NefMoto

im currently tuning a 06A906032HN box, year 03.
using KKL ebay cable with FTDI driver tested and reccomended here.
also using MTX me7-2002 checksum plugin and tunerpro(latest build and not RT).

when i use the "Check if flash matches" button in nefmoto 1.8.0.0, and the original bin, the file matches the flashmemory.
now if i change a few bytes in the bin, and get a "checksums updated succesfully" message, when i try the "Check if flash matches" before i flash this modified bin, it sais the flash doesnt match.. so one question is.. should it match?

me7checker reported all checksums OK for the file, so i went ahead and flashed even tho it said it didnt match..

result, check engine and EPC light flashing and the throttle opening and closing in a cycle.. car starts but revs up and down..
NOW i cannot seem to connect to the ECU ever again.. not with vag-com, and not with nefmoto, so i cannot seem to restore the original flash.. and i dont really understand what is wrong.. all i can think of is the me7-2002 checksum plugin corrupting the file in some way..
that or if there is something wrong with the cable im using.. it does seem to appear a bit sporadic in the devices box in nefmoto.. as if it wasnt really ready..(same in vag-com).. but then i press refresh and its there.. and all communication seems to work.. file took 3:18 to flash.

any help/advice would be greatly appreciated.

i know i can recover the ecu using boot-mode.. but after that i want to be able to flash my new bin file to it with the changes without it going corrupt again.. =/

Most likely flash didnt go thru correctly or tuned file has incorrect checksums.

Post the file here or PM ot to me and I'll check the checksums. I've had files where WinOLS and me7check both saod checksums were correct but they were not.

Could it be you changed some wrong bytes??  Just with checksums failures you should
never see the strange effects you described.
Probably you can post the changed and orig bins to be checked here.

Correct me if I am wrong, but the car should not start if there are bad checksums. OR, is some very vital checksum as bad.

Sounds like some values are corrupt and the checksums are correct for the problematic values being introduced.

thank you for all replies, this gives me hope =)
here are the original file..
then then 0001 file which should disable "sekundärluftpumpe" and rear O2 sensor for cat diagnosis.. also there is a bit changed for turning off the diagnosis on camshaft.. as i am using a different version of the tensioner(which gave me intermittent fault on over retarded intake camshaft).
this 0001 file flashed and the car ran great.. all DTCs i had earlier were removed.. but when i flashed it i got that flash file does not match flash memory message.. SHOULD it match??
something where spooky with this flash as the abs controller reported "an implausible message", other then that, it ran just fine.

so i proceeded to the next stage, where i wanted to try and add some more boost..
after logging AFR and making sure i was on the safe side of things.. i studied some examples and read all info available.. and came up with this 0002 file.. mainly modified kfmiop load axis, kfmirl, ldrxn, ldrxnzk, kfldhbn.. to see what happened.

i flashed this file after checking it with me7checker and all was ok..  AND here we are, the car is flashing EPC and check engine lights at me, throttle opens/closes and everything is spooked.. cannot for the world get in contact with the ecu again.. =(

any thoughts on using this cable? or if the nefmoto program should say that the file matches the memory? so i dont end up doing this allover again..

i was just about to start the fun part tweaking the life out of this old k03.. ;)

ME7Check reports the following on both of the the two tuned images:
======================================================
Me7Check v1.11 (c) mki, 06/2004-07/2011
Checking file MIN_06A906032HN_BOX_0001.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 40/1/ME7.5/5/4019.02//24C/Dst02o/220202//
-> Contents of ECUID data table:
   - '0261207440'         (SSECUHN)         
   - '1037363908'         (SSECUSN)         
   - '06A906032HN '       (VAG part number)
   - '0002'               (VAG sw number)   
   - '1.8L R4/5VT     '   (engine id)       
-> Contents of ECUID data table:
   - 'HW_MAN004'                           


RSA signature failure found
-> Found 1 error!!!   *******************************

Probably you have used an outdated version of the checker, I added the RSA checking in August.

I'm not sure if the checksum failure alone is causing the problems you see, I would have doubted
this.  But the RSA signature appears in damos files with the name "tuningschutz",  i.e. tuning protection, so probably the behaviour you see is intended and all you have to do is fix the
checksums.

there we go, something is definitely wrong with the checksum correction plugin, and i was using an older version of the checker, as you said.

awesome setzi, now we know what is causing these spooks, lots of thanks! =)

Having the RSA checksum wrong has never caused any issues for me.

=========================================
ME7Check v1.11 (c) mki, 06/2004-07/2011
Checking file Golf 1.8t 180bhp AUQ 06A906032HN 0261207440 363908.bin (size=104876)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 40/1/ME7.5/5/4019.02//24C/Dst02o/220202//
-> Contents of ECUID data table:
   - '0261207440'         (SSECUHN)
   - '1037363908'         (SSECUSN)
   - '06A906032HN '       (VAG part number)
   - '0002'               (VAG sw number)
   - '1.8L R4/5VT     '   (engine id)
-> Contents of ECUID data table:
   - 'HW_MAN004'


Page checksum failure(s) found
RSA signature failure found
Overall checksum failure found
-> Found 3 errors!!!   *******************************
=========================================

this is what i get when changing ONE bit in a known working original file for this ecu.. and letting the me7-2002 checksum plugin calculate and save the file.. surely something is wrong with the checksum calculation..

