Subaru Outback Forums banner

41 - 60 of 83 Posts

·
Registered
2005 Outback 2.0XT Limited
Joined
·
77 Posts
Thank you for the write up and your determination, while I am def not at your level, I have prepped all my stuff, actually waiting for my mechanic to get to his shop to try the system out. when I first came across your thread, I read it too fast and didn't realize all the work you had done. I did have my IMMO chip switched from the USDM ECU to the JDM ECU. however I just recently found out that the JDM ECU doesn't pass US state Emissions, so needing the IMMO data cloned between the ECU is crucial for me at this point. I did acquire everything referenced and taken the attached pics. I will hopefully get to tinker with the ECU's today.

ps, the 4 orange on the corners are only to hold the board so it doesn't wiggle.

473474
473475
473476
 

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #42
Thank you for the write up and your determination, while I am def not at your level, I have prepped all my stuff, actually waiting for my mechanic to get to his shop to try the system out. when I first came across your thread, I read it too fast and didn't realize all the work you had done. I did have my IMMO chip switched from the USDM ECU to the JDM ECU. however I just recently found out that the JDM ECU doesn't pass US state Emissions, so needing the IMMO data cloned between the ECU is crucial for me at this point. I did acquire everything referenced and taken the attached pics. I will hopefully get to tinker with the ECU's today.

ps, the 4 orange on the corners are only to hold the board so it doesn't wiggle.
Heya! Glad you're finding it useful.

It looks like you're using the FT232H breakout board, which'll do the job just fine. I've moved on to some code that runs on an Arduino, which is a bit better developed.

Let me know if you run into any issues using the FT232H setup! :)

I'm moving very slowly on my build, but I think I have all the problems solved. Can't wait to get my heap back on the road :)
 

·
Registered
2005 Outback 2.0XT Limited
Joined
·
77 Posts
Heya! Glad you're finding it useful.

It looks like you're using the FT232H breakout board, which'll do the job just fine. I've moved on to some code that runs on an Arduino, which is a bit better developed.

Let me know if you run into any issues using the FT232H setup! :)

I'm moving very slowly on my build, but I think I have all the problems solved. Can't wait to get my heap back on the road :)
awesome, I must have missed the Arduino post (i did see it, but it was a nano and i had already gotten the FT232H), I have an arduino as well, a UNO R3..

is there a specific python version that should be used?

Thank you
Pedro Faria
 

·
Registered
2005 Outback 2.0XT Limited
Joined
·
77 Posts
Alright

got the ECU's last night

running the setup this morning

got this error

Code:
c:\Users\QuattroCS\Downloads\subaru immo>python eeprom-read.py
Traceback (most recent call last):
  File "eeprom-read.py", line 1, in <module>
    import ftdi1, os, sys, time, logging
ModuleNotFoundError: No module named 'ftdi1'
any ideas?

ps, I have added a variety of PY libraries, still no dice

PS2
It appears the libraries and modules have changed mainly the call out for the board py adafruit-blinka ft232h, and the ftdi1, is now pyftdi
I modified the import ftdi1 to import pyftdi it then got stuck on the Line 3 load, and its a documented error that is here and the solution is the new library

FTH232H.py has import ftdi1 as ftdi #87

I have followed all the instructions on this page
CircuitPython Libraries on any Computer with FT232H

I have everything working on my mac and windows, passed all the post-install checks

I believe the module loading and call-out is different now, any assistance would be awesome, I am currently stuck.

made a couple of edits
changed a couple of ref to ftdi1 to pyftdi in the eeprom read file and the ft232h file
and the use_ in line 17 on the eeprom read file

the next error is on the bb93156 that calls out the SPI file, that one is def above my paygrade.

Code:
C:\Users\QuattroCS\Downloads\subaru immo>python eeprom-read.py
2019-11-06 11:30:06,940 [MainThread  ] [DEBUG]  Disabling FTDI driver.
Traceback (most recent call last):
  File "eeprom-read.py", line 18, in <module>
    bb = bb93l56.BB93L56(ft232h)
  File "C:\Users\QuattroCS\Downloads\subaru immo\bb93l56.py", line 7, in [I]init[/I]
    super(BB93L56, self).[I]init[/I](ft232h, 0, 1, 2, 3)
  File "C:\Program Files\Python38\lib\site-packages\Adafruit_GPIO\SPI.py", line 167, in [I]init[/I]
    gpio.setup(sclk, GPIO.OUT)
AttributeError: 'NoneType' object has no attribute 'setup'
2019-11-06 11:30:06,945 [MainThread  ] [DEBUG]  Enabling FTDI driver.[\CODE]

again any help would be appreciated.
 

