First off - this may help:
A Complete Tuning Guide - NASIOC

Many of us amateur tuners cut our teeth on that document. As far as further recommendations... reach out to Andre at HP Academy (Online Car Modification Training Courses | The More You Know, The Faster You Go (hpacademy.com)) His lessons are pricey but well worth it as I understand. I would also recommend Banish' books as well as the Holy Bible - Heywood's Internal Combustion Engine Fundamentals.

OK... now to address your first question.... it isn't that Romraider nor Tactrix support the ECU in the 2015+ WRX, it's that no one has published definitions for that ECU. Without definitions, there is no "map." Whatever you pulled from the ECU would be a string of binary. The hard truth is that MOST of the Subaru ECU definition work done in the OpenSource space was by one individual and that individual was hired by Cobb about a decade ago. There were some rudimentary definitions published for later-model EJ-powered cars because they were just an extension of the earlier definitions. The FA-powered cars were totally new.

 

Thanks for those links, that's a good start. I tried to read Heywood's book way back in college, it put me to sleep a few times before I gave up. I'll try it again but I'm not too worried about the mechanical part of engines. Millikens' book was a bit easier to suffer through lol.

It looks like ECUFlash has a bunch of model specific xml files (definitions?) preloaded. There's two for the hitachi ecu. Any way to know whether these are complete or partial?

 

You ever get anywhere on tuning the Fa or finding definitions? Thanks

 

Funny you should ask now, the tactrix thingy just delivered yesterday. I have a busy few days ahead of me but I'm going to play with this next week, see if i can make it work.

 

So it looks like Ecuflash can read the ROM on a 2015+ but it doesn't have the necessary definitions. At least the cable works and can read the ROM. It also has an option to write the rom so hopefully definitions or modifying the file in some other program will be enough.

Alientech does work and they do back it up with a pretty good guarantee, it will either work out of the box or your money back. There's also no restrictions unlike Cobb, end users have access to everything. My guess is this difference exists because most of their sales are in europe and asia. Over there, cars have to pass inspection and physical emissions tests after modifying, no stupid OBDII tests or rules about CELs. It's pricey though, looks like ~3500$.

There's something called SubaruEdit (Epifan), anyone have experience with it? There are some positive reviews for it on nasioc and rx8 forums. A few members on nasioc say they have been using for a few years with FA20F. It works with Tactrix and costs about 150$ but it's locked to a single VIN & tactrix port. It seems to be the OG for subaru & hitachi ecus. The oldest forum references I can find are for FB series engines around 2011 and then for FA20D engines around 2013.

epifanSoftware | subaruEdit | Versions & prices

ecuEdit, mazdaEdit, gtr35Edit, subaruEdit, BRZEdit, logViewer - ECU tuning and logging solution by epifanSoftware. ECU Read/Flash for Subaru, Mitsubishi, Mazda, Nissan GT-R R35, Subaru DIT, Subaru BRZ, Toyota FT-86, Scion FR-S. SSM,MUT,OBD-II,CAN,Consalt logger, Enchanced Log Viewer, Road Dyno...

www.epifansoft.com

Looking at ECUs, it's almost as if they are trying to hide anything about the stupid things. Normally I get a 30 page datasheet for a circuit breaker or limit switch but nothing on Hitachi Astemo's site for any of their ECUs. The older "Denso" ECUs apparently had a hitachi SH7058 microcomputer, this was shared with a lot of nissans, fords and mazdas, incl. 350Z, RX-8 and MX-5. In 2002, the semiconductor divisions of hitachi and mitsubishi were consolidated and spun off into a separate company called Renesas which has become big enough on it's own to be part of the Nikkei now.

The new "Hitachi" ECUs in the FB and FA series engines just have the cases and boards made by Hitachi. The main microcomputer is a Renesas 7254R. A lot of places incl. Ecuflash list it as Hitachi 72543 which is close but wrong. There is a Renesas 72543 which is a usb emulator in the same product family. The actual ECU is a Hitachi DEF003 series with a Renesas 7254R RISC microcomputer.

https://www.renesas.com/us/en/document/mah/sh7254r-group-users-manual-hardware?r=1054941

Pinout Hitachi SH75243R DEF003 jtag Subaru

On our website your can find a detailed connection diagram for control unit Hitachi SH75243R DEF003 jtag Subaru

ecu.design

I'm going to continue reading and see what else works. Might buy the SubaruEdit license and see if it works. Or I have a feeling RISC might be the way in. There's tonnes of articles about reverse engineering RISC roms and eproms. Whether I will be understand it, I don't know yet.

