Please help me read my ROM

[Johnwastakenalready]

Hey guys,

I've recently got a Tactrix 2.0 and ECUflash and I can't seem to read my cars ECU. Can someone help walk me through the process?

I've been able to open up some VR4 Roms I've downloaded from the internet, and have the appropriate XML file for these roms, and I've been able to fiddle around with the fuel maps etc on these roms.

My car is a 1997 manual Legnum, with a plastic ecu case, which is labelled MD340288 (And therefore should have a 7202 chip in it).
I have tried with editing the 'vr4base' XML to have memmodel "H8539F"
Also before trying to read the ECU, after opening ECUflash I'm not sure which vehicle to select(maybe I don't have the correct read template XML file? there are options from ECU flash for evos, subarus etc, but no vr4 option)

The error I get from ECU flash when trying to read is this:

[12:38:21.411] sending init sequence 2
[12:38:21.414] got 0x10 response instead of 0x11
[12:38:21.414] sending init sequence 3
[12:38:21.767] entering bootloader
[12:38:21.770] sending kernel size (2029)
[12:38:21.771] error sending kernel size
[12:38:21.773] interface close

 

[BCX]

Can you post a more complete log from ecuflash?

Do you have the reflash connector connected?

the memmodel in the vr4base/200300xx xmls are for writing
If you have a 1997, it would have had a metal cased 7201.

It's probably still worth checking if you have a 7202 or 7203 so the memmodel is correct.

The other thing with the memmodel, if the XML matched as 20030013.xml, thats where you need to change the memmodel, changing it in vr4base only wont work as they XMLs are inherited.

You'll need to pick a read template, Evo 5-6 will be fine
but basically any read template that uses:
flash method: mitsukernel
memory model: H8539F or H8539FA
Size: 128k

 

[Johnwastakenalready]

I have the reflash connector connected.
Its definitely a plastic case MD340288, and I've taken the cover off and it has processor chip H8/539.
I have tried those read templates (H8539F and H8539FA).
So the memmodel won't matter until I get to writing the ECU? Shouldn't matter if I'm just trying to read it?

Should the car be entering diagnostic mode when I try to scan?(warning lights flashing sequence)

