Post #1
Online now
- Joined
- 13.11.2026
- Messages
- 4
- Reactions
- 0
- Location
- United States
Hi all,
TL;DR: I have a 2024 Subaru WRX Hitachi DEF040 ECU (Renesas RH850/E1L) on the bench. It appears Cobb-locked — the OEM 0x27 key is rejected. I'm looking for bench flash / boot / recovery information for this ECU family.
ECU / vehicle
Thanks in advance.
TL;DR: I have a 2024 Subaru WRX Hitachi DEF040 ECU (Renesas RH850/E1L) on the bench. It appears Cobb-locked — the OEM 0x27 key is rejected. I'm looking for bench flash / boot / recovery information for this ECU family.
ECU / vehicle
- 2024 Subaru WRX, 2.4L FA24DIT, 6MT, USDM
- ECU: Hitachi DEF040 family (DEF040-105/205; Subaru P/N 22765AR884/AR894)
- MCU: Renesas RH850/E1L (confirmed via the ROM metadata tag RH850E1LN; Atlas declares OSType: SUBARU_DI_RH850)
- CID: LHBP301B00G
- CVN: B69FA97F
- Flash: 4 MB application region plus internal EEPROM
- 12 V on B61-15/31 and B61-14; ignition on B61-54
- Grounds B61-47/48/63 + E52-2/10
- CAN on B61-6/5 (P/U1), 120 Ω termination
- Tactrix OpenPort 2.0 / OBDX Pro; current Atlas (NAMR) identifies the vehicle correctly
- ECU answers identification and responds on 0x7E0/0x7E8 and directly on 0x7A2/0x7AA
- 0x27 returns INVALID_KEY, then EXCEEDED_NUM_ATTEMPTS, then TIME_DELAY_NOT_EXPIRED
- ECU was bought used; the seller likely did not unmarry the Accessport
- Has anyone bench-flashed / booted / recovered a Hitachi DEF040 (RH850/E1L)? Is there a known boot pin, test pad, or pinout procedure?
- Which tools currently support DEF040 in bench/boot — DFB/DFOX, Autotuner, PCMFlash, KESS, Flex, etc.? (Flex 7.10 lists DEF010/011/020/030/031, SH72544R, OBD only; DEF040 is absent.)
- Does a full flash/EEPROM write via boot mode clear a Cobb/tuner lock on this ECU, or does the lock live elsewhere?
- Any checksum / ROM layout information for the DEF040 (application region, checksum location) would help.
- Verified stock ROM dumps for MY2022 (LHBHB10B00G) and MY2023 (LHBKC40M00G), with SHA-256
- Documented UDS stack: session handling, 0x27 AES challenge/response, 0x23 read, flash erase/download/transfer/verify, payload encryption, checksum algorithm and location
Thanks in advance.