ECUFlash - Getting close!

[EAGLE5]

Which hex editor do you suggest?

Originally Posted by ztan

I agree this is likely to be the problem - when using the OFT, the checksum correction + anything else needing to be corrected gets processed by the OFT or OFT manager.

For my successful flashing, I was using EcuFlash brzBeta 1.44.3948, changes to my stock ROM made in TunerPro and RomRaider, checksum corrected in RomRaider, date stamp removed in Hex editor (so EcuFlash woudn't bother me), and written with EcuFlash.

[SkullWorks]

Originally Posted by Td-d

Skullworks - maybe send jsimon7777 the beta version of Ecuflash that Colby sorted you out with, see if that helps?

I will at your suggestion sir

edit: PM SENT

[stugray]

Wow, you guys are freaking me out!
I must be completely confused about how these Roms work...

In my experience, the Checksum is a value that the target processor reads back to the originator (usually over a serial interface) after performing a copy to verify that the destination file matches the source file.

So the way I understand it is that you need to have a final ROM.bin file, calculate the Checksum, transmit the file to the target, target calculates local checksum, if the two checksums (Xmt/Rcv) match, Copy complete & error free.

What am I missing?

You cant mess with the digital data in a file and expect the checksum to be the same.

[Td-d]

stugray - that is basically the way - and both RR and Ecuflash recalculate the checksum (there are 7 in total if I'm not mistaken). Another, less elegant way was to actually disable the checksum checking routine in the rom (RR used to do this).

I think the issue is that the OFT probably has an additional step in the OFT manager somewhere. But I assume, we would need that verified by Vishnu tuning.

[ztan]

Originally Posted by Td-d

stugray - that is basically the way - and both RR and Ecuflash recalculate the checksum (there are 7 in total if I'm not mistaken). Another, less elegant way was to actually disable the checksum checking routine in the rom (RR used to do this).

A01G ROM has 12 checksum blocks filled with 5 blanks starting (17 total) at 0x13F500

RR date stamp gets inserted at 0x13F5CC

[vgi]

http://www.openecu.org/index.php?tit...ksum_Algorithm

sample checksum table, 17 blocks, last 5 have checksum disabled:

start_addr end_addr cksum_val
00008000 0013F4FF 176EBB28
000FAE00 000FB8FF D9F0DD89
000FB900 000FC3FF 2423D83B
000FC400 000FCEFF F0CA38E8
000FCF00 000FD9FF 1299921B
000FDA00 000FE4FF 5AA5A81A
000FE500 000FEFFF 5AA5A81A
0013C300 0013CCFF 9CA358D7
0013CD00 0013D6FF E509C9A9
0013D700 0013E0FF 720C6238
0013E100 0013EAFF 5AA5A7DA
0013EB00 0013F4FF 5AA5A7DA
00000000 00000000 5AA5A55A
00000000 00000000 5AA5A55A
00000000 00000000 5AA5A55A
00000000 00000000 5AA5A55A
00000000 00000000 5AA5A55A

the version is block 0x0013F5CC-0x0013F5CF which is yymmddnn where nn is the number of rom saved for the date. just replace that with FFFFFFFF

Update: the BRZ/FRZ rom has another checksum table with 2 extra checksum blocks. The checksum fix has been made to RR but hasn't been released yet (check this update date) so you should use EcuFlash for checksum correction.

[Td-d]

And, we have logging!

Originally Posted by cboles

Here is a another version to try.

I have made a couple of improvements to the "OEM" reflash process to make it more robust if there are any missing responses on the CAN bus (I'm making the ECU very busy trying to run as fast as possible, which can lead to it dropping commands sometimes).

This version also has firmware that supports logging, using UDS mode 0x23 requests which read from RAM directly. There is a sample of how to do this at

C:\Program Files (x86)\OpenECU\EcuFlash\samples\logging\subaru brz uds.txt

in your installation. You will need to use the OP2 once in EcuFlash (you can even just go to the Help | Licensing page) to get the OP2 firmware update to happen first. The you can copy subaru brz uds.txt as logcfg.txt on your microSD card and you should be good to go. You will probably want to add some trigger conditions - you can look at some of the other examples to see how that is done if you don't know already.

The good news is that this form of logging is pretty fast (> 1000 32-bit parameters / second), so I might not add a custom mod to do any special new logging method. The only downside of this method is that you need to know all of the RAM addresses of the parameters in order to use it - there are no common SSM-style PIDs here. I have automated ways of finding all of the common parameters, so if we run into any new ROMs, this shouldn't be much of a problem anyways.

