EvoScan is a dataloging software that you can buy for around 30$. It was used mostly by Evo and Impreza crowd, but it has also been verified to work on some DSMs.
The 97 (metal) and 98/99 (plastic) DSM ECUs can be logged with a sample rate of 70-110 samples/sec using Mitsubishi/EFI settings, with timeout@1000 and baudrate@15625. Both 97 and 98/99 ECUs can be logged with Hybrid settings as well, with timeout@1000 and baudrate@15625. Dsm-onster reports (EvoScan and EcuFlash tuning) that some of the pre-97 ECUs can be logged at sample rates of ~100 samples/sec as well
I had trouble achieving acceptable data rates or connect to older ECUs though, so I’m still investigating.
You can also log ABS ECU with EvoScan, but in order for it to work you need to get a cable without pin 9 from Limitless. I’m not sure about how accurate the data from the ABS ECU is on DSMs though. I know I can connect to ABS ECU, but so far values were wrong for my 98/99 ECU, 96 ABS combination. Might be that my ABS ECU is fried though, because ABS light is on all the time.
In order to use EvoScan, you need to connect your laptop to the car via the black large OBD2 plug only, if you have two plugs on your cable, the second one is for EcuFlash.
EvoScan can also read and clear Diagnostic Trouble Codes and it has Actuators for injectors, fuel pump, some solenoids etc.
Now the EcuFlash
EcuFlash is free flashing software that allows you to read, modify and write ROMs to ECUs. So far mainly used by Evo and Impreza crowd, seems it has finally gained ability to flash 98/99 ECUs as well. GSXDNA in (New EcuFlash 1.38 for 2G?) thread reports that he has managed to successfully flash the 99 ECU. Unfortunately, as it turns out, only the stock ROM can be flashed back for now (EvoScan and EcuFlash tuning), there is probably a checksum that doesn't allow to flash back modified ROM easily. It also seems that there are problems with (early)98 ECUs, so you need a 98(late)/99 ECU to be able to read it.
In order to read or write the ROM you will have to connect to your car using both plugs on the diagnostic cable, OBD2 and the Flash plug.
Flash plug socket is only available on 98/99 cars as far as I know. If you swap the plastic ECU to an older car, you can add the socket or connect to ECU directly via pin 79 as reported by Ceddy in (New EcuFlash 1.38 for 2G?) thread, but you still need an 98/99 ECU!!! So far I don't have information that would say that 97 ECUs are flashable.
Ceddy in (New EcuFlash 1.38 for 2G?) thread said, that Evo crowd has been learning the ROM contents of their ECUs using IDA disassembler (Hex-Rays IDA Pro Disassembler: What's new Page - version 5.3) which can be downloaded for free if you use it for noncommercial purposes. So it might be possible to learn what DSM ECUs do, the same way. I don’t know if disassembling a ROM is legal though, and if you need additional data to do so. If you know something more, let me know.
You can also learn a lot from ROM if you just look at it via HEX editor like (Freeware Hex Editor XVI32)
A word of warning, if you are going to swap 96 ECU to 98/99 then you need to compensate for the CAS. 97/98/99 CAS is on the opposite side of the engine head, so signal is inverted, you have to swap plug wires and injector pins to compensate, here is what I did (New EcuFlash 1.38 for 2G?). I'm not 100% sure I didn't messed up, but the car runs fine so 99% that it's OK
Additional information and uncertainties regarding data logging with EvoScan
I am only starting to learn the datalogging so I will try to list all the options you can log with the EvoScan and what I think they do. So please send me PMs and/or post here if you know that the description is wrong, that option doesn’t work on DSM ECUs or is calculated incorrectly. I hope we will be able to gather the ultimate tuning list this way real fast.
Injector sizing
One of the things that EvoScan doesn't detect automatically is injector sizing. By default it leaves it at 513. From discussion at (New EcuFlash 1.38 for 2G?) it seams that it's best to enter the real value of the injectors you are running. Stock 2G-T and 1G-T/MT would need 450, stock 1G-T/AT would need 380. But please look at the dsm-onster warning below (EvoScan and EcuFlash tuning), and do report back if you find out anything more.
Logging options
The EvoScan allows you to log following options:
Throttle position sensor:
Logs how open or shut the throttle valve is. I have yet to see a DSM where it displays less than 12% with accelerator fully released, so values of 12-100 seems to be normal. You can tweak the formula so that it starts from 0% if it bugs you.
Engine RPM:
Self explanatory.
