NefMoto

No more clips or desoldering... here is my EEPROM programer tool.

ME7_95040 is a console application that allows to program ME7 ecu's EEPROM.
It has been tested successfully on ME7.1 and 7.5 ecus.
Tool works with a dumb kline cable, either usb or serial.

For usage instructions, in a command line window run 'me7_95040 --help', it will display the program options with some examples.

Update 2011.11.23 - v1.30 -> /topic,1168.msg11101.html#msg11101 (http://nefariousmotorsports.com/forum/index.php/topic,1168.msg11101.html#msg11101)
  - Added read support over OBD port
Update 2012.01.16 - v1.31
  - Fix bug with 4Z7907551S ECU
  - Reduce CPU usage
Update - v1.40 -> http://nefariousmotorsports.com/forum/index.php?topic=1168.msg21504#msg21504 (http://nefariousmotorsports.com/forum/index.php?topic=1168.msg21504#msg21504)
 - 95040, 95080, 95160 and 95P08 as well as more cpu options.
 - Allow to specify the chip select pin in case the search function can't find it

absolutly GREAT Tool !!!!!!!!!!!!!!

fantastic work !!!!!!

this tool works without problems !!!!

 ;D ;D ;D ;D ;D ;D ;D ;D ;D ;D ;D ;D ;D ;D

Thanks so much!

All I have to say is wow. Great work! Will this work with Windows 7?

edit...It does not open on my Windows 7 system.

Ok.. I opened .cmd and drag the .exe into it, and can now read the help portion I believe. But not sure where to go now.. :P

this application is not for beginners !!! you must know exactly what you are doing !!!

you need skills in comand line application

open cmd.exe go into folder where the me7_95040.exe is

than write >> me7_95040 --help or ( --h)

for read the file it is important that your ecu is in boot mode !!!

it is only possible if the ecu is in boot mode !!

for read the file write me7_95040 -rp 1 eeprom.bin or 95040.bin what ever

than you have the 512 byte file in the same directory

Thanks for the clarification, Doberman!

I'm getting the following error on a 4B0 907 551T '01 A6 2.7T ECU:

C:\Users\Robin\Desktop\motronic\95040>me7_95040.exe -r -p 3 read.bin
Opening COM3 ... OK
Starting Boot_mode ... uC identification response = 0xC5 (C167 derivatives) ...
OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P4.7
Configuring SPI Interface ... OK
Checking EEPROM status ... 0x00F0 ... OK
Reading EEPROM ... FAIL. (error=0x07)
Closing COM3

Any ideas?

Nevermind, changed baud rate to 10400bps and it worked flawlessly. Fantastic tool, thank you so much!

yes you found the error by yourself *g*

you only forgott to set the baud rate !!

yes !!! this tool is FANTASTIC !!!!! i was the first person who was allowed to test this tool !!!

many thanks to ArgDub !!!!!!! with best wishes from Germany !!!

Any idea if this will work on edc15 ecu's ?

from a quick search on the internet, the edc15 uses a 24C04 eeprom. So, it won't work without rewriting the eeprom driver. It can be done but I don't have a edc15 to debug the code.
 

Tool will report used baud rate in next version.

thank to Dobermann and the people who took the time to test the beta release.

Seriously, thank you. This will save me so much time...  ;D

greta tool, but i stil have problems, see picture.
what have i made wrong?

Just tried it and it worked 1st time.. Brilliant.

Thank you...

ECU isn't in bootmode I would guess.

Im glad it works  :)

I haven't had time to test it out. Sorry man.

You have to reset the ecu in bootmode, procedure to do so is posted in the forum.

boot mode is fixed now, but still another problem is here, see picture, any idea?

Sent you a PM

Just want to say what a fantastic tool this is.

I basically had a dead ECU which for some reason when using the nefmoto software and verifying the memory layer corrupted the 95040 chip and stopped the car from starting.

Now I used this software to copy the 95040 .bin from my spare ecu and write it to my old dead ecu and it works.. Absolutley brilliant.

Just to so people know

from the command line
To read the eeprom

C:\>ME7 -r -p 3 -b 10400 95040.bin

I changed the full .exe name to me7 to make it quicker

To Write the eeprom

C:\>me7 -w -p 3 -b 10400 95040.bin

You need the ecu in boot mode by shortening pin 24 to ground and I use a galletto 1260 cable

 :) :) :) :) :)

Works great..Thanks again for sharing this great tool!!

Could I use this for the instrument (Tacho) chip 93C86?

I can rewrite the driver but that depends mainly on what microprocessor the tacho use.

It is a VW Sharan I instrument, which is manufactured by VDO. I would try to open it, check, and find out the microprocessor.

@ArgDub and Dobermann
Many thanks for your help, now it works, GREAT!!!

95040 is the immo chip correct?

Brought my ECU back to life without soldering. Thanks!

Hello Friends

i have a little problem with my car !! we have put a 1.8T engine from a Audi TT into a VW Golf 2

Here is from my ECU the eeprom !! the immo should be off or im wrong ?? im sure immo must be off !!

the car must start but the engine start and stops after 1 sec

please have a look at my immo file

thanks 

Is this from a dealer mapped ecu?

I only ask as I had a simple question here

http://nefariousmotorsports.com/forum/index.php/topic,1195.0title,.html

And some said the immo defeat is done in the flash code by some dealers.

Great work!

My spare ECU needed to be rebooted after reading, then after writing... but it worked awesome!

Here is version 1.3 with reading via OBD support

There is an option I use when I'm debugging the software. Once the ecu is in bootmode you can use option '--reconnect' to avoid the trouble of restarting the ecu between a read/write operation and the next one.

the option "--reconnect" works great, also default baudrate is 10400 now. cool!! (tested in bootmode)
later, i will test with obd.

So, no longer boot mode only??

no longer boot mode only, but only read via OBD is supported for now. If you want to write the eeprom with my tool you still need to open the ecu. This new feature is mainly intended to make a backup before a flash operation, just in case..

BTW, I found that obd reading may not reflect changes in adaptation channels, so keep this in mind if you have made changes with lemmiwinks or a similar tool.

This is fantastic, thanks!

Probably best not implement writing over OBD (if it's even possible) otherwise anyone can disable any immo in 2 minutes.

Agree. Although at this time I have no plans to continue working on the tool, if I ever implement writing over OBD, immo-off won't be allowed

This already exists...
Its an obdii connector with a MCU of some sort in it, you plug it in and select immo on or off. I think I saw it on German ebay.

I thought the Vag-tacho cable could do this but I am not sure.

Vag Tacho can read/write to the cluster - which allows you to read your SKC, but not perform an immo off.

Excellent work on this....thanks so much.

For some reason I have yet to get it working in boot mode...not sure whats going on.

Even if I choose 9600 as my baudrate, it always says its using 10400...has anyone else seen this? Maybe I'm doing something wrong. My com port device is set to 9600 (in Windows).

Also, for OBD mode: I have tested on a VW ECU and it worked fine; tried a TT ECU and was able to get ECU ID but then it failed ; tried a Passat ECU and got nothing. Is it using KWP-1281 or KWP-2000?

Thanks for your input on this. Please post the screen output that shows the error messages.

The baud rate option is intended to be used in boot mode. With --OBD option baud rate is fixed at 10400, as far as I know, that's the only speed allowed by kwp1281 protocol.

OK I'll try to do this tonight.

Awesome work ArgDub! ;D

How are you reading the EEPROM over OBD? My understanding was that most of the pages in the EEPROM are blocked from reading and writing over OBD.

Thanks!

There are three pages blocked, the two that contain the SKC and the page that has the adaptation channels, access to the latter is blocked when the adaptation channels values ​​differ from defaults.
I never tried to implement writing over obd, I made this tool with the purpose to make a backup of the eeprom and to allow people to recover a bricked ecu in case something goes wrong. AFAIK there is no other tool (free or commercial) to program the eeprom in boot mode.

Cool, thanks for confirming my understanding about what you could do with the EEPROM over OBD.

In the past I used EEPROM driver code with MiniMon in boot mode to read/write the EEPROM. The NefMoto software supports reading and writing the EEPROM, but I haven't hooked it up to the user interface for people to use yet.

Hi ArgDub.

May I echo the thanks extended by others. I fancy a shot at reading the EEPROM over OBDII. Bearing in mind my novice electronics/software status, am I like to run into difficulties with the Revo remap do you think? What might I gain from doing this? (sorry for newbie style question).

TTQS

It's been available for years, works for all EDC15 and ME7.. last one I saw sold for a mere EUR 112.
There are newer versions that also work for EDC16 and I think ME9 for about 400.

Fact is, this immo is nearly useless and the only people locked out by it are the owners of the vehicle. Since I defeated it on my A8 4D (after key reading stopped working in cold weather), I helped out several people with the same procedure, but they all had to bring in their ECU. So a program for writing the EEPROM would be quite useful.
I tried VAG CAN Commander 2.5 but it seems it cannot operate on the ECU in this car.

Doug, I don't think you will have trouble with the Revo remap since I read eeprom over obd in a similar way to lemmiwinks, but not having a revo file to test, I can not ensure 100 percent. You can make a backup in boot mode first to be safe.

Managed to read the EEPROM via cheap USB (FT232R) cable.

Does Revo, APR, etc companies (who tamper with EEPROM) "sign" the modified data with their company name or so? Or is there another way to know if the EEPROM contents have been modified?

I was able to read from my bench harness, but this 4z7907551S is driving me crazy. Am I just not in boot mode?

my error:
C:\Documents and Settings\GayRaj\Desktop\chiptuner cable software\eeprom boot mo
de programmer\me7>me7b -w --bootmode -p4 test.bin
Ver: 1.30
Com Port: 4
Baud Rate: 10400
Opening COM4 ... OK
Starting Boot_mode ... uC identification response = 0xC5 (C167 derivatives) ...
OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM status ... 0x00FF ... Expected 0xF0 or 0xF2. (error=0x00)
Closing COM4

Thanks to anyone with any suggestions!

You are in bootmode, you know that when the uC answers with its identification code (0xC5 for C167 mcu).

