RomRaider

Haveanyone been successful in pulling they 2003+ JDM Forrester ECU Rom?

The Ecu is Ag572-1355

I had same problem......
I can't swich the car to test mode...
http://www.romraider.com/forum/viewtopic.php? ... ight=#8613

Ok. Any resolution.

FXTSTI ,

Did you get through?

I have the same damn issue, went to a tuner and he is saying that i need to ECUTEK U$500, i wish i could open tune.
any body with success

Hi, I did pull out a ROM sometime back, I believe this model has the six pin (but with only four wires connected) B300 Line End Check connector.Have you tried with the Tactrix six pin programing block connected to this or alternatively pin 1 jumpered to 4 and pin 3 jumpered to 6? See attached schematic for 2003 RHD 2.0 Turbo Forester.

It appears that AG572-1355 has SH7055 processor inside. That does not correspond to ecuflash and romraider definitions for the applicable ecu family.

May this prevent from reading\flashing this ecu?
May this be corrected by creating appropriate defs for it's ID: 2A04446305 ?

Definitions have nothing to do with whether or not you can pull the ROM. You need to select the correct read method in Ecuflash (for SH7055, use the USDM 2004 STi read method).

Still no luck..

This ecu is quite different from others.

It looks like this is the first CAN Denso with SH7055. Ecu pinout does not look like anything USDM, EDM with the same plugs. Pins traced and verified thru k-line SSM.

- extended parameter readings is not possible. Nothing but standard SSM parameters can be read. Any other locations returns 0xFF.
- MemoryWrite (byte) command permits to write 0x60 (Ecu Reset), 0x6F (Ignition Correction), 0x70 (Idle RPM Correction), 0x71 (Idle RPM Correction AirConditioner) and nothing else.
- MemoryWrite (block) is not working.

CANbus exists but is not connected to OBD plug.
Appropriated connection is made. Is not helpful. Tactrix can't init this ecu and get responce thru CANbus.

TestMode and ReadMemory connectors found, SSM2 thru k-line sees them working. FlashConnector found and traced to ecu.

Any combinations of connectors closed\open and ecuFlash methods were tested. Ecu still does not agree to read or write directly to RAM.

That mean that kernel could not be downloaded and kernel download could not be verified. Thus known procedures are not able upload the ROM.

It looks like there is another init sequence (k-line or wire based) to make this particular ecu to except RAM reading\writing\flashing.

Any ideas?

Or I finally have to try ROM upload thru AUD SH7055 diagnostic connector?

Yes. I got through. I pulled the rom ans start creating support. A little while afterwards, romraider supported it.

There is no support for ID 2A04446305 in ecuFlash and RR.

Still no juice with OP2.0.
Probably I have to find original OP1.3U cable.

Upper memory with calibrations has been extracted from this ECU

ECU program code is still not available.

ecuFlash definition for data needed

PLEASE READ THE RULES BEFORE UPLOADING DEFINITIONS - ADMIN

On my earlier post, the Forester in question was not a DBW. I finally got to encounter a 2003 JDM dbw Forester and could not download the rom, how did you go about this?

I have this ROM without the first 8 KB - initial and operating system bootloaders.
This does not allow me to trace possible ways to load the kernel.

Currently I have to correct MAF voltage for air flow > 50 g/s (where ecu provides OL strategy) for internal cooling of a combustion chamber.