2011 WRX Sti Bricked

[MiikaS]

When you enter SH boot mode, it clears whole flash for security reasons, so reading before some writing in that mode has no help...

[Gmguy]

Will not write either.

Is that flash erase just the way fastecu works?

I have used the pcmflash denso bootloader on plenty of modules without losing a flash

[MiikaS]

Will not write either.

Is that flash erase just the way fastecu works?

I have used the pcmflash denso bootloader on plenty of modules without losing a flash

No.

SH boot mode is boot mode system on all SH chips. When you enter to it, it clears flash and then you can upload kernel in RAM which lets you then write flash, similar to any flash tool.

Denso CAN bootloader is Densos code in all Denso 32-bit EJ/EZ engine ECUs which is executed in the start when powering ECU. It's like Denso way to have "backport" for flashing ECU, even if ECUs security access has changed/removed, and has nothing to do with SH/Renesas. It works just as the normal flash method.

[Gmguy]

Ah ok, well my parcel with the stuff to make the usb to serial adapter did not arrive today, so hopefully tomorrow it will show and I can get this thing running again

[rimwall]

SH boot mode is boot mode system on all SH chips. When you enter to it, it clears flash and then you can upload kernel in RAM which lets you then write flash, similar to any flash tool.

Ok, sounds familiar. The hardware manual lists a read command, but maybe that’s only allowed after flashing (for security reasons).

[MiikaS]

SH boot mode is boot mode system on all SH chips. When you enter to it, it clears flash and then you can upload kernel in RAM which lets you then write flash, similar to any flash tool.

Ok, sounds familiar. The hardware manual lists a read command, but maybe that’s only allowed after flashing (for security reasons).

It's protection method to prevent reading someones firmware from flash. You can't read flash before it's erased, and entering to boot mode automatically initiates full flash erase.

[Gmguy]

Just confirmed with Cortin on the Romraider forum who posted the file I intend to use to recover this tcm the the vehicle that file came from is the same jdm market as the ecu rom id was listed to and has the same complete trans number on the body tag so as long as it flashes i should be good to go

[rimwall]

Wow, that's lucky!

What is the CAL ID of the TCU ROM? If it was posted on RR forums, I might have partially reverse engineered it a while back.

[MiikaS]

A3DE207100

[Cortin]

From the experiments I conducted:
If the address range up to 1000 is not affected, the Fastecu Can bootloader will write.
Renesans Shbootmode or ktag will write.

[Gmguy]

Tried the Can bootloader with no luck, Ktag doesnt like the checksum of the tcu file

Just putting to usb-ttl setup together now and going to give it a shot

[rimwall]

If the address range up to 1000 is not affected, the Fastecu Can bootloader will write.

Yes, the Denso bootloader resides in ROM from 0x0 to approximately 0x1000 (sometimes a few bytes before or after 0x1000)

Tried the Can bootloader with no luck, Ktag doesnt like the checksum of the tcu file

ROM up to 0x1000 must be damaged. The TCU ROMs sometimes do checksums differently to the ECU ROMs. Can you force Ktag to flash even if checksum isn't ok?

A3DE207100

I checked, I haven't worked on this one. I did partially reverse engineer a different Denso TCU, so there would be similarities.

[Gmguy]

Not having any luck with boot mode, at first it would not connect at all, but then i disconnected vcc feed from my usb and hooked up a direct 5v supply and now it gets a response but wont go any further

If i try generic id mode i get this:
FCF Settings Applied: SH/7058F, (C:\Program Files (x86)\Renesas\FDT4.09\kernels\ProtC\7058\Renesas\1_0_00\)
FDT API initialised: version 4, 09, 02, 000
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device: 0x00
Attempting 4800
Received immediate response from device: 0x04
Attempting 2400
Received immediate response from device: 0x00
Attempting 1200
Received immediate response from device: 0xC1
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device: 0x00
Attempting 4800
Received immediate response from device: 0xF7
Attempting 2400
Received immediate response from device: 0xF0
Attempting 1200
Received immediate response from device: 0x01
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device: 0x00
Attempting 4800
Received immediate response from device: 0xEC
Attempting 2400
Received immediate response from device: 0xFE
Attempting 1200
Received immediate response from device: 0x20

If i select the chip and file i get
Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2
Connecting to device 'SH/7058F' on 'COM6'
Configuration:
'BOOT Mode' connection - using emulated interface
Opening port 'COM6' ...
Loading Comms DLL
Loaded Comms DLL
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device: 0xE0
Attempting 4800
Received immediate response from device: 0xE0
Attempting 2400
Received immediate response from device: 0xCF
Attempting 1200
Received immediate response from device: 0xFF
Error No 16183: 0xFF received - Boot Error or Device failed to erase
Error No 15024: Boot failed

I did notice when i power on the ecu my mhz starts getting erratic, not sure why that is

[MiikaS]

Can you try by adding gnd wire to capacitor gnd like picture in nasioc thread?
https://i1189.photobucket.com/albums/z4 ... G_3237.jpg

All of my few ECUs that I had to flash in sh boot mode using my own electronics needed gnd connection to it. Layout is quite different to ECU but wont cost much to add gnd to those two capacitors gnd side close to SCI pins in backside of board.

[Gmguy]

I just added the ground and that fixed the mhz going all over the show when i powered the ecu on, but still get the same errors