About that error, seems that the 4z7907551S uses the 95040's write protection feature, thats what indicates the status = 0xFF responce. I have to modify the SPI driver to include the status register write command, check back later I'll be uploading a new version with this fix soon.

Tried old and this new version on an R32 via OBD and it just says
Initializing ..... FAIL (error=0x01)

What do you think. Is bootmode going to be required.

As much as I wish I could have brought the bench harness to work and tried this at my desk, I have to wait to get home. I will try it this evening. I really do appreciate your response/explanation and you taking the time to tweak your program.

It worked like a champ. I successfully read the eeprom immo data from my car, turned the immo off and then flashed that file to spare ecu. Now I can play with the actual tune without having to open the ecu again.
Thank you sir!

can I use a old VAG COM 409 cable with this software? Is it good also a Galletto v1250?
Thank you

Yes


No

And don't forget boot mode required to write

thank you. so, boot mode is again necessary also on this obd version??I didn't understand...

I answer myself...for now, with this software, throught obd I can also read it, I need boot mode!
However, I read now my ECU 8N0 906 018J without problems! File 512 byte in output! Which free software can I use to compare it with another 95040 file?
Is it necessary only the 95040 and 29f800 file to backup after a possible blocked ecu?? Now I have both!
thank you

Strange, the program doesn't work on my A8 through OBD. ECU replies, reading starts.. and fails after a while.

same problem
made  me7_95040 --OBD -r -p 1 95040.bin command
why got only 512 byte file size?

Il Signor Zetec:
Yes, 95040 and 29f800 is all you need to make a backup.

SundayNightDriver:
what exit code is returned? or better, could you post a screen cap?

toplink:
512 byte is the EEPROM size, I think you are confused with flash memory which has a size of 512kb or 1Mb

I'm getting the exact same error on a 2004 R32.  Tried it in boot mode and it gives an error=0x07.  Cycle key back into regular mode and it gives error=0x01 again.

Any help?  Trying to drop in a new ECU into this car that is currently on a GIAC turbo map.

Thanks!

how do i get flash memory file?
which software tools?

hello I new how to read an save eeproms if you ar instrested how to do it I can make a video and upload here

So I have a 95080 IC on the back of my ECU.  95040 is 4KB and 94080 is 8KB.   Will this tool work?

Anyone know how to extract data (VIN/SKC etc) out of the dump file? I think I need to know the memory start/end locations for each piece of info and also maybe convert from hex(?) to decimal.

Have you tried reading it with me7_95040? you can get the SKC using the option --SKC.

No haven't tried it yet.  The ECU I'm working with is a spare but I still don't want to damage it in any way.  So I figured I'd ask before attempting to read/write. 
I did find this thread:

http://nefariousmotorsports.com/forum/index.php?topic=1195.0title

Three or four responses down it does speak of how to convert info in the dump file.  $30/$40 address locations, swapping the bits and converting to decimal.   
I will try me7_95040 tonight though.  Attempting to read probably won't hurt anything.  It may just grab the first 512K of my IC instead of the whole 1024K. (?)

Steve, what is the ecu #?


That's what --SKC option does, dont remember exact address locations though.

The ECU is labeled as a 4Z0 907 551 R and it supposedly came out of a 2004 Audi A6
When I connected with VCDS, it reported it as 4Z7 907 551 S but was soft coded as a automatic(TIP) A6. 
I'm ok with the "S" as I’m putting this in my ALLROAD and VCDS reports I currently have the S load on my (working) Allroad ECU.

They are both ME 7.1.1 and both should be BEL 2.7T motors.

I have not opened up my working ECU to see what kind of IC is on that one.

And from doing some further reading on these forums, it seems that the BEL/7.1.1 Allroad & A6 ECU's are VERY finicky about entering boot mode.   That said I'm leaning back toward
Just reading the info off my stock ECU, flashing that data to a new IC with a standard programmer and swapping the IC onto the PCB.  I assemble prototype PCB's at my job  so I have access to all the right tools.   I would eventually like to try boot mode/flashing and all those fun things.

I did order some replacement IC's from digikey in case I have to go that route.

I have used it on a 4Z7907551R with 100% success over OBD read and boot write. No issues... what baud rate are you using?

I haven't yet tried to read or write. I was all set to de-solder/read on a programmer until someone pointed me toward this thread & ME7_95040 program.

I'm happy to hear that you've successfully read and boot/write to the same ECU!   Did you find it was finicky? I've read that alot.    I have to research more, but do you know of a good thread to guide me on boot mode? I believe I have to ground pin 24 on the flash memory IC on the top side of the ECU? Just rattling that off the top of my head, not sure if true.

Well,  I'm connecting to the ECU and it's starting the read process. I've tried it 15-20 times and each time it fails at a different point in the read cycle.  Sometimes it fails just after connection and sometimes it fails when the ......... is almost to the right side of the screen.  Monitoring my power supply and I have a steady 13.98V.   Not to say there couldn't be some AC ripple on the supply, it's a cheap(er) radioshack model from 20 years ago.  I will try a PC power supply tomorrow; any other ideas?  Going with default baud rate (10400)
  error is 0x07.

Error 0x07 is time out. Are you reading in boot mode or obd?

Reading in OBD mode.  I don't think it's the fault of your application though. 
I'm using a blue ebay-special OBD cable.  I noticed that when I use it to connect to the ECU with VCDS lite, it was dropping the connection quite a bit.   I did switch over to a boost box (to get a nice clean DC voltage) and was able to get 2 good reads out of 4.  So I believe my power supply had too much AC ripple which made the ECU/OBD cable flaky.
 Anyway, it pulled the SKC and the result matched what vag commander pulled.  I should have a clean .bin pull.  I downloaded the NEFmoto software but don't see where I can open the .BIN to look at it.  Is that the right choice of software to view the .bin?   I also noticed that even if I use the -b switch and put in a lower baud rate (like 9600) the application still reports it's connecting at 10400.

Do you think the timeout could  be because it's reading a 8kb IC(95080) and not a 4kb (95040)?  Since I got a couple good reads I'm guessing no but thought I 'd throw that out there.

The baud rate option is for boot mode only. Baud rate while connecting with kwp1281 protocol is fixed by the ecu at 10400.

Tool won't work in bootmode without some changes, just checked the 95080 datasheet and found differences with 95040 on the 'Read from Memory Array' instruction format.

I'm more inclined to think that the problem lies in your bench setup.

ah lame.  Guess I'm back to reading/writing via a chip programmer.  No biggie I guess.  What can I open my BIN with?

Hmm...

im having problems with this. Everytime i open it up i just get a mesage that the command --OBD is not recognised as an internal or external command.

Anyone shed any light on my failings

Can you post the EXACT command that you're trying?
E.G. this works for me:

ME7_95040 --OBD -r -p 4 test.bin

Run the app / OBD mode / READ / port 4 / file name=test.bin

It wouldn't work for me if OBD was lowercase (obd) which is weird.

Try just running ME7_95040 and it will list all of the valid commands.  Did you download the latest version?

Command line arguments follows the posix convention, that means they are case sensitive as Steve pointed out.

Btw, Steve, I don't have a 4Z7907551S to test, but if you are interested I'll work with you to fix any compatibility issues.

Thanks, I appreciate that.  I'm going to iron out my bench setup before I bend your ear any more.  I will report back.  Right now I can't get my ebay cable to connect to my ECU via vcds lite anymore (something that was working well a few days ago) so something's definitely up with my setup.  I bought some capacitors to put on my DC output, hopefully to absorb any AC ripple in my supply. I'm also going to shorten all my bench wires and get rid of the redundant connections.
  Incidently, I also have a vag + K type cable (from EBAY) which I can't even initiate communications with and a real-deal ross-tech cable.  However the ross-tech doesn't show up as a PORT in my device manager so I don't know how to use it from the command prompt.  I don't think the ross-tech can be used as a dummy cable like the EBAY ones.

Ok, made some good progress today. (better than I thought) Cleaned up power and wiring, switched to a different cable and I'm back to getting consistent reads from the ECU.  I was also able to get into Boot Mode on my first try. (today)  Can't find where the log file is (if it exists) so here's a screen shot of what was returned. I think this will mean more to you than me, might have to do with the 95080 IC instead of 95040?

(http://gallery.quattroworld.com/d/32203-2/bootmode_fail.JPG)

Great software friend, will be awesome if it can be updated for other serial eeproms like 24Cxx or other Motronic versions. Really useful!!!!!!!!!!!!!

Steve, great work cleaning up the wiring. Try with last version (1.31), I see you are using v1.30.



As long as the ECU uses a C166 uP, I see no problem to extend support for other EPROMs. What ecu you have in mind?

 :-\ :-\ I was looking for 06A906018xxx ECUs but mine 018CG M383 one uses an Intel AN87C196KR.

Well I'll check back in 3 or 4 days.  Fried my test ECU with static. Can't talk to the ECU with any cable/program.   :-( ahh wall-to-wall carpeting  F me

Hi does any body have a L box, well 4B0 907 551 L stock eeprom bin? Can read and write eeprom just can't connect to flash stock bin to get un bricked... :(

Tada!!

Successfully read the EEPROM, then brought the ECU up in boot mode and wrote the same file back to it.  Not bad. 

Now, only problem I have is I've been able to connect to two different ECU's with my bench harness setup, but when I attempt to connect to the ECU in my car, I get repetative time-outs.  So I can't get a read from my working ECU to flash to my "new" ECU. I'd prefer to not pull my good ECU from my car and connect it to my bench flash setup in case something should go wrong.

(http://gallery.quattroworld.com/d/32396-2/ME7_Write.JPG[font=Verdana][/font])

Bahh....one successful read/write session and about 30+ failures.  This "S" box is a real PITA.  I've tried two different ECM's, three different cables, two different power supplies and I still can't get consistent read/writes.


Update: Well, for anyone else who's interested, I think I finally found the "key" to consistent reads/writes.  No mystery as I read it in a few other threads but I started leaving 5-10 minutes between attempts.  (powering down in-between of course)   Since I started doing that I've had 4 successful reads and 3 successful writes.  I don't know if all ECU's require this much pampering but mine does.

So, in bench there is no issues to read/ write the EEPROM either over OBD or bootmode, right? If you are having trouble reading Sbox with the ecu in the car probably this is due the instrument cluster disturbs the communication.

