roadie08

Think I got my M32176F4V into bootmode correctly now. Thought it would be uart tx/rx to sio1 as in the renesas manual but I dont get any response. Tried with the sync bytes and commands like ufla32 program. Also tried sio3 and sio0/k-line without any luck.

Ecumem Will try to do it in bootmode later. If its a renesas as Sasha wrote on rr, it should be easy to flash in bootmode.

I have posted the rom image at rr forum.

Just got a 2007 JDM LGT TCU. Doesnt say UJ on this one. Will look at it more as soon as I have time. M32R/ECU M32176F4 31711AK570 on the cover. 2006/02-2007/04 http://i.imgur.com/3gKbo6Q.jpg?2

No, I dont think so..

Dont know if I get it into bootmode correctly. Power on -> pull mod0 high -> pull reset low Then reset should go high as in normal mode but it does not. I can pull it high but not sure if thats correct. Any ideas?

I have looked at the rom in winols demo but dont understand the table layout... Also trying to connect directly to the mcu in bootmode but no luck yet.

25A7C I think its where the SSM response message is put together.

I think the ecuid is at 802A to 802E 0000802A .byte 0x91 0000802B .byte 0xFE 0000802C .byte 0x20 0000802D .byte 0x71 0000802E .byte 0

Havent tried that, but onlinedissasembler will probably have similar output.

m32r

Found some SSM commands BF, A0, A8, B0, B8.... and 81,83,27? 00026580 push lr 00026582 push R10 00026584 push R9 00026586 push R8 00026588 add3 R10, fp, #-0x2EF8 0002658C ldi8 R9, #0 0002658E ldi8 R8, #0 00026590 bl.s sub_266E8 || nop 00026594 ldub R0, @(4, R10) 00026598 ldi16 R1, #0xBF ; '+' 0002659C beq R0, R1, loc_265E0 000265A0 ldi16 R1, #0xA0 ; 'á' 000265A4 beq R0, R1, loc_265E0 000265A8 ldi16 R1, #0xA8 ; '¿' 000265AC beq R0, R1, loc_265E0 000265B0 ldi16 R1, #0xB0 ; '¦' 000265B4 beq R0, R1, loc_265E0 000265B8 ldi16 R1, #0xB8 ; '©' 000265BC beq R0, R1, loc_265E0 000265C0 ldi16 R1, #0x81 ; 'ü' 000265C4 beq R0, R1, loc_265E0 000265C8 ldi16 R1, #0x83 ; 'â' 000265CC beq R0, R1, loc_265E0 000265D0 ldi8 R1, #0x27 ; ''' || nop 000265D4 beq R0, R1, loc_265E0 000265D8 ldi8 R1, #0x10 || nop 000265DC bne R0, R1, loc_26680

Hooked up a spare TCU to see what would happen on the canbus. http://i.imgur.com/EwEI9vC.jpg?1 Didnt expect this, maybe something was wrong. Had to select "listen only" in settings instead of "active" as last time in the car. Will have to try "listen only" in the car to verify. Period=0 ? http://i.imgur.com/AYTlNmV.png

Yeah. I saw that the second byte at 410 was increasing while I accelerated.

Alright. Will log the 42x ids next time and try to find the tcu shift message bit for ignition retard