 

Just fyi I recently emailed the people at epifan and I was told the $150 version is….
“Hi
Lite version is for remote tuning ony. If you want to change settings by yourself - get the Personal version”
The personal version is closer to 400 last I checked.

 

Lite is 99, personal is 150 and vin-locked. The pro version is 500 and doesn't limit how many cars you can tune.

 

Found some more interesting information. It looks like the SH7254R chip is an ITRON OS with FAT32 filesystem. Also, Renesas offers a development toolkit, C++ compiler and device file updater for this. From past experience, this could mean anything from a couple of animation screens to full blown interpreter and binary editor. I'm going to download this and try to run my rom file through it. Maybe I'll get lucky, or just hit another dead end.

Flash Development Toolkit (Programming GUI)

Renesas Software and Tools. Flash Development Toolkit is flash programming software for SuperH, RX, R8C, M16C, H8SX, H8S, H8, 740 embedded systems.

www.renesas.com

SH7254R - 32-bit Microcontrollers

The SH7254R brings the user the ability to set up high-performance systems with strong functionality at less expense than was achievable.

www.renesas.com

 

I need some advice about how to approach this from someone who's tuned previous gens on opensource.

Tactrix/Ecuflash has added support for the 2015 wrx and BRZ sometime after Nov when I last checked.

ECU part #s on subaru website are confusing but all model years from 2015-21 definitely use a Hitachi ECU.

View attachment 336404

As far as I can tell, Romraider doesn't support this ECU.

A few questions:

• Are Romraider and ECUFlash independent IDEs or is there some mutual dependency?
• Can OS tuning work with just Tactrix/ECUFlash support or do I need to wait until Romraider adds support for it?
• Are ECUs across VA model years similar with just year-specific tuning or does ECUflash need to add support for the 2021 MY?
• Where can I start to learn about ECU tuning and is road tuning with oem sensors possible at all or is a dyno with wideband O2 necessary?

I have a decent enough idea about the mechanics and thermodynamics of engines. Mainly need to learn about the quirks of factory ECUs and real-life operational problems. Last time I tuned an engine, it was in a lab and finding the limits there was relatively easy with in-cylinder pressure sensors.

How did you get yours to read? Ive tried everything, except my cars list doesn't have the "hitachi" list, where did you find that? I'm very interested in taking this on as well.

 

ok update, i am blind. I see those defs now. Gonna go try this out

 

Let me know if you get anywhere. Hit a dead end with Renesas reflash editor. Going to try more stuff this week or just bite the bullet and go with subaruedit.

 

I got subaruedit, I'm going to try it later and let you know how it goes. I'm still working on the binary defs tho. I'm trying to use Ghidra, but do you know what language these files are written in? I seen C++ somewhere but I'm not sure if that's true or not.

 

That's disappointing, I'd hoped it would be easier. Does subaruedit have any kind of aftersales support?

But it's able to read your rom and show you some tables at least? If you have some time, could you post screenshots of what you are seeing? I'm curious which tables it uncovers.

 

Any updates with Ecuflash/Romraider? Did you go for it and get Subaruedit? Im very interested in assisting OS for the 16 wrx. Practically nothing out there for it from what I’ve collected. Openport came in today, will be deep diving into the softwares shortly.

 

I'm sure any support you can provide to the RomRaider community would be massively appreciated.

 

I’d love to contribute, no doubt. Im new to OS tuning but I have been obsessed these last couple weeks with it. Can’t wait.

 

Nothing much yet, i posted everything i found earlier and then got too busy to mess with it. I'll continue posting whatever I find over time. Hopefully we can collectively figure this out and make the fa20f open source tunable.

 

What did you find was off with Subaruedit? I have it right now and I'm curious to know what you're seeing. Subaruedit is very...confusing and incomplete. Yes it does allow for logging and tuning of the FA20F, however it's clear that many parameters either don't work or they are "unknown". We really need to try cracking this ECU. I will be checking this post daily for anyone who is willing to give this a go with me. I'm not super versed on programming, but I know a lot about cars and a decent bit about this ECU. I have successfully reflashed my car using subaruedit and my own custom tune, but during the process I did see some errors in console. ECUFlash and Romraider, once we Crack the defs, will be much easier to use. Can we rip these from other programs?

 

Some forum posts about random bugs and vulnerabilities. One man operation without people or maybe even expertise for a good cybersecurity strategy or vulnerability tracking. Most of these niche programs have safety thru obscurity, not enough people use them for anyone to bother building exploits. But I still prefer not to have them on the same computer I use to access emails or financial stuff.

