Partial maps for the 2017 S10C rom (ZA1JS10C)

[callisto]

I've been wanting to get the native sensor scaling tables (and various other things) from my 2019 BRZ which came with ZA1JS10C for a while now, and so I ended up learning Ghidra thanks to a lot of encouragement from posts on the forum. I haven't looked up everything yet, but I wanted to share what I have so far since essentially there is nothing public for RomRaider and S10C (or 2017+ at all).

I'm not providing a drop-in XML because I don't have one that's safe to open and modify an S10C rom with yet. I'd like to finish that XML file and release it someday, but if I don't, at least now RomRaider tuners can look up the stock O2, MAF, and Intake sensor scalings for a 2019 BRZ.

I'm not really taking requests for other ROMs, since I've just the one car and this is only a hobby for me. But take heart: In a world with infinite free time, I would do complete XML files for all 2017+ manual shift ROMs simply out of curiosity to see what's in them (and to see if there's any useful changes in the V-series ROMs that I can backport), so I'll certainly get there if I can.

I haven't done Timing or Fueling or Trims yet, because I'm not trying to tune my stock S10C rom. I am quite grateful to the tuner I purchased my OTS tune from for their hard work and I don't intend to replace it. I justwanted to extract the MAP scaling table from my 19MY stock ROM and apply it to my 13-based tune ROM. I may have gotten slightly carried away, but I am especially happy with the S10C Throttle tables melded with my tune, and after I post this I'm going to go enjoy a drive in the mountains while it learns.

I haven't done P1234 codes, so when you hack some/all of these into a calid-hacked tune ROM XML file and then try to load a stock ROM with it, you'll get a hundred error dialogs, one t a time. If you tire of RomRaider dialogs about P1234 code mismatches, you can just hold down the escape key and it takes about five seconds to get through them all.

Here's the list of tables I've done so far, each with addresses (and the one case that changed uint8->16):

• AFR Maximum Correction, Minimum
• Calculated Torque A, B
• Cylinder Fill Percentage
• Desired Overrun Mass Airflow A, B, C
• Direct Injection Quantity Maximum, Minimum
• Engine Load Compensation (MP)
• Engine Load Limit (Maximum), Engine Load Limiter A, B
• Engine Load Multiplier
• Front Oxygen Sensor Compensation (Atm. Pressure)
• Front Oxygen Sensor Rich Limit
• Front Oxygen Sensor Scaling A, B
• GDI Firing Angle Cold Idle
• GDI Firing Angle High Load Cold, High Load Hot
• GDI Firing Angle Low Load Cold, Low Load Hot
• GDI Flow Rate
• GDI Pressure Multiplier A, B, C
• GDI Pressure Target A, B
• Ignition Dwell
• Injector Flow Scaling, Injector Flow Scaling BRZ
• Injector Latency
• Injector Minimum Open Time
• Intake Temp Sensor Scaling
• Knock Sensor Calibration
• Low Pulse Width Fuel Injector Compensation
• MAF Compensation (IAT)
• MAF Sensor Scaling
• MAF Voltage Limits (CEL)
• Manifold Pressure Sensor Scaling A
• Minimum Port Injection Quantity
• Per Injector Pulse Width Compensation A, B, C, D, E, F, G, H
• PI Ratio Thresholds
• PI Ratio Threshold (Load), PI Ratio Threshold (RPM)
• Post Cranking Airflow Initial Reference Coolant, Post Cranking Load Initial Reference Coolant
• Requested Torque Base, A, B
• Solenoid Control, Solenoid Duty
• Target Throttle Plate Position Maximum (Requested Torque)
• Total Injection Ratio Port Hot

This would not have been possible without the documentation and posts by authors on both RomRaider and FT86 forums. Going through my page of bookmarks about this, thank you specifically to these users: ztan, steve99, Wayno, rimwall, gooflophaze, reverseslayer, nsfw, dschultz. I may not have used everything you posted, but I couldn't have done it without y'all.

[callisto]

One year later, as I pick up this project again, here's the new CELs added in S10C bin:

<table name="(P1192) FUEL RAIL PRESSURE SENSOR B CIRCUIT LOW INPUT" storageaddress="12512c"/>
<table name="(P1193) FUEL RAIL PRESSURE SENSOR B CIRCUIT HIGH INPUT" storageaddress="125138"/>
<table name="(P1C00) BATTERY MONITOR MODULE A PERFORMANCE" storageaddress="12515c"/>
<table name="(P24B9) ???" storageaddress="12d478"/>
<table name="(P24BA) ???" storageaddress="124d18"/>
<table name="(P24BB) ???" storageaddress="124d0c"/>
<table name="(U0077) LIN COMMUNICATION BUS ECM/PCM OFF" storageaddress="125144"/>
<table name="(U1712) LOST LIN COMMUNICATION WITH BATTERY 1 MONITOR MODULE" storageaddress="125150"/>
<table name="(U171F) LOST LIN COMMUNICATION WITH GENERATOR" storageaddress="125168"/>

[Compelica]

Very interesting - OOT, but would you be able to give a primer on how someone may start working on their own ROM using Ghidra?

[makinen]

Originally Posted by Compelica

Very interesting - OOT, but would you be able to give a primer on how someone may start working on their own ROM using Ghidra?

Open a rom image file with a hex editor and look around known addresses. Then you'll get the inspiration.

[callisto]

Originally Posted by Compelica

Very interesting - OOT, but would you be able to give a primer on how someone may start working on their own ROM using Ghidra?

IF you know Ghidra, then it's an SH-2A (SH72531) CPU with the ROM is at 0x0-0x140000, the RAM is at 0xFFF80000-FFFF, and the hardware registers at 0xFFFF0000-FFFF; docs are generally public but incomplete in some of the areas where Subaru's using functionality and/or addresses that aren't well-documented.

[Compelica]

Originally Posted by callisto

IF you know Ghidra, then it's an SH-2A (SH72531) CPU with the ROM is at 0x0-0x140000, the RAM is at 0xFFF80000-FFFF, and the hardware registers at 0xFFFF0000-FFFF; docs are generally public but incomplete in some of the areas where Subaru's using functionality and/or addresses that aren't well-documented.

Thank you. Am taking some out of my free time to explore the well understood A01G calibration soon.