Correct, no issues on the bench.  Another thing I did was dis-assemble and remove the extra wires coming out of my junkyard ECU connecter. (it was fully populated with wires) There's only a couple now.
  I haven't gone back to try the ECU in the car again.  My first attempt at connecting was with 3.0.  After I realized I was using 3.0 I then switched to 3.1 but at that time I hadn't been using a 5-10 minute wait period.
  Wondering if I should just unplug my instrument cluster?  Still being a little cautious about actually putting my good ECU in my bench setup.  Probably just paranoid.

I should add that I was waiting 30-60 seconds (powered down) for all my experimenting prior to this but that doesn't seem like it was enough.  I noticed the PCB does have two fairly large capacitors (compared to the majority of the microscopic one's used on most PCB's) so those might take a while to dis-charge.

UPDATE:
 Unplugged my instrument cluster and was able to get a clean read (no failures at least) on my first try; ECU installed in car.   Will flash that file to my spare ECU tonight.  Do the ol' switchero tomorrow. 

UPDATE:
Flashed my spare ECU.  Connected with my genuine vag-com cable and the VIN (etc) info that comes up matches the ECU in my car.  me7_95040 -SKC reports same skc code as what's in my car as well.  Lookin' good!

Well I believe I have success. Swapped in my flashed ecm, connected with vcds, cleared all codes  and then fired it up. Car stayed running, no CEL,. Restarted three more times, no problems. Sweet! Finally. I'm now equipped to train others LMAO

Great!! I'm sure you are ready to train others ;D Thanks for posting the solution.

please,i have problem with write eeprom, it write me: no response from ecu ?

how to give my ecu to bootmode? ecu is me7.5 06A906032HN

Guys cant get a copy of my eeprom via OBD.
I tried with and without instruments clusters connected.
I get 0x0B, 0x07 & 0x01 errors.
Havent tried via BOOT mode.

Ecu is ME7.5 06A906032RP.

Error 07h is time out, error 01h is a general error (think I have to include a better description about this error) and error 0Bh is check sum (communication chksum) which is strange because its only used in my kwp2000 library and me7_95040 only uses kwp1281.

I'll PM you a new version with more detailed descriptions.

I'll wait for this  :)

PM sent  ;)

PM answered  :)

Well im failing miserably trying to read the 95040 from my ecu via OBD, i usually remove the ecu and clip the chip to read them but im determined to read with your software ArgDub, btw thanks for releasing this cheers.

Ive tried diffrent ports diffrent directorys removed instrument fuse but keep getting 'error 0x01'

the lead im using is a cheap serial vagcom lead with ftdi usb -232 converter, maybe this is the problem? not sure but this lead works fine any other time.. eg.. nef software/vagcom software etc..

as the audi a4 ecu's are a pain in the ass to remove i would really like to get this working.

one other thing to mention nefmoto software has trouble reading the ecu on this car, any other audi ive used nef on (5 diffrent audi a4's) it reads first time everytime (vagcom software works fine everytime with this car)

nefmoto connects to the car but keeps failing on read, i managed to get one full read out of approx 40 tries.

Audi A4 1.8T (163) AVANT 2003
ECU: 8E0909518AA

any idea's with your software ArgDub??

Thanks
Col

here is pic of log

I added more diagnose details to the returned error codes. Please try this version

thanks m8 ill try that....

ive removed the ecu now so ill try the new software on bench and when the ecu is back in car.

Cheers
Col

bench/boot mode read works great but still no go over obd

error 0x50101

im doing this to get the pin code to login the cluster to add a new key/transponder to the car (remote locking has been coded and works) is the 95040 pin and cluster pin supposed to be the same? becasue no matter what i do i cant login to the cluster with vagcom but i can login to the ecu with pin i got from ArgDub's software?


Col

Is your cluster matched to the ecu? once matched the SKC code should be the same. I'll check the error 0x50101 when I get home.

im not sure if its matched how do i check?

ill have a google and research it a little.

Thanks

i dont think the cluster is matched to the ecu, ive just noticed a crazy looking VIN in the cluster, its partly correct but the last few digits are wrong.

ill try correct this then hopefully the pin will work and your software may work.

Thanks

reading through ross tech website i need the cluster pin before i can correct the incorrect cluster VIN.. this is a nitemare.

I have Vag-Can/VagTacho and read the cluster eeprom with programmer and they keep showing diffrent pins which none of them work, VagTacho dosnt actually work just says 'Unkown immo' when trying to read pin.

nevermind thanks anyway for your help.

ok managed to correct the VIN in cluster, i edited the dump with 'HexEdit' and flashed it back to the cluster and all is good:)

I could then login to the cluster with vagcom and add my new IMMO3 Key.

also been having lots of trouble with nefmoto software connecting to this car and just found out what the problem was, latency on the com port was set to 1 so i changed it to 16 which is default and the software works perfect no problems at all:)

But the main reason i origianlly posted in here was for ArgDubs software which i still cant get working over OBD?

Thanks
Col

Can this be made to work with ME7 using P8_1 as Chip Select pin?

the EEPROM driver seeks the correct chip select pin before attempt any read/write operation. In case it fails to identify the CS pin, it will show a error msg and quit.

I traced the CS pin to P4_7 on the older ME7, and also found P4_7 hardcoded in the eeprom driver, so I thought that the searching was not really happening. My newer ME7 has CS connected to P8_2. (Edit: P8_1 was wrong.)
But it is also a 0xD5 CPU, so I had to change 0xC5 to 0xD5 in the code to test it.
That might also be a problem I guess.

The eeprom driver returns 7E E4 on an old ME7, but 00 00 on the newer. It should have been 1E EA. (05 command)

The Main? CPU is SAK-C167CS-L40M, the other is ST10C167-Q3/A6

In fact CS pin is not hardcoded, the 0xE47E or BSET P4.7 you see in the driver is relapsed for the right instruction by the CS search function.. you can see in a previous post (http://nefariousmotorsports.com/forum/index.php?topic=1168.msg15649#msg15649) that it detects CS at P6.3.

What's your ecu #? to make it work we have to find a function that changes the CS state and modify the search function in the driver.

My ECU is ME7.0.1 0261207712 Part number 08675760A Serial Number 110440. (Volvo)

In the file around 33300 there are some possible eeprom stuff.
After a closer look it turns out that the CS pin was connected to pin11 on the CPU P8_2.

Hi,

great tool.

Works with a AVG4000 cable in transparent mode, on a RS4 B5 with 8D0907551K ECU without hints.

Thanks for share this.

Tom

any one know if this works with ross-tech hex+can cable?

my tool works with a dumb kkl interface, you can try with ross-tech cable in transparent mode

transparent mode? is it in vag-com setting?

Never used a hex-can cable, I think ross-tech call it "pass through mode".. maybe someone else can give you a more accurate response

how about adding support for the 5p08c3 eeproms found in say 24v vr6 ecus or some newer a6 ecus? my minimon script wont read them over obd. still have to pull it off and read with a programmer. tried to patch it but not sure of the addresses. now if your tool would read those, youd get a cool point from me. :)
nice tool already though, btw.

ArgDubs tool does read 5P08C3 on the older Volvo ME7, but not on newer, so the problem is not the eeprom itself.

right, i would assume its the address area its trying to read is not the same for newer ecus using the 5p eeprom.

could you send me a pm too? have the same problem... "searching chip _select pin ... FAIL. (error=0x07)
closing com4

??

EDIT: downloaded the other version, and get same error, just 0x01 at the end

effing tablet.. new screendump in next post :)

seems the image was empty for some reason.. new try

EDIT: again, a empty file.. new try, this time from the pc, and not from android tablet...

new edit: cleaned up a bit on the bench, and now it works like a charm :)

I have the same problem  with my TT '99 , any ideas/solutions ?

What kind of checksums does EEPROM has?

(http://i11.photobucket.com/albums/a162/laurentpotin/EEPROM/95040Beetle.jpg)

Cool, thanks. Could you elaborate on how to recalculate these checksums by giving example?
BTW: What is BFC? Is sum(octets) from whole file or some zone?

ffff - sum of octets. that chksum starts @ 0x10. try using a hex calculator and you will see.

understood :) Now please look at attached image and tell me if I am correct

i didnt bother to check your second picture but first looks correct.

Ggreat, I think I've analyzed all the checksums in this file except for TWO.
What formula is for the first line (00000000) checksum 5AFF? In tho different eeprom files it is different. Also at 000000F0 looks like checksums are 0A0A. How to calculate them?  ???

I'm already preparing update to my ME7 WIZZ and those two checksums are needed for brand new spreadsheet

I also would enjoy this. I can't get it to work with the 5p08c3. Weird that SteveAR has success with the 95080 though. I'd be willing to possibly send you(ArgDub) my ME7.1.1 ECU for you to poke around on if you'd like?

what you need is a programmer and an soic8 clip or just desolder and read that way. obd tools and such are great but sooner or later it will happen where you must desolder and use a programmer.

thanks very much for this I managed too read 2 eeproms via my bench harness in OBD mode, I am going too try and write in boot mode shortly... awesome!

I have an APR .bin that I want to back up via OBD.  Has anyone done this successfully?

Why is it that when I open the 'me7_95040' file, it opens and closes so fast that I can't even barely get a screen shot of it??
What the hell is going on?

(http://i50.tinypic.com/rclb2f.jpg)

Have you ever considered reading the first post in a thread?

lol.  :D

Of coarse I have... This is whats coming up.... Not real good with command prompt...
(http://i49.tinypic.com/2i8u5b4.jpg)

I figured it out. Had to put file destination\ in front of Me7

thanks?

Is there any type of tutorial to help out with using this thing? Like I said i'm a little fuzzy on CMD prompt.

this program is about as basic as you can get with a terminal app. i mean if you just run the app it gives you the switches you can use and theres only a handful.
i would think that comport, bootmode, and read/write would be the most useful.

i mean hell, it gives you exact examples at the end of the help. lol.

First of all, find out what comport your cable is using. lets say it uses port 1.
press start, write CMD in the searchline at the bottom, press the enter button.

