ECUFlash - Getting close!

[stugray]

So when is someone going to do a write up for a "How to Flash your BRZ with a Tactrix & ECUFlash"?

I recall someone on one of these threads saying they would do it.
I am hesitant to try it after hearing:
Do I save as a *.bin file?
Am I supposed to get a checksum error?
Do I need to pad the first X-bytes?
Why do I get this connection error?
etc, etc.

I am ready to upgrade my ROM to get rid of the DI seals threat, but the exact steps to pull my old ROM & load a new one are not terribly clear.
My car is my DD, so bricking the ECU would definitely ruin my day.

[AdrianG]

Originally Posted by stugray

So when is someone going to do a write up for a "How to Flash your BRZ with a Tactrix & ECUFlash"?

I recall someone on one of these threads saying they would do it.
I am hesitant to try it after hearing:
Do I save as a *.bin file?
Am I supposed to get a checksum error?
Do I need to pad the first X-bytes?
Why do I get this connection error?
etc, etc.

I am ready to upgrade my ROM to get rid of the DI seals threat, but the exact steps to pull my old ROM & load a new one are not terribly clear.
My car is my DD, so bricking the ECU would definitely ruin my day.

I believe you said you have ZA1J700C, so you can read with EcuFlash, let it pad the first 8000 bytes and then store it. You won't be able to put it back with EcuFlash since there's no matching definition, but it won't hurt to hold on to it. Save it as a BIN. You can open it in a hex editor and find that it's all zeroes until the 8000 address where you'll find ZA1J700C in ASCII

If you have an Automatic, I'm pretty sure you'll need to find an AT rom instead of the one below.

Now, to flash.

- Turn the car off, start it, and then turn it back off again.

-Download ZA1JA01C here

- Turn the car to the ON position.

- Open the ROM in EcuFlash
- Write it to your car (this is the same one I used after fixing checksum, date etc)
- Cross your fingers for ~4 minutes
- If it fails, don't shit your pants, just turn the car off and on again and try again (probably won't start, but the bootloader will still be there)

- After flash, start the car and let it idle for a solid 6 minutes without touching the throttle.

- Drive on and be merry

If you break your car, don't blame me. Colby at Tactrix will likely be able to get you sorted out though if you do manage to completely break it.


-Adrian

[stugray]

"You won't be able to put it back with EcuFlash since there's no matching definition"

That is unfortunate since my plan was to put it back if I ever needed to go in for warranty work.
And dont I need a definition to go with the ROM?

Also, if I want to get one of the OFT stage 1 "stock" tunes, where do I get a definition to use with ECUFlash?

[AdrianG]

Originally Posted by stugray

"You won't be able to put it back with EcuFlash since there's no matching definition"

That is unfortunate since my plan was to put it back if I ever needed to go in for warranty work.
And dont I need a definition to go with the ROM?

Also, if I want to get one of the OFT stage 1 "stock" tunes, where do I get a definition to use with ECUFlash?

Td-d's github has the definitions along with an improved 32bitbase.XML for ecuflash.

You're flashing a regular factory ROM, just not the one your car came with. I don't think the dealership would even notice. It's not taking the car out of factory spec so really no grounds for warranty denial. In my opinion.

You can work with Shiv's ROMs with the same definitions, his ROMs are based on the same ZA1JA01C, just F padded instead of 0's and obviously with his own modifications to ~40 tables. The addresses and everything are the same though so you can read his tunes with EcuFlash/RomRaider just fine.

If you want to flash Shiv's ROM and then want to revert back to stock for warranty repair, just flash on the one I posted and that will return you to stock.

- AdrianG

[ztan]

Originally Posted by stugray

"You won't be able to put it back with EcuFlash since there's no matching definition"

That is unfortunate since my plan was to put it back if I ever needed to go in for warranty work.
And dont I need a definition to go with the ROM?

Also, if I want to get one of the OFT stage 1 "stock" tunes, where do I get a definition to use with ECUFlash?

Get the EcuFlash and ROMRaider A00C .xml definition files, go through with a text editor and change all the "...A00C" tags to read "...700C" and you'll be able to edit and flash your stock ROM back on. All the addresses are the same as far as I know.

[AdrianG]

Originally Posted by ztan

Get the EcuFlash and ROMRaider A00C .xml definition files, go through with a text editor and change all the "...A00C" tags to read "...700C" and you'll be able to edit and flash your stock ROM back on. All the addresses are the same as far as I know.

I've tried that (twice actually) with EcuFlash and no luck.

[ztan]

Originally Posted by AdrianG

I've tried that (twice actually) with EcuFlash and no luck.

