Mitsubishi Eclipse 3G Club banner

General questions about 2001 Montero Sport 6g72 rom

6.8K views 8 replies 2 participants last post by  mysticj  
#1 ·
I realize this is likely not the best first post to make, but here goes.

First off, some background.

I have the complete engine/harness/PCM/immo/key setup from a wrecked 2001 Montero Sport 6G72 3.0L, originally equipped with the Invecs 4 speed auto, that is going into a 1990 Mighty Max V6 truck with a V5MT1 5 speed.

The engine runs perfectly fine on the test stand, no immo issues, just the normal "where are my extra CALIFORNIA TOYS!!!!" codes for the non-existent rear O2 sensors, the evap solenoid circuit, fuel temp sensor, and auto trans control relay.

As far as diagnostics/flashing, I have an OpenPort 2.0, the latest ECUFlash, a copy of Palmer PCMScan, and a hand-held code reader.

From 4 days of searching, it seems that an eclipse 5 speed rom won't play nicely on a Montero setup, mainly due to the DIS Vs dizzy issues, so I'll likely be modding my own rom to cut out the rear O2 and all that cruft.

The open-ecu forums seem to be dead on the subject of anything with more than 4 cylinders, so I'm asking here.

The main questions I have are:

1) How does one find the periphery bit locations in an unknown rom such as this? What methods are used, possibly looking for subroutines/hex markers?

2) Is there a central repository for binary/assembly code edits like the 1G DSM's had?

3) how are the immobilizer seed/key addresses found? I'd like to keep the immobilizer active and not just nuke it.

I have searched, but not found very much information on Montero PCM work.

Sorry for the questions and whatnot.
 
#2 ·
The Montero ECU "should" be similar to the 99 3000GT/3000GT VR4 if it has a H8 processor. Just pull the rom from the ecu, someone will look at it and define some of the stuff for you.

You know, the 04-06 Kia Sorento has a 5 speed manual for the 6G7x and using the 98-99 3000GT ecu will make the swap easier?
 
#3 ·
The Montero ECU "should" be similar to the 99 3000GT/3000GT VR4 if it has a H8 processor. Just pull the rom from the ecu, someone will look at it and define some of the stuff for you.
Processor is MH8301F, so it's flashable from what I can tell.

Part number on the label is MR560348

The PCM PCB itself is labeled JE331B38404B

I'll try pulling the rom in a few minutes, not sure how things will go with the entire harness spread on the floor though.

At the moment I'm doing an ABSectomy, Airbagectomy, HVACectomy, and splicing into the trucks old harness in to cover the HVAC and lighting roles.

You know, the 04-06 Kia Sorento has a 5 speed manual for the 6G7x and using the 98-99 3000GT ecu will make the swap easier?
The pick-n-pull closest to me only does "most vehicles 10 years and older", so I won't see many 04's till about mid 2013. The other yards within a reasonable distance (under 30 miles) want an arm, leg, and left gonad for stuff, and won't allow you in the yard.
Next closest pick-n-pull is 90 miles away.. :squint:

I already have the factory V5MT1 5 speed in the truck, so I'm taken care of in the transmission department :D Good news to know though.

As far as the 99 3000GT PCM, I'll keep my eyes out for one if will play nice with the DIS setup on this engine and keep things easy.

Thanks for the help so far, it is very much appreciated.
 
#4 ·
Good news is, I read the rom just fine.

Bad news is, now the ECU is bricked. Just get the MPI relay clicking on and a CEL, no response from the Actron scanner, or PCMScan, and ECUFlash says "unable to connect to vehicle interface".:mad:

Here's the rom from my PCM, along with another one that I found floating on the OpenECU forum.

Mine is 67140008.

http://zarnochwf1.com/mitsubishi/roms

I used the Lancer RalliArt to read it, then made 2 bare definitions for the roms themselves.

Likely screwed something up royal someplace.:facepalm:

I know the read went well, because the roms are the same except for what looks like some map data.

Yippee, timing belt, plugs, wires, engine mounts, everything needed to finish this up is on it's way, my budget is maxed out, and the engine is now a lump of iron that won't do anything till I can figure out wtf happened.:(
 
#6 ·
I read it out, left the OP2 plugged in, then cut power to the batt pack when ECUFlash said to.
I did read it back twice to make sure there were no read errors, and didn't cycle power between the reads. Once I disconnected the jump pack, it was brick...

I wonder if it was because I didn't follow the ign on, read, ign off, batt off profile the PCM normally sees?

MMCFlash costs as much as the entire engine/harness/PCM setup did, so I was hoping to avoid it... :/

As far as unbrick, I can't find a datasheet for the processor (typical), and it seems Tactrix only unbricks EVO-X PCM's.

Just goes to prove that just because I'm an EE doesn't mean I can fix everything. :(
 
#7 ·
Getting another PCM/immo/key set, worst case scenario I let it run with set codes for the first few weeks and snag another spare PCM for flash test when I can drum up the cash.

Now that the shock of the situation has worn off and the denial has faded, I realize it's just part of the risks involved.

Still cheaper than gambling/smoking/drinking though!
 
#8 ·
Ok, another dead PCM.

I've narrowed it down to the "test write" button in ECUFlash.
For some godforsaken unknown reason, it seems to issue an ACTUAL flash erase command before doing the "test" write. In effect, instant brick. Might as well call it the "brick your PCM/ECU, NANANANANA!" button.

Here's the ECUFlash log from the run that killed it. I read just fine before hand with no issues, and the PCM sprang right back without issues.

http://zarnochwf1.com/mitsubishi/roms/destructive_test_write.log

I'm not sure what to do right now.

ECUFlash now seems about as safe as playing Russian roulette with ICBM's. Relax, only one of them has a nuke, the rest are conventional explosive warheads....

On the plus side, I learned that the immobilizer code is at 0x3FFCE so at least it wasn't a full waste of time...