NightHawk

iTrader: (5)

Hello guys, so I have an 08 GSR and tried flashing the ecu in car last weekend with a tactrix 2.0 (+all their cables) and Ecuflash 1.44.4361 but it tossed me a locked ecu message. So i made a bench tool from a spare main harness and ECU connector. Power came from a 12v DC transformer (Evoscan says 12.8v along with multimeter). My issue is that I am still getting a locked ECU message whether i try to read, test-write, write or recovery flash. This is the log from last night.

[22:18:45.797] J2534 API Version: 04.04

[22:18:45.797] J2534 DLL Version: 1.01.4358 Oct 10 2014 03:49:00

[22:18:45.797] Device Firmware Version: 1.15.4340

[22:18:45.797] Device Serial Number: TAuuKAFv

[22:18:47.403] -- loading kernel --

[22:18:47.403] -- connecting to kernel --

[22:18:47.403] kernel get version

[22:18:47.731] ECU HW part number : 1860A979

[22:18:47.747] ECU SW part number : 1860A97902

[22:18:47.778] VIN : JA3AW86V68U*******

[22:18:47.778] -- unlocking ECU --

[22:18:47.778] starting session...

[22:18:48.105] requesting seed...

[22:18:48.105] sending key...

[22:18:48.121] no key(s) worked - perhaps this ECU has been intentionally locked?

[22:18:48.121] interface close

[22:18:48.121] interface close

[22:18:55.079] J2534 API Version: 04.04

[22:18:55.079] J2534 DLL Version: 1.01.4358 Oct 10 2014 03:49:00

[22:18:55.079] Device Firmware Version: 1.15.4340

[22:18:55.079] Device Serial Number: TAuuKAFv

[22:18:56.935] sending init sequence 1 (0001)

[22:19:00.195] sending init sequence 1 (0003)

[22:19:03.456] sending init sequence 1 (FFFF)

[22:19:06.716] sending init sequence 1 (F0F0)

[22:19:09.462] no response to any known code

[22:19:09.462] interface close

Any help now would be greatly appreciated. Evoscan reads the ECU fine, it pulled DTC's right off it but for some reason even when running ecu-unlocker I cannot unlock this thing. I tried each time with 3 different maps for my car (base 52680022, tephra 52680122, personal map from rickerman which inherits 52680022). Thanks!

NightHawk

iTrader: (5)

NightHawk

iTrader: (5)

Anyone have any ideas?

Rcus

So... whoever did this knew his job.

I'm not sure how k-line bootloader protocol works. Maybe "Init Code" can be bruteforced, it's only 65536 values. If one attempt takes x seconds then you are guaranteed to get solution in around x*0.76 days.

[ADD] 32185/32186 GroupHardware Manual contains the following note
in the section 6.8 Connecting to Serial Programmer (CSIO Mode).
If someone did change that password then you still might be able to read flash via JTAG, but it can be locked out too.

ZZZ

I thought "ecu unlocker" supposed to do that bruteforce job...

NightHawk

iTrader: (5)

I opened a support ticket with Tactrix, they said they will be coming out with a new beta program that may help. Still stuck, engine and car is done but can't have any fun with it, its been over a year in the making. I don't know if the init codes sent to the ECU may have bricked it even more. If anyone knows that they feel confident in unlocking this ECU let me know we could work out a cash deal.

bellacotim

300mA may be too weak. Try at least a 2A (2000mA) rated supply.

NightHawk

iTrader: (5)

Thanks for the feedback guys. I just downloaded the newest version of Ecu Flash 1.44.4491 and was able to recovery write the ecu fine on the first try. Recover wrote it to stock 52680022_2008_USDM_5MT hex file. I will be putting the ecu back into the car tomorrow and loading my custom map. I will post my results tomorrow whether i was successful or not. Thanks again guys