Subaru Outback Forums banner

61 - 80 of 83 Posts

·
Registered
2005 Outback VDC limited 3.0r
Joined
·
852 Posts
One thing I just thought of, not sure if it matters. But maybe it needs to be in "test mode" to fully read and write/clone? Honestly dont remember if that was already mentioned/discussed.
 

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #62
One thing I just thought of, not sure if it matters. But maybe it needs to be in "test mode" to fully read and write/clone? Honestly dont remember if that was already mentioned/discussed.
No, the process used here completely works around any standard functionality of the ECU. It need not be powered, and in fact that would likely cause issues.

This just powers the IC directly from the programmer, and read/writes accordingly.
 
  • Like
Reactions: SwitchPNW

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #63
I'm about to upgrade my bench setup so that I can keep doing some R&D with a bit more ease.

This is also going to be the basis of my logging solution, which has lost a bit of steam.
474552
474553
 

·
Registered
Joined
·
6 Posts
was wondering if u guys have tried programming a set of keys on a bench and logging the data during programing I found a way to use a tatrix cable and the immo app Subaru uses there's a program code u input then an ECU security id code that's mated to each ecu i was wondering if there a way to change the ECU security id number so u can program any ecu using the same ecu id injected my question is will this be stored in biu or ECM i got a hacked version of the tool if u guys want to mess with it
 

·
Registered
Joined
·
6 Posts
i use the subaru learning code to program my 11 wrx keys to new sti cluster useing subaru learning code 3781 then next prompt will be enter security id do not try to many attempts it locks out so try to back up ur stock eeprom and ur biu eeprom to be safe
 

·
Registered
Joined
·
3 Posts
l88m22vette or Ryan, I know this is an old thread and not sure if you're still active or not, but I'm in a pickle.

Do either of you have enough information about the structure of the ROMs in the 3 units to be able to rebuild a wiped EEPROM on the ECM? I've got dumps from the BIU and instrument cluster but my ECM is just nonsense.
 

·
Registered
Outback 2.0XT, Audi TTq, Ducati M750
Joined
·
315 Posts
I'm sorry I don't, been waiting for an update as well 😀
 

·
Registered
Joined
·
6 Posts
well found somthing intresting converting a wrx to sti think u need to input an sti vin in to wrx ecu in order to reprogram vdc in abs pump to 6 speed to get added traction control options sti offers need to find a oem sti and plug in a wrx abs pump and see if smm will let me program over it to a sti pump
 

·
Registered
Joined
·
6 Posts
think just need to swap vin hex section i think it uses it for a config setting or fillnit with ff for that section then use smm to program a vin
 

·
Registered
2005 OBXT Limited, VF37, STI intake, 5MT
Joined
·
1,545 Posts
Just throwing my success story out there as well. Finally got around to cloning the USDM ECU to the JDM ECU. Looking at the hexdump (side-by-side), the USDM also seems to have some more data in several of the later lines compared to the JDM dump. Interesting...

Anyway, my setup:

Adafruit FT232H breakout board
SOIC8 clip (with integrated wires)
"Dupont" wires (single wire connectors)
Ryan's code for the read/write
USDM 2006 LGT ECU (22611AK468 "J2")
JDM 2005 LGT ECU (22611AK230 "G1")

Some notes:

If using the Adafruit GPIO library, just install the 32-bit version of Python 2.7. I struggled for hours trying to get the 64-bit Py2.7 to play nice with the 32-bit library, trying to use the 64-bit "FTDI.py" files, emulating into a 32-bit enviro without having to do side-by-side installs, etc. Ended up just installing a fresh Python 2.7 32-bit, re-importing the libraries, and it worked. Don't forget to allow Windows to "path" the python install, otherwise it's a few extra steps. And if you have another version "path'd", make sure to differentiate between the two.

Don't use the actual FTDI-supplied drivers, you'll just end-up reinstalling with the libusbK drivers anyway to play nice with the Adafruit GPIO library.

Had to "wiggle" the clamp on my USDM chip to clean the contacts enough to read. The first two reads were blank (ff ff ff ...). JDM ECU was MUCH cleaner inside for some reason...

Cheers to @Ryan J. Geyer for the leg work, it works!
 

·
Registered
Outback 2.0XT, Audi TTq, Ducati M750
Joined
·
315 Posts
So when you did yours, you just copied the info from the old ECM to the new one? Never messed around with the BIU or cluster?
Check the first page, post 6, that's everything I did. I just flashed the original immo code to my JDM ECU, I didn't touch anything else, and the advantage is that now I can swap between ECUs. I'm still curious about adapting an STi 08+ ECU since it has USDM emissions and can run dual AVCS, but then you run into much more complex wiring and my setup works fine. When you see threads or topics where people talk about swapping the ECU, BIU, cluster, keys, and all that crap is because they're working around not being able to update the immo code, this is the "fix" to that work-around.
 