Thanks Adrian,

I can open your stock ROM with EcuFlash with the following header:

<romid>
<xmlid>ZA1J700C</xmlid>
<internalidaddress>8000</internalidaddress>
<internalidstring>ZA1J700C</internalidstring>
<caseid>22765AC810</caseid>
<ecuid>ZA1J700C</ecuid>
<make>Subaru</make>
<market>USDM</market>
<model>BRZ</model>
<transmission>6MT</transmission>
<year>2012</year>
<flashmethod>subarubrz</flashmethod>
<memmodel>SH72531</memmodel>
<checksummodule>subarudbw</checksummodule>
</romid>

Can't comment on re-flashing it.

However, having had a look at your stock 700C ROM, I was wrong about 700C and A00C addresses being the same - they are very different and you would need a different def file to work on the stock 700C files.

The modded "700C" files on the OFT site all have the same addresses as the A00C ROM as they are based on the latter ROM: that is what led me to think that the 700C and A00C addresses were all the same.

[stugray]

AdrianG -
Thanks for the instructions. I was able to look at both the Stock ZA1JA01C and the OFT Stage 1 ROM.
I love the ROM comparison feature - you can see exactly what Shiv changed wrt the stock ROM.
However I got one checksum error message when opening the Stock ROM, and two checksum errors when opening the OFT ROM.
I got screen shots of both errors, but they are at home.

Is that normal?

And I assume that your instructions above should include the "test write" prior to the full flash?

[AdrianG]

Originally Posted by stugray

AdrianG -
Thanks for the instructions. I was able to look at both the Stock ZA1JA01C and the OFT Stage 1 ROM.
I love the ROM comparison feature - you can see exactly what Shiv changed wrt the stock ROM.
However I got one checksum error message when opening the Stock ROM, and two checksum errors when opening the OFT ROM.
I got screen shots of both errors, but they are at home.

Is that normal?

And I assume that your instructions above should include the "test write" prior to the full flash?

I don't recall being able to do a test write, that function was disabled when I tried flashing.

The checksum is to be expected, I prepared this room by doing the checksum fix and FF'ing the date stamp with a hex editor. The file I linked to for ZA1JA01C is the prepared file for EcuFlash that worked for me.

Shiv added LC and FFS code to his ROMs so they are not identical, but the memory locations for all the tables are the same as ZA1JA01C.

- AdrianG

[jamesm]

Originally Posted by ztan

James and mad-sb:
Can either of you provide a quick how-to on getting port/DI fueling right?
Is it worth re-scaling MAF first, or trying to balance fueling first with the stock MAF scale?

my method was to scale the maf against 100% direct injection on pump gas (so no consideration for injector scaling or fuel density), then scale the ports against that maf scaling. it's worked well for me. it's extremely critical for drivability that the port and direct both be as spot-on as possible. even a little bit of error between the two can introduce a whole bunch of suck.

of course ideally you'd scale the maf against stock injectors then install the bigger injectors and scale them independently. the important thing is just to maintain process separation between the two, and not allow the influence of one to skew the data when setting up the other.

pm me if youd like more detailed information. i will have a screencast on this process once i get some time to make one.

[Td-d]

I could organise a 700C flash definition for the Ecuflash in a couple of minutes - no maps defined, but would allow to flash the original rom back on. Easy.

[stugray]

Originally Posted by vgi

you should use EcuFlash to open rom and fix checksum unless you have latest RR xml definitions and latest RR code from github

I did have the latest xml defs from Github.

Ok, I opened both the ZA1JA01C.bin RM and the Stage 1 ZA1JA01C.bin in ECUflash and it warned me about the checksums.
I clicked yes when it asked me if it wanted to fix them.
Then I saved the ROMs.
I closed ECUFlash and opened each ROM and got no checksum error.

Then when I opened them in RR ECU editor, they both had only one error:
Table: Checksum fix 2
Table editing has been disabled
Definition file or ROM image may be corrupt.

The Checksum No. 1 is invalid error on the OFT ROM is gone now. (was present prior to fixing checksum in ECUFlash)

Is the checksum fix 2 error OK? I have no intention of editing the ROMs, but if I wanted to, how do I fix the No 2 checksum errors so I can open in RR ECU editor without errors?

[stugray]

Originally Posted by vgi

You can check this thread (http://www.romraider.com/forum/viewtopic.php?t=10284) and download the latest beta RomRaider.

Thanks!
I got that to work.
I was able to open the stock rom in RR with no errors.
I was able to open the OFT rom in RR with no errors after first opening it in ECUFlash, fixing checksum, and saving.

Now before I go trying to flash anything, dont I need some beta version of ECUFlash (not the one from the website)?

[stugray]

Originally Posted by vgi

i believe the EcuFlash Version 1.44.4040 is the latest beta which will be production unless some bugs are found.

Where do I get that version. The download site is only up to 1.44.3721