NefMoto

Technical => Cluster and Immobilizer => Topic started by: N1CKY on September 01, 2014, 05:36:43 AM



Title: Me7.1.1 Immo problem
Post by: N1CKY on September 01, 2014, 05:36:43 AM
Hello lads, I have a r32 engine with the me7.1.1 ecu and the origional owner failed to immo off the ecu, I then sent it to another guy who tried to IMMO off and it seemed to make it worse, He told me i need an origional dump. Are all me.7.1.1 dumps the same?

I found this thread below but i dont know if its safe to flash to my chip?

http://nefariousmotorsports.com/forum/index.php?topic=3319.0title=

Thanks in advance.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 01, 2014, 05:43:51 AM
Wrong link, I meant this one.

http://nefariousmotorsports.com/forum/index.php?topic=3317.0title=



Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 01, 2014, 06:39:06 AM
That *may* work, but personally I would not try flashing an eeprom from a totally different vehicle just to do an immo-off.

Immo-off is super easy, you just need the ecu, windows laptop and a blue KKL lead.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 01, 2014, 07:58:52 AM
I have all 3, Does the canbus have to be wired into the OBD port or does it flash over Kline? Its not the regular eeprom thats in normal me.7's from what iv read, This eeprom is marked SP08C3 253P. Im abit desperate because at the moment iv got a ecu thats useless.


Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 01, 2014, 08:13:35 AM
The regular 7.1/7.5 ecus can be flashed over k-line, dont know if yours is different. Try reading the eeprom out of it and see.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 01, 2014, 08:36:17 AM
The regular 7.1/7.5 ecus can be flashed over k-line, dont know if yours is different. Try reading the eeprom out of it and see.

Im unfamiliar on the software that needs to be used, Is it the one below?

http://nefariousmotorsports.com/forum/index.php?topic=1168.0



Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 01, 2014, 08:47:50 AM
Yep, use argdub's tool to read/write to the ECU.

1. Read eeprom from ECU.
2. Set immo to off in the eeprom dump.
3. Fix checksum
4. Write back to ECU in bootmode.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 01, 2014, 08:54:04 AM
Thanks, Sorry for the questions. But is there a specific set of drivers i have to use for the cable? Or just the ones provided on ross tech website? Also, Is that the most up to date version of the software on page 1?

Thanks again.



Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 01, 2014, 10:12:00 AM
I use the FTDI drivers from their website (the manufacturer of the chipset) for my blue cable http://www.ftdichip.com/FTDrivers.htm, the D2xx ones seem to work ok.

With my rosstech lead, I use the rosstech drivers, but I've never managed to get that working with argdub's tool (although others report that if you use the rosstech Virtual Com Port drivers, it will work).

I think the most up to date version of argdub's tool is somewhere in the thread, not in the first post.

FYI you may need to mess around inside your ECU to get it into boot mode (required to write the eeprom back to the ecu) - I think you will need to remove a resistor from the board,there are threads on the subject, but I've never paid too much attention as I dont have an R32.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 02, 2014, 11:06:38 AM
Right, Iv managed to read the eeprom twice. (In about 20 attempts, I keep getting a weird error!)

Code:
c:\SIR\Nicky\ECU>me7_1.4.exe --bootmode 95P08 -p 3 -b 10400 -r dump3.bin
ME7_EEPROM v1.40
COM: 3, Baud Rate: 10400
Memory type: 95P08, size: 1024
Opening COM3 ... OK
Starting Boot_mode ... uC ID response 0xD5 ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Reading IDCHIP ... 0x0C43: C167CS ... OK
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Reading EEPROM ... FAIL. (error=0x40B01)
Closing COM3

Any ideas?

Attatched are the two files plus a log that i managed to get!



Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 02, 2014, 12:28:38 PM
Just had a quick look at these in a hex editor, defo isnt a happy read:
- the files are twice as long as conventional eeproms, 1024bytes not 512bytes, with the latter 512bytes padded with FFs. This may be an R32 *thing* or it may be a failed read, if you can find a known good R32 eeprom then take a look at that and see.
- the first half of the file looks good, but even limiting to the first 512bytes only, it appears the checksum is invalid:
Code:
$ python 95040tool.py dump2.bin
Debug mode active
Read in 64 16 byte rows - 1024bytes total
Parsing as ECU eeprom
EEPROM Status:
- VIN: WVWZZZ1JZ4D010174 (VW 2004 - Golf and Bora 4, Bratislave, Slovakia)
- SKC: 06050
- Immobiliser: Off
- Checksum: Invalid Checksum
- Size: 1024bytes - 512bytes expected, check this is a eeprom bin
- Cluster Code: BA DD 32 C5 E2 C8 3B
- P0601 DTC: not set
- Immo ID: VWZ7Z0C8204091
- Softcoding ID: 0132

I would try reading it over odb not boot mode, or try using the bootmode params as described in this thread http://nefariousmotorsports.com/forum/index.php?topic=5675.0


Title: Re: Me7.1.1 Immo problem
Post by: k0mpresd on September 02, 2014, 12:30:25 PM
that e2p is 1kb in size. not 512 bytes like conventional me7.5. it is padded with ff on the bottom half.
also, a quick look at a data sheet and his e2p chip # would have told you that.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 02, 2014, 01:09:34 PM
Just had a quick look at these in a hex editor, defo isnt a happy read:
- the files are twice as long as conventional eeproms, 1024bytes not 512bytes, with the latter 512bytes padded with FFs. This may be an R32 *thing* or it may be a failed read, if you can find a known good R32 eeprom then take a look at that and see.
- the first half of the file looks good, but even limiting to the first 512bytes only, it appears the checksum is invalid:
Code:
$ python 95040tool.py dump2.bin
Debug mode active
Read in 64 16 byte rows - 1024bytes total
Parsing as ECU eeprom
EEPROM Status:
- VIN: WVWZZZ1JZ4D010174 (VW 2004 - Golf and Bora 4, Bratislave, Slovakia)
- SKC: 06050
- Immobiliser: Off
- Checksum: Invalid Checksum
- Size: 1024bytes - 512bytes expected, check this is a eeprom bin
- Cluster Code: BA DD 32 C5 E2 C8 3B
- P0601 DTC: not set
- Immo ID: VWZ7Z0C8204091
- Softcoding ID: 0132

I would try reading it over odb not boot mode, or try using the bootmode params as described in this thread http://nefariousmotorsports.com/forum/index.php?topic=5675.0


So can i fix the checksum and ill be good to write back to the chip ? Also any idea why its rarely reading and giving me an error ? I tried it in obd mode with similar result.

Thanks a bunch guys


Title: Re: Me7.1.1 Immo problem
Post by: k0mpresd on September 02, 2014, 01:14:45 PM
that immo off/on or whatever the hell someone was trying to do is completely wrong.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 02, 2014, 01:28:13 PM
that immo off/on or whatever the hell someone was trying to do is completely wrong.

Is it fixable ?


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 02, 2014, 01:55:51 PM
Iv just got my file back from the tuner who modified it.. And that seems to be 512bytes with IMMO off, I used that python script i seen above. It looks like he messed it up, So was the immo good to go in the fist place? The car kept cutting out after a conversion, And i took the previous owners words with a pinch of salt when he said the IMMO was removed (It wasnt even wired up at the time )

Code:
EEPROM Status:
- VIN: WVWZZZ1JZ4D010174 (VW 2004 - Golf and Bora 4, Bratislave, Slovakia)
- SKC: 06050
- Immobiliser: Off
- Checksum: OK
- Size: 512bytes
- Cluster Code: BA DD 32 C5 E2 C8
- P0601 DTC: not set
- Immo ID: WZ7Z0C8204091



Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 02, 2014, 02:54:19 PM
It might be ok, kompresseds post suggests your EEPROM is meant to be 1024bytes and padded with FFs, so it may still be wrong. (Your tuner may be like me, too lazy to look at a data sheet and just assumed it was a bad read, truncated the file a 512bytes and fixed the checksum...then again kompresseds may be wrong about 1024 being correct).

I would try and get a bit more info on your EEPROM before flashing the new bin on.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 02, 2014, 03:01:56 PM
See im unaware, the original one that was pulled off is 512 with correct checksums. (When i say origional, I mean modified by previous owner)
Then i sent it away and received it back at 1024 with bad checksums.