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #45
Alright

got the ECU's last night

running the setup this morning

got this error

Code:
c:\Users\QuattroCS\Downloads\subaru immo>python eeprom-read.py
Traceback (most recent call last):
  File "eeprom-read.py", line 1, in <module>
    import ftdi1, os, sys, time, logging
ModuleNotFoundError: No module named 'ftdi1'
any ideas?

ps, I have added a variety of PY libraries, still no dice
Looks like you're missing the drivers, and python library that actually communicate with the FT232H.

You'll want to follow these instructions :)


Also, no worries on the Arduino bits. You could use your Uno, but the python stuff with the FT232H is perfectly adequate. The Arduino stuff I built is just suited to reading and writing other EEPROMs that are part of the immobilizer system.
 

·
Registered
2005 Outback 2.0XT Limited
Joined
·
77 Posts
ok, took me a moment but, I got it going

Code:
c:\Users\QuattroCS\Downloads\subaru immo>python eeprom-read.py
2019-11-06 13:02:05,096 [MainThread  ] [DEBUG]  Called ftdi_usb_open and got response 0.
2019-11-06 13:02:05,096 [MainThread  ] [DEBUG]  Called ftdi_usb_reset and got response 0.
2019-11-06 13:02:05,096 [MainThread  ] [DEBUG]  Called ftdi_read_data_set_chunksize and got response 0.
2019-11-06 13:02:05,096 [MainThread  ] [DEBUG]  Called ftdi_write_data_set_chunksize and got response 0.
2019-11-06 13:02:05,096 [MainThread  ] [DEBUG]  Called ftdi_usb_purge_buffers and got response 0.
2019-11-06 13:02:05,096 [MainThread  ] [DEBUG]  Called ftdi_set_bitmode and got response 0.
2019-11-06 13:02:05,096 [MainThread  ] [DEBUG]  Called ftdi_set_bitmode and got response 0.
2019-11-06 13:02:05,151 [MainThread  ] [DEBUG]  Setting clockspeed with divisor value 66
2019-11-06 13:02:05,157 [MainThread  ] [DEBUG]  SPI write with command 11.
2019-11-06 13:02:05,160 [MainThread  ] [DEBUG]  SPI read with command 20.
is this an expected response?

how do I check the values as you have in the initial post?
 

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #47

·
Registered
2005 Outback 2.0XT Limited
Joined
·
77 Posts
Yep, looks right!


I used hexdump for mac, but it looks like there's a windows flavor.

ok great, I did find on online one and I was hoping it would yield a different result, it has not

Code:
c:\Users\QuattroCS\Downloads\subaru immo>python eeprom-read.py
2019-11-06 13:15:04,282 [MainThread  ] [DEBUG]  Called ftdi_usb_open and got response 0.
2019-11-06 13:15:04,282 [MainThread  ] [DEBUG]  Called ftdi_usb_reset and got response 0.
2019-11-06 13:15:04,282 [MainThread  ] [DEBUG]  Called ftdi_read_data_set_chunksize and got response 0.
2019-11-06 13:15:04,282 [MainThread  ] [DEBUG]  Called ftdi_write_data_set_chunksize and got response 0.
2019-11-06 13:15:04,283 [MainThread  ] [DEBUG]  Called ftdi_usb_purge_buffers and got response 0.
2019-11-06 13:15:04,283 [MainThread  ] [DEBUG]  Called ftdi_set_bitmode and got response 0.
2019-11-06 13:15:04,285 [MainThread  ] [DEBUG]  Called ftdi_set_bitmode and got response 0.
2019-11-06 13:15:04,302 [MainThread  ] [DEBUG]  Setting clockspeed with divisor value 66
2019-11-06 13:15:04,302 [MainThread  ] [DEBUG]  SPI write with command 11.
2019-11-06 13:15:04,305 [MainThread  ] [DEBUG]  SPI read with command 20.

c:\Users\QuattroCS\Downloads\subaru immo>hexdump.exe 93x56-dump-1573063822.02.bin
000000  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000010  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000020  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000030  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000040  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000050  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000060  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000070  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000080  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
000090  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0000a0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0000b0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0000c0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0000d0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0000e0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
0000f0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

c:\Users\QuattroCS\Downloads\subaru immo>hexdump.exe -C 93x56-dump-1573063822.02.bin
000000  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
000010  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
000020  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
000030  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
000040  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
000050  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
000060  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
000070  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
000080  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
000090  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
0000a0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
0000b0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
0000c0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
0000d0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
0000e0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
0000f0  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................

c:\Users\QuattroCS\Downloads\subaru immo>
Any idea why this is happening?

checked and doublechecked connections again

now i'm getting all 0's

with it on the chip i get all 0's with it off i'm getting all f's

Thank you
 

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #50
Kind of stuck at this point, not sure if I wiped the chip or it's getting read incorrectly. Any suggestions appreciated.