Gonzo: any thought on what could be causing this behavior besides the cheksums?

no known issues like these with the ebay KKL cables using FTDI d2xx drivers?

so.. i know why i cannot get in contact with the ecu now.. the ecu keeps shutting down and rebooting.. over and over.. and this is why it flaps the throttle and flashes EPC and check-engine lights at me.. it boots up, shuts down, boots up, shuts down and so on in a neverending cycle.

Salvatore at MTX-electronics, who have developed the checksum plugin, have confirmed that the RSA signature/checksums are being incorrectly calculated by the plugin for this file, and he is looking into it right now... progress..! =)

Weird.

I have tested files with wrong RSA checksum and worked perfectly. Oh well...

Keep us updated, this is interesting for me.

The image _0002 crashes with stack overflow after about 0.5 seconds!

In both modified images, _0001 and _0002 there is a modification in the code area,
so it is just luck that the image _0001 did not crash.

Here is the relevant diff from orig to 0001 and from 0001 to 0002:
At 83'F8EC there is a change:
< 0003f8e0: d4a942f4 80328d29 9a092750 9a0e0de0  ..B..2.)..'P....
---
> 0003f8e0: d4a942f4 80328d29 9a092750 0a0e0de0  ..B..2.)..'P....

< 0003f8e0: d4a942f4 80328d29 9a092750 0a0e0de0  ..B..2.)..'P....
---
> 0003f8e0: d4a942f4 80328d29 9a092750 ec0e0de0  ..B..2.)..'P....

This changed an instruction "JMP somewhere"  to a "PUSH PSW; JMP somewhere else",
the result is clear  ;D

Old cracked versions of WinOLS will do this. It will do random edits on the code.
I think its related to the checksum module that messes up.

Try using Tunerpro?

gonzo: i AM using tunerpro latest build with the MTX checksum plugin.. but the plugin apparently misses something in the calculation.

setzi: i dont think this is something i could have done in tunerpro while i set the disable bit for the camshaft diagnosis?
this is caused by the checksum plugin altering the code somewhere it shouldnt if i understand you correctly..?

Check the xdf definition you used wether it contains the changed address by mistake.
I would rather guess it was done by you than by the checksum plugin, but you could
test this out.

i made the xdf for myself.. and now i have double-checked everything and i cannot find that i have added anything even close to that adress.. =/
from what i can tell, this must be caused by the checksum-plugin.. since even if i just change ONE bit, in an otherwise verified and working file, i get these errors..

im hoping salvatore att MTX will find out whats causing this and get back to me, ive forwarded the adresses you wrote on here as i thought it might help him figure it out, thanks for all the help with this :)

ill post/share the xdf file for these HN/HJ boxes, when i have verified it isnt causing trouble, and added all the necessities.

any other ideas as to what might be causing this would be much appreciated, ill update till and when we find a solution =)

Solution!
**********
i recieved this mail from salvatore just now:

"Hi, thanks for the hint. Setzi was right the problem with the rebooting issue was that byte being modified by the plugin due to a typo error in the code :( I fixed the issue and have an updated plugin ready for downloading on my site.

I'm working on a new release to implement better RSA support and hopefully it will be available in a few days..."


there we go, problem solved, now im off to recover the dead ecu and then its time to give it another shot.. with all changes made to a new and clean original bin this time.. again, thanks for all the help!  ;D

Snook, could you share the HN xdf? I'm trying to switch to TunerPro and this is the only thing stopping me.

carlossus: the xdf is very much a sloppy work in progress with lots of notes to myself, descibing how i was thinking when i put it together, but i will clean it up and share it here soon :)

i can verify that the MTX me7-2002 plugin now works correctly, but still have some issues with that RSA signature, salvatore told me he was working on improving the RSA support, and hopefully a new version could be release in the near future.

tonite i spent 7 hours in the car, on the road, with my laptop, and the result is one really kickass "stage 1" tune, with totally reconstructed fueling, boost, load, torque model, knock-control, and all safety features active.
ive also made some changes to the variable camtiming-system, which resulted in a very smooth and strong bottom/mid range.. this is lovely  ;D

i had some problems with setzis logger tho.. it wont let me connect using my FTDI 232R cable.. not in com-port mode, and not using ftdi mode.. i must be doing something wrong here..
ive made an ecu-file from my original bin, and configured it, configured the logging variables, tested all different baud-rates.. slow connect.. fast.. still nothing.. am i missing something here? using the wrong cable?
a bit OT, but id appreciate any ideas..  :)

Try a clean install of the FTDI driver maybe.

Incidentally, Argdub posted a winols definition for this S/W version (HN)  if it helps with your xdf!

There's also a CSV export http://nefariousmotorsports.com/forum/index.php/topic,576.0title,.html