Hey MiikaS! I saw your post on RomRaider about needing SH72543R ECUs to develop the boot-mode recovery code for FastECU (https://www.romraider.com/forum/viewtopic.php?p=174223).
I have 4 SH72543R ECUs (2015-2017 Subaru WRX FA20DIT, Hitachi SH72543R, 2MB flash - LF79101P/LF79103P calibration IDs) that I'm willing to donate/send for testing. I'm in the US (Denver, CO) but can ship internationally.
What I'm trying to do:
- Recover a bricked ECU (mid-flash interrupt during Cobb AP map write, corrupt calibration section)
- FastECU currently reads fine over OBD but the write path needs serial boot recovery support
- I have known-good 2MB ROM backups, Tactrix OpenPort 2.0, Renesas FDT, and bench-flash hardware (FT232 UART adapter)
What I've confirmed:
- The VIN/immobilizer data is NOT in the Renesas internal flash — there's an external ROM chip on the board (likely 93C86 or similar SPI EEPROM). No VIN patterns anywhere in the 2MB dump
- FastECU's memory model already has the correct SH72543R flash block layout:
{0x00000000, 0x00006000} + {0x00006000, 0x001FA000}
- The
kernelmemorymodels.h correctly shows NO internal EEPROM for SH72543R (unlike older SH7055/SH7058)
- Kess V3 can recover these via boot mode (confirmed on RomRaider)
Questions:
- What specific vector/register values do you need to identify for the boot-mode recovery?
- I see you have
SH72543R listed as an MCU type in kernelmemorymodels.h but without ram/kernel/eeprom blocks defined — do you need the RAM layout and kernel load address?
- Would an Arduino-based boot-mode flasher be feasible? The SH-2A boot protocol is simple UART (9600 baud init → negotiate speed → flash commands). I found the
renesas-bootmode Python library (github.com/gregjhogan/renesas-bootmode) that already supports SH-2A.
Happy to send ECUs wherever needed — these are paperweights to me right now and I'd love to see FastECU get full SH72543R recovery support. I can also test builds on Windows with Qt/MinGW if that helps.
Thanks for all your work on FastECU!
Hey MiikaS! I saw your post on RomRaider about needing SH72543R ECUs to develop the boot-mode recovery code for FastECU (https://www.romraider.com/forum/viewtopic.php?p=174223).
I have 4 SH72543R ECUs (2015-2017 Subaru WRX FA20DIT, Hitachi SH72543R, 2MB flash - LF79101P/LF79103P calibration IDs) that I'm willing to donate/send for testing. I'm in the US (Denver, CO) but can ship internationally.
What I'm trying to do:
What I've confirmed:
{0x00000000, 0x00006000}+{0x00006000, 0x001FA000}kernelmemorymodels.hcorrectly shows NO internal EEPROM for SH72543R (unlike older SH7055/SH7058)Questions:
SH72543Rlisted as an MCU type inkernelmemorymodels.hbut without ram/kernel/eeprom blocks defined — do you need the RAM layout and kernel load address?renesas-bootmodePython library (github.com/gregjhogan/renesas-bootmode) that already supports SH-2A.Happy to send ECUs wherever needed — these are paperweights to me right now and I'd love to see FastECU get full SH72543R recovery support. I can also test builds on Windows with Qt/MinGW if that helps.
Thanks for all your work on FastECU!