Thank you
Unlikely that you wiped the chip, and the fact that you're getting all zeros when the clip is not attached, and all ones when it is attached is actually encouraging. That means the breakout is (probably) wired right, and the software is working.

Getting all ones (0xFF) means that there is a steady 5v on the data output pin. The Vcc (5v source for the chip) and the data output pin are at opposite corners of the chip.

If you put the clip on backwards, you'd get this sort of behavior. Make sure that pin 1 of the clip is connected to the pin closest to the little dimple in the corner of the chip.

These are super resilient and fault tolerant, so it's tough to mess it up.

Also, if you stay stuck, I can mail you a chip with some data on it to experiment with before you keep trying with the ECU.

I'd advise that you try to read the JDM one first, just so the stakes are lower.
 

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #51
Oh, also, how are you plugging the breakout board it in to your PC? Directly to a USB port, or using a hub?

If possible, try using a powered USB hub, that's how I tested my solution.
 

·
Registered
2005 Outback 2.0XT Limited
Joined
·
77 Posts
Oh, also, how are you plugging the breakout board it in to your PC? Directly to a USB port, or using a hub?

If possible, try using a powered USB hub, that's how I tested my solution.
I have been working on the JDM chip first.

I have been plugging in directly, I will get a powered USB hub and give it another go, thank you for the follow-up.
 

·
Registered
Outback 2.0XT, Audi TTq, Ducati M750
Joined
·
315 Posts
I got a few bad reads when I did the immo flash swap, I used a fine brush on the chip soldiers and clip contacts and took my time to make sure it was seated well. It can be finicky but I got it to work just fine.

Also, were you a TT owner? VVVortex or the like?
 
  • Like
Reactions: QuattroCS

·
Registered
2005 Outback 2.0XT Limited
Joined
·
77 Posts
I got a few bad reads when I did the immo flash swap, I used a fine brush on the chip soldiers and clip contacts and took my time to make sure it was seated well. It can be finicky but I got it to work just fine.

Also, were you a TT owner? VVVortex or the like?
I'll also pick up a fine contact brush, thank you for the advice

I have been meticulous as much as possible, checking for seating before plugging in USB, and unplugging USB before unclipping. I think I may even "pull the pin" slightly out on the plug to make sure.

I am/was an Audi gear head before this outback, still kind of am. the emblem is from a UrS4. my Audi/vag owned count is at 11 at the moment.

4k fwd, 4kq, 5ktq, 4kq, UrS4, 90tq (project), 5kt fwd (donor), 4kq, A6q, jetta mk4 2.slow, A4 2.0 tq

Not so much in the audi/vw/vag forums anymore. My userid though is consistent.
 

·
Registered
Outback 2.0XT, Audi TTq, Ducati M750
Joined
·
315 Posts
Cool, I feel like I've seen it but I've owned the TT for 12 years (holy ****!) so that's pretty likely. I actually got the OBXT over an A4 Avant, it was terrible trying to find a manual and most were way too expensive, high miles, or both since they're kind of unicorns. I've found both companies to be pretty similar, turbo AWD that is a good mix of style and actual normal use, neither are really that tough to work on, and if you address the few problem areas they are solid. This might include timing tensioners, ringlands, valve seating, suspension bushings, and other stupid stuff, but solid :p
 
  • Like
Reactions: QuattroCS

·
Registered
2014 Impreza MT, Manual to Auto HVAC Swap, Color MFD Swap, Headlight Projectors, idatalink Maestro.
Joined
·
2 Posts
Ryan,

Great work! I am very interested in this thread. I'd like to swap my 2014 Impreza cluster for a XV's... not a fan of the white gauge faces. Its a long story, but as part of aftermarket pushbutton start, I have a immobilizer bypass already installed which would allow me to swap the instrument cluster without issue (other than mileage). However, I'd really like to allow the car to start if the bypass fails for whatever reason.

There's a forum called Digital Kaos that I have been checking out also, it seems like there might be a few people on there who understand pieces of the CM and/or immobilizer system. I'd ask a few questions there but I don't have much to offer in return (other than money i guess).. But you might be able to use them as a resource.

