Jump to content
LegacyGT.com

5EAT TCU Reverse Engineering


utc_pyro

Recommended Posts

Here's a link to a 2005 LGT TCM Pak file: http://dl.dropbox.com/u/9760777/UD-S209.pak

Info:

Decryption Keyword: E23F7EC8

SUM Value: 013A

New CID : MB436L

Hopefully somebody can get something useful out of this.

 

I also have a copy of Flashwrite from the subaru SSM software CD, i was playing around with it and it recognized the openport2.0 drivers as a usable passthrough device for writing to the ECU/TCM. If somebody can crack open and modify the values in the file above, seems like it could be easily flashed using Flashwrite and a Tactrix cable.

Link to comment
Share on other sites

  • Replies 614
  • Created
  • Last Reply

Top Posters In This Topic

  • 3 months later...
  • 1 year later...
  • 1 year later...

Back from the dead.

 

One of the tuners on here has claimed to cracked the TCU. I am not sure why there has not been much progress made by others on this. Unless he means he is able to "control" the TCU from the EC parameters he is setting i.e. per gear boost.

Link to comment
Share on other sites

Back from the dead.

 

One of the tuners on here has claimed to cracked the TCU. I am not sure why there has not been much progress made by others on this. Unless he means he is able to "control" the TCU from the EC parameters he is setting i.e. per gear boost.

 

Do you mean throttlehappy? What he does is increase the "requested torque" field in the ECU to tell the transmission to expect to have more power being produced and shift harder. I have the tune. It does improve things, mostly. And the Hexmods-F1 helps a little bit more. But it's NOT F1-like shifting. Not even close.

Link to comment
Share on other sites

Do you mean throttlehappy? What he does is increase the "requested torque" field in the ECU to tell the transmission to expect to have more power being produced and shift harder. I have the tune. It does improve things, mostly. And the Hexmods-F1 helps a little bit more. But it's NOT F1-like shifting. Not even close.

 

Possible. I just remember seeing one of these is the TCU cracked posts and someone said they cracked it years ago and was part of their tuning process.

Link to comment
Share on other sites

Do you mean throttlehappy? What he does is increase the "requested torque" field in the ECU to tell the transmission to expect to have more power being produced and shift harder. I have the tune. It does improve things, mostly. And the Hexmods-F1 helps a little bit more. But it's NOT F1-like shifting. Not even close.

 

The Calculated Torque tables also. Raising those values helps bump line pressure up to make the shifts much firmer and greatly reduce the time it takes to complete the shift. Raising Requested Torque higher does almost the same thing but also moves the shift points higher in the rev range going up and effects downshifts at less pedal angle. As you say, this is not the same as 'F1-like' shifting, whatever that means. Certainly nothing like a DSG in crispness or speed, though it is a big improvement.

Obligatory '[URL="http://legacygt.com/forums/showthread.php/2008-gh8-238668.html?t=238668"]build thread[/URL]' Increased capacity to 2.7 liters, still turbo, but no longer need spark plugs.
Link to comment
Share on other sites

Nope. Just people tweaking requested torque and claiming magic while selling tunes. We're way past the point where there is enough money in this for anyone to care. Not gonna happen.

 

That's what I figured as this thread would be hopping if it was truly cracked wide open. I should have some of the interns I am hiring to crack this for us as a project to get hired LOL

Link to comment
Share on other sites

  • 1 year later...

There hasn't been a good quality dump really avalible. Some more private groups appear to have had them before (subi disable crew has the '08+, a well know tuner from Australia mentioned looking through the tables in the earlier ones).

 

IDA should be able to work with this the same was as some earlier evos and Subaru ECU's. Not sure if a flashing method is on hand but if you can see how the thing responds to inputs, you can modify what you're handing it from the ECU to optimize what's there.

 

Edit: if you want to try and take a stab at it, they have the M32R documentation showing it's memory maps and want it here: http://www.evoscan.com/technical-vehicle-manuals/17-evo-ecu-dissassembly

 

Edit2: The data sheets on that page aren't quite the right ones, you'll need to find one for a M32170F3, M32174F3, or M32182F3 depending on what's really in there. Likely it's the former, but the memory map appears to be the same other than total ram space.