 

Here are some pics of the map screen from Subaruedit

 

Don't know why it sent repeats. Sorry about that

 

I'm in for figuring out this ecu, i don't know whether we will make any progress every week but in a year or two we should be able to figure it out.

One update: Pulled the ecu harness and there are unused pins on the connector that correspond to analog inputs defined in the microcontroller pinout. That means it's theoretically possible to wire a continental ethanol sensor, the same one Cobb and Link use, and run flex fuel natively without a separate controller.

 

This is very interesting. Did you ever open the case of the ECU and check the chips for their serial numbers? I tried to open mine and its sealed tight with what I assume is RTV. Thanks for the info about subaruedit. As much as it's been useful, I've run into some issues in regards to logging and map accuracy. I'm in the process of installing Linux to run CANUtils and sniff out some of the CAN bus networks.

 

Just be careful.

I have AccessTuner for my STI and Subaru has added a LOT of logic over the last decade. Tons of conditional arguments that affect timing, ipw, etc.

Many of these conditions are missing from the OS definitions.

 

Good point. I had higher hopes for subaruedit but apparently not. The traditional method of ECU tuning was to uncover tables as much as possible, guess the operation and leave logic section alone and it . I'm hoping I can do a sanity check, i.e. reverse compile the whole flash drive of microcontroller and get a list of tables from it so we know how many we have uncovered & how many are still not identified. Renesas publishes their decompiler officially but I haven't been able to make it work for this file. I don't think subaru encrypts this gen of ecu but not sure.

 

I'm in for figuring out this ecu, i don't know whether we will make any progress every week but in a year or two we should be able to figure it out.

One update: Pulled the ecu harness and there are unused pins on the connector that correspond to analog inputs defined in the microcontroller pinout. That means it's theoretically possible to wire a continental ethanol sensor, the same one Cobb and Link use, and run flex fuel natively without a separate controller.

I also have

No, Subaru doesn't sell the seal/gasket for it and with the amount of rain we get, I didn't want to risk a leak.

Didn't know about CANUtils, just looked it up and seems interesting.

I have access to a bunch of sealants and gaskets at work. Talking with some of my coworker, they suggested using RTV to reseal. I also live in a very wet climate so I'm apprehensive about trying to open it, but I think I might do it on my days off. There's going to be a lot of useful information in there. So far I'm having issues with getting Linux running on my computer, hope to have CANUtils up soon. I've got the stock rom for my car and have changed the binary to hexadecimal but need to CAN sniff to figure out what is what.

 

Another update in regards to Subaruedit. I tuned with it, but have discovered that the CL/OL Mode identifier in the logger is missing, therefore there is no way to reliably tell when the ECU switches between the two. This is relatively important for tuning, so it does present some issues.

 

Alternatively, a RISC-V virtual machine like one of these:

GitHub - LekKit/RVVM: The RISC-V Virtual Machine

The RISC-V Virtual Machine . Contribute to LekKit/RVVM development by creating an account on GitHub.

github.com

RISC-V System emulator — QEMU documentation

www.qemu.org

 

I'm really impressed guys. You are talking way over my head here.

Have you already gotten involved in the RomRaider forums? Please do so if you haven't.

 

Ok so ive found a program that might help, unfortunately the free version isn't giving me what I need. It's called IsoBuster, and it might be able to help us convert the BIN files for the ROM to ISO mountable. Go to their website and look at the "buy now" section. It lists all the capabilities of the software. Let me know if this is something that might work for us.

 

Interesting, I got black hole error, where the programs just keep running for hours and eventually crash with no error message. I don't know whether this site lets you send srf files. I'll try to send that.

 

I'm really impressed guys. You are talking way over my head here.

Have you already gotten involved in the RomRaider forums? Please do so if you haven't.

I have an account over there but haven't posted anything yet. Thinking about making a general post thread of this process for anyone who's already trying or anyone wanting to get involved. I've gotta say I'm very happy to have found this thread. Doing it alone is extremely hard

Interesting, I got black hole error, where the programs just keep running for hours and eventually crash with no error message. I don't know whether this site lets you send srf files. I'll try to send that.

AFAIK, the SRF file is the issue. I had the same when working on putting the binary into hexadecimal. When you pull your stock ROM with ECUflash, it gives the option between .srf and .bin, I downloaded both for good measure and found that the .bin was the only one readable. If you have that one, try it or pull a new one from your ECU