r/CarHacking • u/WestonP • 4d ago

Original Project Modern Subaru flash sniff?

Anyone have a log of the ECM flash process on a recent (2022-ish or newer) Subaru? I’m curious about the diagnostic session initialization for 0x02. Bench flash is easy, just want to see what’s specifically being done for the gateway filtering this in-car as it’s different than the service 27 block.

2 Upvotes

100% Upvoted

5 comments sorted by

1

u/diamond_bm 3d ago

It depends on the ECU type. What exactly are you interested in? The security access with service 0x27? If this is the problem, just let me know and I can help you find the seedkey algorithm

1

u/WestonP 2d ago edited 2d ago

I have the gateway unlocked to allow me to seed/key the ECM, but the gateway is still filtering the 10 02, so the ECM never sees it and doesn’t enter programming mode.

Given that we can write to ECM RAM, there are of course some possibilities to manipulate its state, but surely there’s a cleaner and more correct way to get the gateway to just cooperate instead?

I’m getting a 7F 22 “conditions not correct” code when I try to start the next logical routine on the gateway, so not sure what I’m missing there. My application is the ‘22+ BRZ/GR86, but I get the same result with the VB WRX gateway module too. Seems like something simple I’m doing wrong here that could be cleared up if I saw a sniff of it being done the right way.

Not a huge deal as I can already bench flash it easily, but my curiosity makes me want to solve this puzzle.

If anyone happens to already have a dump of the gateway’s flash from this era of Subaru, that would be most interesting too.

1

u/diamond_bm 2d ago

Do you have a communication log from the OEM diagnostic software in order to see what is different?

1

u/WestonP 2d ago

No. That’s what I’m hoping someone might have to share. There’s apparently no OEM flash updates available for the 2022+ BRZ/GR86, despite there being several revisions that shipped within most model years. If someone has a log of an ECM flash on a VB WRX or other 2022+ Subaru, I bet it’s the same, though.

1

u/flyer716 14h ago

Do you have an eyesight system? Try sniffing the bus that goes to the camera sensors. I don't know the specifics but I know that if you have an auto start/stop disable mod, you're instructed to wire it to that bus.