One important thing to note is that these mode 0x23 requests allow you to read large blocks of memory at once, so the OP2 tries to take advantage of this by sorting your parameters by address and figuring out when it is quicker to request many parameters at once (when their addresses are close enough together). This is also means that sometimes logging additional parameters comes at virtually no speed expense if their addresses are right next to the other parameters. If you look at my sample file, you will see that may RAM parameters are in fact right next to each other, which is good news.

Unless there are some problems with this beta, this will probably be the last version before I switch everyone over to using a Tactrix flashing kernel instead of the OEM flashing method. This will make the flashing considerably faster as it won't be rewriting the entire code/data calibration area with each flash.

Let us know if you are having any problems with this.

http://www.tactrix.com/downloads/ecu...ta_1444018.exe

Colby

[jamesm]

yay! back to my happy place (romraider).

[ztan]

Fantastic.
Now looking for RAM addresses for IAM, FBKC, FLKC, Knock Sums, Accel Pos, Target AFR...

[endrswrd]

YAY! So to be clear logging is running but only via standalone on the OP2.0, the work hasnt been ported to the RR logger definitions? I guess it makes sense since hes the dev for ECUflash not RR. Once all the memory locations are found it shouldnt take too much extra effort to get this over to the RR logger.

[Td-d]

I have a good deal of the logger addresses already defined - I'm going to be out of town for a week plus, so I'm not going to have time to code them up, but I can post up the raw addresses for people to use.

[Td-d]

These are for A00C and A01C:

E_AF_Correction_1_2byteExtExt_E82                      FFF89B48 
E_AF_Correction_1_4byteExt_E81                         FFF8A5D8 
E_AF_Learning_1_2byteExtExt_E83                        FFF89B4C 
E_AF_Learning_1_4byteExt_E48                           FFF8A760 
E_AF_Sensor_1_2byteExtExt_E92                          FFF89B38 
E_AF_Sensor_1_4byteExt_E91                             FFF8932C 
E_Closed_Loop_Fueling_Target_2byteExt_E122             FFF89B4A 
E_Closed_Loop_Fueling_Target_4byteExt_E121             FFF8A6BC 
E_Engine_Load_1byteExtExt_E86                          FFF89B5D 
E_Engine_Load_4ByteExt_E32                             FFF89148 
E_Engine_Speed_Delta_E157                              FFF893FC 
E_Feedback_Knock_Correction_1byteExtExt_E94            FFF89B65 
E_Feedback_Knock_Correction_4byteExt_E39               FFF8B0B0 
E_Final_Fueling_Base_2byteExt_E124                     FFF89B44 
E_Final_Fueling_Base_4byteExt_E123                     FFF8A008 
E_Fine_Learning_Knock_Correction_1byteExtExt_E95       FFF89B68 
E_Fine_Learning_Knock_Correction_4byteExt_E41          FFF8B14C 
E_Fine_Learning_Table_OffsetExt_E58                    FFF8B16B 
E_Fuel_Injector_1_Latency_4byteExt_E50                 FFF8A048 
E_Fuel_Injector_1_Pulse_Width_2byteExtExt_E99          FFF89B40 
E_Fuel_Injector_1_Pulse_Width_4byteExt_E60             FFF887C8 
E_Gear_CalculatedExt_E59                               FFF895DA 
E_IAM_1byteExtExt_E96                                  FFF89B67 
E_IAM_4byteExt_E31                                     FFF816F4 
E_Idle_Speed_Map_SelectionExt_E49                      FFF8B734 
E_Ignition_Base_TimingExt_E53                          FFF8AE74 
E_Knock_Correction_Advance_4byteExt_E43                FFF8B0AC 
E_Knock_Correction_Advance_IAM_onlyExt_E40             FFF8B120 
E_Knock_Correction_Advance_Max_PrimaryExt_E118         FFF8B118 
E_Manifold_Relative_Pressure_4byteExt_E113             FFF88F78 
E_Manifold_Relative_Sea_Level_Pressure_2byteExtExt_E89 FFF89B30 
E_Manifold_Relative_Sea_Level_Pressure_4byteExt_E52    FFF88F74 
E_Primary_Open_Loop_Map_Enrichment_2byteExtExt_E85     FFF89B52 
E_Primary_Open_Loop_Map_Enrichment_4byteExt_E84        FFF8A974 
E_Requested_TorqueExt_E56                              FFF8B490 
E_Target_Throttle_Plate_PositionExt_E57                FFF8B578 
E_Throttle_Plate_Opening_Angle_2byteExtExt_E93         FFF89B32 
E_Throttle_Plate_Opening_Angle_4byteExt_E38            FFF89030 
E_Tipin_ThrottleExt_E54                                FFF89038 

