RomRaider

I know that there is a rom modification for evos that flash the cel when there is engine knock. Has anyone figured out how to make it happen in subaru roms?

It would just be amazing!

Most of this was tipped to me by acamus from the EVO world. A big thanx to him.

Poor man way to search for CEL port:

here's the first step for an 06 STI:

1.- sh7058 Hardware manual

2.- Ecuflash

3.- MY06 STI manual

4.- IDAPro

5.- Copy of you ROM.

6.- Romraider

Steps:

1.- Locate a dummy SSM query:

You need to get to a point where the you can "see" SSM routine in your ROM in IDAPro. The procedure is well described here: viewtopic.php?f=25&t=6303. I have choosen SsmGet_Roughness_Monitor_Cylinder_3_P69 for NO particular reason other than it seems to return an int.

2.- Find which ports is being exercised on a MIL/CEL event:

The sh7058 has a list of i/o ports available for developer. Some are 16 bits multiplexed.
We will try 0xFFFFF754 which port E. Yes, you might need to test other port if you are not successful.

3.- ecuflash trick:

The goal is to reroute the SSM routine (SsmGet_Roughness_Monitor_Cylinder_3_P69) to the port address we want to look at using ecuflash

add those line to the A2zje11j xml of:

<scaling name="uint16" units="units" toexpr="x" frexpr="x" format="%x"
min="0" max="65535" inc="1" storagetype="uint16" endian="big"/>
<table name="P69 value" address="44564" type="2D" level="1" scaling="uint16">
<table name="X" type="Static X Axis" elements="2">
<data>Hi</data>
<data>Lo</data>
</table>
</table>

5.- flash new image to the car.

6.- Connect romraider to the car and select Roughness monitor 3. Write down value (A). Get out of the car and disconnect the MAF. Check for a CEL light in the dash. Write down value (B). If the value B is different from A, you may have found the correct PORT for your ECU. Reset ecu and repeat with another sensor.

IF THAT DOESNT WORK, TRY ANOTHER PORT ADDRESS LISTED IN THE SH MANUAL. YOU WILL NEED TO REFLASH YOUR ECU.

CEL port will change by MY I guess. The next step is to write insert a routine in code to exercise that port on whatever even you want.

Mart

Is not it much easier to download limited free Renesas HEW and try all ports suspected?
Just do not forget to satisfy watchdog (toggle portb.bit15 ) if needed.

well maybe I dunno. I have no experience with the renesas HEW tool. I know that mitsubishi/MUT has some sort of port query to do it...

Have you considered this?

yes, it does provides some info but I dont know how to compile the code, how to inject the code and how to hook the routine. He doesnt seems to answer his email. But one thing for sure, that guy knows how to do a lot of stuff. So for me, there is more chance of failure.

ok so with my poor's man way to probing port, I have found in 15 minutes that on my A2ZJE11J (06 STI USDM) something related to the test switch connector port is apparently:

PORT D 0xF746 fast switching 0x3C - 0x3E

now need to figure out the rest... at least I have a working ecu on my bench.

Mart

Whoops, wrong thread.

But I will say that flashing the CEL on knock would be awesome.

Editing again, because what I wrote in the other thread applies here too:

Can you read the port's memory location just like reading any other location in RAM? If so, then you should be able to view the port value without any reflashing or uploading code - just define the memory location as a parameter in your logger.xml.

Does that work? I confess I haven't tried it....

Probably you are unable to read ports (and any other processor registers) for 32 bit ecu.
Processor code includes memory ranges allowed to be read\written. Processor registers are excluded.
It is true at for the first JDM DBW 32bit ecu I am testing.

I know next to nothing about 16 bit ecu code...

that's what I thought. However, in the mitsu sh world, there is a MUT command I believe for ports (or a way to query them).

Mart