Jump to content


Photo

Data logging via SSM from 1993 Legacy GT BG5


  • Please log in to reply
6 replies to this topic

#1 Ordex

Ordex

    New Member

  • Members
  • Pip
  • 93 posts
  • Gender:Male
  • Location:Hobart

Posted 21 February 2017 - 05:59 PM

Hello all,

 

I bought this EvoScan SSM1 data cable (SSM1 one end to USB the other) to hopefully aid me troubleshoot the intermittent boost & limp mode issues I have been experiencing.

 

I have spent many hours researching to try and work out what addresses I should read for the sensors in the car, but have come up empty handed in terms of anything specific for my car - 1993 Legacy GT Twin Turbo BG5 with 7C ecu.

 

Today my cable arrived and I've spent an hour or so fiddling around with both the EvoScan software and the free Subaru Select Monitor scan tool. This has at least confirmed the ecu<->laptop communication works ok via the cable, and I can interrogate parameters and see values changing, but still I have no idea what address values I need to be querying to get anything meaningful out of the ECU.

 

Can anyone point me in the right direction or provide any tips to working out the address mapping, short of having to scan every address from 0000-7fff?

 

Cheers

 



#2 duncanm

duncanm

    wha' who ?

  • Members
  • PipPipPip
  • 2,002 posts
  • Gender:Male
  • Location:Sydney

Posted 21 February 2017 - 09:43 PM

As that SSM tool page says - there's a lot of overlap.

 

Given freessm (on sourceforge) a go before poking memory locations. 

 

executable installers, but the source (and hence defs) are available on git: https://github.com/C...defs_Engine.xml

 

I note there's a 1993 legacy in that defs file.



#3 Ordex

Ordex

    New Member

  • Members
  • Pip
  • 93 posts
  • Gender:Male
  • Location:Hobart

Posted 24 February 2017 - 10:01 AM

I think the 1993 legacy in the def file must be a gen 1 legacy (not BG/gen 2) as the parameters I've tried to poke at don't provide anything meaningful.

That being said you are right about the overlap, and there are many many addresses I haven't tried.

freessm doesn't support SSM1 vehicles at the moment out of the box.

 

I've looked at the disassembly for a few of the ECUs on alcyone page I think it may be possible to use these, where the known code to write a value to memory has been identified, to find a equivalent code in my own ECU ROM.

 

So I have used the Polaris RXL Select Monitor ECU tool to download my ROM to a hex dump file. This process took about 50 minutes, and because I wasn't sure if the car battery would flatten during this process I idled the car at intervals. The Polaris software seemed to deal ok with brief interruptions.

I'm yet to run the hex through a disassembler, and at this stage I haven't opened my ECU box to find out what's inside but I'm assuming it's the same Mitsubishi M377xx CPU as the other JECS ECUs of this era.

 

Barring that from working, I've also found a few mentions that the ECU RAM address space is from 1000 - 14FF (so that narrows it down to only 1279 possible addresses).



#4 Ordex

Ordex

    New Member

  • Members
  • Pip
  • 93 posts
  • Gender:Male
  • Location:Hobart

Posted 05 March 2017 - 01:35 PM

Yet to get any of the disassembly programs to run, let alone give me any output.

 

I decided to break the sealing tags and open up my ECU and confirmed I have the M377xx CPU (one less unknown).

 

Somebody somewhere may be interested to see how the MINES board attached - this is a Legacy BG5 TT 7C Manual ECU

Attached Files



#5 Ordex

Ordex

    New Member

  • Members
  • Pip
  • 93 posts
  • Gender:Male
  • Location:Hobart

Posted 18 March 2017 - 08:13 PM

I've had a few more tries to disassemble the ROM dump with no success so this afternoon I tried a different method.

From the alcyone page I've been comparing the disassembly from the 1995 JDM Legacy TT (being the 8C ECU I believe this is the auto version of my car), against the 1994 SVX EG33 by B3lha which has been thoroughly broken down into functional code blocks. By hunting for code blocks with a similar structure between the two ECU disassemblies I have found some promising addresses for:

  • RPM (divided by 50) - 306e
  • Vehicle speed - 3071
  • Coolant temperature - 3092 & 3196
  • Engine load - 3745

and maybe

  • Ignition advance - 309a

It's a laborious process but I will continue to post the addresses here as I find them.



#6 duncanm

duncanm

    wha' who ?

  • Members
  • PipPipPip
  • 2,002 posts
  • Gender:Male
  • Location:Sydney

Posted 28 March 2017 - 05:04 AM

its not BG, or even JECS, but you might want to grab this data point while you can: http://www.clubsub.o...reflash-stuffs/



#7 Ordex

Ordex

    New Member

  • Members
  • Pip
  • 93 posts
  • Gender:Male
  • Location:Hobart

Posted 30 March 2017 - 02:22 PM

Thanks for the link duncanm. I haven't looked yet as it requires sign-up.

 

After a little more fiddling around I discovered the Polaris RXL Select Monitor only downloads half my ROM. I have successfully downloaded my ECU ROM using the ECU dump utility found on the alcyone website I linked previously. I ran this using a Live CD version of Ubuntu Mint. It is very low-level, so it's possible to restart if/when the connection gets interrupted. I found the utility wouldn't actually write the response to disk, but with a little Linux magic I piped the output displayed in terminal to a file and then massaged this into something usable.

 

I tried using the MAME software but nothing I did would make the pre-compiled programs run and it refused to compile from source on my machine.

I was successful disassembling my ROM using Hex-Ray's Interactive Disassembler (IDA). This contains the required smarts to create assembly for the Mitsubishi M377xx processor.

 

I have been match giving aliases in IDA for memory addresses and functions I've worked out from comparing against the disassembly on the Alcyone page, and I've found a few differences with the other TT listed there, but it still requires a bit of guess work. I have also found the instruction set for the M377xx here useful to help understand what the ECU is being asked to do by the assembly.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users