Battery level:
Displays how much juice the ECU is getting, 13-15 is OK, anything below or above is probably bad.
Airflow/Rev:
------no idea------
Coolant Temp:
The temperature of the coolant, not sure from which sensor, I have a feeling that it’s from the one in engine block, although EvoScan says it’s from radiator.
Air Temperature:
Seems to display temperature of the air under the hood, but not after Turbo and intercooler
MAF Air Temperature Scaled:
Usually around 2 deg higher than air temp, could be under the hood temp as well
Coolant Temperature Scaled:
------no idea------
Timing Advance:
The timing advance in degrees, some guidelines of what to expect would be great. If someone knows the stock maps they could be a good reference point. As far as I know there are different maps for high octane and low octane operations and ECU can interpolate between them depending on knock. *my speculation*
Air Flow:
------no idea------
Barometer:
The barometric pressure that ECU sees.
Target Idle RPM:
------no idea------
Fuel Trim Low:
------no idea------
Fuel Trim Mid:
------no idea------
Fuel Trim High:
------no idea------
O2 Feedback Trim:
Supposedly the percent of fuel that ECU adds or subtracts from standard fuel map depending on O2 sensor response in closed loop.
O2 Sensor:
First O2 sensor, useless for tuning as it’s a narrowband and is used only during closed loop. Displays voltage that should be floating on idle and get saturated under heavy acceleration.
O2 Sensor 2:
Sensor behind the cat, shows constant 0v on my car all the time, although it’s there.
Speed:
Doesn’t seem to work on (late)97 and floats even when car is standing still on my 96 car with 98/99 ECU.
Still, 98GSXtreme07 reports that he had no trouble logging this parameter and that it's pretty accurate. He used Mitsubishi setting.
Injector Pulse Width:
------no idea------
Injector Duty Cycle:
------no idea------
Fuel Consumption:
Calculated value. Depends on duty cycle, rpm, injector pulse width, speed and other variables. If one of them is wrong, this one is wrong.
Gear:
Calculated value from speed and RPM’s
Air Volume:
------no idea------
(Boost) MAP:
Boost pressure, I don’t know how accurate it is.
JDM MAP:
Same as above but for JDM’s?
Wide Band AF:
Data from external wideband attached to serial port of your laptop.
Knock Sum:
*
ISC Steps:
------no idea------
Crank Signal Switch:
------no idea------
Idle Position Switch:
Probably the sensor that tells the ECU that you have fully released the accelerator.
Power Steering Switch:
*
AC Switch:
*
AC Relay Switch:
------no idea------
Inhibitor Switch:
------no idea------
AFRMAP:
------no idea------
Load Calculated:
------no idea------
Load11bit4:
------no idea------
ECU Load:
Variable that displays the load of your engine, required for most graphs
Injector Latency:
------no idea------
Load MUT 2 Byte Mod:
------no idea------
RPM MUT 2 Byte Mod:
------no idea------
Air Flow MUT 2 Byte:
------no idea------
Estimated g/Rev:
------no idea------
Estimated Lbs/Min
------no idea------
Estimated HP:
Calculated HP, could be pretty accurate if you set up all the params like vehicle weight, gear ratios, etc, etc.
Estimated TQ:
Same as above, but torque
E1 RAM:
------no idea------
E4 RAM:
------no idea------
Knock Voltage:
On DSM you should look at Knock sum, this is meaningless
Octane Level:
This might indicate if youe ECU is switching to lower octane fuel map because of excessive knocking.
knock_adc:
------no idea------
knock_base:
------no idea------
knock_var:
------no idea------
knock_change:
------no idea------
knock_dynamics:
------no idea------
knock_flag:
------no idea------
EGR Temp:
------no idea------
Wastegate Duty Cycle:
------no idea------
Load Error:
------no idea------
WGDC Correction:
------no idea------
ZTX…/LC1…:
External wideband data
Custom:
Custom requests to ECU
As you see there are ton of things that I don’t know yet, so if you know something, let me know. I will update the post so that we can have one place where to look for settings and formulas that are correct for our cars. I will update the post as soon as I discover something new as well.
Last edited by _Madman_; 10-24-2008 at 04:19 PM.
Advertisement
To browse the forums without the advertisements above, Login/Register
Great stuff. I don't know how much of it is accurate since I'm much lower on the learnign curve than you right now . Looks right to me. This is a great way to put all the meat in one place.