Here is the log I have been getting


[06:44:16.146] Logging to file C:/Users/jrmcc/AppData/Roaming/OpenECU/EcuFlash/logs/ecuflash_log_20200911t064416.txt
[06:44:16.146] EcuFlash Version 1.44.4799
[06:44:16.146] OS Version Windows 10
[06:44:16.146] Kernel Type winnt
[06:44:16.146] Kernel Version 10.0.18362
[06:44:16.146] CPU x86_64
[06:44:16.146] Product Name Windows 10
[06:44:16.146] Product Type windows
[06:44:16.146] Product Version 10
[06:44:16.146] Qt Version 5.6.0
[06:44:16.146] Qwt Version 6.1.2
[06:44:16.146] QwtPlot3D Version 0.2.6
[06:44:16.146] Boost Version 1.60
[06:44:16.146] FTDI Library Version 3.02.11
[06:44:16.146] Openport J2534 Library Version 1.02.4798
[06:44:16.157] 67 memory models read.
[06:44:16.157] scanning for metadata models in D:/Things to keep/Car stuff/legnum/ECU Tuning/EC5A-EC5W BCX Defs/Trial
[06:44:16.164] 31 ROM metadata models scanned.
[06:44:16.164] checksum module "subarudbw" loaded.
[06:44:16.164] checksum module "subarudiesel" loaded.
[06:44:16.164] checksum module "subaruhitachi" loaded.
[06:44:16.164] checksum module "mitsucan" loaded.
[06:44:16.164] checksum module "mitsuh8" loaded.
[06:44:16.164] patch module "Subaru CAN Enhanced RAM Parameter Logging" loaded.
[06:44:16.164] patch module "Mitsu CAN RAM Parameter Logging" loaded.
[06:44:16.168] using metadata XML ID read_EM2004 from file D:/Things to keep/Car stuff/legnum/ECU Tuning/EC5A-EC5W BCX Defs/Trial/read templates/Read_vr47202.xml
[06:44:16.171] flashing tool "wrx02" loaded.
[06:44:16.171] flashing tool "wrx04" loaded.
[06:44:16.176] flashing tool "sti04" loaded.
[06:44:16.176] flashing tool "sti05" loaded.
[06:44:16.176] flashing tool "mitsucan" loaded.
[06:44:16.176] flashing tool "mitsukernel" loaded.
[06:44:16.176] flashing tool "mitsukernelocp" loaded.
[06:44:16.176] flashing tool "mitsubootloader" loaded.
[06:44:16.180] flashing tool "shbootmode" loaded.
[06:44:16.180] flashing tool "shaudmode" loaded.
[06:44:16.181] flashing tool "subarucan" loaded.
[06:44:16.183] flashing tool "subarucand" loaded.
[06:44:16.183] flashing tool "subarubrz" loaded.
[06:44:16.183] flashing tool "subaruhitachi" loaded.
[06:44:16.217] J2534 API Version: 04.04
[06:44:16.217] J2534 DLL Version: 1.02.4798 Jun 13 2016 17:17:10
[06:44:16.217] Device Firmware Version: 1.17.4877
[06:44:16.217] Device Serial Number: TAeNBp1A
[06:44:16.218] interface close
[06:44:16.238] J2534 API Version: 04.04
[06:44:16.238] J2534 DLL Version: 1.02.4798 Jun 13 2016 17:17:10
[06:44:16.238] Device Firmware Version: 1.17.4877
[06:44:16.238] Device Serial Number: TAeNBp1A
[06:44:16.239] interface close
[06:44:16.258] J2534 API Version: 04.04
[06:44:16.258] J2534 DLL Version: 1.02.4798 Jun 13 2016 17:17:10
[06:44:16.258] Device Firmware Version: 1.17.4877
[06:44:16.258] Device Serial Number: TAeNBp1A
[06:44:16.259] interface close
[06:44:16.275] J2534 API Version: 04.04
[06:44:16.275] J2534 DLL Version: 1.02.4798 Jun 13 2016 17:17:10
[06:44:16.275] Device Firmware Version: 1.17.4877
[06:44:16.275] Device Serial Number: TAeNBp1A
[06:44:16.276] interface close
[06:44:16.294] J2534 API Version: 04.04
[06:44:16.294] J2534 DLL Version: 1.02.4798 Jun 13 2016 17:17:10
[06:44:16.294] Device Firmware Version: 1.17.4877
[06:44:16.294] Device Serial Number: TAeNBp1A
[06:44:16.295] interface close
[06:44:16.309] J2534 API Version: 04.04
[06:44:16.309] J2534 DLL Version: 1.02.4798 Jun 13 2016 17:17:10
[06:44:16.309] Device Firmware Version: 1.17.4877
[06:44:16.309] Device Serial Number: TAeNBp1A
[06:44:16.310] interface close
[06:44:23.586] using metadata XML ID read_EM2004 from file D:/Things to keep/Car stuff/legnum/ECU Tuning/EC5A-EC5W BCX Defs/Trial/read templates/Read_vr47202.xml
[06:44:27.104] using metadata XML ID read_EM2004 from file D:/Things to keep/Car stuff/legnum/ECU Tuning/EC5A-EC5W BCX Defs/Trial/read templates/Read_vr47202.xml
[06:44:27.118] J2534 API Version: 04.04
[06:44:27.118] J2534 DLL Version: 1.02.4798 Jun 13 2016 17:17:10
[06:44:27.118] Device Firmware Version: 1.17.4877
[06:44:27.118] Device Serial Number: TAeNBp1A
[06:44:30.118] sending init sequence 2
[06:44:30.123] got 0x10 response instead of 0x11
[06:44:30.123] sending init sequence 3
[06:44:30.475] entering bootloader
[06:44:30.476] sending kernel size (2029)
[06:44:30.480] error sending kernel size
[06:44:30.482] interface close


Thanks so much for your help

 

[BCX]

If the physical chip has screen printed h8/539 rather than MH7202/MH7203 then ecuflash wont support it.

Early plastic ECUs had the renasis/hitachi branded chip rather than Mitsubishi.

You'll need MMCFlash to reflash it.

Tactrix unfortunately haven't updated ECUFlash for a while, so I doubt they will add support even thought they support the other two revisions of the same chip architecture. You could try sending their support an email? or find an MH7202/MH7203 ECU.

 

[Johnwastakenalready]

I see.
So my options are:
A) Buy a new ECU which has a MH 7202/7203 chip
B) Buy MMCFlash
C) Email ECUFlash support and see if they have a solution.

So for options B
-If I buy MMCFlash, will I then be able to read my current ROM? Or will I instead be flashing a new ROM onto my current ECU, set to 7202F?, and from that point on I'll be able to read and write onto the ECU
(As per TME Steve post titled "H8 ECU's can now be reflashed"

If this is the case then I will just be balancing the price of a new ECU Vs buying MMCFlash.

