guitar24t
Full Member
Karma: +13/-0
 Offline
Posts: 101
|
 |
« Reply #375 on: November 20, 2013, 02:46:45 PM »
|
|
|
shit!, can someone yup load a pic of the boot pin on a s60r ecu real quick!!!!!!!!! like asap please...
 |
|
|
|
|
Logged
|
|
|
|
|
terminator
|
|
« Reply #376 on: November 20, 2013, 03:17:42 PM »
|
|
|
Just ground pin 24 of the PSOP44 flash through a 100ohm resistor. Consistent on every ECU I've seen.
except siemens  |
|
|
|
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #377 on: November 21, 2013, 02:14:38 AM »
|
|
|
Has someone attacked that with a hotair station Robert?
You can see the trace that goes to the pin on the pic, if your ECU is the same that is.
|
|
|
|
|
Logged
|
|
|
|
guitar24t
Full Member
Karma: +13/-0
Offline
Posts: 101
|
|
« Reply #378 on: November 21, 2013, 09:48:34 AM »
|
|
|
Has someone attacked that with a hotair station Robert?
You can see the trace that goes to the pin on the pic, if your ECU is the same that is.
Haha no hot air that I know of. Got it from some junkyard selling on eBay. |
|
|
|
|
Logged
|
|
|
|
technic
Full Member
Karma: +17/-5
Offline
Posts: 227
|
|
« Reply #379 on: November 21, 2013, 11:50:55 AM »
|
|
|
except siemens Before anyone asks, its 28 on Siemens |
|
|
|
|
Logged
|
|
|
|
hazard860
Newbie
Karma: +0/-0
Offline
Posts: 11
|
|
« Reply #380 on: November 22, 2013, 04:09:51 PM »
|
|
|
robert, or anyone i guess,.... have a method where they can log variables, im planning to run 550 ev14's, and was going to try scanxl to log with an elm cable, anyone have any input on this?
|
|
|
|
|
Logged
|
|
|
|
guitar24t
Full Member
Karma: +13/-0
Offline
Posts: 101
|
|
« Reply #381 on: November 22, 2013, 06:12:55 PM »
|
|
|
robert, or anyone i guess,.... have a method where they can log variables, im planning to run 550 ev14's, and was going to try scanxl to log with an elm cable, anyone have any input on this?
If you have a 2004 or earlier car, you won't be able to log without a combo of a k-line and a can interface. 2005 and up shouldn't be a problem if you have the correct parameters. The way a lot of people do it now is with VIDA and a DiCE. Unfortunately this isn't great for logging data in a tuning-friendly way. Care to comment, John? |
|
|
|
|
Logged
|
|
|
|
hazard860
Newbie
Karma: +0/-0
Offline
Posts: 11
|
|
« Reply #382 on: November 22, 2013, 06:27:12 PM »
|
|
|
Could someone please give me a hand locating the hex address for the KRKTE in this 2004R6spd file linked blow? really appreciate any input!
|
|
|
|
|
Logged
|
|
|
|
xtiz
Newbie
Karma: +1/-0
Offline
Posts: 12
|
|
« Reply #383 on: November 23, 2013, 01:47:24 PM »
|
|
|
Iam looking for boost limiters in my volvo S60 now.
Posting bin file and xdf file.
I have found some maps but iam really new in map searching. i have tuned a lot of aftermarkets ECU. but never really on this level.
Someone who knows the adress?
|
|
|
|
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #384 on: November 23, 2013, 01:50:28 PM »
|
|
|
robert, or anyone i guess,.... have a method where they can log variables, im planning to run 550 ev14's, and was going to try scanxl to log with an elm cable, anyone have any input on this?
Yes, variables can be logged via canbus. As Robert said you need to poll the Kline interface on the pre facelift cars for the CEM to open up it's relays. The easy way is to use vida, but err its not a very nice way to tune. I've got a working logger custom written for 05s, but it still needs work and it is also using a fairly expensive dual CAN arm setup. Also I'm currently researching other methods of obtaining what I need in an effort to increase resolution. I think its possible to get close or beyond the Audi stuff. The extremely difficult part is getting all of the variables you need as they vary quite a bit. I've still not got my head around DPPs and IDA as the Volvo memory layout seems to be different to Audi. So I'm stuck there. |
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #385 on: November 23, 2013, 02:07:20 PM »
|
|
|
Yes, variables can be logged via canbus. As Robert said you need to poll the Kline interface on the pre facelift cars for the CEM to open up it's relays.
The easy way is to use vida, but err its not a very nice way to tune. I've got a working logger custom written for 05s, but it still needs work and it is also using a fairly expensive dual CAN arm setup. Also I'm currently researching other methods of obtaining what I need in an effort to increase resolution. I think its possible to get close or beyond the Audi stuff. The extremely difficult part is getting all of the variables you need as they vary quite a bit.