Dumb question. . .The 1997s don't have the reflash plug. But does that mean that they arn't reflashable? Has someone wired in a 1998-1999 reflash plug, just to see?
Also stock fuel pressure for the m/t 1g is 37 (not a/t) psi not 43.5 psi which injectors are rated for as industry standard. Won't this need to be corrected for in the injector sizing field? For 1g cars with stock fuel pressure, the 450cc injectors actually only flow 415cc. 450cc X sqrt( 37psi / 43.5psi ) = 415cc
____________________________
Matt
dd '90 GST, Holset H1C
So to summarize the potential 2g ecu tuning options. That means that only one year 2g ecu is not reprogramable. 1996 is not flashable, does not have an eprom, nor does it have a good logging rate, which renders EvoScan practically useless. 1995 has the eprom which can be changed and 1997-1999 can be reflashed directly. You'll need to wire in the plug for the 1997, but the logging output is as fast as a 1998-1999. And all reflashable ecus log as fast as a 1995 with dsmlink. All 2g ecus swap in directly, except you'll need to tackle the 1995-1996 inverted cas and firing order issues. EvoScan with the recommended cable is by far the best option for logging a 1997-1999 ecu. The data sample rate is the best. And it shows a knock sum. ECUFlash is freeware that uses the other plug on the EvoScan recommended cable to flash 1998-1999 ecus since they have a flash plug. And, with a wire-in of that same plug for a 1997 car, you can use ECUFlash for the 1997 ecu.
We need to get those rom images disassembled!!!!
____________________________
Matt
dd '90 GST, Holset H1C
I've been following along with the other couple of scan/flash threads, my understanding isn't at the level to really be of any great help right now, (researching as much as I can, would appreciate any and all links to more info) but I'm very interested in the possibility of successfully reflashing a 97 ECU.
Does anyone know, -are the chipsets nearly the same comparing the 97 metal case to 98+ plastic cased ECUs? From my understanding, the 97 connects to EvoScan at the same speeds as 98+...
Has anyone ever tried adding the additional flash plug to a 97 with success at establishing a connection? I don't yet have EvoScan/EcuFlash and my ECU doesn't have a flash plug added yet... but I'd be willing to offer my help if its very likely at all to be workable. Just please bear with my ignorance, and be specific as I attempt to learn. I want to jump onboard here if I'm able to help.
Like many others out there, my budget's tight, DSMLink or AEM is looking out of reach at the moment, and a re-flash solution would surely offer as much tuning capability as I'd likely ever need. I feel bad for all the '96 owners, it looks like they may be the only 2G owners still without a possible solution for an easy setup capable of ECU ROM modification.
edit: Matt posted as I was typing... can anyone else confirm for he and I?
No-no-no! 97 is not reflashable as far as I know, you need the plastic case ECU which is 98/99. What you can do is add 98/99 ECU to your car and make a socket for pin 97 of ECU connector, then you will be able to reflash you 98/99 ECU from a car that didn't had flash plug originally.
I will take a look to make sure the main post doesn't leave impression that you can flash 97, because so far no one have found a way. I'm really sorry for not being clear, it's Friday...
Madman, do you know what the differences are between a 97 and 98+? Do they use different processors or memory addresses? Would it be possible to physically modify the 97 boards to match the 98+?
No-no-no! 97 is not reflashable as far as I know, you need the plastic case ECU which is 98/99. What you can do is add 98/99 ECU to your car and make a socket for pin 97 of ECU connector, then you will be able to reflash you 98/99 ECU from a car that didn't had flash plug originally.
I will take a look to make sure the main post doesn't leave impression that you can flash 97, because so far no one have found a way. I'm really sorry for not being clear, it's Friday...
No problem. 1998-1999 ecus are going for $50. Have a beer. It's Friday.
Since 1997 ecus are not editable, can you still cut on/off the fuel pump, individual injectors, fuel pressure solenoid, wastegate solenoid set base timing without grounding, radiator fan high, radiator fan low with EvoScan? My brother's walbro/AFPR setup sucks for cold starting. We'd like for the pump to cut on when the ignition is on. I did this with my 1g dsmlink setup and it greatly saves starter wear.
____________________________
Matt
dd '90 GST, Holset H1C
Is the 98-99 ecu a direct swap with a 96 car or do you have to change anything? (like firing order etc)
You can swap them, but CAS is inverted so you need to fiddle with few things, here are the pictures of what I did (New EcuFlash 1.38 for 2G?)
