Kirjoittaja PetriK » 04 Marras 2007, 14:23
Tässä ohjeet miten OpenECU:ssa lähestyvät tätä 7052 ohjelmointia:
b) 2004+ Subaru DBW - SH7055 and SH7058 based
* get the chip docs!
* try using the same initialization sequence as the WRX
* it works!!!
* build SH cross-compiler
* start writing test kernels - some trial and error here
* the ECU is being reset by a watchdog!
* start tracing pins on the board with a scope - PB15 is twiddling!
* add WDT code to kernel - it works!
* write flashing code - test - test - test
* reprogram using boot mode (solder into ECU) when you screw up
* write another kernel for SH7058 that uses built in reflash functions
c) EVO 7/8 - SH7052 based
* get the chip docs!
* borrow a MUTIII - very handy 
* snoop a TSB reflash using the MUTIII (only get one chance!)
* identify init sequence and kernel upload - no seed/key - this is easy!
* Mitsubishi uses boot mode for bootloader, which makes development and flash failures easily recoverable...
* write a simple kernel to dump all of ram so I can see what the Mitsubishi bootloader looks like
* buy IDA Pro Advanced - don't want to write any more modules!
* disassemble bootloader completely to understand how it all works, including initialization codes
* modify Subaru SH7055 kernel to work with SH7052 - easy!
* done!
d) EVO 9 - SH7055 derivative
* get the chip docs!
* borrow a MUTIII
* snoop a reflash using the MUTIII
* same init sequence!
* try loading my SH7055 kernel, and the ECU takes it, but doesn't seem to run the code
* I am stuck in the bootloader for some reason!
* from the snooping, I can see how to read / erase / write with the bootloader, but I want to use my own kernel - but how - I need to be able to read out the bootloader to find out how to load a kernel...
* create a EVO 9 ROM with a trojan kernel in it.
* flash this into the ECU, but is doesn't respond
* start tracing board and discover that there is a WDT that needs to run off of PD8 - but only when not in the init mode
* add WDT code to trojan kernel
* flash it and it runs!
* read out EVO 9 bootloader still left in RAM
* see command to load a kernel!
* see that bootloader uses built in flashing function like SH7058
* make new SH7055 kernel to support new flashing method like SH7058
* it works!
Tässä linkki missä Cboles antoi nämä neuvot...
Tuo MUT III on OBD työkalu ja tuskin toimii tässä yhteydessä, mutta kernelin osalta tuo vahvistaa mitä täällä on aiemmin kirjoitettu.
Ja täällä myös kaikenlaista aiheeseen liittyvää
Edited By PetriK on 1194179609
[color=#000000]Tässä ohjeet miten OpenECU:ssa lähestyvät tätä 7052 ohjelmointia:
[quote]
b) 2004+ Subaru DBW - SH7055 and SH7058 based
* get the chip docs!
* try using the same initialization sequence as the WRX
* it works!!!
* build SH cross-compiler
* start writing test kernels - some trial and error here
* the ECU is being reset by a watchdog!
* start tracing pins on the board with a scope - PB15 is twiddling!
* add WDT code to kernel - it works!
* write flashing code - test - test - test
* reprogram using boot mode (solder into ECU) when you screw up
* write another kernel for SH7058 that uses built in reflash functions
c) EVO 7/8 - SH7052 based
* get the chip docs!
* borrow a MUTIII - very handy :)
* snoop a TSB reflash using the MUTIII (only get one chance!)
* identify init sequence and kernel upload - no seed/key - this is easy!
* Mitsubishi uses boot mode for bootloader, which makes development and flash failures easily recoverable...
* write a simple kernel to dump all of ram so I can see what the Mitsubishi bootloader looks like
* buy IDA Pro Advanced - don't want to write any more modules!
* disassemble bootloader completely to understand how it all works, including initialization codes
* modify Subaru SH7055 kernel to work with SH7052 - easy!
* done!
d) EVO 9 - SH7055 derivative
* get the chip docs!
* borrow a MUTIII
* snoop a reflash using the MUTIII
* same init sequence!
* try loading my SH7055 kernel, and the ECU takes it, but doesn't seem to run the code
* I am stuck in the bootloader for some reason!
* from the snooping, I can see how to read / erase / write with the bootloader, but I want to use my own kernel - but how - I need to be able to read out the bootloader to find out how to load a kernel...
* create a EVO 9 ROM with a trojan kernel in it.
* flash this into the ECU, but is doesn't respond
* start tracing board and discover that there is a WDT that needs to run off of PD8 - but only when not in the init mode
* add WDT code to trojan kernel
* flash it and it runs!
* read out EVO 9 bootloader still left in RAM
* see command to load a kernel!
* see that bootloader uses built in flashing function like SH7058
* make new SH7055 kernel to support new flashing method like SH7058
* it works!
[/quote]
[url=http://forums.nasioc.com/forums/archive/index.php/t-1027462.html]Tässä linkki missä Cboles antoi nämä neuvot...[/url]
Tuo MUT III on OBD työkalu ja tuskin toimii tässä yhteydessä, mutta kernelin osalta tuo vahvistaa mitä täällä on aiemmin kirjoitettu.
[url=http://forums.openecu.org/ezdloads.php?sid=33fe2cb1cd951eeb6022a5baa31ef321]Ja täällä myös kaikenlaista aiheeseen liittyvää[/url][/color]
Edited By PetriK on 1194179609