my ECU bricked

[aagun]

Originally Posted by steve99

Ok it was worth a try

Only option now is replacement ecu

Unless someone works out how to read the boot area 00000 7ffff

Hopefully you can get a cheap secondhand ecu

there are something else stop us form connecting to rxd and txd . and it is not the mode .

[aagun]

Originally Posted by jsimon7777

Automatic or manual transmission? The link I posted is manual, I think.

i found ecu near me and cheap too i will pick up it . What i am doing here is try make solution

[steve99]

Originally Posted by aagun

there are something else stop us form connecting to rxd and txd . and it is not the mode .

If you connect via serial knterface and use the renasis or tactrix ecuflash software tool to talk to ecu they send the software commands to ecu to go into sh boot mode as soon as this happens the ecu wiĺl delete both the user and boot areas

To reflash ecu you then
need both the boot and user rom areas unfortunatly no one has boot area code

[churchx]

I wonder cannot stock boot area code somehow be read to some image?

[aagun]

Originally Posted by steve99

If you connect via serial knterface and use the renasis or tactrix ecuflash software tool to talk to ecu they send the software commands to ecu to go into sh boot mode as soon as this happens the ecu wiĺl delete both the user and boot areas

To reflash ecu you then
need both the boot and user rom areas unfortunatly no one has boot area code

as what happened to ztan right !

what about this in evo
http://www.evolutionm.net/forums/evo...-pictures.html

[steve99]

Originally Posted by aagun

as what happened to ztan right !

what about this in evo
http://www.evolutionm.net/forums/evo...-pictures.html

yes thats what happened to ztan, he bricked his ecu same way as you did, he hooked up to serial interface as in his post and it immediately deletes the user area and the boot area. So unable to recover ecu as no boot area to write back.

the tactrix guys wre working on trying to read the boot area. Once someone works out how to read the boot area then you will be able to use the SH boot mode and serial interface to recover ECU.


The Lancer ecu is different, it was simialr to older wrx ecu based on earlier processor 7058 7059 and these processors only had one memory area and you could read entire area and recover using sh boot mode.

The BRZ ecu is different unfortunatly and has the two memory areas

[zc06_kisstherain]

say wha wha??? i can understand a shit on this. haha
i read all thread though..interesting

[vgi]

This below just really doesn't smell right:

Originally Posted by steve99

he hooked up to serial interface as in his post and it immediately deletes the user area and the boot area.

I donno, but it would be extremely careless on ECU archs part to do so, and somehow I don't think they're that stupid. I would assume that in the boot mode they allow to overwrite both areas. But this is just my assumption.

If I were you, rather than asking on this forum I would contact Tactrix guys directly to get 100% correct answer to this question - if it's possible bench BRZ ECU ala EVO and use EcuFlash flash recovery mode.

[aagun]

ecu changed . and the car work now after registration the ECM to key id

[justatroll]

Has anyone looked to see if the ECU brings out the JTAG pins (TCK, TMS, TDI, TDO & TRST)?
If there is a 5-8 pin header all by itself (or even bare pads), they might have provided a connection for a JTAG pod to connect.
If that is the case, it should be possible to get control through that port on a bricked ECU.

[aagun]

@steve99
thx for helping


i am not give up form old ecu . i know alot of ppl wanna unbrick sh72531 ecm
and there are many rom devrs can't hijack anything coz of bricks .


thx alot

[aagun]

Originally Posted by justatroll

Has anyone looked to see if the ECU brings out the JTAG pins (TCK, TMS, TDI, TDO & TRST)?
If there is a 5-8 pin header all by itself (or even bare pads), they might have provided a connection for a JTAG pod to connect.
If that is the case, it should be possible to get control through that port on a bricked ECU.

[steve99]

Originally Posted by vgi

This below just really doesn't smell right:



I donno, but it would be extremely careless on ECU archs part to do so, and somehow I don't think they're that stupid. I would assume that in the boot mode they allow to overwrite both areas. But this is just my assumption.

If I were you, rather than asking on this forum I would contact Tactrix guys directly to get 100% correct answer to this question - if it's possible bench BRZ ECU ala EVO and use EcuFlash flash recovery mode.

Yes sh boot mode allows you to re-write both areas but the problem is no one has sucessfully read the boot area it has more protection than the standard user area. this is the 0000-7ffff which is just padding in the roms we use as we dont write back this area we start at 8000-13ffff.
when you use sh boot mode you need the actual data from 0000-7ffff which no one has, the tactrix guys were working on reading the boot area.

[steve99]

Originally Posted by justatroll

Has anyone looked to see if the ECU brings out the JTAG pins (TCK, TMS, TDI, TDO & TRST)?
If there is a 5-8 pin header all by itself (or even bare pads), they might have provided a connection for a JTAG pod to connect.
If that is the case, it should be possible to get control through that port on a bricked ECU.

This would certiany be worth investigating. However the problem appears to be that when people flash bad code to the user rom area the sh72531 processor becomes unresponsive and no longet "talks" to any interfaces other than the low level serial interface ( sh boot mode). It seems to be poor coding of the watchdog or something and you dont seems to be able to get it to go to the boot rom which should save you by removing and restoring power. Somtimes this will work and somtimes it doesnot, it appears dependant on the corruption or coding error in the user rom.

If the user rom is completly corrupt non existant and checksum is wrong you can usually recover with a power off on reset and reflash.

If the rom flashed correctly and checksum is correct but code is bad and send processor into loop or some strange state then you dont appear to be able to recover with power off on and for some reason the watchdog does not seem to recover the processor. Or maybe it does and its resetting the thing so often you dont get a chance to talk to it via obd port.

Untill somone bench tests one and looks at all the signals its all speculation