Introduction
Select Monitor Adapter
Subaru Diagnostic Ports
How to build a PC adapter
Protocol
Software
Troubleshooting
Eavesdropping
Engine Control Unit (ECU)
Description
Reading Error Codes
Reverse Engineering
Modifying
ROM images
Transmission Control Unit (TCU)
Description
Reading Error Codes
Reverse Engineering
Power Mode
Modifying
ROM images
Other Control Units
Air Conditioning Unit 4WS Control Unit Cruise Control Unit
OBD2 Information
Select Monitor Cartridge
Downloads
Links to other sites
Custom TCU Development
TCU Rom Images
This is my collection of TCU ROMs. If you would like to contribute your ROM, please download it to a file and email it to me. The best way to download the TCU ROM from your car is to use a select monitor adapter and my TCUdump utility. I am particularly interested in SVX ROMS and also any modified ROMS that you have produced and are willing to share with the community.
Stock TCU ROMS
| RomID | Label | Year | Origin | Vehicle | Type | Downloads | Contributor | |||
| 705005 | ?? | 1990 | USDM | Legacy | 4EAT | Binary | Hex Dump | Disassembly | Analysis | Ryan Press |
| 705263 | ?? | 1990 | Euro | Legacy | 4EAT | Binary | Hex Dump | Disassembly | More Information | Andrey |
| 705402 | FB | 1991 | USDM | SVX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | Longassname |
| 705404 | FB | 1992 | USDM | SVX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | Nomake Wan |
| 705405 | MQ | 1996 | USDM | SVX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | Longassname |
| 705503 | FC | 1994 | USDM | SVX | FWD | Binary | Hex Dump | Disassembly | Analysis | NeedForSpeed |
| 705605 | FA | 1992 | JDM | SVX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | B3lha |
| 705606 | FA | 1992 | JDM | SVX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | Noriyasu Mori |
| 705607 | FA | 1994 | JDM | SVX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | B3lha |
| 705622 | FF | 1992 | UK | SVX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | SVXistentialist |
| 705623 | FJ | 1994 | MiddleEast | SVX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | Silverspear |
| 705625 | MS | 1996 | UK | SVX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | Gez |
| 735C04 | KC | 1990 | Euro | Legacy | 4EAT | Binary | Hex Dump | Disassembly | Shift Plan | Andrey |
| 745913 | KM | 1993 | JDM | WRX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | Longassname |
| 745917 | MW | 1995 | JDM | WRX | 4EAT | Binary | Hex Dump | Disassembly | Analysis | Mark Bancroft |
Modified TCU ROMS
The ROM images below have been modified and are provided with absolutely no warranty of any kind.
| Base Rom (see above) | Description of Modification | Difference | Download | Coder |
| 705622-1992-UK-SVX-4EAT | Power mode is engaged when Economy Switch is off | diff | Binary | B3lha |
| 705625-1996-UK-SVX-4EAT | Power mode is engaged when Economy Switch is off | diff | Binary | B3lha |
The binary and hex dumps above have been padded to 64K for convenience so that the file offset corresponds to the memory address. The actual ROM data is 16384 bytes long and starts at address 0xC000 in the files.
ROM ID NumbersThe TCU ROM ID is stored in the first three bytes of the ROM, at address C000. There is not such an obvious pattern to them, but with more data, we may be able to figure it out.
The TCU program compares the second byte of the ROM ID against the value 55. If it is less than 55 then the TCU expects to get a signal from the atmospheric pressure sensor in the ECU. Not all ECUs have an atmospheric pressure sensor.
The ROM chip inside the ECU has a label that presumably relates to the firmware installed. For example, a 92 JDM TCU is "E23AV12P", a UK TCU is "E23AVFFP", a USDM AWD is "E23AA12P", a USDM FWD is "E31UF1DO". NeedForSpeed pointed out that the 5th character represents the transmission type "A"=ACT4, "V"=VTD, "F"=FWD. It is possible that the 2nd digit could be the year of manufacture.