|
prometey1982
|
 |
« Reply #1800 on: November 03, 2022, 04:21:23 AM »
|
|
|
Prometey, did you manage to find which CAN commands dump bytes from ROM?
You can dump flash with read memory by addr message. |
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
|
« Reply #1801 on: November 03, 2022, 08:18:57 AM »
|
|
|
Prometey, did you manage to find which CAN commands dump bytes from ROM?
By the way flash can be read by checksum calculation command. For example for TCM module 7A: 1. Start sending sleep message for 2 secs with 100 ms interval: 0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00 2. Switch TCM module to programming mode: 0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00 3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down 0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD 4. Send get checksum with next byte: 0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1 5. Read response from TCM. 6. After all flash is read send CAN reset message. 0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00 Looks like this approach can also be used for ECM module read. |
|
|
|
« Last Edit: November 03, 2022, 08:21:31 AM by prometey1982 »
|
Logged
|
|
|
|
t6
Full Member
Karma: +0/-5
 Offline
Posts: 54
|
|
« Reply #1802 on: November 03, 2022, 09:21:04 AM »
|
|
|
heres what i have used for 03-04 autos in a euro file
Hi, I tried this soft but the engine does not start. S60R 2003, original: QGHJ |
|
|
|
|
Logged
|
|
|
|
luki743
Newbie
Karma: +2/-0
Offline
Posts: 18
|
|
« Reply #1803 on: November 03, 2022, 09:32:52 AM »
|
|
|
By the way flash can be read by checksum calculation command. For example for TCM module 7A:
1. Start sending sleep message for 2 secs with 100 ms interval:
0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00
2. Switch TCM module to programming mode:
0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00
3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down
0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD
4. Send get checksum with next byte:
0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1
5. Read response from TCM.
6. After all flash is read send CAN reset message.
0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00
Looks like this approach can also be used for ECM module read.
ECM 0x7A TCM 0x6E CEM 0x40/0x50 |
|
|
|
|
Logged
|
|
|
|
rlinewiz
Jr. Member
Karma: +12/-1
Offline
Posts: 42
|
|
« Reply #1804 on: November 03, 2022, 09:45:36 AM »
|
|
|
I usually flash a 50GPHJ in an 05 auto car. This Will cross flash no problem. As long as you are sure the bin is a auto
thats good to know, and will save me a ton of work. now I just have to track down a 50GPHJ AUT AWD US bin.. unless an EU bin will work? I remember reading they're tuned back a wee bit |
|
|
|
« Last Edit: November 03, 2022, 10:01:59 AM by rlinewiz »
|
Logged
|
2005 S60R M66-Swapped // Self-tuned @ 22psi
[[forever coding for the OpenMoose project]]
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 136
|
|
« Reply #1805 on: November 03, 2022, 10:24:34 AM »
|
|
|
By the way flash can be read by checksum calculation command. For example for TCM module 7A:
1. Start sending sleep message for 2 secs with 100 ms interval:
0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00
2. Switch TCM module to programming mode:
0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00
3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down
0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD
4. Send get checksum with next byte:
0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1
5. Read response from TCM.
6. After all flash is read send CAN reset message.
0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00
Looks like this approach can also be used for ECM module read.
Thanks, its just as you said. However adding 1 to address does not fetch correct data, I have to set checksum address to the new byte location and then issue get checksum again. Slower but at least it works. diki@raspberrypi:~ $ cansend can0 000FFFFE#7A9C00000080 <- rom address 00000080 diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000081 <- fetches first byte from that address diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000082 <- does NOT fetch next byte correctly, it's mutated diki@raspberrypi:~ $ cansend can0 000FFFFE#7A9C00000081 <- set checksum pointer to next byte diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000082 <- correct data retrieved. All in all, I would call this a success, thank you for the invaluable information. |
|
|
|
« Last Edit: November 03, 2022, 10:32:00 AM by dikidera »
|
Logged
|
|
|
|
s60rawr
Full Member
Karma: +19/-878
Offline
Posts: 151
|
|
« Reply #1806 on: November 03, 2022, 06:02:13 PM »
|
|
|
Delete this. its old and irrelevant
|
|
|
|
« Last Edit: November 10, 2022, 12:15:35 PM by s60rawr »
|
Logged
|
|
|
|
SparkyR
Full Member
Karma: +18/-21
Offline
Posts: 77
|
|
« Reply #1807 on: November 03, 2022, 07:23:44 PM »
|
|
|
might be something to think about... you dont have a method to state your can speed for datalogging
good work!