Quote:
Originally Posted by delta448
Madman, do you know what the differences are between a 97 and 98+? Do they use different processors or memory addresses? Would it be possible to physically modify the 97 boards to match the 98+?
I think they both might be H8/5xx, but only the later ones area easily flashable. I could tell you more if I could get my hands on CPU serial number of 97 ECU.
Theoretically all ECUs should be flashable, but you might have to desolder parts of them. And that's PITA.
Quote:
Originally Posted by dsm-onster
Since 1997 ecus are not editable, can you still cut on/off the fuel pump, individual injectors, fuel pressure solenoid, wastegate solenoid set base timing without grounding, radiator fan high, radiator fan low with EvoScan? My brother's walbro/AFPR setup sucks for cold starting. We'd like for the pump to cut on when the ignition is on. I did this with my 1g dsmlink setup and it greatly saves starter wear.
Well, you can activate all the actuators, log, read and clear DTC, but that's it.
It will be way easier to tune if you have SAFC though, as you will have very accurate data and plenty of it. The maps the EvoScan can draw are awesome as well.
I added en example of (engine load/rpm/timing advance-max) graph straight from the EvoScan, logged from 97 GST.
You can even load reference maps in the lower part if you can get them from your ROM or 98/99 ROM, as they should be equal.
I can get the serial number. My brother's 1997 AWD talon is right in my yard now...
This evoscan is awesome !!! So I can set his pump to always come on when the ignition is on, regardless of being hooked up to a laptop/evoscan? Or is that not going to happen. . . Either way, evoscan is better than EVERY logging program out there. Even the obd1 guys should be jealous. . . Unless evoscan works well with dsm obd1.
EDIT: batteries in camra are dead. Give me 20 minutes. I'll take a pic of the insides, too. Maybe that can help us determine if the 1997 is fairly easy to make reflashable.
____________________________
Matt
dd '90 GST, Holset H1C
Last edited by dsm-onster; 10-10-2008 at 12:57 PM.
Reason: dead batteries
Well, my 97 gsx is down right now and I don't see it being back up for at least a month, maybe 2. If you can promise me that you won't fry it, I can pull it and ship it to you for testing if you'd like.
I contacted Colby the creator of EcuFlash, I basically said I could read my 98 ecu, but couldn't flash it.
His reply was:
Quote:
This is a known issue. The H8 kernel is unable to flash until I can figure out why the H8 is setting a flash error lockout bit before my kernel loads. If I can fix this, everything will work. Unfortunately, I have spent an inordinate amount of time on this already, without success.
Colby
So flashing isn't working for us right now, hopefully this will be fixed in the future.
I've heard that a commercial company has been able to flash the Evo 5/6 ecu, which use the same H8 processor as 98-99s, so it is definitely possible.
Well, my 97 gsx is down right now and I don't see it being back up for at least a month, maybe 2. If you can promise me that you won't fry it, I can pull it and ship it to you for testing if you'd like.
d
Well, my car is down as well DSMs...
But, no, thanks, I think shipping is way too painful I live on the opposite side of the pond, so getting anything across is a real PITA... Trust me I know
It's better if we just find the CPU serial number so we can understand which CPU family it actually is, or if we can find someone who knows anything about 97 ECUs.
Or maybe we can just try to read the ROM by using EcuFlash and extra wire for pin 79? I hope it won't fry the ECU...
Quote:
Originally Posted by dsm-onster
Pics of the 1997 ecu with sial number. This is a august 2006 car, 1997 model year:
I tried to look up the serials, but the Google seems to come up empty-handed. As far as I understand the CPU is the (6371FEF766722) chip.
By the pin count, it seems to be the closest match to my old 96 JDM ECU CPU I have on the table right now. Pictures can be found here (Injector plug swap). The CPU on my ECU seems to be the one that is overexposed in the first picture, part number MH6311F.
Do you have another serial under the (6371FEF766722) sticker, like MH/MD/M?. Maybe that will come up with some search results...
I contacted Colby the creator of EcuFlash, I basically said I could read my 98 ecu, but couldn't flash it.
His reply was:
So flashing isn't working for us right now, hopefully this will be fixed in the future.
I've heard that a commercial company has been able to flash the Evo 5/6 ecu, which use the same H8 processor as 98-99s, so it is definitely possible.
I think I saw some info about lock out in the H8 specs, but there is so much info I just can't remember where. Since you know where to send the info, maybe you could send a link to the spec we have in this thread (http://www.xtreme3s.net/H8500/H8%20539F.pdf), maybe that will help... Or, if you can PM me his contacts, I might try to contact him and search for additional data that might help him write the software for DSMs...