·
Registered
Joined
·
6 Posts
one thing id like to figure out is security is set to ecu threw hex oe is it calculated threw vin if it calculated threw vin then u may be able to change vin in ecu and use a security id number from that vin if not isolateing where the security id numbers stored will open doirs to flash lots of jdm ecus to mate with usdm cars easy threw a tatrix cable and smm tool
 

·
Registered
Joined
·
2 Posts
Dealing with a bricked ECU in my 05, ordered an 06 ECU to replace and want to save on the cost of a towtruck + dealer visit. Seems all I need to do is read the immobilizer EEPROM from my old ecu, and override the 06 eeprom. Based on the reading here - since I am not tinkering with any other component such as the gauge cluster. It should be just as easy and moving the .bin data and zeroing out the destination prior to writing.

I currently have a CH341a i've used to flash 25SPI BIOS chips before. It supports 24 I2C eeprom - but based on this thread, seems you need to unsolder the chip to be able to read/write from the chip.

Might take a stab at using the CH341a to try and read the eeprom using ubuntu/flashrom. Otherwise will wait for Adafruit FTDI ft232h to come into the mail.

At the same time, one might wonder why not just desolder and swap chips if there is no edit to the data performed in this application.
 

·
Registered
2005 OBXT Limited, VF37, STI intake, 5MT
Joined
·
1,545 Posts
Dealing with a bricked ECU in my 05, ordered an 06 ECU to replace and want to save on the cost of a towtruck + dealer visit. Seems all I need to do is read the immobilizer EEPROM from my old ecu, and override the 06 eeprom. Based on the reading here - since I am not tinkering with any other component such as the gauge cluster. It should be just as easy and moving the .bin data and zeroing out the destination prior to writing.

I currently have a CH341a i've used to flash 25SPI BIOS chips before. It supports 24 I2C eeprom - but based on this thread, seems you need to unsolder the chip to be able to read/write from the chip.

Might take a stab at using the CH341a to try and read the eeprom using ubuntu/flashrom. Otherwise will wait for Adafruit FTDI ft232h to come into the mail.

At the same time, one might wonder why not just desolder and swap chips if there is no edit to the data performed in this application.
You can desolder, that's not an issue. I think it's safer to read/write (plus, have a physical "backup" if something goes wrong). And you don't have to blank the existing EEPROM, the overwrite writes it completely.
 

·
Premium Member
2005 Mazda 6 && 2007 Outback 3.0 LLBean, WGO
Joined
·
388 Posts
I'm hoping to use this process to get a replacement ECU working for our 2007 H6, where the OE ECU has been misfiring on cyl #1 (seems like no pulse sent to the "coil", per shop's diagnosis).
I've seen almost all 2005-2006 here, with one other thread on a 2009 I think. Anyone know if I should expect complications from the 2007 or the H6? It almost sounds too straightforward, now that our more ambitious members have done the research! Many thanks, @Ryan J. Geyer !
 

·
Premium Member
2005 Mazda 6 && 2007 Outback 3.0 LLBean, WGO
Joined
·
388 Posts
Alright, digging in now, windows 7, trying to do this with either an Arduino Uno or Nano.
The library "ftdi1" isn't available through the python package manager, as previously noted by QuattroCS and Infosecdad (at legacygt.com forums); Adafruit suggests pyftdi as a replacement, but it seems as if that isn't compatible with Python 2.

So, I'm going to try using Python3 32-bit first, and if that's no use will follow the rabbit hole from the LGT.com thread about building the ftdi1 library locally.
 

·
Registered
2005 Outback XT 2.5T
Joined
·
193 Posts
Discussion Starter #78
One thing I just thought of, not sure if it matters. But maybe it needs to be in "test mode" to fully read and write/clone? Honestly dont remember if that was already mentioned/discussed.
Sadly, no. I have worked out a lot of details, most of which I've shared here, but I still can't work out the relationship of values between the various systems. It seems that's where the magic is.

I've been super buried in various real life things, but would like to get back to this, as it is very interesting, and I think I can ultimately crack it.

Stay tuned here. But... It could be a while ;)
 

·
Registered
Joined
·
3 Posts
Sadly, no. I have worked out a lot of details, most of which I've shared here, but I still can't work out the relationship of values between the various systems. It seems that's where the magic is.

I've been super buried in various real life things, but would like to get back to this, as it is very interesting, and I think I can ultimately crack it.

Stay tuned here. But... It could be a while ;)
Hey Ryan I dont suppose you would be willing to send me the contents of your ripped data from your own vehicle to try to get mine working? I promise not to come down and use it to steal your car 😅

EDIT:
Looks like the eeprom got fried anyway, I could read it before but now nothing.

Likely need a new ECM, do you know if I get a new ECM and write my VIN over the old VIN in the 3 places, if that will be enough to get it to play with the immobilizer?
 

·
Registered
Joined
·
2 Posts
The BIU pin code is stored on the 24A01 eeprom. Location is address 16-17 and 26-27. This is true up until 2006. I have a BIU from 2008 which seems to have a different format.
 
61 - 80 of 83 Posts
Top