2011 Impreza STi rom ported to GenV (Merpmod support, LC,FFS,SD etc).

[moral hazard]

Before we start, just a warning that you need to have a way to recover your ecu from a bricked state.

Don't attempt flashing the rom if you aren't capable of performing recovery.

I am not responsible for any bricked ECU's...

 

Ok, so I have managed to successfully modify the 2011STi rom (AE5IB00V) to enable flashing via ECUflash to the GenV lgt.

 

The purpose of this was to give the LGT better support (enable more features and access to better defs).

 

 

Attached is the modified file with merpmod patch applied (see romraider forum for guide) and checksum corrected. Note, I added the .pdf extension to allow uploading to this thread, when you download the rom just change the extension to .bin or .rom.

 

Mermod guide is here :

http://www.romraider.com/forum/viewtopic.php?f=37&t=10276

 

I have flashed this to my 5eat GenV and can confirm ecu not bricked. I'm aiming to upload a video explanation of the change I made in about a week.

 

As this rom was from a manual STi so its going to be more useful for guys with the manual LGT (launch control, ffs etc).

 

Here is my successful flash output:

[16:29:33.206] kernel get version

[16:29:33.213] kernel version is : OpenECU Subaru SH7058 OCP CAN Kernel V1.07

[16:29:33.213] reading kernel comm buffer size

[16:29:33.216] comm buffer size set to 2048

[16:29:33.216] reading kernel flash buffer size

[16:29:33.219] flash buffer size set to 4096

[16:29:33.219] -- flashing image to ECU memory --

[16:29:33.620] -- comparing ECU flash memory pages to image file --

[16:29:33.620] seg start len ecu CRC32 img CRC32 same?

[16:29:33.630] FB01 00000000 00001000 A40574DD A40574DD YES

[16:29:33.638] FB02 00001000 00001000 750D1713 750D1713 YES

[16:29:33.646] FB03 00002000 00001000 52FFB915 88779232 NO

[16:29:33.656] FB04 00003000 00001000 2AC0AE0C 2B7AAD4F NO

[16:29:33.666] FB05 00004000 00001000 ED677369 A9275D2E NO

[16:29:33.676] FB06 00005000 00001000 0A9C85C3 DF1A0E94 NO

[16:29:33.684] FB07 00006000 00001000 EFEE0CA7 12ABDE22 NO

[16:29:33.692] FB08 00007000 00001000 61FE0854 568DD3F7 NO

[16:29:33.817] FB09 00008000 00018000 3F5701A6 0A34FEF7 NO

[16:29:33.985] FB10 00020000 00020000 43522D4F 3F8A925C NO

[16:29:34.152] FB11 00040000 00020000 D638424A 225694AC NO

[16:29:34.319] FB12 00060000 00020000 08B4669C 3CA89CEA NO

[16:29:34.486] FB13 00080000 00020000 8FA0F51A 74452EB3 NO

[16:29:34.652] FB14 000A0000 00020000 62212029 28C38616 NO

[16:29:34.820] FB15 000C0000 00020000 A5B6F5E0 8A74D0B7 NO

[16:29:34.991] FB16 000E0000 00020000 7142A241 BD6913C4 NO

[16:29:34.991] kernel read area: addr: 00000000 len: 0080

[16:29:35.000] kernel read area: addr: 00000000 len: 0100

[16:29:35.014] kernel read area: addr: 00000000 len: 0200

[16:29:35.040] kernel read area: addr: 00000000 len: 0400

[16:29:35.087] kernel read area: addr: 00000000 len: 0800

[16:29:35.178] kernel write flash buffer addr: 00000000 len: 00000080

[16:29:35.187] kernel write flash buffer addr: 00000000 len: 00000100

[16:29:35.201] kernel write flash buffer addr: 00000000 len: 00000200

[16:29:35.227] kernel write flash buffer addr: 00000000 len: 00000400

[16:29:35.276] kernel write flash buffer addr: 00000000 len: 00000800

[16:29:35.372] kernel flash enable

.

.

.