 

[BCX]

If you get MMCFlash, you'll forever need to use MMCflash to read/write. The different versions of the processor have small differences with the physical hardware of the chip, but will execute/run any ROM as the architecture of the processors are all the same (ie they are all H8/539), hence you can put any MH7202 or MH7203 rom on the ecu.

This is why ECUFlash might be able to support the proc, it's similar to what they already support, just the boot mode/flash kernel needs tweaking for the specific version of proc.

I've emailed Tactrix in the past, and haven't had much luck with them given the cable is a few hundred.

Option C is free, so might as well try. But you'll get quicker turn around/working solutions with the other two options. You only need 1 module of MMCFlash, which I believe is the cheapest out of modules.

I was reading the datasheet for the H8 boot mode, I dunno where to begin with writing something given I don't have the hardware to test on. If someone has a spare H8/539 ECU, happy to have a look at it, but cant guarantee anything.

 

[BCX]

Never noticed before, but seems ECUFlash uploads its reflash kernel to ram address 0xF000

The datasheet I've been reading states that user data needs to be at address 0xF380 in RAM.... hmmmm

 

[Johnwastakenalready]

Another question,
If I was to get MMCFlash and keep using my H8/539, would I still be able to get other goodies one day like flexfuel, antilag, launch control etc?

 

[BCX]

Yep, you can use any rom, just that to put it on your ecu will require mmcflash

 

[madluke]

Hi all, by any chance does anyone of you have a better definitions for ECU MR507734 with 7203 chip (EM2434) and H8539FA memory module?

 

[Johnwastakenalready]

I have now successfully been able to read my ROM from the ECU using MMC Flash software, and I've been able to edit the ROM with ECUFlash, and then write the new ROM back onto the ECU with MMC Flash. (Which is an awesome feeling)
(Advice for anyone else with my situation, I would recommend buying a different ECU rather than getting MMC Flash, because the software and USB takes a while to arrive, and still costs a fair bit)

Hopefully someone can help me with my next step:
-Will Evoscan be able to read my ROM? I need to be able to datalog before doing significant tuning.
-I'd like to know its possible before purchasing the $25 software from evoscan.com
-I have emailed evoscan 5 days ago but havn't got a reply

 

[BCX]

Evoscan emulates the MUT tool the dealership has.
It'll work with any ecu from the era, regardless of reflash abilities or not.

look at it this way, reflash method is hardware based, different revisions of processor need different method of reflashing.
Diagnostics and communications is really a software function of the ECU. Dealerships only had one tool for diagnosis for all models - MUT. All roms and ecus needed to work with this one tool.

 

[Rasheid Doctor]

@madluke

Hi all, by any chance does anyone of you have a better definitions for ECU MR507734 with 7203 chip (EM2434) and H8539FA memory module?

Did you get the matter resolved? I am also looking for definition for sohc 6a13 as close as possible to the fto definition, I would have tried to flash the fto gpx roms to my ECU except the 6a12 is coil pack and my motor has a distributor

 

[BCX]

Is there any specific tables you are after?

 

[Rasheid Doctor]

cool thanks for the quick response, at the moment almost everything in the fto's definition seems like tables I would like to manipulate, to start I would want to manage to idle up to compensate for my alternator's shortcoming when the ac is on stock settings keeps the car at about 750rpm, I have a aftermarket 130amp alternator that honestly seems like maybe 80amps, about 1300rpm seems to keep charge voltage happy with a/c on, but I would like to have as much of the ftos definition without the variable cam settings, and multi coil systems. I hope to squeeze 30hp out of the motor, with future plans for bigger injectors and boost. At moment I'm trying to compare the bins to make my own definition it seems complicated but I'm willing to give it a go.

 

[BCX]

What ROM did you want the definitions for? the right hand side of your hex editor screenshot?

Can you upload the rom?

 

[Rasheid Doctor]

The rom is from a spare ecu I had laying around, I don't have a cable so dumping the ecu requires removing the ecu and using a bdm device which I planned on doing later today. I will attach from I'm using

 

[Rasheid Doctor]

Hello again, here is the actual rom

 

[Rasheid Doctor]

Ok! so these are the tables i want to find the addresses for(attached)

 

[Rasheid Doctor]

Is there a guide to creating a new definition from a known good definition or does any have a working definition for the sohc 6a13? I'm not making much headways. Thanks