Introduction

Select Monitor Adapter
Subaru Diagnostic Ports
How to build a PC adapter
Protocol
Software
Troubleshooting
Eavesdropping

Engine Control Unit (ECU)
Description
Reading Error Codes
Reverse Engineering
Modifying
ROM images

Transmission Control Unit (TCU)
Description
Reading Error Codes
Reverse Engineering
Power Mode
Modifying
ROM images

Other Control Units
Air Conditioning Unit
4WS Control Unit
Cruise Control Unit

OBD2 Information
Select Monitor Cartridge

Downloads
Links to other sites

Custom TCU Development



ECU Rom Images

This is my collection of ECU ROMs. If you would like to contribute your ROM, please download it to a file and email it to me. The easiest way to download the ECU ROM from your car is to use a select monitor adapter and the snowmobile select monitor utility (See links page). I am particularly interested in SVX ROMS and also any modified ROMS that you have produced and are willing to share with the community.


Stock ECU ROMS
RomIDMakerLabelMCUYearOriginVehicleTypeDownloadsContributor
781150JECS79HD63B031988EDML SeriesEA82TBinaryHex DumpDisassemblyAnalysisKai Kalmey
703243JECSD4M377911991EDMLegacyEJ22BinaryHex DumpDisassemblyAnalysisCheno
703315JECS??M377911990JDMLegacyEJ20BinaryHex DumpDisassemblyMore InformationBrett
703942Hitachi60HD63B031990EuroLegacyEJ18BinaryHex DumpDisassemblyAnalysisAndrey
703943HitachiE6HD63B031990EuroLegacyEJ18BinaryHex DumpDisassemblyMore InformationAndrey
722515JECSD2M377911992JDMSVXEG33BinaryHex DumpDisassemblyAnalysisB3lha
722521JECSD1M377911991USDMSVXEG33BinaryHex DumpDisassemblyAnalysisB3lha
722525JECSM7M377911992USDMSVXEG33BinaryHex DumpDisassemblyAnalysisNomake Wan
722527JECSM7M377911993USDMSVXEG33BinaryHex DumpDisassemblyAnalysisTom
722531JECSJ6M377911996UKSVXEG33BinaryHex DumpDisassemblyAnalysisBucks Subaru
7232A5JECSG1M377911992UKLegacyEJ22BinaryHex DumpDisassemblyAnalysisTony Wilk
7237A2JECSG6M377911992EDMLegacyEJ20BinaryHex DumpDisassemblyAnalysisCheno
7237A5JECSG6M377911992EDMLegacyEJ20BinaryHex DumpDisassemblyAnalysisCheno
733257JECSW2M377911993CanadaLegacyEJ22BinaryHex DumpDisassemblyAnalysisTony Wilk
733F17HitachiZ1H8/5001996JDMImprezaEJ15BinaryHex DumpDisassemblyMore InformationAlexander
742512JECS9AM377911994JDMSVXEG33BinaryHex DumpDisassemblyAnalysisB3lha
742521JECSX4M377911994USDMSVXEG33BinaryHex DumpDisassemblyAnalysisUPnorth362
742541JECSJ5M377911994MiddleEastSVXEG33BinaryHex DumpDisassemblyAnalysisSilverspear
742FA1JECST8M377911996UKLegacyEJ20BinaryHex DumpDisassemblyMore InformationDaniel
7432A1JECSU1M377911996UKLegacyEJ22BinaryHex DumpDisassemblyAnalysisB3lha
743A17JECS8CM377911995JDMLegacyEJ20 TTBinaryHex DumpDisassemblyAnalysisKai Kalmey
744011JECSW9M377911994JDMWRXEJ20 turboBinaryHex DumpDisassemblyAnalysisTony Wilk
744014JECSZ4M377911995JDMWRXEJ20 turboBinaryHex DumpDisassemblyAnalysisRob Files
744017JECS??M377911994JDMImpreza?EJ20 turboBinaryHex DumpDisassemblyAnalysisNat
74401AJECSZ5M377911995JDMWRX RAEJ20 turboBinaryHex DumpDisassemblyAnalysisPaul
74401EJECS7KM377911996JDMWRX STi RAEJ20 turboBinaryHex DumpDisassemblyAnalysisAndrew Dennison
744042JECS??M377911994UKWrxEJ20 turboBinaryHex DumpDisassemblyAnalysisNat
753C21JECS1BM377911995USDMImprezaEJ18BinaryHex DumpDisassemblyMore InformationPSIfreak
792314JECSD1NEC 78C141989USDMJustyEF12BinaryHex DumpDisassemblyAnalysisMazz304

Modified ECU ROMS

The ROM images below have been modified and are provided with absolutely no warranty of any kind.

Base Rom (see above)Description of ModificationDifferenceDownloadCoder
742512-1994-JDM-SVX-EG33Removed 180km/h Speed LimiterdiffBinaryB3lha

The binary and hex dumps above have been padded to 64K for convenience so that the file offset corresponds to the memory address. The actual ROM data is 32768 bytes long and starts at address 0x8000 in the files.

ROM ID Numbers

The ROM ID is a 6 digit hexadecimal number. You can find the ROM ID by sending the "Get RomID" 00 46 48 49 when the ECU is transmitting. 46 48 49 is "FHI" (Fuji Heavy Industries) in ASCII representation. The Select Monitor seems to read the ROM ID directly from the ROM at address 8C3D rather than using the "Get RomID" command.

There seems to be a pattern to the ROM ID number, with each digit having a specific meaning. But we don't have enough data to fully decode it. If you have a JECS ROM from 1990-1996, please send me the ROM ID and details of your car so that I can investigate this further.

DigitMeaningNotes
1UnknownAlways 7. Does this mean "Subaru"?
2Model Year of Car0=1990, 2=1992, 4=1994 etc. Sometimes this is older than the year the car was actually sold and registered.
3,4Type of car/engine25=SVX/EG33, 31=Legacy/EJ20, 32=Legacy/EJ22, 36=Legacy/EJ20T, 3F=Impreza/EJ15, 40=Impreza/EJ20T
5Domestic Market1=Japan,2=USA,3=Europe,A=UK
6ECU Firmware RevisionRelative to the rest of the ROM ID