roadie08

Think I got my M32176F4V into bootmode correctly now. Thought it would be uart tx/rx to sio1 as in the renesas manual but I dont get any response. Tried with the sync bytes and commands like ufla32 program. Also tried sio3 and sio0/k-line without any luck.

Ecumem Will try to do it in bootmode later. If its a renesas as Sasha wrote on rr, it should be easy to flash in bootmode.

I have posted the rom image at rr forum.

Just got a 2007 JDM LGT TCU. Doesnt say UJ on this one. Will look at it more as soon as I have time. M32R/ECU M32176F4 31711AK570 on the cover. 2006/02-2007/04 http://i.imgur.com/3gKbo6Q.jpg?2

No, I dont think so..

Dont know if I get it into bootmode correctly. Power on -> pull mod0 high -> pull reset low Then reset should go high as in normal mode but it does not. I can pull it high but not sure if thats correct. Any ideas?

I have looked at the rom in winols demo but dont understand the table layout... Also trying to connect directly to the mcu in bootmode but no luck yet.

25A7C I think its where the SSM response message is put together.

I think the ecuid is at 802A to 802E 0000802A .byte 0x91 0000802B .byte 0xFE 0000802C .byte 0x20 0000802D .byte 0x71 0000802E .byte 0

Havent tried that, but onlinedissasembler will probably have similar output.

m32r

Found some SSM commands BF, A0, A8, B0, B8.... and 81,83,27? 00026580 push lr 00026582 push R10 00026584 push R9 00026586 push R8 00026588 add3 R10, fp, #-0x2EF8 0002658C ldi8 R9, #0 0002658E ldi8 R8, #0 00026590 bl.s sub_266E8 || nop 00026594 ldub R0, @(4, R10) 00026598 ldi16 R1, #0xBF ; '+' 0002659C beq R0, R1, loc_265E0 000265A0 ldi16 R1, #0xA0 ; 'á' 000265A4 beq R0, R1, loc_265E0 000265A8 ldi16 R1, #0xA8 ; '¿' 000265AC beq R0, R1, loc_265E0 000265B0 ldi16 R1, #0xB0 ; '¦' 000265B4 beq R0, R1, loc_265E0 000265B8 ldi16 R1, #0xB8 ; '©' 000265BC beq R0, R1, loc_265E0 000265C0 ldi16 R1, #0x81 ; 'ü' 000265C4 beq R0, R1, loc_265E0 000265C8 ldi16 R1, #0x83 ; 'â' 000265CC beq R0, R1, loc_265E0 000265D0 ldi8 R1, #0x27 ; ''' || nop 000265D4 beq R0, R1, loc_265E0 000265D8 ldi8 R1, #0x10 || nop 000265DC bne R0, R1, loc_26680

Hooked up a spare TCU to see what would happen on the canbus. http://i.imgur.com/EwEI9vC.jpg?1 Didnt expect this, maybe something was wrong. Had to select "listen only" in settings instead of "active" as last time in the car. Will have to try "listen only" in the car to verify. Period=0 ? http://i.imgur.com/AYTlNmV.png

Yeah. I saw that the second byte at 410 was increasing while I accelerated.

Alright. Will log the 42x ids next time and try to find the tcu shift message bit for ignition retard

Did some more canbus logging today. Shifter P,D,R,N doesent make any messages. D Shiftup 51482 Shiftdown 51484 Sportmode 51481 Shiftup 51483 Shiftdown 51485 Brakepedal 514808 Ecomode 514802 Anyone know tcus canid? http://i.imgur.com/6CxQD5D.png

Yes it is just hanging there. Look for twisted red and blue wires. Ok. Iam interested to take a look at your rom when you get it

Canbus logger was not connected. In my 2005 RHD JDM can connectors is next to the BIU. White connector with red and blue wires. Red=CANH Blue=CANL http://i.imgur.com/hJJvsCS.jpg?1 In newer cars its probably in the obd port. I will try, just need to find something that I understand in the rom Great. Did you try to pull your rom with ecumem?

No, havent had any time for canbus logging lately. I will probably log all shiftmessages this weekend. Only thing I have done is changing the "Calculated torque" table. I feel difference at part throttle but hard to say if it is a difference at WOT. Anyone getting anywhere with the dissassembly?

I dont have SI/S/S# but I have the beep when downshift too fast. Yes BIU sends the message directly. If you press the button it will generate shiftmessages as long as it is pressed. When I shifted from my computer it was exactly as slow as from BIU. Need to find the canmessage input in tcu rom.

Yes my lights where off! I will log some downshift later. I think downshift starts with 51484 drive 51485 sport

Yes its only upshifts when the button or paddle is pressed and they look diffrent from the ordinary BIU messages described on subdiesel. I havent checked any other messages from the BIU yet. I think the lenght is correct. 514 (sender BIU) 8 (the message is 8 bytes) 2000730048931500 (8 byte message)

Did some more canbus logging today. D mode upshift starts with 51482 Sport mode upshift starts with 51483 Engine on D mode t51482000730048931500 t51482000730048931700 t51482000730008921900 t51482000730008921B00 t51482000730048911D00 t51482000730048911F00 t51482000730088911100 Driving slow in D mode t514820007300C8A41D00 t514820007300C8A41F00 t51482000730088A31100 t51482000730088A31300 t51482000730008A31500 t51482000730008A31700 t51482000720088A81B00 t514820007200C8A31D00 WOT in Sport mode t514830006F0008EB1300 t514830006F0008EC1500 t514830006F0008EC1700 t514830006F0048EA1900 t514830006F0048EA1B00 t514830006F0088EA1D00 t514830006F0088EA1F00 t514830006F0048D21B00 t514830006F0008D41D00 t514830006F0088CD1100 I copied one message and changed some of the last digits. It shifts at the same speed, but it was a copied message and I dont know what the last bytes is. Looks like some kind of timestamp but dont know if it is something more than that. I could only use one message for one shift then I had to change some digit. So back to the disassembly of the TCU. Anynone had any luck?

Ignition on and the canmessages will start. Maybe it will work with socketcan? In my 2005 the canbus wires are not connected to the obd2 port.

I will