[16:30:31.361] kernel commit flash addr: 00006000 len: 00001000 crc32 12abde22

[16:30:31.400] written in 1 pulse(s)

[16:30:31.400] kernel blank flash page: addr: 00005000

[16:30:31.451] erased in 1 pulse(s)

[16:30:31.451] kernel write flash buffer addr: 00005000 len: 00000800

[16:30:31.546] kernel write flash buffer addr: 00005800 len: 00000800

[16:30:31.642] kernel commit flash addr: 00005000 len: 00001000 crc32 df1a0e94

[16:30:31.682] written in 1 pulse(s)

[16:30:31.682] kernel blank flash page: addr: 00004000

[16:30:31.733] erased in 1 pulse(s)

[16:30:31.733] kernel write flash buffer addr: 00004000 len: 00000800

[16:30:31.828] kernel write flash buffer addr: 00004800 len: 00000800

[16:30:31.923] kernel commit flash addr: 00004000 len: 00001000 crc32 a9275d2e

[16:30:31.964] written in 1 pulse(s)

[16:30:31.965] kernel blank flash page: addr: 00003000

[16:30:32.010] erased in 1 pulse(s)

[16:30:32.011] kernel write flash buffer addr: 00003000 len: 00000800

[16:30:32.105] kernel write flash buffer addr: 00003800 len: 00000800

[16:30:32.202] kernel commit flash addr: 00003000 len: 00001000 crc32 2b7aad4f

[16:30:32.243] written in 1 pulse(s)

[16:30:32.243] kernel blank flash page: addr: 00002000

[16:30:32.293] erased in 1 pulse(s)

[16:30:32.293] kernel write flash buffer addr: 00002000 len: 00000800

[16:30:32.388] kernel write flash buffer addr: 00002800 len: 00000800

[16:30:32.482] kernel commit flash addr: 00002000 len: 00001000 crc32 88779232

[16:30:32.523] written in 1 pulse(s)

[16:30:32.524] kernel flash disable

[16:30:32.527] verifying result...

[16:30:32.527] -- comparing ECU flash memory pages to image file --

[16:30:32.527] seg start len ecu CRC32 img CRC32 same?

[16:30:32.536] FB01 00000000 00001000 A40574DD A40574DD YES

[16:30:32.546] FB02 00001000 00001000 750D1713 750D1713 YES

[16:30:32.554] FB03 00002000 00001000 88779232 88779232 YES

[16:30:32.562] FB04 00003000 00001000 2B7AAD4F 2B7AAD4F YES

[16:30:32.570] FB05 00004000 00001000 A9275D2E A9275D2E YES

[16:30:32.579] FB06 00005000 00001000 DF1A0E94 DF1A0E94 YES

[16:30:32.587] FB07 00006000 00001000 12ABDE22 12ABDE22 YES

[16:30:32.597] FB08 00007000 00001000 568DD3F7 568DD3F7 YES

[16:30:32.723] FB09 00008000 00018000 0A34FEF7 0A34FEF7 YES

[16:30:32.889] FB10 00020000 00020000 3F8A925C 3F8A925C YES

[16:30:33.056] FB11 00040000 00020000 225694AC 225694AC YES

[16:30:33.225] FB12 00060000 00020000 3CA89CEA 3CA89CEA YES

[16:30:33.392] FB13 00080000 00020000 74452EB3 74452EB3 YES

[16:30:33.559] FB14 000A0000 00020000 28C38616 28C38616 YES

[16:30:33.726] FB15 000C0000 00020000 8A74D0B7 8A74D0B7 YES

[16:30:33.895] FB16 000E0000 00020000 BD6913C4 BD6913C4 YES

[16:30:33.895] flash correct! exiting.

[16:30:33.897] interface close

[16:30:33.904] interface close

 

Edit: file removed, too many issues after testing. Needs more work...

Edited April 7, 2020 by moral hazard

[moral hazard]

Standby for another update soon, looking at getting the flex fuel version working for us from here:

https://www.romraider.com/forum/viewtopic.php?f=37&t=14020

[A_A_ron]

danger to manifold and ecu

 

This is interesting. I'm putting on some popcorn.

[Aphex28]

Just as a general question, I assume the GenV rom already exists in the DB as my tuner is confident that he can get my car stage 2 via open source no problem. But the existing rom doesn't have the same features available? Launch control, speed density, gear dependent boost?

 

I'm just looking for clarification as to the complete advantage of this. At least at Stage 2 levels I don't think it matters as much but for the more advanced builds I assume so

[moral hazard]

But the existing rom doesn't have the same features available? Launch control, speed density, gear dependent boost?

 

Yes exactly, this work is simply to add features that the merpmod patch brings.

 

The existing rom has only had a basic version of the merpmod patch (adding speed density) created by Merp and given out to the public for free.

It also has gear dependant boost if the tuner has the right definition.

 

With that basic version, if you have disassembly and reverse engineering skills and know your way around IDA , you can work from there to add other features. I don't have those skills yet (however will be meeting someone in the next few weeks that will likely run me through it and create a mini series of videos).

