roadie08 Posted August 17, 2017 Share Posted August 17, 2017 Just got a 2007 JDM LGT TCU. Doesnt say UJ on this one. Will look at it more as soon as I have time. M32R/ECU M32176F4 31711AK570 on the cover. 2006/02-2007/04 http://i.imgur.com/3gKbo6Q.jpg?2 Link to comment Share on other sites More sharing options...
roadie08 Posted August 18, 2017 Share Posted August 18, 2017 I have posted the rom image at rr forum. Link to comment Share on other sites More sharing options...
utc_pyro Posted August 18, 2017 Author Share Posted August 18, 2017 I have posted the rom image at rr forum. What method did you use to pull it? Link to comment Share on other sites More sharing options...
roadie08 Posted August 19, 2017 Share Posted August 19, 2017 What method did you use to pull it? Ecumem Will try to do it in bootmode later. If its a renesas as Sasha wrote on rr, it should be easy to flash in bootmode. Link to comment Share on other sites More sharing options...
roadie08 Posted August 24, 2017 Share Posted August 24, 2017 Think I got my M32176F4V into bootmode correctly now. Thought it would be uart tx/rx to sio1 as in the renesas manual but I dont get any response. Tried with the sync bytes and commands like ufla32 program. Also tried sio3 and sio0/k-line without any luck. Link to comment Share on other sites More sharing options...
nightfire37 Posted August 25, 2017 Share Posted August 25, 2017 Think I got my M32176F4V into bootmode correctly now. Thought it would be uart tx/rx to sio1 as in the renesas manual but I dont get any response. Tried with the sync bytes and commands like ufla32 program. Also tried sio3 and sio0/k-line without any luck. Good work dude. Probably its own propitiatory code designed around the M32R chip Link to comment Share on other sites More sharing options...
Impreza41 Posted September 27, 2017 Share Posted September 27, 2017 Any news? Glad to see this isn't dead Link to comment Share on other sites More sharing options...
nightfire37 Posted October 8, 2017 Share Posted October 8, 2017 More research and I believe I have found the model of the transmission. Its a jatco RE5R05A which has been used on much more then just Subaru. Apparently its been used on Nissan v6 and v8 cars and trucks. So if we look at some of the research the Nissan guys have done then we might get somewhere close. Link to comment Share on other sites More sharing options...
Timothy.B Posted October 13, 2017 Share Posted October 13, 2017 More research and I believe I have found the model of the transmission. Its a jatco RE5R05A which has been used on much more then just Subaru. Apparently its been used on Nissan v6 and v8 cars and trucks. So if we look at some of the research the Nissan guys have done then we might get somewhere close. I know a guy that works at Infiniti as a tech that used to work for Nissan. He's kinda gave me some info into it. Maybe I can get something helpful for you guys? He explained to me that 5th gear is just the TC fully locked. Also, you're right, they did use it in the V6 and V8 cars. Timothy.B's 2011 LEGACY 3.6R Link to comment Share on other sites More sharing options...
mattie47 Posted July 21, 2019 Share Posted July 21, 2019 Hi all, Sorry to bring up an old thread, but I was hoping someone here may be able to help. I'm trying to build a racing sim with an outback gen3 Instrument Cluster. Reading through the thread it looks like some of you have been trying to reverse engineer some of the CAN messages within the vehicle. Does anyone here have experience with the CAN messages and the body ECU it connects to? After powering up the cluster with 12v, I was surprised to see no messages with a candump tool (I'm familiar with the CAN protocol). I tried 125kbit, and 500kbit but nothing. I assumed despite there being no ECU that it would at least still send some messages. I tried to simulate some messages with can ID 410, and 148 but no feedback on the cluster. It's possible I need more connected than just power,ignition and can high/low. Unfortunately I don't have an ECU so this task I'm doing may be a bit fruitless. Anyone got any thoughts / tips? Thanks, Matt Link to comment Share on other sites More sharing options...
utc_pyro Posted July 21, 2019 Author Share Posted July 21, 2019 BIU translates the ECU/TCU information and sends it over to the cluster at 125kbps on different CAN ID’s. Contact G-ROM cluster flashing on Facebook, he has all the cluster ID information. Link to comment Share on other sites More sharing options...
rimwall Posted May 31, 2023 Share Posted May 31, 2023 Anyone still interested in this? I have reverse engineered a good chunk of an M32R based 5EAT ROM image. ROM comms, dumping and flashing commands have been deciphered, and many tables have been located. Next step is writing some code (probably by extending FastECU) to establish comms and test ROM dumping. After that some logging to help figure out the tables of interest. And then flashing. I have a MT so I need some volunteers with an AT (5EAT) to help out. Anyone keen? Also, it would be good to know which particular tables folks are interested in flashing. Switching tables plus what other ones? Link to comment Share on other sites More sharing options...
kiki86 Posted June 2, 2023 Share Posted June 2, 2023 I'm interesting, how you manage to flash? Link to comment Share on other sites More sharing options...
rimwall Posted June 4, 2023 Share Posted June 4, 2023 (edited) Great! Good to hear. Flashing will be using the SSM commands. Not quite up to flashing, yet. First step is writing the code to mimic SSM. Doing that soon. Edited June 4, 2023 by rimwall Link to comment Share on other sites More sharing options...
rimwall Posted June 6, 2023 Share Posted June 6, 2023 See update posted on RR forums here Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now