure what the TX/RX lines should read though.

Anyway, when soldered up to an ECU, things change.

Vcc => P405
GND => P413 => ECU pins D1,D2,D3,D7,A5 (connecting adapter and ecm grounds as Colby mentioned on OpenECU)
TX => P409
RX => P411
WDS => P407

This is while running:
12V POS => ECU pins B5,B19
12V NEG => ECU pins D1,D2,D3,D7,A5

I get the following readings with or without the 12V source applied
Vcc: 5v
GND: 0v
TX: 2.5v
RX: 2v
WDS: 0v - 2.5v Square Wave @ 150Hz

So, it looks like the ECU may be broken, or the pad numbers aren't corresponding to the proper CPU pins. I found a spare 04 STi ECU to test, will see how that goes, and I suppose I could scrap one of my ecu's to trace the pads if my cable is indeed working.

Can anyone who's sucessfully booted an ECU post the above readings when connected?

Thanks!

_________________
06 Wrx Wagon 2.3 longrod in the works


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Sat Mar 28, 2009 3:58 pm 
Offline
Senior Member

Joined: Mon Jan 19, 2009 6:31 pm
Posts: 1615
Location: Moscow, Russia
You do have a problem with powering the processor.
Voltages measured prove that there is 2 V power instead of 5 V required for the chip.

Probably the ECU voltage stabilizer (12V->5V) chip is dead.

Is it possible that your 12V wiring is incomplete?


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Sat Mar 28, 2009 10:43 pm 
Offline
Experienced
User avatar

Joined: Wed Feb 13, 2008 3:00 am
Posts: 153
I'm pretty sure my 12V is good. I talked to Colby @ Tactrix, he said my power adapter is sufficient (12.0v, 1.5a), and the pins and ground connection are correct. I'm using every POS and GND connection I can find in the Subaru manual, and it matches what Colby is using. I also tested with a car battery running 12.5v or so.

I'll have the 04 STi ecu shortly for testing, but in the meantime I'll check over the 7058 docs to find a way to test the voltage stabilizer.

_________________
06 Wrx Wagon 2.3 longrod in the works


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Wed Apr 01, 2009 6:32 am 
Offline
Experienced
User avatar

Joined: Wed Feb 13, 2008 3:00 am
Posts: 153
Tested the 04 STi ecu, no luck.

The ecu was in working shape, has a working rom on it and all. I'm using a ground strap and a grounded soldering iron, so It's safe to say there's nothing wrong with it.

With or without 12V power, the WDS, TX, and RX lines all show a big voltage drop, down to ~2V, just like my 06 WRX ecus.

Not sure what to make of this, perhaps I have something setup wrong with the adapter's voltage setup on the DLP-USB chip.

_________________
06 Wrx Wagon 2.3 longrod in the works


Top
 Profile  
 
 Post subject: Re: JTAG Flash Howto
PostPosted: Wed Apr 01, 2009 10:25 am 
Offline
Newbie
User avatar

Joined: Sun May 28, 2006 4:59 pm
Posts: 1
Location: Russia, Krasnodar
I sucessfully SHbooted 2 bricked ECU. Euro AL340(sti 06) and AK710(fxt 06).
ECU powered with 13.1v by two pins - ign(b134-7) and gnd(b134-5) in my case. Also provided strong ground between ECU, adapter and 13.1v power source. 5v is VCC on schematic. Uploading rom time in shbootmode is about 15min. I made USB-serial adapter on FTDI ft232bm chip and ne555n timer.
Here ecuflash logs.


You do not have the required permissions to view the files attached to this post.

_________________
NO TURBO NO CRY..


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 36 posts ]  Go to page Previous  1, 2, 3  Next

All times are UTC


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
Style based on FI Subsilver by phpBBservice.nl