Here's my how-to on this whole thing. Hope it helps anyone out who is interested. I will have to fix the links when I get home, I can't get them to format right on my work computer

https://www.evolutionm.net/forums/ev...ml#post8032712

 

I would love to be able to tune that...

https://www.evolutionm.net/forums/ec...p-control.html

 

Ok, it seems you would make some use of it, so I will try to find the code.

 

Mine arrived today. I started taking pictures of it, and noticed the pinout is significantly different than the schematic posted above. It's almost impossible to see the components without a lot of contortions because of how they've layered the three boards; prominent parts are two 220uF caps, a 5V voltage regulator, some SMD resistors, a thr zener diode, a crystal, and the edge of the micro on the middle board.

After a lot of squinting at that middle board through a macro lens, it turns out that it's an ATMEGA644, rather than a PIC, which means I can probably reprogram it with my Arduino and avrdude.

The construction is quite nice; we picked one up for my wife's WRX as well, and they've taken care to match the interior appearance of each car much better than I expected. The RJ11 connectors for the temperature sensors are a nice touch (although I suspect that's only because they were able to get pre-made temp sensors with the connectors already there for a good price). Install looks like it'll be a breeze.

More later, after I've had a chance to power it up on the bench, and possibly hook up the ICSP header to pull the flash.

 

I cannot wait to see the pictures and the binary

 

I didn't get a chance to wire it up beyond just powering it on last night, but I tossed a few pictures in Bobster's install thread: https://www.evolutionm.net/forums/ev...r-install.html

Unfortunately, the pictures won't tell you too much; like I said, all the interesting bits are hidden under the top connector board; there's at least one 8-pin IC on the underside of the top board, plus the main chip on the middle board, and a few more larger ICs hiding under the piezo speaker, but you can't see them well enough to identify them. I suppose I could desolder the top board (it's only 12 header pins holding it in place) but I'd probably make a royal mess of it.

What's interesting is that there's a 1x6 header ("RC") that looks like it's for the remote control SERG sells; the remote doesn't excite me all that much, but that's probably one or two inputs you could do something else with (like, say, read a wideband or MAP voltage reference for display, or set off the piezo on overboost, etc).

The 2x3 pin "P" block is probably the typical AVR programming header (although it seems to be a 2mm pitch connector, rather than .1", and I'm not sure which is pin 1 yet). The one I'm curious about is the 1x4 header labeled "FLASH"; pins two and three appear to be connected to what I'm tentatively calling pins 2 and 4 on the "P" connector, which would normally be Vcc and MOSI. What would normally be pin 3 on the ISP connector (serial clock) looks like it connects to pin two on the remote control connector, which seems a little weird.

So, I'm not at all confident about the pinout on this guy, basically. Anyway, more later when I get a chance.

 

I unfortunately have not been able to get anything to work on mine but the kilometers per hour on one of the screens and mileage on the other screen. I hooked all of the wires up exactly as the directions stated. I'm not sure if the wire I tapped into for the fuel level was the correct one. The one I used was the white/black wire on the end of the blue plug behind the gauge cluster, not sure what else to do...

 

(Well, not that it's funny)

But... It's the speed that I'm struggling to get working, Everything else seems fine

 

Which one did you tap into for the speed sensor wire?

 

Okay, it's not a typical ICSP pinout, but it's definitely a programming header. Here's the pinout that's working for me right now (looking at the back, with the labels at the top):

GND - MOSI
+5V - MISO
GND - SCLK

Reading a few interesting bytes with avrdude, we get:

efuse: 0xff
hfuse: 0xd9
lfuse: 0xf7
lock: 0x3c

Reading the eeprom gave nothing but 0xFF repeatedly; trying to read the flash hung my programmer. That jives with the lock bits; they're both set to zero (0x3c), meaning we're not going to be able to read the flash off of this, unless acamus knows a super-secret back door to AVRs that we don't currently know about?

So, we know the fuses, and can probably guess the inputs from the older PIC-based schematic; it's possible to reimplement the on-chip code based on that, but the developer would have to be willing to erase the original code irretrievably.

 

, maybe you can try paralell programming mode

 

I can overwrite what's there if I just issue an erase, but that won't get me the code, and will just turn my trip computer into a brick.

The high-voltage mode that guy is using works for correcting problems like mangled fuse bits (like if I couldn't communicate with the device at all, which I can: the fuse bits and signature are readable), but the lock bits can't be erased (well, re-written; you have to set them back to 1) without erasing everything. These guys sell a similar device, and they're explicit about it not being able to clear the lock bits.

I've been told there's a few companies you can send a chip to for code recovery, but it destroys the chip in the process. :P Which would almost be fine, if the chip were replaceable without a hot air station.

 

I am sorry that I have got you into these troubles
I wish I could help you.

 

It's no trouble; the original code works, it just sucks that I can't read it off and modify it.

I might try reading the code off my wife's version; it should be the same thing, but you never know.

I'll have to think about whether it's worth the trouble to rewrite it from scratch. In the meantime, I have a nice little trip computer that reads in metric.

 

Any ideas you guys?