|
|
|
|
« Last Edit: November 03, 2022, 07:27:28 PM by SparkyR »
|
Logged
|
2005 S60R m66, Xona Rotor 7864, turbosmart 45mm wastegate, id1700cc injectors
|
|
|
s60rawr
Full Member
Karma: +19/-878
Offline
Posts: 151
|
|
« Reply #1808 on: November 03, 2022, 07:57:32 PM »
|
|
|
might be something to think about... you dont have a method to state your can speed for datalogging
good work!
that may have been an oversight.... the fuction is there lol... oopsssss |
|
|
|
|
Logged
|
|
|
|
SparkyR
Full Member
Karma: +18/-21
Offline
Posts: 77
|
|
« Reply #1809 on: November 03, 2022, 08:51:40 PM »
|
|
|
Also may think of incorporating the checksum tool on flash. This is how my .bin flasher works
|
|
|
|
|
Logged
|
2005 S60R m66, Xona Rotor 7864, turbosmart 45mm wastegate, id1700cc injectors
|
|
|
s60rawr
Full Member
Karma: +19/-878
Offline
Posts: 151
|
|
« Reply #1810 on: November 03, 2022, 09:43:00 PM »
|
|
|
ya the other tool I have does that too
but it has the vlic lock stuff
it's on the list!
I have it running on my computer and it refreshes the folder every so often
but yes
thanks for testing
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 136
|
|
« Reply #1811 on: November 04, 2022, 12:12:28 AM »
|
|
|
Also may think of incorporating the checksum tool on flash. This is how my .bin flasher works
Curious. Is it the CEM that verifies the code or the ECM? Why not just patch out the checksum code? |
|
|
|
|
Logged
|
|
|
|
s60rawr
Full Member
Karma: +19/-878
Offline
Posts: 151
|
|
« Reply #1812 on: November 04, 2022, 01:45:56 AM »
|
|
|
Curious. Is it the CEM that verifies the code or the ECM? Why not just patch out the checksum code?
prometey has an updated checksum tool and it works great. can easily be incorporated into the project |
|
|
|
|
Logged
|
|
|
|
Dudde
Newbie
Karma: +1/-0
Offline
Posts: 14
|
|
« Reply #1813 on: November 04, 2022, 03:08:49 AM »
|
|
|
Free The Moose testing
Flashing works
Reading does not work, always stops at same time and tells the file is corrupt.
Logging not tested yet, need to make xml file but then i will put the car on my dyno and test the logging.
|
|
|
|
|
Logged
|
|
|
|
rlinewiz
Jr. Member
Karma: +12/-1
Offline
Posts: 42
|
|
« Reply #1814 on: November 04, 2022, 06:16:22 AM »
|
|
|
this is happening because the checksum is being checked while downloading the bin for some reason, this code can be easily bypassed for now also to answer previous questions the can speed is determined automatically when you click the connect button, and it appears the checksum is updated automatically when loading a bin to send to the car, there's no manual process for this Free The Moose testing
Flashing works
Reading does not work, always stops at same time and tells the file is corrupt.
Logging not tested yet, need to make xml file but then i will put the car on my dyno and test the logging.
were you able to start the car after you flashed? i have a sneaky suspicion the checksum code is incorrect, and theres a chance its incorrectly 'fixing' the checksum before flashing to the car |
|
|
|
« Last Edit: November 04, 2022, 06:37:27 AM by rlinewiz »
|
Logged
|
2005 S60R M66-Swapped // Self-tuned @ 22psi
[[forever coding for the OpenMoose project]]
|
|
|
|
