FastECU

The successful ECU log shows it tries 0x10 0x03, which fails, and then tries 0x10 0x43 which works

The TCU log only tries 0x10 0x03 and then bombs out. My guess is that sub_tcu_denso_sh7055_can needs an update to also try 0x10 0x43 if 0x10 0x03 fails.

Nice! Well done!

I am guessing the SHboot command sequence is pretty simple. I wonder if it would be quick thing to add to FastECU?

If the address range up to 1000 is not affected, the Fastecu Can bootloader will write.

Yes, the Denso bootloader resides in ROM from 0x0 to approximately 0x1000 (sometimes a few bytes before or after 0x1000)

Tried the Can bootloader with no luck, Ktag doesnt like the checksum of the tcu file ...

Wow, that's lucky!

What is the CAL ID of the TCU ROM? If it was posted on RR forums, I might have partially reverse engineered it a while back.

SH boot mode is boot mode system on all SH chips. When you enter to it, it clears flash and then you can upload kernel in RAM which lets you then write flash, similar to any flash tool.

Ok, sounds familiar. The hardware manual lists a read command, but maybe that’s only allowed after flashing ...

I'm struggling to remember all the details of the SH boot approach, but fundamentally I think what happens is a bootloader is first loaded into RAM, and then that bootloader is used to write a ROM onto the chip. IIRC, the bootloader also has commands to dump data from the ROM. So, you could use the ...

Depending on when in the process the flash failed, most of the TCU ROM may still be there. For example, it's possible only the first ROM block was written to. This will still cause the TCU to be uncommunicative but the rest of the TCU will still have the original ROM, and might be recoverable before ...

Cool, thanks.

The other cables might have worked if the BIU part of FastECU was integrated with the rest of FastECU. But that’s on the todo list…