In addition, I thought you might find this interesting:

I have access to a firmware database that gives rev's and information on firmware updates for various CM's (not sure if I actually have the firmware's themselves, I should look and see maybe). Well what I noticed was that for the 5 region's I can see, NONE of them have any updates for the CM. This got me thinking as to whether there were ever recalls associated with the CM that required firmware changes. So I did some Googling:

I noticed that there was a recall for some 2018 models that had an issue with the Combination Meter. "WTW-82" Well, by the looks of it, the dealer's were sent a special tool to flash the CM's to carry out the work for the recall. The CM has to be removed from the car to be flashed, so I would tend to guess that any prior model all the way to current cannot have its flash read or written via CAN-BUS. Would be nice to get our hands on one of those tools! Wish I knew someone that worked at a dealer. Alternatively, by the looks of things, the dealer can also send the CM in to have it flashed.

Sure seems that what this says is it is impossible to gain flash access from the OBD port, but it is possible from the CM connection directly. I'd love to figure out a way to get the flash read, but I am too nervous about damaging the needles.. Actually, I already pulled the needles of an ebay unit, and I seemed to be able to do it without any major damage, but there are some scuffs on the front (hard to see them, but it will bug the **** out of me...) and I am too cheap to risk trying to desolder the Flash from my existing CM.. According to the Subaru documentation I read, it says that used parts can't be setup to work with an SSM and that you have to use new parts (or copy the flash). I have an SSM but it gives an error when I try to learn a new used CM which seems to confirm what the documentation says. Even knowing all of this, its possible that you can only access the flash through the microcontroller, and then I'd suspect it would require to have knowledge of the source code. The Fujitsu microcontroller on my CM mentions that it is possible to prevent reading of its program information when a security feature is enabled, question is whether the manufacturer actually did I guess. Thinking what I might do next is to look for any info that has insider knowledge on Nippon Seiki clusters as that is who manufacture's mine.
 

·
Registered
2005 Outback 2.0XT Limited
Joined
·
77 Posts
Oh, also, how are you plugging the breakout board it in to your PC? Directly to a USB port, or using a hub?

If possible, try using a powered USB hub, that's how I tested my solution.
Hi Ryan

Still no go, getting all f's on the jdm ecu. for the usdm it seems to rotating between 0's and f's almost like cycling.

somewhat lost as to what to do next, any help appreciated.

Thank you
Pedro Faria
 

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #58
Hi Ryan

Still no go, getting all f's on the jdm ecu. for the usdm it seems to rotating between 0's and f's almost like cycling.

somewhat lost as to what to do next, any help appreciated.

Thank you
Pedro Faria
Hey Pedro,

So, I'm looking into this now. It's been A LONG time since I used the FT232H device, since I moved my efforts to using an Arduino and some custom code on the computer.

I've just re-setup my bench config and I'm trying to reproduce success using the tools I have. It looks like the driver(s) I used for the device are now deprecated, so I'm going to try to follow the steps you used to install them.

Are you using Windows, Mac, or Linux?
 

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #59
Ryan,

Great work! I am very interested in this thread. I'd like to swap my 2014 Impreza cluster for a XV's... not a fan of the white gauge faces. Its a long story, but as part of aftermarket pushbutton start, I have a immobilizer bypass already installed which would allow me to swap the instrument cluster without issue (other than mileage). However, I'd really like to allow the car to start if the bypass fails for whatever reason.

There's a forum called Digital Kaos that I have been checking out also, it seems like there might be a few people on there who understand pieces of the CM and/or immobilizer system. I'd ask a few questions there but I don't have much to offer in return (other than money i guess).. But you might be able to use them as a resource.

In addition, I thought you might find this interesting:

<snip>
Dallas. Thanks for the kind words and additional info, I'll look into this.

Quite frankly, my research into this has fallen off a bit due to competing priorities, and due to the fact that I've "solved" my initial challenge.

I have actually been helping a couple others get their ECM immobilizer cloned over the past few weeks, which has motivated me to try to clean up this thread and/or create some documentation to help along the way.
 

·
Registered
2005 Outback 2.0XT Limited
Joined
·
77 Posts
Ryan I certainly appreciate your assistance, testing and input.

With the new clip I bought, I successfully read the usdm immo chip and somewhat read the jdm immo chip. The jdm chip seems to cycle between 0's and f's, but then it reads something. I have replicated the same read.

Sadly the writing as not yet yielded any success.

However because of the good read on the usdm immo chip and because i had already had it transplanted to the jdm ecu, the build is able to progress. I will have the ability to get the car rolling and have some time to figure out the usdm ecu with the jdm immo chip in order to pass state inspection.

I Was starting to question my technical abilities, albeit not great, i did have a few frustrating nights.. ?

Thank you again Ryan for your assistance on this.


474401
.

Link for the clip i used
Pomona SOIC8 Clip

474402


474403
 
41 - 60 of 83 Posts
Top