FastECU

Sorry for the desinformation, but I found that there are two initial value tables. The main one is:
ROM_PFD16WA2:00050D50 Initial value table: .word 0x78B1,0x4625,0x201C,0x9EA5,0xAD6B,0x35F4,0xFD21,0x5E71,0xB046,0x7F4A,0x4B75,0x93F9,0x1895,0x8961,0x3ECC,0x862B
It is identical to the SH7058 ECU.

Hi MiikaS, Regarding the DensoBoot protocol, we figured it out and fixed it together. Now I'm curious to understand the protocol that is not DensoBoot. Is it simply called "Subaru boot," or what is its correct name?

The Subaru ECU with the SH7058 can be read in FastECU via CAN using IDs 7E0 and 7E8 ...

That's why we have protocols like:
sub_ecu_denso_sh7055_02 -> Forester Cross Sports 32-bit (Some UK? Cross Sports has also 16-bit version)
sub_ecu_denso_sh7055_04 -> All other SH7055 ECUs (not yet 180nm in repo)
sub_ecu_denso_sh7058 -> All SH7058 gasoline ECUs
sub_tcu_denso_sh7055_can -> Some ...

at least one incident where TCU was flashed with ECU ROM and was succesfully recovered
I know a lot of incidents :D
Yesterday, I took a 1 MB ECU firmware (SH7058) and flashed it with the new kernel we made for the SH7055 (180 nm). I then flashed it to the SH7055S TCU (512 KB, 180 nm) for testing ...

During these two weeks of intensively studying the kernels and microcontrollers, thanks to you, I discovered that microcontrollers with the same marking, SH7055, can be different.
Until now, I thought all SH7055 were the same. So, I now only know two types of control units: the ECU with the SH7055 ...

And regarding the second point of my "CRC" topic.
I haven't yet figured out how it works in FastEcu. But the Subaru SH7055 has three types of software for calculating CRC.
1. ECU
2. TCU 1 type
3. TCU 2 type
I know how to calculate them. When I figure out how it's done in your program, I'll write ...

Or add a new line SH7055S

Yahoooo we did it!)) All it works!

https://drive.google.com/file/d/1k2wHQ_ ... drive_link

There's an old file here! I don't see the new file.

Are you sure you used right kernel?
You're right, I got it mixed up. Could you add the version number here so I don't get confused? That's how I do it myself, but I still get confused with the files.
kernelv.jpg

So far I have the same error. I'm still investigating. Or maybe I've mixed ...

https://drive.google.com/file/d/1k2wHQ_ ... drive_link

I guess you've got something mixed up. Old error (0x06) about 350nm (180nm):

I disassembled the entire 180nm kernel you sent me. I might be wrong, but I write about it.
I see this:
Kernel180nm:FFFF6008 mov.l #0xFFFF9ABC, r1 ; End BSS
Kernel180nm:FFFF600A mov.l #0xFFFF7978, r0 ; Start BSS
In the linker you specify the BSS addresses: 0xFFFF7978 - 0xFFFF9ABC

Ultimately you ...

can you confirm that if the page erase work?
I'm not sure. When I do a real write, it freezes without an error. I haven't powered down and checked reads and writes again, but the kernel doesn't respond. And after reset power cycle, the TCU doesn't work. The CAN bus doesn't work, there are no logs ...

And I didn't notice when I was writing in flash, I didn't get the error code and didn't send it to you. But when I tried to test write, I got the error code:
"[2025-11-10 01:24:59.604] (II) Flash buffer write complete... "
"[2025-11-10 01:24:59.604] (DD) Image CRC32: 0xbe5fe24a"
"[2025-11-10 01:24 ...

I'll be writing about things I see in datashets that seem insignificant to me. But just in case, I'll be writing about them, in case they play a role or spark an idea:
SH7058:
1. The operating frequency at programming/erasing is a maximum of 40 MHz.
2. Store general registers R8 to R15 and the ...