 

But for now I thought I could start with a rom (in this case from the STI) that has a patch which someone has put more time and work into, adding all the features I would want (personally I want the map switching so I can switch between running E85 or not).

 

This thread is hopefully the start of what I can contribute as I look to upskill.

Edited October 17, 2019 by moral hazard

[moral hazard]

FileName: AE5IB00V.MeRpMoD.Switch.Testing.v00.60.d19.8.5.1149.patch

Mod Identifier: AE5IB00V.MeRpMoD.Switch.Testing.v00.60.d19.8.5.1149

Version: Testing

Author: Merp

Description: Speed Density load calculation with MAF blending and VE map switching

Map switching with blending

Launch control and flat foot shifting (static or gear based calculation)

Launch control live adjust using cruise control resume/accel

CEL Flash (FBKC, EGT from Front O2 resistance, Coolant Temp)

Primary open loop fuel hacks

Per Gear WGDC & Target Boost

 

 

New patched rom ready for testing with the features above, see attached (remember to change file ext from .pdf to .hex.

 

You will need the definitions and 32bit base from the attachment here:

https://www.romraider.com/forum/viewtopic.php?f=37&t=14020

https://www.romraider.com/forum/download/file.php?id=33846&sid=153f2244c004d6fd115041048a6e9592

 

Remember you also have to copy all of your tunes tables across in order to drive the car (especially things such as the injector scalar).

 

You could use the Ziggyrama stg1 or stg2 maps as a starting point for example:

https://www.romraider.com/forum/viewtopic.php?f=27&t=8190

 

Edit: file removed, too many issues after testing. Needs more work...

Edited April 7, 2020 by moral hazard

[moral hazard]

A word of warning for those with a 5eat and push button start, this rom is not ideal as there is a big I found.

 

When you are in park or natural, if you try pressing the start button twice to turn the car on (but not intending to crank), the car will start cranking away (even though your foot is not on the brake).

This does not happen in drive or reverse.

 

I will still use this rom, as that bug doesn't bother me but this may bother others.

Edited October 20, 2019 by moral hazard

[petergc8]

A word of warning for those with a 5eat and push button start, this rom is not ideal as there is a big I found.

 

When you are in park or natural, if you try pressing the start button twice to turn the car on (but not intending to crank), the car will start cranking away (even though your foot is not on the brake).

This does not happen in drive or reverse.

 

I will still use this rom, as that bug doesn't bother me but this may bother others.

 

Before we start, just a warning that you need to have a way to recover your ecu from a bricked state.

Don't attempt flashing the rom if you aren't capable of performing recovery.

I am not responsible for any bricked ECU's...

 

Ok, so I have managed to successfully modify the 2011STi rom (AE5IB00V) to enable flashing via ECUflash to the GenV lgt.

 

The purpose of this was to give the LGT better support (enable more features and access to better defs).

 

 

Attached is the modified file with merpmod patch applied (see romraider forum for guide) and checksum corrected. Note, I added the .pdf extension to allow uploading to this thread, when you download the rom just change the extension to .bin or .rom.

 

Mermod guide is here :

http://www.romraider.com/forum/viewtopic.php?f=37&t=10276

 

I have flashed this to my 5eat GenV and can confirm ecu not bricked. I'm aiming to upload a video explanation of the change I made in about a week.

 

As this rom was from a manual STi so its going to be more useful for guys with the manual LGT (launch control, ffs etc).

 

Here is my successful flash output:

 

 

Edit: file removed, too many issues after testing. Needs more work...

 

 

Hello, its possible your help me please?

what metod are you using to transport this patch to you Rom ID?

 

I have a Ida pro and hew but this work its very hard!

and this metod that you using its one idea to have in mind

 

transport patch of wrx11 ADM to wrx 11 USDM, I consider a possible diferences on the ecu pinout but its a solventable thing

 

but I imagine you are transpor the rom to your ecu and not the patch, tue?

help please

[moral hazard]

 

but I imagine you are transpor the rom to your ecu and not the patch, tue?

 

Sorry just saw this post, yes what you say here is correct.

I simply changed a few values in the sti AE5IB00V rom to allow cross flashing to that rom via ecuflash.

 

It is goal of mine to learn enough to eventually figure out how to actually port the patch to any rom, but right now I can't do that sort of thing.

 

If only someone like Merp or andea79 from the romraider forums would record their screen and upload to YouTube whenever they do this kind of work so that others could follow those steps etc.