Edited by utc_pyro
Digging through spec sheets
Link to comment
Share on other sites

Great, I'll get one of my interns to take a look and crack it for a project. LOL

 

Even though I'm 7 years late on the project, do I get to be your intern if I crack it?:lol:

 

Looking at the code in a hex editor this is simpler than the ECU code at least. Lots and lots of lookup tables, and blank space in the code. I suppose we're going to have to use to find the SSM routine and start by looking at the variables that populate those values. I think this is how they got started pulling apart ECU's. You can kind of make out where some of the shift point tables are just looking at the values, and they are a lot bigger than the Subaru XT TCU tables that have been published.

 

Trying to get IDA setup now.....

 

Edit: Anyone figure out the code entry point yet? The bootloader (or at least all of it) isn't in the ROM file. It looks like the first two pages of the flash (0x0000, 0x4000) are maybe part of the bootloader code of calibration data. The 0x8000 page starts looking more like the "program" portion of the code, but I havent found the entry point yet.

Edited by utc_pyro
Link to comment
Share on other sites

Even though I'm 7 years late on the project, do I get to be your intern if I crack it?:lol:

 

Looking at the code in a hex editor this is simpler than the ECU code at least. Lots and lots of lookup tables, and blank space in the code. I suppose we're going to have to use to find the SSM routine and start by looking at the variables that populate those values. I think this is how they got started pulling apart ECU's. You can kind of make out where some of the shift point tables are just looking at the values, and they are a lot bigger than the Subaru XT TCU tables that have been published.

 

Trying to get IDA setup now.....

 

Edit: Anyone figure out the code entry point yet? The bootloader (or at least all of it) isn't in the ROM file. It looks like the first two pages of the flash (0x0000, 0x4000) are maybe part of the bootloader code of calibration data. The 0x8000 page starts looking more like the "program" portion of the code, but I havent found the entry point yet.

 

Ha! I would if I could. I hire hundreds if interns and new grads each year, but you need to be in school or a recent grad. :(

 

It would be awesome if this gets momentum. Enjoying my Stg 2 tune, can't wait till it's done. I'm sure the hex mod + tcu tuning would really livin this beast up.

Link to comment
Share on other sites

  • 3 weeks later...
Picked up an 05 auto wagon in Feb. If anyone here is from florida should know about Rev Works. To bring back some spark in the lines of getting the TCU reflashed, I can have them look into it when I get my car send there. Should be able to get it sent there within the end of the year based on how my $$$$ is
Link to comment
Share on other sites

It's a bit more complex than that... Using the available tools you cant even pull the code from our TCU. I tried two weeks ago and got the same gibberish that the tool NSFW wrote back in 2010 did. It spits out something, but it's not what we're looking for.

 

Shipping a TCU to Sasha to pull the ROM on the bench is looking to be the most probably method. Hum, need to get the test TCU back from ClimberD to send to Russia....

Link to comment
Share on other sites

He's just changing the calculated and requested torque tables in the ECU. This tells the TCU that the engine is outputting more power, and it responds accordingly. The TCU appears to have had a wider tuning envelope than a stock motor will output, so you're basically just telling it what you're actually doing. We talked about this in the ask your questions thread.

 

West_minst (Xtreme Racing Tuning guy), Throttlehappy, and Fahr_Side all offer this tuning as part of their etuneing services, and are all active on these forums at some level. Carefuly review there post history and choose one. These tables are only avalible for Opensource and ECUtek, so the majority of shops that just do Cobb can't help you.

Edited by utc_pyro
Link to comment
Share on other sites

Shipping a TCU to Sasha to pull the ROM on the bench is looking to be the most probably method. Hum, need to get the test TCU back from ClimberD to send to Russia....

 

 

Note shipping either way takes minimum 6 weeks. Suggest sending via the White House for express service with no customs clearance required ;)

Obligatory '[URL="http://legacygt.com/forums/showthread.php/2008-gh8-238668.html?t=238668"]build thread[/URL]' Increased capacity to 2.7 liters, still turbo, but no longer need spark plugs.
Link to comment
Share on other sites

Note shipping either way takes minimum 6 weeks. Suggest sending via the White House for express service with no customs clearance required ;)

 

Completely on board, just messaged utc_pyro about details of getting it shipped. Should take under two weeks.

[CENTER][B][I] Front Limited Slip Racing Differentials for the 5EAT now available for $1895 shipped, please inquire for details! [/I][/B][/CENTER]
Link to comment
Share on other sites

Ive got a question i seen utc's post on changing requested torque tables is that something i can mention to my tuner or does he have to do some research? Do i even need to do that since ive got the f1? Also will that change the lag from manual shifting?
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



×
×
  • Create New...

Important Information

Terms of Use