This opens the command window. Now, lets say your folder with me7 files are located at your desktop, and you renamed it "ME7" to make things simpler... type "cd desktop" - press enter- "cd ME7", this should put you in the right map to start the program.

Tell the program what you would like it to do for you.. lets say you want to read your eeprom in bootmode.

write "me7_95040 --bootmode -r -p 1 95040.bin"
This means: start program me7_95040 --the ECU is in bootmode -read eeprom -cable uses port 1 save as 95040.bin

If you read thru OBD swap the --bootmode with OBD (capitol letters), and if you want to write files to the eeprom, simply swap the -r with -w (write).

In bootmode you need to ground the right pin on the ECU to put it in bootmode.

Thats as straight forward as I can explain it.

I have problem using this tool with my other laptop.
For some reason com-ports 1-25 are reserved (many other USB-tools), so my dumb cable generates COM26.
Program rejects this as a valid port number, there seems to be a limitation of some kind.
Port does work normally with other tools, so it's not that.

you could move whatever is using com1 to a different com port and move the cable to com1. (advanced options)

I could do that, yes. I just wanted to point this out, as there is no reason for such limits.

This tool works great,tested it on volvo me7,works.I´m started looking at volvo immos.
Can some one take a look at this,very diferent to vag,can also be wrong readout.
Bosse

Hi Bosse,

Just desolder the 95040 and read it in a eprom reader. Should be fairly quick to do, and you have 100% proof of
the readout beeing a 1:1 match.

B.t.w. what ecunumber did you read-out this file off ?

Thanks,

PvL

I have no eeprom reader.But i did write in a vag file and read it back.100%match.
So i am sure now it´s a corekt read.
I´m going to buy a reader as soon as i can,depending on how manny pair of shoes my wife buying this month.
Ecu.H6,2 0261206272 Just a ecu for testing.
Bosse.

Greatest tool I ever had! Works perfectly! I wish there was such simple one for flashing AM29F800BB  8)

hi

any ideas?? cant get it running on me7.1.1 ecus??! either obd or bootmode... any hints?!


thanks

Seems that the r32 use a different derivative of cpu, I sent you a program to dump the cpu iram, I need the chipID registers to add support to that cpu.

^ im pretty sure its also using the 5p08c3 eeprom.

I'am making my own obd to serial cable, is K-line the only pin that will need to be connected, and what pin no on the 9-pin com will I use.
Very nice work, thank you ;D ;D

You need Ground and K-line on the car side, and Tx, Rx and Ground on the PC side.
RS232 pinout is all over the net.

You are aware of the fact that you need to create an interface circuit and not just a cable?

It's easier to just order a $5 KKL interface on ebay or aliexpress.

OK thank you, so "dumb" cabels do have an interface that "splits" up the K-line into Tx Rx ?

Yes. "dumb" might be a bit misleading.

A "dumb" cable will only combine Tx,Rx and K-line and do the voltage conversion/inversion.
The computer will do all the data processing and must also handle the echo it will receive when sending a byte to the ECU.
The echo will come because the passive components will register a voltage change on the K-line regardless of which end is responsible.

If the computer is too slow, the ECU will normally stop the communication.
An LM339 and a few resistors is enough to make an interface. Some capacitors should probably be installed to filter the signals.


An "intelligent" cable can be like ELM based interfaces. The interface has a CPU and software on it that can initialize and communicate with the ECU on its own. The PC is free to talk to the interface when it feels like doing so in a special format decided by the interface maker.
The interface will keep the communication going even if there are no new instructions from the PC.

Hi, i can't read the 95040 eprom of a Me7.5 audi S3 ECU , it failed with OBD and Bootmode :

(http://img840.imageshack.us/img840/8027/95040s3.png) (http://imageshack.us/photo/my-images/840/95040s3.png/)

Uploaded with ImageShack.us (http://imageshack.us)

5p08c3 and infion support would be prett cool

Here is version v1.40, I added support to 95040, 95080, 95160 and 95P08 as well as more cpu options. It also allows to specify the chip select pin in case the search function can't find it.

Run ME7EEPROM for help.

Confused  ???
tried to use it but communication failed.
me7eeprom --OBD -r -p4 95040.bin
but fails all the times with 0x21xxx error code.

All recent changes are related to boot mode, I didn't touch the obd part.. but this kind of problems with the ibiza ecu aren't something new, I remember that we couldn't make it work last time.

U are a god.cant wait till i come home to test this new wersion.

will this work with a vag k+can cable?

Havent tried yet on boot mode, all efforts are via OBD mode.
Guess i ll try it soon  :)

BTW, for those of you having trouble to put the ecu in boot mode. When testing the tool on a ME7.5 from a Volvo 2004-2009 model, Robert Arnold from ARDideas figured out that if he activates the program immediately after the ECU gets power, the ecu enters bootmode fine. However waiting just 1-2 seconds and activate the program then he gets an error message. Don't know if these are problems of the same nature but it worth to mention.

Try using the vag k+can cable in transparent or pass through mode

I used ver1.31 to dump my 95040 today, using my HEX-USB+CAN interface, after reading this: http://www.ross-tech.com/vag-com/usb/virtual-com-port.html.

Thanx for this fantastic tool. 

Can anyone tell me if I have got a corect dump, i.e all of the chip/file, I'am going to program a "new" used-ecu with this content.

looks like a good read.

Thank you for your feedback.
This is my first ECU changeover.
Can I simply load this file onto my "new-used-ecu", using bootmode?
And can the "new-used-ecu" be in the car while writing to the 95040?
or do I have to do it on the bench?

This is probably going to be one of my many stupid questions.. but how do I do that?? Tried google, but couldnt find anything... ???

Can this tool be used on a seat ibiza (2002)  siemens ECU? From what I understand its a edc16 chip(?)

Same for me, I keep getting god reads using ver1.31 with KKL cable (with FT232RL chip), using --OBD
 but trying to use ver1.40 I get 0x21007 error. Just FIY...   I love the tool :-)

Trying it on a 5p08c3:

F:\>me7e2p --bootmode 95P08 -w -p3 --CSpin P4.7 a3.e2p
ME7_EEPROM v1.40
COM: 3, Baud Rate: 10400
Memory type: 95P08, size: 1024
Chip Select pin: P4.7
Opening COM3 ... OK
Starting Boot_mode ... uC ID response 0xD5 ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Reading IDCHIP ... 0x0C44: C167CS ... OK
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00FF
Writing EEPROM OK
Closing COM3

Basically it instantly says OK when writing without actually writing anything. 

How do I know which CS pin is correct?  If i don't put anything it fails to find them.  Tried 4.7 and the above happens.  ME7.1.1

Rick

I get:
me72 --OBD -r -p 2 seat.bin
ver: 1.31
Com Port: 2
Baud Rate: 10400
Opening Com2: ... OK
ECU ID response: 03E906033D
                        1.2l/4V SIMO
                        S3  00HS4650
                        SoftCod: 00061, WSC: 06402
Reading EEPROM .FAIL. (error=0xEF01)
Closing COM2

guess it doesn`t work on this car...??

What I would like to do is clone my 5P08C3 (4z7907551 S BEL 2.7T) onto a spare (4z7907551 AA, S-Line) and swap that in as a first step in tuning.  Once I have a working spare I'll feel better about experimentation. 

Using a Ross-Tech Hex Can in non-intelligent mode and with the COM port emulator drivers, correctly installed, the port (COM 4) reports open correctly but then no comms, (0x21007).  Tried v1.31 also, same error (0x07).

Any tricks I'm missing?  Do I need to pull the instrument cluster breaker as with the Nefmoto tool?  Didn't see where anybody else needed to do so, but maybe its just a given?

Played around with a GQ-3x/Pomona clip on the spare today, which worked perfectly.  So making progress.
Terrific site, some seriously helpful folks on here!

It's displaying the wrong message, it should say FAIL, but this doesn't affect the operation. I'll fix this in the next release along with other changes.

There are two option to find the chip select pin, first is disassembling.. or you can follow the CS track with a voltmeter to the ucontroller. Please use this option carefully, if you set an input pin as output you are making a short circuit, this can fry your ecu. What is the ecu part #, I'll take a look.

OBD it's not working with Ibisa and Polo ecus.


The easiest is to just buy KKL cable. For the ross-tech cable, have you unchecked "boot in intelligent mode" in the VCDS options screen? if you have the old Ross-Tech KEY-USB, it doesn't support true dumb mode.

Yes, definitely Hex-Can, and unchecked "boot in intelligent mode".  It seems to set OK (i.e. still unchecked when closing/reopening VCDS).  mort1skoda (I think) got Hex Can to work a few days ago (but I don;t recall with which model ECU).

Guess I'll try the el cheapo cable.  Last resort will be to pull the ecu and read with the GQ-3x.  Seems like there are probably enough options to get me out of a jam if I screw something up.
 
Thanks for the quick reply.

Audi 3.2 022906032GH - Thanks :)

Rick

Will it work on seat ibiza in boot mode?
I ask because I am in spain now, and if it does I could take the ECU with me home to norway and get it done there..

tried today without success...
after a quick research i found that an me7.9.10 could have an 95080 eeprom..
so i hooked up the cable an tried to read but after opening del COM it fails at "Initiating communication"

now my questions are:
how can i check the cable is correct? (i tried with that cheap blue "vag-kkl 490" cable from ebay)
how to check if my ecu is supported? (fiat 1.4 turbo 120hp - bosch me7.9.10)

any idea? :)

ME7.1.1 ori attached :)

Rick, P6.3 is the CSpin.

EnIgMa, read fiat ecus over OBD port is not supported. If your ecu uses a c166 proc and your eeprom is supported, then you can program it in boot mode.

Stompen, I 've read that the Ibiza ecus are a bit stubborn to enter boot mode.. ask user professor, maybe him can give you a more accurate response

Thanks :)

ECU is fixed and back up and running.  I used seeprog to write the e2p.  Next time i get one i'll try it

Succesful read on my 4z7907551 S ('03 A6 2.7T) using a cheap blue cable.  Very cool.  (I wonder why the .bin shows it as an R-box when VCDS shows it as S-box?  I also notice that the 551 AA I have doesn't show any info at all on type of box.)