I will try to do my best here as well, I'm only software developer, but I hope I'll be able to find something that might come of use in this flashing thing. I have partially understood the way the program loads on H8 processor, now I'm trying to understand how the memory behaves. The specs are good and the information from (Disassemble a Bosch ME7.5.5 with IDA Pro) is helpful as well, but I can't figure out which mode exactly is our ECU supposed to work, only that it's in one of the 'Extended Maximum' modes, as the standard ROM is bigger than 64KB... (see the picture about memory layout below, taken from the specification)
I know for sure that in order for H8-539F to work it must read the first 4 bytes in ROM (RESET or startup interrupt), take the second byte as the 64KB page offset and bytes 2/3 as the function offset, and start executing function there. The start-up function must load the data offsets then (to know where most of the things like different fuel/timing variables most likely are stored) and then proceed with the actual execution.
Pics of the 1997 ecu with sial number. This is a august 2006 car, 1997 model year:
Your 97 ecu is identical to my 95 non-eprom ecu.
Both have board # JE331B719C.
They just have different code revisions on the CPU.
The CPU is a MH6371F-ED04, a 68HC11 type like the 1Gs.
The EVO 4s also use the MH6371F.
This chip is not flashable.
I think I saw some info about lock out in the H8 specs, but there is so much info I just can't remember where. Since you know where to send the info, maybe you could send a link to the spec we have in this thread (http://www.xtreme3s.net/H8500/H8%20539F.pdf), maybe that will help... Or, if you can PM me his contacts, I might try to contact him and search for additional data that might help him write the software for DSMs...
I will try to do my best here as well, I'm only software developer, but I hope I'll be able to find something that might come of use in this flashing thing. I have partially understood the way the program loads on H8 processor, now I'm trying to understand how the memory behaves. The specs are good and the information from (Disassemble a Bosch ME7.5.5 with IDA Pro) is helpful as well, but I can't figure out which mode exactly is our ECU supposed to work, only that it's in one of the 'Extended Maximum' modes, as the standard ROM is bigger than 64KB... (see the picture about memory layout below, taken from the specification)
I know for sure that in order for H8-539F to work it must read the first 4 bytes in ROM (RESET or startup interrupt), take the second byte as the 64KB page offset and bytes 2/3 as the function offset, and start executing function there. The start-up function must load the data offsets then (to know where most of the things like different fuel/timing variables most likely are stored) and then proceed with the actual execution.
I found this info on one of the boards:
Quote:
tell me about it, now we know why it took colby so long to even release the read routines.
Some interesting things to note about the H8/539F.
The PROM mode memory map runs from 0000-1ffff.
The MCU mode memory map runs from 0000-2ffff.
When we read the ROM, we get the information from H10000-h2ffff.
The information in h0000-h3fff is identical to h10000-h13fff.
The information from h3fff-hffff is not readable in prom mode.
This means when we see an op code targeting that region, it really targets a memory location that is not in the file that we read.
This also means that when we see an op code that targets h1ffff, it really targets hffff in our file.
See Hardware Manual P.509(P.523 in pdf file) Table 18-4
The H8 with its memory modes makes things complicated.
I contacted Colby thru the Bug Report in EcuFlash.
I suspect any info we can find he already has.
I think the problem is the Mitsu kernel is not allowing his kernel to load, or possibly the kernel is being locked out because of a memory mode that is being used.
The Evo 5/6 and 2000+ Eclipse are all waiting for H8 support also, so hopefully someone will make some progress.
I found this info on one of the boards: (...text...)
There was one bit that was locking part of the address space, I will try to look it up in the spec. If the bit is set you'll get an error on read/write attempt in some memory areas.
I will also try to understand the memory mangling you described. So far the entry point really seems to mismatch and/or point to the wrong address.
One question concerning failed flash though, have you tried test writing your stock ROM back? Is it the problem with all ROMs or only the modified ones? I noticed that GSXDNA was flashing back his unmodified ROM.
I also noticed that ECU numbers are different for some 98 ECUs (Eclipse Talon Laser Galant 3000GT Stealth ECU ID Reference). GSXDNA had a 99 ECU, so it can only be plastic one. But some 98 cars have early ECUs, the same ones that goes on the late 97's and is very similar from logging standpoint with EvoScan. It might be that the ECU in 97(late)/98(early) are also H8 ECUs, but are locked compared to 98(late)/99 ECUs. Which model do you have?
