RomRaider

Hoping this gets to the right person cause I'm not sure where else to ask this.

I am interested in the ability of using the already programmed read and write sequence for the M32176 based Evo X ecu. As I have an ecu that is running a very similar M32195 based ecu, and would like to try to read the rom with ECUFlash, but I would need to know the pins on the Tactrix 2.0 cable to connect to what pins on the M32195 and M32176 chip. The reason for this is that it is not a vehicle that has a OBDII so the Tactrix doesn't work as is.

I'm pretty sure that the pins on the chip that need connected are MOD0, MOD1, FP, and RESET. But I'm not really sure. Any information as to what needs connected and what settings need selected in ECUFlash.

Thanks,
Branden

There are different families of M32R achitecture.
EvoX uses MH8xxxF Mitsubishi chip.
Hitachi uses JECS WA122129xxWWW.
DENSO uses Renesas M321xxF.
All of them use different bootloaders.

Ok, do they each have their own read and write sequence because of the bootloader being different?

My guess would be yes, so what would you recommend doing? I have already ordered a spare ecu to take apart to trace the pins. I'm not sure how exactly to go about doing this.

Thanks,
Branden

They do really have different bootloader command sets.
First of all you should know what M32R family chip is used inside the ecu.

I was told that it is a M32195F4, and I will confirm that when I receive my spare ECU.

UFLA32R program and 5V UART is a key.
Provided the ecu TX output is able to send @ 115200 baudrate.
Otherwise you need to open the ecu case and connect to TX1 directly or to modify UFLA to start at lower baudrate.

Reading is not supported in UFLA.

Ok, so I downloaded the UFLA program and I already have a 5V UART connection.

If this program cannot read, then what is it needed for?

This program may help to initialize connection.
After that you may use your own code\program and read the ROM.
ReadBlock command is known.

The ecu I have is using a MH8104F Mitsubishi chip after taking it apart.

If you have any suggestions for beginning to hack this ecu I appreciate it.

I believe I've found that the pins from the ECU connector that go to the MCU TXD0 & RXD0, but I'm having trouble finding the pin(s) that pull the FP and MOD0 high. I have a couple suspect pins since there are only a few left, and I've tried to connect to the ECU and read the Lock Bit Information to verify I was getting comms, but I think I might have damaged the ECU in taking it apart to trace the pins.

I have another ECU, but I want to be sure I won't damage it if I apply 5v to the wrong pin.

Also, I'm using an Arduino to connect to the Tx & Rx. Do you see any problem with that?

Thanks,
Branden

I am afraid that MH8xxxF uses Mitsubishi k-line protocol instead of Renesas Rx\Tx version you are looking for.

Ok, can I use my OP2.0 cable and ECUFlash to read it?

Or do you have any documentation/information on how to read it?

Thanks,
Branden

Contact tacrix and mmcflash dealers relative MH8xxxF reflash.

I know this is an old reply but can anyone share the UFLA program or how to download it. I can't seem to find it on the renesas website. Thanks!

Did anyone work out if an MH810xF can be read and/or written by free tools over K-Line?

I'm about to wire up an adaptor to an OBD2 socket to connect an OpenPort 2.0 and see what ECUFlash does. Failing that, I guess a commercial product like PCMFlash is the way to go? I've heard a lot of bad things about MMC Flasher.

I'm not sure if MH810xF needs power applied to the VPP pin to flash. I've ordered an ECU connector on AliExpress just in case it does.

MMC can read and flash over k-line.
43 K-line
34 VPP
3 -
8 +

I am new to romraider but can we adapt maps in romraider?