Main question:  when trying to read the 4B0906018DQ in an '04 Passat 1.8T I get FAIL on initiating communication, 0x50101

Does the code give any real clues?

Ok i flashed a 2000 A6 2.7t with a 4-L box to a stage 1 8-L box. I am having CEL for brake servo and o2 and cant connect to cluster. I read the ecu before flashing fine with Nefmoto and APR immo program and made back ups with both. After flashing the car i saved the immo again thru apr program.

Since the flash I have had problems connecting. Right now I cant get APR program or Nefmoto to connect. But sometimes if I turn ignition on and click connect in nefmoto and me7 eeprom problem and turn ignition to off I will connect.

Here are my results with 1.40

ECU ID RESPONCE; 8D0907551L
                 2.7 V6/5VT     G
                 0001
                 SOFTCOD: 06652, WSC:21503
READING EEPROM .......FAIL. <ERROR=0x21007>
CLOSING COM5



AND 1.31

ECU ID RESPONCE; 8D0907551L
                 2.7 V6/5VT     G
                 0001
                 SOFTCOD: 06652, WSC:21503
READING EEPROM .......FAIL. <ERROR=0X07>
CLOSING COM5


I am using the blue ebay cable with sliver cable. I also have access to a ross tech usb II cable. Please tell me whats wrong or how to fix it please.

Thanks
Kendel

4B0907551 L is stock

I am in obd mode

when I do connect in nefmoto it says I dont have security access. Is there a way I can fix this by re coding the instrument cluster?

This piece of art works like a charm also for 06A906032RP ecu in boot mode.
I used 1.32 version.

ArgDub thank you  ;D

Thanks again for this fantastic tool.

I swapped my ecu with a used replacement today. I did not have SKC for my old ecu or the replacement ecu.  Pulled the SKC from my old ecu, and then pulled the SKC from the used replacement ecu (on the bench, due to immo).  Then used vcds (vag-com) and adapted it to the car using the two sets of five digit pins.

Hey guys.
Just got a Blue KKl cable.
Am going to attempt to get the SKC via the OBD from a APR tuned ECU.

I assume this will not have any negative impacts on the ECU as its tuned.

Unless someone tells me to STOP.
I will give it a go.
Wish me luck

Hey guys.
I have successfully ran the program and got the SKC off of a test ECU on the bench (not in boot mode)

However I am still not going to run it on my APR tuned ECU because of the issues in this post.
http://nefariousmotorsports.com/forum/index.php?topic=633.0

I know they are referring to the flash memory, and we are talking the EEPROM.
But I just need a confirmation that it wont mess with my ECU please.

Tried to use this today to pull the SKC from my ECU so I could program a couple keys to my car. When I run the 1.31 version in the OP, I get error 0x01 when trying to read the data. I also tried 1.40 from page 12, but ended up with error 0x50101. I have a 2003 Audi A4 with ECU 8E0 909 559 D. If you have any info on how to actually read the EEPROM to get the SKC, I would greatly appreciate it. Let me know if you need anymore info to fix or track down the cause of the error as well.

Ok. All is good!

I managed to dump the EEPROM off my APR tuned ECU with no issues.

I can the checksum checker and it came back ok.
Does it look ok to flash onto a spare ECU?
I DUMPED the EEPROM from my spare and its more detailed near the end of the file than on my main ECU.

Just wondering if I get a complete dump file or if its missing pages.

Thanks guys.

I sent you a PM over at audizine.

Try pulling the instrument cluster fuse and then reading the eeprom.

Installed the VCP drivers for the ross-tech cable and used that this time, and now I'm getting error 0x07 (v1.31) or 0x21007 (v1.40). Tried with the fuse for the instrument cluster fuse in and out, same problem both times. It's failing at "Initiating Communication"

Guys, excuse my ignorance, but have you manage to work this program under windows 7?
Ty

I run it in win7 without any problems...

Can you connect actually?
I tried in Win7 via bootmode, program open and you can try to use it but couldnt connect, same error always (0x2something).
I tried afterwards in XP (not XPmode in windows 7, another physical HD) and worked.

Yes. I used this program today on a win7 machine in bootmode, and worked like a charm.

But I see you`re driving a seat.. and from what I hear (and from the times I`ve tried), they can be a real PITA to get into bootmode sometimes..

Hm i ll get my ecu now inside to test it. You gave me hopes, i ll use all usb ports my pc has  :)

Did it was the usb port.
Applaud added just for the encouragement  :)

decided to give this a try tonight. I'm also getting error=0x50101, using version 1.4 on COM2. tried increasing read timeout time with no luck. Tried increasing/decreasing latency settings. Tried increasing/decreasing receive/transmit byte size.

Using --OBD of couse.   Also tried pulling the instrument cluster fuse. Also tried many other COM ports, stopped after COM7.

2003 Audi A4 1.8t, ECU 8E0909518AF.

VCDS, ME7Logger and a number of other tools work perfectly fine.


c:\me7logger>ME7EEPROM.exe --OBD -p4 --screen
ME7_EEPROM v1.40
COM: 4, Baud Rate: 10400
Opening COM4 ... OK
Initiating communication ... FAIL. (error=0x50101)
Closing COM4

c:\me7logger>ME7EEPROM.exe --OBD -p5 --screen
ME7_EEPROM v1.40
COM: 5, Baud Rate: 10400
Opening COM5 ... OK
Initiating communication ... FAIL. (error=0x50101)
Closing COM5

c:\me7logger>ME7EEPROM.exe --OBD -p6 --screen
ME7_EEPROM v1.40
COM: 6, Baud Rate: 10400
Opening COM6 ... OK
Initiating communication ... FAIL. (error=0x50101)
Closing COM6

Could someone explain that what needs to be done in between the read and write?

For example if I want to disable the IMMO, or swap the ECU's?

Ok, I found out the IMMO disable for dummies. So you can read the SKC-code for swapping ECUs, or modify the bin for disable the IMMO.

If you just want to swap ECU`s, all you have to do is flash the new ECU with the immo you read out from the original.

Hi,

Try ver 1.31, that works for me, I never got 1.40 to work in OBD mode
I only got 1.40 to work in bootmode, while 1.31 works for me in bootmode and OBD mode.

 ;D
top job!
many thanks tried and tested with galletto no probs

Hey Tony, now is time to release that e2prom r/w option in your software too! Even if it is at the pay version, i would not hesitate to buy my license.



Argdub thanks for this great tool BTW. I managed to read my eeprom by OBD at first try.

On 4B0906018AA ME7.5 512k was not able to read eeprom via OBD.
Bootmode works well  ;D

Hi professor,can u post the eeprom dump? I have a 18AR i want to convert to 18AA.
Best reg. Bosse

Argdub...Great tool. Trying to get it to work whith volvo me7.1 obd on the bench.Any tip?

Here it is.

Friend told me that he have reduce ignition 3degrees with the help of lemmiwinks, perhaps you should restore defaults after use of this eeprom.

Cheers.

Professor,Thanks!

Argdub  Same as professors 18aa,18ar dont work in obd,starts read ok but fails after a wile.
Bootmode is also messing,will try again.
Bosse

Any support yet for the edc15 24C04 eeprom? I have an ecu I can send you to debug! Really I just need the IMMO deleted but would like to tune in the future. I tried this program with obd and bootmode but it just won't connect.

programmer and test clip is easiest for edc15. thats how i do them at least.

Have you set the VCDS cable to start up in "dumb mode", via the options page? Never mind I see this discussed before, now.

same error here. Any Idea what does it mean?

ok, i really dont know what im doing here but i used visual basic express to make this app.
it will read and write with the click of a button.
this is only a gui for the me7_95040.exe.

it is currently hardcoded to use com port 2. i would like to add a 1-4 variable menu up above the buttons and import that variable in to the command.
hardcoded to read/write in bootmode. will save file as 95040.bin and write 95040_edit.bin.

anyways, i am 100% no coder and this is 100% the first program ive ever made that actually works.
just unzip and run me7 95040 GUI.exe.
for some reason theres a console window in behind the program. again, i have no idea what im doing and its really late but figured i would share.  :-\

Hehe,fun,i did it yesterday.But i came only to thefirst screen.guess i am not good enouth.
My hat it of.
Nice.

I have posted earlier in this thread about volvo 95040 eeprom read.I am an idiot,there is no 95040 in volvo ecus.
I´ts sp08c3.Only in boot mode baudrate 10400.
I only got early 2000working so far,i get a correkt read on edc15,but in hexeditor it´s just ff,i will try anoter cs pinn,next time i am drunk.
Bosse

Hi,

Maybe you can try ver 1.31, that worked for me. I never got 1.40 to work in OBD mode.
I only got 1.40 to work in bootmode, while 1.31 worked in bootmode & in OBD mode.

Hello

Volvo me7 0261208289 1039S5977
I want read out EEPROM flie.
Now I'm using me7eeprom.exe

What number CSpin for this ecu ?

Please let me know........ :'(

regard

Ok,volvo me7.To -01 simens  OK.From -02 on infineon cpu Not readable with me7 eeprom programmer.

How bad is the setup for using the Hex+Com+CAN?  I can't tell from the ross-tech site whether or not I would have to swap the drivers around every time I want to switch from using VCDS to using Argdub's program or Nefmoto.  If I can set it up once and still use all of VCDS, that would be cool, even if I have to remember which USB port to use for which program.

Thanks.
Brian

@machine007
Looks like P8.2 as my newer one mentioned previosly in this thread. But you can verify by measuring on the circuit board.

@Bosse
Infineon works also.

Download some datasheets from a site like www.alldatasheet.com
P8.2 will be pin 11 on a C167CS
On a 5p08c3 or ST95P08B1TR pin 1 will be the CS pin.
Then use some kind of measuring tool to check that pin 11 of the cpu is connected to pin 1 of the eeprom.

But if you have already both read and written the eeprom, then your problem is something else.

thank you very much.
I will be try next week.