Quote:
Originally Posted by dsm-onster
Is there another difference? The 1997 ecu logs much faster than a 1995, right?
Turns out the late ones. The cars I logged were both late 97. I would like to hear more on this issue as well.
Huh... For some reason, not sure if it was because my other GSX was newer or ECUFlash was older, but I can't get EcuFlash to work anymore. It now times out and says "not responding". It worked on my other GSX and would read the ECU but on this GSX it just won't read. I can only get this far and as soon as I press "read" it doesn't respond. Any idea's?
Page 1:
A ZTAT™* (Zero Turn-Around Time) version of the H8/539 is already available, with on-chip
ROM that can be freely programmed by the user. However, the PROM in the ZTAT version can be
programmed once only. Flash memory, on the other hand, is electrically programmable and
erasable, so that it can be reprogrammed while mounted on the circuit board. Moreover, the
single-transistor structure of flash memory—in contrast to the two-transistor structure of
EEPROM—makes it suitable for large-capacity applications.
Page 4:
Operating modes Seven operating modes
1. High-speed 16-bit bus modes, starting in 2-state 16-bit mode at reset
• Expanded minimum mode (mode 1)
• Expanded maximum modes (modes 3 and 4)
2. Low-speed 16-bit bus modes, starting in 3-state 8-bit mode on reset
release
• Expanded minimum mode (mode 6)
• Expanded maximum mode (mode 5)
Page 499:
Flash memory contents can be erased and reprogrammed up to 100 times.
Page 515:
H8/539F branches to H'F380 in RAM area and executes user program downloaded into RAM
It seems that information Ceddy found is indeed correct, and there's more to all this stuff than it seems.
I'm not sure if page 515 is talking about the actual bootup, but if it is, then it seems that real program code is copied to the memory area we don't have in our ROM, then CPU starts executing there.
If I understood correctly, the ROM that can be downloaded/flashed will be only 2/3 of the code we have on our ECU. We can duplicate the first page (64KB) from ROM to the beginning of the ROM file, leave first 0x3E00 bytes intact. but then we have to figure out what is copied in the rest (0x3E00-0xFFFF) bytes, only then we will have full memory layout of our ECUs.
Huh... For some reason, not sure if it was because my other GSX was newer or ECUFlash was older, but I can't get EcuFlash to work anymore. It now times out and says "not responding". It worked on my other GSX and would read the ECU but on this GSX it just won't read. I can only get this far and as soon as I press "read" it doesn't respond. Any idea's?
Could be that the ECU is different. So I understand you do have a flash plug in your car?
EcuFlash is free flashing software that allows you to read, modify and write ROMs to ECUs. So far mainly used by Evo and Impreza crowd, seems it has finally gained ability to flash 98/99 ECUs as well. GSXDNA in (New EcuFlash 1.38 for 2G?) thread reports that he has managed to successfully flash the 99 ECU. The only problem right now is that we don’t have a tuned ROM to write. EDIT: There might be a problem for now (EvoScan and EcuFlash tuning). It also seems that there are problems with (early)98 ECUs, so you need a 98(late)/99 ECU to be able to read it.
Unfortunately, this is not true. I spoke with Colby (the guy who is responsible for most of the EcuFlash program development), and he told me that the only reason I was able to flash my ROM back onto the ECU of my '99 GSX is because I made no changes to it. He said that once a change is made to the ROM and you try to flash it back to the ECU, it will not work.
So, I have just purchased an EVO VIII ECU on ebay for $150. With some very minor rewirings, this ECU should be able to run my '99GSX. Then, I will be able to use EcuFlash with no issues. I plan on having this installed by either next week or the week after, so I will keep everyone updated. If I am successful with this, this may be the most powerful tuning solution on the market for the money. Complete control over a mitsubishi factory ECU for under $200!
That's not so great... But anyway, the information you have found tells us a lot. If the problem is with modified ROMs then there is most likely a checksum somewhere in the ROM.
Or, maybe the modified part is inside/mirrored to the read only memory sector that we cannot touch.
I heard about Evo 5 ECUs and that you can get them to work on our cars with some minor rewiring and immobilizer code tweaks, but since I just purchased my 98(late)/99 ECU, I will keep looking for a solution.
If you can't flash back the modified ROM, then problem is most likely with the ROM.
It's Friday.
I live on the opposite side of the pond, so getting anything across is a real PITA... Trust me I know 
I hope it won't fry the ECU...
