Here's a Romraider defs XML for ZA1JS10C (2019)

[callisto]

The 2019 BRZ (manual shift) comes with ZA1JS10C, but the latest RomRaider definition available has been for K00G, so after a couple years of Ghidra work I've ported the defs forward to S10C. Now that I've finished porting the XML for my car, I'll keep working on V00C00G so I can release that someday. I'd like to do K10C and N20C (and automatics) as well, but this is a free-time activity only for me, so that's years of work ahead of me.


"Old intake" is K00G and prior; "New intake" is any car with a red intake. I have not tested whether 2019 S10C can run on older red intakes. I know that 2020 V00C00G can't run on 2019 (U0155), but I haven't figured out what changed in instrument cluster communication yet.

As far as I know, all off-the-shelf tuner ROMs that can be opened in Romraider are implementing by Calid-hacking K00G. This is an S10C OEM XML and will only work with original S10C and modified ROMs derived from S10C (which is none, as of today, to the best of my knowledge).

The CL/OL code is completely different. Lots of tuning tables don't exist anymore, and lots of numeric values have changed that don't have XML definitions. I do not recommend copying anything from these CL/OL tables into old-intake ROMs. They are completely incompatible. Aside from CL/OL, there are a few other random tables that are no longer present in their old form. For example, the AFR heating code has been rewritten, which means some of the tables aren't in the same place. I've commented those out with notes in the XML.

I've explored the idle code, the direct / port injection code, and various other areas of the ROM, and so there are new tables in this file that aren't present in K00G. I'll eventually release a K00G defs update that includes the new tables, so that it's easier to compare and see what's changed, but it's still possible to see lots of changes immediately with a straight compare. (And maybe someday I'll re-release K00G with expanded timing/vvt/etc. table axes to support backporting new intake tables.)

The OEM stock ROM is able to learn positive timing advances at IAM 1.0; that is to say, the learned LTFT for any given LTFT_Offset can absolutely be positive, even at IAM 1.0, if your gas is good enough. I fed my car 100 octane gas for six months on stock ROM to confirm this. (I'm still analyzing the fuel trim system, so more on that in a future logging update.)

There are a lot of new CEL codes, and I also documented some that existed previously. Not all of these codes are called by the ROM. (Also, the P957x codes were incorrectly converted from hex 957x; they've been corrected to DTC codes C157x.)

Disclaimers: I offer no warranty, your mileage may vary, good luck storming the castle, any damage incurred is your responsibility and not mine. I don't tune cars for others, I'm not tuning cars for performance, and I don't have tuning experience with Subaru ECUs prior to my BRZs. I will not help anyone circumvent emissions. I encourage using the services of a professional tuner if you are uncertain how to tune your vehicle.

Tactrix logging config for S10C: https://www.ft86club.com/forums/showthread.php?t=152015

I am eternally grateful to all the tuners who worked on gen1, and I'm sad I missed the party. Your conversations and research made this possible. Cheers.


EDIT: (2023-04-07) v2 fixes some tables that were incorrectly swapped versus K-series, including the entire Intake Duty / Exhaust Duty series, and updates the Base Timing and Open Loop Fueling table names to match their meanings.

EDIT: (2023-05-03) For verification, I’m u/callistobrz.

EDIT: (2024-08-10) v3 fixes the missing final column of Front Oxygen Sensor Scaling A/B, brings back Fuel Injection Ratio ECT Threshold A/B, adds labels for dtd codes P153[012], and fixes name mismatches in trouble codes that. This file now loads into RomRaider 0.7.0-1.0.0 without errors.

EDIT: (2025-07-08) v4 fixes one Intake and two Exhaust tables that were still incorrect, after being misled by new (post-K00G) tables in the Intake code.

[EAGLE5]

While I don't need this, you are a golden god.

[Clipdat]

Originally Posted by callisto

The OEM stock ROM is able to learn positive timing advances at IAM 1.0; that is to say, the learned LTFT for any given LTFT_Offset can absolutely be positive, even at IAM 1.0, if your gas is good enough. I fed my car 100 octane gas for six months on stock ROM to confirm this. (I'm still analyzing the fuel trim system, so more on that in a future logging update.)

Interesting and thanks!

[Compelica]

Originally Posted by callisto

The OEM stock ROM is able to learn positive timing advances at IAM 1.0; that is to say, the learned LTFT for any given LTFT_Offset can absolutely be positive, even at IAM 1.0, if your gas is good enough. I fed my car 100 octane gas for six months on stock ROM to confirm this. (I'm still analyzing the fuel trim system, so more on that in a future logging update.)

Great work so far.

I don't understand what you meant though, you mean that it can increase ignition timing beyond what's set in the KCA table? And what is LTFT Offset?

[callisto]

Originally Posted by Compelica

Great work so far.

I don't understand what you meant though, you mean that it can increase ignition timing beyond what's set in the KCA table? And what is LTFT Offset?

I checked my notes and I confused LTFT and FLKC in my writeup, apologies. The FLKC offset indicates which of the 35 knock correction zones is active. I’ll go back and make sure I didn’t check the wrong things in my logs.

It’s not that you can exceed KCA; it’s that you can have positive knock correction (advance) while at IAM 1.0. Which makes sense! But back when the car was being tuned in 13-16, there weren’t any convenient sources of months of 100 octane learning data to realize this.

[callisto]

Updated to v2 above; I have to rename like fifty things in Ghidra to fix the intake/exhaust name swap I let sneak in by accident. Oops.

[callisto]

Updated to v4; specifically, Intake/Exhaust fixed and verified against K00G.

[Compelica]

Originally Posted by callisto

There are a lot of new CEL codes, and I also documented some that existed previously. Not all of these codes are called by the ROM. (Also, the P957x codes were incorrectly converted from hex 957x; they've been corrected to DTC codes C157x.)

Dusting off the old project... any hints on where to find the DTCs? Some DTCs are not defined in the open source definitions hence would like to peer around.

[callisto]

Originally Posted by Compelica

Dusting off the old project... any hints on where to find the DTCs? Some DTCs are not defined in the open source definitions hence would like to peer around.

The CEL array is in the later area of the ECU, well past most of the program code and amidst various tables and such. For whatever reason all the ECUs open with P0300 (which is multi-use), so searching for:

01 0a 00 00 00 03 00 00 00 00 00 00

should locate the tip of that array and the first complete entry; the number of entries in that array is hard-coded all over the ECU and may vary version-to-version, but typically the first-ish function that refers to that array will say it right up top:

  if (ENGINE_cel) {
    bVar2 = true;
    for (iVar5 = 0; iVar5 < 0xe2; iVar5 += 1) {
      if (CEL_array[iVar5].enabled == true) {
        bVar1 = CEL_array[iVar5].kind;

That reference to CEL_array should be revealed by the Ghidra analyzer, but if not, using Search > Instruction Pattern : hex [O] should find it with this hex string inserted:

4b f0 d1 26 60 10 88 01 8b 47 ec 01 ee 00 ed e2 6d dc a0 3a eb 0c 60 b3 66 e3 46 80 d4 28 60 63 00 4c 88 01 8b 30 74 08 60 63 02 4c