I want to make the clone ECU.
Because immo file read from "Master ECU"

Thanks a lot.

rkam,u are right. I dident se the earlier post.
I took a look at the datasheet also.
And if someone like to know Volvo D5 edc15 is cs p2.3 (tested) bootmode

i have download sofware. But it don't indicator Install. why? help me

some knowledge of english is recommended

http://nefariousmotorsports.com/forum/index.php?topic=1168.msg10764#msg10764

please help me with virgin eeprom from Audi A4 1.8T Me7 BEX engine

Need eeprom from : 8E0909518AN 0261208285 1.8T BEX chipnumber 368075

i can flash ecu but give an error message and car not start.

i tried bootmode also but not work.

memory not finish written or something

who can help me??

Give this a shot.

thanks,but i have found the error.

rgds  8)

Love this program!

I have an ECU that I've already read/written to already. However, now I get to Searching Chip_Select pin ... FAIL. I know it has something to do with the ECU.

What might cause this?

Thanks,
Rey

I love the program. and I'm stuck.

I have a junkyard ecu, and I know that without the cluster plugged in it will need to be in bootmode before me7_95040 can do anything with it.  I believe I am getting the ecu into bootmode (kwp protocols don't work), but then neither me7_flasher, galletto, or me7_95040 can connect to the ECU, no matter what baud. Once repowered, the ecu is fine with kwp protocols.

as a junkyard ecu, I know that I will need to immo-defeat it or always bootmode communicate, but I can't seem to get anything to talk to the ecu in bootmode. any ideas?

cmd log attached

me7.1
29f400bb

Edit: apparently mkiv vw's need power to pin 21 as well, per this thread (http://www.nefariousmotorsports.com/forum/index.php?topic=115.15), I'll have to try it tomorrow...

Edit: success after adding a switch to pin3.

Big Big Thx, tool is working great!

it is possible for the vag k + can, to read the me7.5 eeprom in obd mode ? get a time out response.

can the me7_95040 read in obd mode if the clocks do not match the skc code of the ecu ?

sure I have used vag k +can before and not in boot mode to read the eeprom for pin code .

just asking before I have to source an old ecu plug/obd socket to bench flash this thing.

thanks

Yes, this program can read the ecu eeprom (doesn't need to be adapted and matched, I used it on the bench all the time without being near the car). In order to write the eeprom you need bootmode.

Read the entire thread, it's all detailed.

great managed to read the eeprom in obd mode where ,vag k+can cannot ,maybe due to not been able to set the port speed to 10,400

anyway is there a program to read the dump and show me the pin to adapt it or does it have to be done through a hex editor

It must be done with a hex editor. Read the immobilizer sticky.

opened it in a hex editor ,read the sticky on how to read the skc , not really looked at a eeprom dump from an ecu before but to me the eeprom looks corrupt . checked in vcds there is now vin or immo data when reading the engine

could someone confirm this before i solder to the pins in the ecu so i can flash either the virgin dump or an immo off one.

thanks

The Immo is on in that file, and the SKC has been FF'd out? What are you trying to accomplish there?

The reason the vin and immobilizer ID are coming up XX'd is because they were XX'd in the bin.

i either need to defeat the immo or read the skc so i can adapt the ecu to the cars cluster and key . there is no vin showing in vcds for this ecu , measure block 91 shows 4 as though its adapted but the immobilser is showing  blocked in the cluster .

the ecu is part off an engine conversion . i was given the car to "get it running" after the person who fitted the engine ,chopped wires and also snapped the original transponder for the ecu . i do have the clocks but they are B00 and cannot be read even with abritus .

the car now starts but cuts out when the immo kicks in

forgot to state that is the untouched dump from the ecu . i have no history of the donor car or even if it was running before the transplant.

There is no skc in that dump, it's FF'd out. Here is your dump immo-off'd. I tagged it because the immobilizer sticky details everything you're asking. You can remove my tag but will require research. That being said, the car will start and run with this file.

thankyou for the file ,i didnt post it up to get it sorted ,saying that i am grateful for the file .it posted it up to confirm that there was no   skc  in the file rather than flash another file to the ecu if it was good and i just wasn't looking at it correctly.

i do wonder though maybe the donor car was cheap as it obviously wouldnt run in this state 

I see no reason to FF out the skc. Sorry if I came off harsh, but the sticky covers all of this. Write the file, car should stay running.

DD

think im explaining myself wrong here , i havent ff out the skc at all , i think the eeprom has corrupted trying to read it with vag k+can and the original 1.4 clocks in situ .could not gain access to the eeprom
even tried abritus72 with no success .
this program in this thread  is the only one capable of access to the eeprom whilst in situ in the ecu .

only after reading the whole thread and the the immobiliser thread did i attempt to read it in a hex editor .
i have edited bin files from vw cars before to add functions to the clocks .

when i opened the dump it looked incorrect as the address was ff,ff i was just wanting confirmation.

i have edited the original file which i uploaded here and added an skc  , just trying to work out how to use the checksum program to correct the checksum.
i am correct to have added the skc of 7229

The immobilizer is still on in that file, and you added half an SKC. The skc is mirrored in the location directly underneath 32 and 33, you need to modify those bits as well.

In addition, bits 12 and 22 have to be set from 01 (on) to 02 (off).

And the eeprom wasn't corrupted, someone (I never thought it was you) obviously ff'd the skc out.

right understand you on that now ,i would rather have the immo on if possible, as i understand it if the skc matches the one in the cluster, then the ecu would start the car as it would then be matched .

just cant seem to get the cmd's right to correct the checksum

Name your eeprom on.bin

When you have the exe and on.bin saved in your user directory, run CMD, and type:

95040sum bad.bin good.bin

then, you can open your user directory, and the good.bin will be the corrected file.

If you can't get it, start a new thread. No need to clutter this one.

thankyou so much for your patience ddlillinger i was missing the sum after the file name ,edited the bin and mirrored the skc  and corrected the checksum .
just have to reflash it to the ecu tomorrow

managed to flash eeprom today  didnt have the correct plug just used a set of croc leads from maplin .

car now runs
many thanks dd

Hey,

i've some problems with flashing in bootmode...

so problem is that i can't read anything on ecu with bootmode. in normal mode everything works fine..

the errors are: "no response from ecu (0x08)" and "bootmode ... fail (0x07)

I supply the ecu with ~13,5V and grounded pin 24 for the first 2-3 seconds after switching on the system.

The cable i use is a normal OBD-cable with RS323 and KL-line support. A friend of mine means that this is working fine at hims setup..

Using 1.40 on a ME7.1.1 in a RS6 I get errors: 0x501010 and 0x21007.

command line args :  ME7EEPROM --OBD -r -p 1 rs6orgin.bin

I have tried cycling the key before running, connecting with VCDS and then running, turning key on with trying to connect.

Any tips? I just bought the car and would like to backup the EEPROM before I try read the flash.

Thanks in advance.

I get a lot of x07 errors with OBD on 7.1.1. Bootmode the eeprom, it'll read just fine.

Hi Guys,

I'm noob in flashing ME7.5 that's why don't kick me a lot for my dump questions :)

I want to swap my ECU M3.8 to ME7.5 (photo is below) (AUQ engine). As far as I understood my first action should defeat IMMO in the new ECU (ME7.5). According to this could someone explain or give me the URL with explanation which pins I should use in ECU in order to read/write my ECU "on the table" with the mentioned programm not in the car through OBD?

Thanks in advance!

(http://golant.users.photofile.ru/photo/golant/96680328/xlarge/130244790.jpg)

Regards,
Oleg

Oleg, start here (http://nefariousmotorsports.com/forum/index.php?topic=417.msg2922#msg2922)

Thanks a lot!!!
That is what I wanted.

Or you can use K+CAN commander 2.5 to read the eeprom too ;)

I fell in love with the speed at which I can do things in CMD as opposed to cumbersome GUI's. Never thought that would happen :)

Good day!
I have ECU 4b0906018CM (working KWP2000).
Soft dont work.
I think it's in the protocol.
Is there a solution to this issue?

Try bootmode. Whenever I have a problem reading, I use bootmode. 1/10th the time, and always works.

Thank you, and do it!

ArgDub thanks a lot! Your programm is very nice! I've managed to read EEPROM from my ECU in bootmode. But now I have some new questions :)

1. Can I leave 2kOm resistor soldered to flash chip for always? I've noticed that I could connect to ECU with bootmode in several second after switch +12B.
2. As I understood I can only EEPROM read/write with this programm?

Regards,
Oleg

hello..great program!

i have a problem..i can read the 95040 from my 8n0 906 018 S but i can't write..i keep getting this error...what can i do?thanx!

i managed to write without error the immo off file.but i dont get one thing...i have a 8n0 906 018 S ecu..if i write the 8n0 906 018 A flash in it ( both are 29f400bb) , vag-com doesnt recognize the ecu anymore....why?

thanx in advance!

Do you Flash in boot mode?
Try to write with boot mode.

yes...galetto 1260 in boot mode..

I have next situation I bought a spare used ME 7.5.10 ECU and I don't have its pin code, I know my original pin code from the ECU I have now on the car. If I install the spare ECU in the car and try to start - the immo will come on . In this particular case is it possible to read over OBD not in bootmode the content of 95040 chip with ArgDub tool ME7_95040 in order to decode the pin from the spare ECU

In other words:

Has somebody succeeded to read the content of 95040 chip with ArgDub tool ME7_95040 over the OBD port from an ECU not matched with the cluster?

I guess it's not possible. In order to connect through ODB the ECU should authenticate successfully with IMMO.

Even if I'll remove the cluster fuse? I mention that I can communicate with not matched spare ECU with vagcom , it's possible to scan and show stored dtc's , I even erased the dtc's from this spare ECU without being matched to the cluster ?

As far as I know if the ECU didn't authenticate with the cluster you can do only several things with it (read DTC, etc) and the car can't work properly as well. In order to connect to the ECU in boot-mode or OBD (for reading and writing flash/eeprom) you should defeat IMMO or enter correct PIN code in ECU's EEPROM. Or just duplicate EEPROM into your new/spare ECU.

and you think it could be done in boot mode or bench mode? bench mode is preferable over boot mode - I'm talking about reading EEPROM with ArgDub's tool

You can use boot-mode in bench. BTW I managed to read/write my EEPROM from HN-box only in boot-mode with the ArgDub's programm. How I did that http://golant.users.photofile.ru/photo/golant/96680328/xlarge/130404903.jpg

"bench" is not a mode, it is the practice of connecting to the ecu on a workbench as Golant has shown (outside of the car).

for these ecu's, you need to open the ecu and do a little dance to get them into bootmode, which is easier to do on the workbench, and is why the terms are frequently mentioned together. example: "bench and bootmode it"

I thought bench mode is to have a harness, an OBD connector and a 12 V DC source  to connect to the ECU outside the car but -without inducing the boot mode state of the ECU by opening the case and ground the correct pin- bypassing the cluster .

