RomRaider

Question is, will he release his source. If not, I'd rather not rely on his implementation.

apparently his doesn't really use JTAG either; he basically goes into another software layer above JTAG but below the level that is possible to corrupt via standard ecuflash operation

this is a good interim option, but I don't think that it covers the immobilizer (the REAL reason I am interested in doing this)

Huh, just found out I know a guy that works with JTAG and embedded systems for a living. When I get smart enough with this topic, I'll forward him some questions.

Better yet if he is near releasing the source code. We're very anxious.

Before sending my dead ECU to Colby for boot mode flashing (what you guys want to be investigating BTW, not JTAG), I took a number of pictures of the ECU PCB (05 LGT MT). I shall upload them tonight when I get home from work..

The SH-2 processor family has a boot mode, where it is possible to talk via the SCI and re-write the entire flash area without a valid bootloader. Essentially, there are a few config pins on the ECU which have to be pulled high or low. For the nitty gritty details, see http://documentation.renesas.com/eng/pr ... sh7058.pdf
page 878 for the table (look for plain old "boot mode" not "user boot mode")

From there, it's a matter of tying into the SCI port and feeding the right programming data to the flash. If Ecuflash has the ability to talk to a RS232 to generic serial IC (like a Maxim 232), then we may be already set. It would just be a matter of finding the right pins and putting the correct voltage values on them for "1" or "0" to enable boot mode flash.

I'm planning on getting a junked ECU (unless someone wants to donate one) to play with. Hopefully, Colby will be able to enlighten us all soon as to the exact hardware/software setup for bench flashing.

right, but that boot mode has the disadvantage of not being able to be read.

my main concern is the immobilizer if this method is used

Your DBW ECU is under the carpeting on the passenger side foot well. Pull the carpeting from the top where the floor slants up toward the firewall. The ECU is behind a metal plate in the floor.

Post pictures.

So what's the interface between Ecuflash and the microprocessor? It'd be lovely if all you had to do was make a few jumper wires with tiny alligator clips on either end to connect between OpenPort pins and the microprocessor pins.

its not actually JTAG functionality; I misread/misunderstood what he was saying.

he has renesas boot mode support built in already, and he says hes going to post schematics for it soon.

can't open my passenger side door....

First pic, no flash, a little blurry. Shows overall layout. Top right corner is the Renesas 7058, the IC in the lower left corner is either a Low Side or High Side smart switch (could be the IC that shorts when the radiator fan relay zaps it).

There are also 2 other micro/memory-looking ICs and a smaller QFP in the middle. My guess is that the immobilizer code lurks in one of those.

For those interested, the mating harness connectors are JAE MX3100 models.

Closeup of the Renesas 7058 SH-2. Pin 1 looks to be in the upper right corner.

Bottom right corner showing the 2 mystery (as of now) ICs.. The flash makes it hard to read through the conformal coat.

Bottom left side.

excellent!

now to identify in the photo which pins are jtag....