So do i just need to padd out the first file to 1024? Or am i meant to flash another 512?

Im confused.


Title: Re: Me7.1.1 Immo problem
Post by: f1torrents on September 02, 2014, 03:06:40 PM
The file must be 1024 with the last 512 being all FF


Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 02, 2014, 03:26:03 PM
Is it litterally a normal EEPROM, but padded, or is the structure different too?


Title: Re: Me7.1.1 Immo problem
Post by: k0mpresd on September 02, 2014, 06:45:53 PM
this whole thread is 2 pages of nonsense when fixing and correcting whatever idiot touched that file before would take about 10 seconds.
btw, i may be wrong? use your fucking brain and stop being "lazy" and you would know 100% that im correct.


Title: Re: Me7.1.1 Immo problem
Post by: vwaudiguy on September 02, 2014, 09:51:55 PM
this whole thread is 2 pages of nonsense when fixing and correcting whatever idiot touched that file before would take about 10 seconds.
btw, i may be wrong? use your fucking brain and stop being "lazy" and you would know 100% that im correct.

Thanks for clearing that up, K0m. I thought I was loosing my mind :)


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 03, 2014, 02:31:49 AM
this whole thread is 2 pages of nonsense when fixing and correcting whatever idiot touched that file before would take about 10 seconds.
btw, i may be wrong? use your fucking brain and stop being "lazy" and you would know 100% that im correct.

I hope your not referring to me with that comment? I'm very new to this, and I'm learning.

So can i just pack a good 512 file out to 1024 (The other 512 all being FF ) and flash it to the eeprom?

 I really appreciate the help guys.



Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 03, 2014, 02:36:19 AM
It's ok, he's referring to me ;)


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 03, 2014, 08:57:49 AM
Oh okay, I literally have no idea why i keep getting this error trying to read this eeprom! i dont want to write to it incase it messes something up.

Reading EEPROM ... FAIL. (error=0x40B01)

Cheers.


Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 03, 2014, 09:05:07 AM
Have you snipped off the resistor mentioned in the r32 thread linked above?


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 03, 2014, 09:33:42 AM
Yeah, it was just a 000 surface mount resistor, So a link basically.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 03, 2014, 10:02:27 AM
Okay so iv had a go at fixing the checksums etc, Can someone check it over please?


Title: Re: Me7.1.1 Immo problem
Post by: k0mpresd on September 03, 2014, 10:45:31 PM
Okay so iv had a go at fixing the checksums etc, Can someone check it over please?

chksums are not the issue.


Title: Re: Me7.1.1 Immo problem
Post by: ddillenger on September 03, 2014, 11:03:57 PM
0x12 and 0x22 are supposed to be 02, not 03. Someone ran this file through one of those immo off programs twice and messed it up. Start with the original read, change bytes 0x12 and 0x22 from 01 to 02, correct the checksums, and you're done.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 04, 2014, 04:03:16 AM
0x12 and 0x22 are supposed to be 02, not 03. Someone ran this file through one of those immo off programs twice and messed it up. Start with the original read, change bytes 0x12 and 0x22 from 01 to 02, correct the checksums, and you're done.

The problem is, I dont have the original read. Below is the most raw one i have (Still not raw, prev owner modded it) buts its only 512bytes can i pack it out to 1024 and correct the checksums?

I appreciate your help lads, I really do.



Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 04, 2014, 04:54:21 AM
Just had another look at the dumps N1cky pulled, and extended my eeprom tool to attempt to process R32 bins. Few oddities:
- in DUMP1.BIN, checksum is wrong in pages 1C and 1D - these lines are all FF, am I right in assuming checksum is not calculated for these lines too?
- in nicky.bin, the lines 1C and 1D are not all FF and have a checksum calculated.
- DUMP1.BIN and nicky.bin also differ in pages 0x11 and 0x14, nicky.bin appears to have a date in 0x14
- in DUMP1.BIN and nicky.bin, they start with 5 bytes of 0x30, all other immo3 bins' that I've seen start with 5 bytes of 0x20.

Have a look at the attached bin.



Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 04, 2014, 05:20:48 AM
Just had another look at the dumps N1cky pulled, and extended my eeprom tool to attempt to process R32 bins. Few oddities:
- in DUMP1.BIN, checksum is wrong in pages 1C and 1D - these lines are all FF, am I right in assuming checksum is not calculated for these lines too?
- in nicky.bin, the lines 1C and 1D are not all FF and have a checksum calculated.
- DUMP1.BIN and nicky.bin also differ in pages 0x11 and 0x14, nicky.bin appears to have a date in 0x14
- in DUMP1.BIN and nicky.bin, they start with 5 bytes of 0x30, all other immo3 bins' that I've seen start with 5 bytes of 0x20.

Have a look at the attached bin.



Iv just had a look and tried to understand what you mean, But my understanding of the file system layout is slim to none. I see the differences in a hex editor that you pointed out but that's about it. I'm hoping one of the more experienced members can shed some light.



Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 04, 2014, 10:57:30 AM
Most of that is random commentary as I've been trying to figure out what a 1kb bin should look like- although looking at it again, it looks like the bin I attached above has checksums calc'd for 1c and 1d too, which I think is wrong. Try writing the attached eeprom and see if that solves your problems.

Kompressed/f1torrents - any more info on what a 1kb bin should look like, as the ori is unavailable?


Title: Re: Me7.1.1 Immo problem
Post by: k0mpresd on September 04, 2014, 11:04:29 AM
heres a gimme. proper 5p08c3 e2p file.


Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 04, 2014, 11:12:31 AM
thanks :)


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 04, 2014, 04:43:47 PM
I really appreciate your help on this guys, so in theory can i modify evan.bin with my vin/skc immo off etc correct the checksum and everything be okay? I know the vin and skc etc dont need to be changed but it will give me a very similar file to what was stock.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 05, 2014, 09:17:03 AM
Just a little update guys, For anyone experiencing the same error as me: Sending Loader + MonitorCore ... FAIL. error=
0x40001

I managed to fix it, After ALOT of trial and error with different cables/drivers/computers baudrates etc.

I set both my cable (Device manager/COM4/port settings) and the argument in argdubs tool to 19200. Hoora! 5 consecutive dumps!

Now i just need help with the file, I wouldn't mind spending some money to pay for someones time to help me out?


Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 05, 2014, 10:17:10 AM
I've compared your files (dump1 and nicky) with evan.bin, neither nicky or evan have a block of padding at 1c and 1d, so I've taken dump1, zero'd those pages and checksummed them as normal. Going through evan.bin, it has nochecksum and backup pages as normal for immo3, so I'm cautiously confident that this file is ok.

My only question is the 30 30 30 30 30 at the start of dump1 and nicky.bin - std immo3 bins usually start 20 20 20 20 and the evan.bin starts 30 51 31 30 31 - but this may be irrelevant.

Give it a try with this version :) If not, maybe try evan.bin. latest version of the eepromtool script attached too - this is still very hacky until I get enough 1kb bins to properly figure out what they should look like, hopefully getting another couple soon :)


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 10, 2014, 09:02:00 AM
Right, I believe i now have a working file. But a new problem arises! When argdubs tool finally lets me write a file to the eeprom without failing, i read it back to check the file was the same. IT WAS NOT! It didnt even write the file, It says it did in the tool. But reading it back tells me otherwise. Iv almost had enough now, Is there reputable person i can send this to in the UK? I have the file i need to write now (Thanks DDllenger) but i just cant write the thing!


Title: Re: Me7.1.1 Immo problem
Post by: seishuku on September 11, 2014, 03:21:26 PM
Writing must be done in boot mode...


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 12, 2014, 02:52:21 AM
Hello, I was writing in boot mode. The ECU enters bootmode fine, It even says the write is successful. But it does not actually write.



Title: Re: Me7.1.1 Immo problem
Post by: turboat on September 12, 2014, 04:39:13 AM
Assume you've diff'd the file you read back and dump1.bin from above and its the same? Tried a different version of argdubs tool? Any error messages? You could try writing with vag eeprom tool - not sure if that does ECUs but might be worth a look.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 23, 2014, 09:43:59 AM
Im at my witts end now, I need the car started before Friday and i have no idea what's going on. It will fire on brake cleaner so its sparking, The injectors are getting live and fuel pump is running as it should. Im getting quite a few DTC's ill pop them below for people to look at, The interesting one is the check coding of ECU's.