So did somebody succeed to read EEPROM of the ME 7.5 ECU with ArgDub's tool through the OBD port ?

Argdub's tool is hit or miss via OBD. I don't even bother trying anymore, I just bootmode. Reads in 1/10th the time and never fails.

But to answer your question, yes, I have used it via OBD on me7.5, and it has worked several (but not all) times.

Thanks very much Ddillenger for your very clear answer , the second question is if you succeeded reading the EEPROM through OBD of an spare ECU not matched with the cluster - reason not known pin code, or it doesn't matter so the reading can be done through OBD for both situations matched and non matched ECU's with the cluster?

Could help in this particular situation of not matched ECU - removing the instrument cluster fuse 11 or both fuses 11 and 15

It can be read via OBD even if not paired to the vehicle.

Thank you very much DDillenger , that's a very good news , as I don't want to open the ECU box and solder a wire to ground the pin in charge with booting mode of the ECU :)
I will do the operation this weekend and let everybody know the results, hoping to be a successful reading

   

Just tried it couple hours ago. It can be read without taking off cluster fuses.

I'm on my way to where the car is parked , trying the EEPROM reading after connecting the spare ECU in place of my original one.
I'll post the results.
Thanks for the info.

I Just read my spare ECU's EEPROM 95040 through OBD . IT worked like a charm and it took only 1.5 minutes, I want to mention that the ECU was not paired and it was read with ArgDub's tool after it was connected to the car without removing the cluster's fuse. After that with DDillenger -how to guide- I learned the SKC of the spare ECU and paired with my car cluster using VagCom. Everything went from the first time and all the procedure with the car running at the end with the spare ECU took less than 10 mins.
I thank you everybody , this is an awesome SITE.
Next that I have a spare working ECU is to write a new map in order to accomodate my supercharger to my NA engine without having DTC's and sustain a good fueling
Thanks ones again everybody for their input.

Okay guys, I can't figure out why this doesn't work. I've tried everthing.

I have 4 different cables, 1 Ross-Tech old-school HEX-COM interface. 3 different variants of blue and black vag-tacho-like interfaces.
The one I'm trying now is a blue one with a FT232RL chip.

Set up using COM 1, baud rate set to 115200 in Windows XP sp3 under VirtualBox.

I always get error 0x50001 without seeing any communication with the ECU.

The Ross-Tech cable communicates effortly via a prolific usb-serial adapter in this setup.

ANY pointers would be appreaciated!

Oh, the car in question is a 2003 Audi A4 1.8T engine code BFB (think european AMB).

Cheers!

Hello and thank you for the great tool.

I'm trying to get this to work bootmode on a 2005> Volvo ME7 ECU with 95080 flash chip.

I get the following:

Starting Boot_mode ... uC identification response = 0xD5. Not supported. (error=0x01)

Are there any other avenue that I can explore or am I stuck desoldering etc?

Many thanks..

same error i get dreamR, it doesnt do this with older 99 me7 from volvo's :-\

Got it to read 100%!  I assume writing will work but haven't tried.

Thanks to a friend who helped (rkam).

The bin file was a 1:1 match from the read I took with my chip programmer off-board.

Here is the console output if it helps anyone:

mind sharing how you got it to work :-D i went the old school method with mine, worked though, ofcourse i dont plan on frying my ecu again

edit : nvm, i read your commandline, thanks

noob question  :-[ but has anyone delt with error message boot_mode fail no echo from cable error=0x07? I am jumping pin 24 to ground via a switch I soldered from pin24 to the outer section of the PCB and if so what might be causing this issue? I have successfully read this ecu with my current cable and I am currently using version 1.31   

I had this when I first used it yesterday, I updated the FTDI drivers from the site and set the cable to COM1 instead of 10 then rechecked my connections and it worked.

Not sure which one of those fixed it to be truthful.

Hi there,

I've got issues writing to my 95080, I can read fine which makes me think it's some sort of write protection?

When I use your exact same argument except I use 95P08 instead of 95080 and P6.3 instead of P8.2 I get: error: too many arguments specified...

If I use bootmode to try to read without the CSpin and P6.3 I get:
Starting Boot_mode... uC ID response 0X00. Unknown ID. (error=0x40201)
My chip is 95P08C3

If I try to do a bootmode write I get an error of: Invalid file size 'file.bin'.  (error=0x3010C)

This in an a ME7.1.1 from a D3A8 and again the eeprom chip is 95P08C3
Here is a sample read I got from using a couple of various tools...
Any ideas Argdub?
And thank you for this wonderful tool

Which version are you using it HAS to be 1.4

Yes I am using 1.40 from page 12 I think it was

Hmm I just noticed something odd that may explain the write error.
On my computer the file shows as 1kb so I didn't think anything of it, but I just noticed that when I uploaded it to here it shows as 512. I took a pic of the chip on the board and it is indeed the 5P08C3.
Now i'm corn fused...

So I am just trying to understand the checksum calculations. I know there is a utility to do it, but I want to know exactly how it works.

I understand 0xFFFF - (Sum of Octets) but that seems over simplified.

It looks like it is actually 0xFFFF - (Sum of Octets) - (row offset from 0x10)

The above is where 0x10 counts as the 0th row. This mostly makes sense to me but why is row 0x10 and 0x20 the same with a checksum offset by 1, but then rows 0x90 and 0xA0 are the same values as well but the checksums are exactly the same? Same thing with rows 0x70 and 0x80.

ME7 EEPROM Checksum-Guide
=========================

The ME7 EEPROM contains 512 bytes and is divided into 32 pages with 16 bytes per page.
In the ME7 code you will find a table with 32 entries that contains one descriptor word for
each eeprom page. The index into this table is the eeprom pagenumber (00..31).

The descriptor word is a bitmask, the following bits are relevant for the checksum calculation:
 bit 0 = checksumPresent(CS)   1 -> page has checksum,  0 -> page has no checksum.
 bit 6 = cksumBit(CB)          this bit is subtracted from the pageNumber to get the
                               same checksum in backup page as in original page.
 bit 7 = backupPage(BP)        1 -> page has a backup page.

Here is how the eeprom page info table looks like:
PAGE   DESCR-WORD  -> CHECKSUM-BITS
-----------------------------------
00      FF18       ->    --
01      0017       ->   (CS)
02      0117       ->   (CS)
03      0207       ->   (CS)
04      0307       ->   (CS)
05      0437       ->   (CS)
06      0533       ->   (CS)
07      06B7       ->   (CS) (BP)
08      06F7       ->   (CS) (BP) (CB)
09      07B3       ->   (CS) (BP)
10      07F3       ->   (CS) (BP) (CB)
11      08B7       ->   (CS) (BP)
12      08F7       ->   (CS) (BP) (CB)
13      09B3       ->   (CS) (BP)
14      09F3       ->   (CS) (BP) (CB)
15      0AB3       ->   (CS) (BP)
16      0AF3       ->   (CS) (BP) (CB)
17      0B32       ->    --
18      0B10       ->    --                           
19      0B10       ->    --                           
20      0B10       ->    --                           
21      0C37       ->   (CS)
22      0D33       ->   (CS)
23      0E33       ->   (CS)
24      0F33       ->   (CS)
25      1033       ->   (CS)
26      1133       ->   (CS)
27      1233       ->   (CS)
28      1235       ->   (CS)
29      1235       ->   (CS)
30      13B7       ->   (CS) (BP)
31      13F7       ->   (CS) (BP) (CB)

If the checksumBit(CS) is set for a page, this page has a checksum.
Calculate the checksum as follows:
- sum up the first 14 bytes of the eeprom page in a 16bit variable.
- add the page number to the sum.
- if the checksumBit(CB) is set, subtract 1 from the sum.
- negate the sum (this is not the same as complement!).
- store the resulting value in the last two bytes of the eeprom page,
  first the low-byte, then the high-byte.

Disclaimer: this information was collected to the best of one's knowledge, but I won't give
any guarantees for the correctness of my information. If you find any errors, please correct.
Have fun, mki

Great! Thanks! Makes everything clear now. Just waiting for me EEPROM programming in the mail (didn't wanna mess with doing it via OBD for now, and it's good to have a solid backup plan).

hi i know this is abit late just wondering does the software put the ecu into bootmode or do i need to open the ecu thanks

You have to open the ecu and put it in-to bootmode, then run the software.

Looks like a great tool for the EDC16C39 with 95640 EEPROM !

But will it work with that EEPROM and galetto clone ?

Thanks , it is really working on ME7.5 . ;)

Finally figured this out and tested it , for the newbies like me ..

Add up 0X00001 to 0X00010 (upto just before the check sum start) = Y
FFFF - Y = AB CD , but reverse this for the checksum IE CD AB

Do the same for the next line but use FFFE - Z

Hope this is clear ..

Hi,
Is there any source code available for this utility? I am attempting to flash the EEPROM on Volvo ME7 ECUs. I am experiencing the same problems as described before with writing back the EEPROM contents. Reading seems to work fine. I was hoping to figure out what part of the writing process is failing on these ECUs and attempt to correct it.
Thanks,
Rob

Once I urgently needed to reprogram eeprom in last HW versions ME7.1.1 ECUs with ST10F275 inside. No apropriate tools are around, me7eeprom soft not operate because of unknown IDCHIP value. Than I made 5 minute patch in 1.40 version of programmer (ArgDub, please sorry) and can do job.
Below is screen log. A3 3.2 DSG 2008 (022906032LA) ECU

D:\ME7 Eeprom Reader\1.40\me7eeprom --bootmode 95160 --CSpin P6.3 -r -p1 eeprom.bin
ME7_EEPROM v1.40
COM: 1, Baud Rate: 10400
Memory type: 95160, size: 2048
Chip Select pin: P6.3
Opening COM1 ... OK
Starting Boot_mode ... uC ID response 0xD5 ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Reading IDCHIP ... 0x1143: C167/ST10F OK
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x0080
Reading EEPROM ... OK
File saved
Closing COM1

I spoke with the author about this issue and the thought was that it was a bug in the driver.  Unfortunately he didn't have an ECU to test and didn't seem too interests (Can't blame him lol).  I ended up just soldering.  The older <04 ECU's work fine though.