Ram_AFR_Sensor_Heater_Protection_Result                                     FFF88480 
Ram_AFR_Sensor_Heating_Limit_Result                                         FFF88478 
Ram_AF_Correction_3_32bit_ECU                                               FFF8A8EC 
Ram_AF_Learning_3                                                           FFF81644 
Ram_AF_Sensor_1_Current                                                     FFF89328 
Ram_AF_Sensor_1_Resistance                                                  FFF89340 
Ram_AF_Sensor_1_Resistance_0                                                FFF8A624 
Ram_Accelerator_Pedal_Angle                                                 FFF8922C 
Ram_Alternator_Duty                                                         FFF884A4 
Ram_Atmospheric_Pressure_1                                                  FFF89B88 
Ram_Base_Pulse_Width                                                        FFF89738 
Ram_Base_Pulse_Width_times_100_0.84                                         FFF89CB4 
Ram_Battery_Voltage                                                         FFF87C6C 
Ram_CFP_Delta                                                               FFF89048 
Ram_CPC_Valve_Duty_Ratio                                                    FFF89CC4 
Ram_CPC_Valve_Duty_Ratio_0                                                  FFF8BD14 
Ram_Calculated_Base_Pulse_Width_                                            FFF8A044 
Ram_CoolantTemperature                                                      FFF890A4 
Ram_Coolant_Temperature???                                                  FFF87C74 
Ram_ECT???                                                                  FFF89FC6 
Ram_Engine_Speed                                                            FFF89564 
Ram_Fuel_Injector_1_Pulse_Width                                             FFF887D8 
Ram_Fuel_Injector_1_Pulse_Width_4byteExt_E60???                             FFF887F0 
Ram_Fuel_Injector_2_Pulse_Width                                             FFF887DC 
Ram_Fuel_Injector_Pulse_Width?                                              FFF88810 
Ram_Fuel_Injector_Pulse_Width???                                            FFF887C4 
Ram_Fuel_Pressure_MPa                                                       FFF8936C 
Ram_Fuel_Pump_Duty                                                          FFF8B1A0 
Ram_Fuel_Pump_Duty_0                                                        FFF8BD24 
Ram_Gear                                                                    FFF895D9 
Ram_High_Low_Load_0_L_1_H                                                   FFF8A0E4 
Ram_Idle_Switch                                                             FFF8B5B2 
Ram_Idling                                                                  FFF89FBE 
Ram_Ignition_Total_Timing                                                   FFF8ADF8 
Ram_Injector_Pulse_Width???                                                 FFF8884C 
Ram_Intake_Air_Temperature                                                  FFF87C64 
Ram_Intake_OCV_Current_Left                                                 FFF891B4 
Ram_Intake_OCV_Current_Right                                                FFF891A8 
Ram_Intake_OCV_Duty_Left                                                    FFF8C1F8 
Ram_Intake_Temp                                                             FFF890B4 
Ram_Map_Delta?                                                              FFF8A220 
Ram_Mass_Airflow                                                            FFF89114 
Ram_Minimum_CFP_Delta_for_Transient_Retard                                  FFF8B004 
Ram_Port_Temp                                                               FFF8A0F4 
Ram_Roughness_Monitor_Cylinder_1                                            FFF8CEC5 
Ram_Roughness_Monitor_Cylinder_2                                            FFF8CEC6 
Ram_Roughness_Monitor_Cylinder_3                                            FFF8CEC7 
Ram_Roughness_Monitor_Cylinder_4                                            FFF8CEC8 
Ram_SI_Drive_Mode_I3_S1_SSharp2_                                            FFF88999 
Ram_TEST_byte_FFF8B064                                                      FFF8B064 
Ram_Transient_Threshold_Testunk_FFF8923C                                    FFF8923C 
Ram_Vehicle_Speed_0                                                         FFF893C4

[ztan]

Again, Td-d, many thanks.
I'll port to A01G

[jamesm]

ok, so how do i copy from brzedit into romraider?