The immo file im using is a donor file ddilenger gave me, I got a friend to write it with a programmer rather than argdubs tool, But when i read the file back with argdubs there was 4 differences, Ill attach them for you to look through.

I dont want to give up, But im so damn close!

Code:
                Address 01: Engine       Labels: 
Control Module Part Number:
  Component and/or Version:
           Software Coding:
            Work Shop Code:   
                      VCID: 55A167DFACF48DB6975
13 Faults Found:

18058 - Powertrain Data Bus
            P1650 - 004 - Missing Message from Instrument Cluster                         No dash in
18055 - Check Coding of ECUs on Powertrain Data Bus                                       No idea?
            P1647 - 008 -
16497 - Intake Air Temp. Sensor (G42)                                               probably wasnt plugged in
            P0113 - 002 - Signal too High
17834 - EVAP Purge Valve (N80)                                                                Dont have one
            P1426 - 004 - Open Circuit - Intermittent
19475 - Valve for Exhaust Flap 1 (N321)                                                      Dont have one
            P3019 - 004 - Open Circuit - Intermittent
17841 - Secondary Air Pump Relay (J299)                                                    Dont have one
            P1433 - 004 - Open Circuit - Intermittent
17530 - Oxygen (Lambda) Sensor Heating; B2 S2                   Wasnt plugged in when i last tried it, Was previously
            P1122 - 004 - Open Circuit - Intermittent
17526 - Oxygen (Lambda) Sensor Heating; B1 S2                                             As above
            P1118 - 004 - Open Circuit - Intermittent
17606 - Oxygen (Lambda) Sensor Heater Circuit: B1 S2                                     As above
            P1198 - 004 - Electrical Malfunction - Intermittent
17607 - Oxygen (Lambda) Sensor Heater Circuit: B2 S2                                     As above
            P1199 - 004 - Electrical Malfunction - Intermittent
17951 - Angle Sensor 1 for Throttle Actuator (G187)                                 No idea, Throttle works
            P1543 - 002 - Signal too Small
17580 - Angle Sensor 2 for Throttle Actuator (G188) Signal too Low                      As Above
            P1172 - 002 -
16502 - Engine Coolant Temp. Sensor (G62)                               Probably wasnt plugged in when last cranked
            P0118 - 002 - Signal too High


Title: Re: Me7.1.1 Immo problem
Post by: f1torrents on September 23, 2014, 12:18:25 PM
None of those codes have to do with the immo off file.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on September 25, 2014, 02:26:06 AM
Could the differences between the two files be causing the car not to start?


Title: Re: Me7.1.1 Immo problem
Post by: coreyj03 on October 02, 2014, 07:24:13 AM
Could the differences between the two files be causing the car not to start?

sometimes the ecu tunes are locked to the original immo .bin   which would cause a no start situation with no faults. 

i use a 8 pin soic clip and gq-4x programmer to flash all immo eproms with out desolder or boot mode.


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on October 21, 2014, 06:25:39 AM
Just to let everyone know i got the car started and running fine! Massive thanks to DDlillenger for providing me with a donor immo file to work with! Also thanks to everyone else who contributed and helped me out. You have no idea how much i appreciate it.

Regards,
Nicky



Title: Re: Me7.1.1 Immo problem
Post by: turboat on October 21, 2014, 09:33:10 AM
How did you get it going in the end? Any chance I can have copies of the bin you used?


Title: Re: Me7.1.1 Immo problem
Post by: f1torrents on October 21, 2014, 10:41:45 AM
Daz posted this in the eeprom section for everyone all ready. Gotta use your peepers... :)

http://nefariousmotorsports.com/forum/index.php?topic=3317.0title=


Title: Re: Me7.1.1 Immo problem
Post by: turboat on October 21, 2014, 11:25:33 AM
It worked with an allroad bin on a r32? How did you solve the issues you were having reading/writing it?


Title: Re: Me7.1.1 Immo problem
Post by: N1CKY on October 28, 2014, 03:40:45 AM
A local guy to me had an eeprom programmer, So i whipped the eeprom off and gave him the chip and file. Find it attatched.