I've still not got my head around DPPs and IDA as the Volvo memory layout seems to be different to Audi. So I'm stuck there.
You're stuck because you can't share any of the information necessary for any real help. |
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
guitar24t
Full Member
Karma: +13/-0
Offline
Posts: 101
|
|
« Reply #386 on: November 23, 2013, 02:20:13 PM »
|
|
|
I've still not got my head around DPPs and IDA as the Volvo memory layout seems to be different to Audi. So I'm stuck there.
I believe I've made a little bit of progress in this area. I'm sure you've already gotten this far John, but for anyone else who wants to try, here is what I believe to be true. Volvo uses a different memory layout from Audi. Instead of the BIN section starting at 0x800000, the BIN begins at 0x0 (so you only need to load the original bin file with starting point of 0x0). Similarly Audi's RAM section begins at 0x380000 while Volvo's RAM section begins at 0x300000 (both Audi and Volvo RAM have size 0x10000). When disassembling, this means it's no longer necessary to split the file into two parts. Here's a comparison of the DPPs. Audi DPP0 = 0x204 DPP1 = 0x205 DPP2 = 0xE0 DPP3 = 0x3 Volvo DPP0 = 0x4 DPP1 = 0x5 DPP2 = 0xC0 DPP3 = 0x3 Also, the processor type for the Rs is under C166 > C167CS Please correct me if I'm wrong. I've just begun working on this again. |
|
|
|
« Last Edit: November 23, 2013, 02:22:34 PM by guitar24t »
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #387 on: November 23, 2013, 02:31:10 PM »
|
|
|
You're stuck because you can't share any of the information necessary for any real help.
That's not correct. I've shared information with quite a few people who knew a bit about IDA and the C166, but unfortunately thy haven't got anywhere, yet. The fact is some of my info, map locations mainly, not logging, is under an NDA. Fwiw, the info given should have been enough to crack it but I struck out. Try and try again as they say, or maybe do it myself. |
|
|
|
|
Logged
|
|
|
|
|
dream3R
|
|
« Reply #388 on: November 23, 2013, 02:38:07 PM »
|
|
|
I believe I've made a little bit of progress in this area. I'm sure you've already gotten this far John, but for anyone else who wants to try, here is what I believe to be true.
Volvo uses a different memory layout from Audi. Instead of the BIN section starting at 0x800000, the BIN begins at 0x0 (so you only need to load the original bin file with starting point of 0x0). Similarly Audi's RAM section begins at 0x380000 while Volvo's RAM section begins at 0x300000 (both Audi and Volvo RAM have size 0x10000).
When disassembling, this means it's no longer necessary to split the file into two parts.
Here's a comparison of the DPPs.
Audi
DPP0 = 0x204
DPP1 = 0x205
DPP2 = 0xE0
DPP3 = 0x3
Volvo
DPP0 = 0x4
DPP1 = 0x5
DPP2 = 0xC0
DPP3 = 0x3
Also, the processor type for the Rs is under C166 > C167CS
Please correct me if I'm wrong. I've just begun working on this again.
Funny this i was dumping RAM last night and came to the same conclusion. But there seems to also be another section of RAM much lower where I think I found knock retard... Can't remember offhand and I'm away ATM. Does that ring any bells? If you could shoot over your IDA DB, maybe we can get this rolling. But yeah I could dump stuff from 0x3000-0x4000 too. There's also some stuff hidden from DHA that I found, different read record stuff but still trying to work out what it is. Does anyone have a list of me7 ecu requests? Example is read data by identifier and the like... |
|
|
|
|
Logged
|
|
|
|
guitar24t
Full Member
Karma: +13/-0
Offline
Posts: 101
|
|
« Reply #389 on: November 23, 2013, 02:41:30 PM »
|
|
|
Funny this i was dumping RAM last night and came to the same conclusion. But there seems to also be another section of RAM much lower where I think I found knock retard...
Can't remember offhand and I'm away ATM. Does that ring any bells?
If you could shoot over your IDA DB, maybe we can get this rolling.
But yeah I could dump stuff from 0x3000-0x4000 too. There's also some stuff hidden from DHA that I found, different read record stuff but still trying to work out what it is.
Does anyone have a list of me7 ecu requests? Example is read data by identifier and the like...
I'd be happy to send over my IDA DB. Before I do that though, I want to redo it. I started analyzing with the C167CR variant instead of the C167CS. I got them confused in my head when I did it late at night. haha Any chance you can log a memory address and see what info is there, when you get a chance? I believe 0x30022F is some kind of ignition angle, but I have no way to test it, right now. As you know, my car is super extra out of commission for a little while longer! lol |
|
|
|
|
Logged
|
|
|
|
|