Use a hot air station, imo.

I don't think the code is available.

That's a shame. Oh well. I just bought a SOIC8 clip and program the chip directly on the board.
Would have been nice to get this working, though.
I thought I tried writing to the 2002-2004 ECUs with no luck as well, but I might be mistaken.

You have a 50 percent chance of reading on the board, and about a 10 percent chance of writing.

Most of the time I have to remove the eeprom.

That's odd. I haven't had any problems reading or writing. My biggest problem was getting the clip seated properly. Once I got the hang of it, I had no further problems.

Depending on the ECU, it might be necessary to bridge the crystal oscillator with a capacitor or a wire.

Volvo users
This is old notes,i wrote it down last year.
Hopes it right.
Siemens  CS P4.7
Infineon as u know CS P8.2
EDC15 CS P2.3

(http://creativeion.com/rey/vw/help/032RF_error.gif)

06A906032RF 0261208561


Is there anything I can do to read/write this eeprom?

Thanks,
Rey

usually I get
FAIL (error=0x01)

with other tool that I have, I can read it fine via OBD without any issue, but this tool seems to have some bugs

Just want to say thanks for the tool!
Cloned 8E0909559R with internal rom error onto 8E0909559L box.
me7_95040 and Nefmoto to the rescue!

first: big thx to Argdub, this tool is really great!
but i have a question:
i scanned the eeprom of a ME7.5 twice: first in OBD-Mode and a second time (1 minute later) in bootmode. and the files differ. Can anyone tell me which kind of info is stored in this area and why its different in the 2 files?
thx and kind regards

Get the latest 1.4?

elRey: have you already tried to read it via bootmode to see whether the error still occurs?

ArgDub Good Job, Thank you

v1.40 Work perfect with ME7.4.6
EEPROM 25C160 in bootmode as 95160

Yes, in the "Options" screen, there is a check box for selecting "Force Dumb mode". Check this box then close VCDS. Until changed back, the cable will operate in Pass through mode, that is, it won't translate protocols or commands passed over the cable.

I've got the same issue while cloning a RS6 ECU. Has someone fixed this?
When I read the file after this error it has the same content as before writing it with the new file.

I could be wrong, but I'm pretty sure if the write fails the previous code will remain.
I just dealt with this the other day, I too had many difficulties writing the EEPROM to an ME7.1.1 on my 04 A6 2.7t.  I originally had a P0601 bad checksum error so I zeroed out the 33's at 1c and 2c.  I probably made 15-20 attempts, changing baud rates (in the VCP and the command line argument), and using different versions of argdub, I even tried the other 7.1.1 files posted on this thread (model specific, of course) to no avail.  Finally, I got a successful write. 
I took my original 95040 file and zeroed out the checksum errors @ 1c/2c, but this time I also removed immo AND I used the version from page 4 (http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=1168.0;attach=1931).  I'm not sure if it was the version I used, the fact that immo was removed, or if it was just dumb luck, but it wrote successfully.  The car hadn't started for days, but "lucky" for me I got it working just in time to be able to drive to the in-laws for Thanksgiving.
I'll paste my command prompt so you can see part of what I went through.  If you look at it closely you will see the different files/settings/versions I tried, but the last one is indeed successful.  As the great ddillenger told me, the later ME7s are very stubborn, so if it doesn't succeed, try try again.


c:\Users\Public\Documents\ME7>ME7EEPROM -b9600 --bootmode 95040 -wp4 95040fixed.
bin
ME7_EEPROM v1.40
COM: 4, Baud Rate: 9600
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x70101)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b9600 --bootmode 95040 -wp4 95040fixed.
bin
ME7_EEPROM v1.40
COM: 4, Baud Rate: 9600
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xAA. Unknown ID. (error=0x40201)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b9600 --bootmode 95040 -wp4 95040fixed.
bin
ME7_EEPROM v1.40
COM: 4, Baud Rate: 9600
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xAA. Unknown ID. (error=0x40201)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b19200 --bootmode 95040 -wp4 95040fixed
.bin
ME7_EEPROM v1.40
COM: 4, Baud Rate: 19200
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x70101)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b19200 --bootmode 95040 -wp4 summed.bin

ME7_EEPROM v1.40
COM: 4, Baud Rate: 19200
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x70101)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b19200 --bootmode 95040 -wp4 ME7.1.1 OF
F.bin
ME7_EEPROM v1.40
Error: too many arguments specified. (error=0x10A01)

c:\Users\Public\Documents\ME7>ME7EEPROM -b19200 --bootmode 95040 -wp4 "ME7.1.1 O
FF.bin"
ME7_EEPROM v1.40
COM: 4, Baud Rate: 19200
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x70101)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b57600 --bootmode 95040 -wp4 summed.bin

ME7_EEPROM v1.40
COM: 4, Baud Rate: 57600
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xE0. Unknown ID. (error=0x40201)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b57600 --bootmode 95040 -wp4 summed.bin

ME7_EEPROM v1.40
COM: 4, Baud Rate: 57600
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x20D07)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b9600 --bootmode 95040 -wp4 "ME7.1.1 OF
F.bin"
ME7_EEPROM v1.40
COM: 4, Baud Rate: 9600
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x70101)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b9600 --bootmode 95040 -wp4 immosum.bin

ME7_EEPROM v1.40
COM: 4, Baud Rate: 9600
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... FAIL ... No ECU response. (error=0x20F07)
Closing COM4

c:\Users\Public\Documents\ME7>ME7EEPROM -b9600 --bootmode 95040 -wp4 immosum.bin

ME7_EEPROM v1.40
COM: 4, Baud Rate: 9600
Memory type: 95040, size: 512
Opening COM4 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x70101)
Closing COM4

c:\Users\Public\Documents\ME7>ME7_95040 -b9600 --bootmode 95040 -wp4 immosum.bin

Error: unrecognised option `--bootmode'. (error=0x01)

c:\Users\Public\Documents\ME7>me7_95040 -w -b 9600 -p4 immosum.bin
Opening COM4 ... OK
Starting Boot_mode ... uC identification response = 0xC5 (C167 derivatives) ...
OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM status ... 0x00FF ... Expected 0xF0 or 0xF2. (error=0x00)
Closing COM4

c:\Users\Public\Documents\ME7>me7 -w -b 9600 -p4 immosum.bin
Ver: 1.31
Error: 'OBD' or 'bootmode' option not specified. (error=0x01)

c:\Users\Public\Documents\ME7>me7 --bootmode -w -b 9600 -p4 immosum.bin
Ver: 1.31
Com Port: 4
Baud Rate: 9600
Opening COM4 ... OK
Starting Boot_mode ... uC identification response = 0xC5 (C167 derivatives) ...
OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P6.3
Configuring SPI Interface ... OK
Checking EEPROM status ... 0x00F0 ... OK
Writing EEPROM ................................ OK
Verifying EEPROM write ... OK
Closing COM4

c:\Users\Public\Documents\ME7>

After more than 10 tries i gave up and used the pincode to adapt the immo.

Tried this tool today(V1.31) over OBD on my Euro S4(G-box) and it worked right on first try

many thanks

i keep coming up with this.. cant figure out what it means

C:\>me7_95040 --bootmode -wp2 1.bin
Ver: 1.31
Com Port: 2
Baud Rate: 10400
Opening COM2 ... OK
Starting Boot_mode ... uC identification response = 0xC5 (C167 derivatives) ...
OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... FAIL. (error=0x01)
Closing COM2

What ecu are you running?

me7 from an audi s4 8d0 907 551 a

This worked the first time both ways on my 2004 Allroad BEL ME7.1.1
All of this while in the car. Read through OBD my stock ECU and then bootmode the spare one that I couldn't match with VCDS although I had all PIN #s...
The bootmode worked the first time around, even on the moody 7.1.1 to my surprise.  I was ready for it though with the little tool I made and described below changed to a 5k resistor and removing the cluster fuse (#15 on the C5).

I wanted to give some guidance as to how to get into bootmode while in the car AND not requiring help from someone else:
I bought a few things at RadioShark and I also pictured the receipt so you can get just show up at the store and ask for the same reference #s.
(http://i771.photobucket.com/albums/xx354/killerpitou/20140316_102002_zps18105ecb.jpg)
I used some cable from a charger. You need 2 cables, long enough to go from the battery to the inside of the car (4 to 5 feet), the other one long enough to go from the inside back to the ECU location (2 to 3 feet).
On one end of long cable, I stripped for connection to the battery. About of 1/2 inch of visible copper should be good. The other end of the long cable connect (welded for me) to one side of the switch. Top side on picture below:
(http://i771.photobucket.com/albums/xx354/killerpitou/20140316_103951_zps7119de94.jpg)
The other cable will have this perfect croc pliers small enough to pinch PIN 24 without touching the other pins on one end:
(http://i771.photobucket.com/albums/xx354/killerpitou/20140316_103040_zps7cf06e83.jpg)
on the other end, a 1K resistor (I had to go to 5k to work with the 7.1.1 so I ended up welding the 5 1k resistors in the Radioshark package in series, no picture) and then the resistor to the other side of the switch as seen above on the bottom side. Tested the whole thing, pretty good at 982 ohms on and infinite off. Perfect!
Switch ON
(http://i771.photobucket.com/albums/xx354/killerpitou/20140316_104011_zpsc0f44cdf.jpg)
Switch OFF
(http://i771.photobucket.com/albums/xx354/killerpitou/20140316_104022_zpsf02bfac7.jpg)

More pictures of the in situ action:
pin side :
(http://i771.photobucket.com/albums/xx354/killerpitou/20140316_105539_zps215bf3bf.jpg)
It looks like it could on this picture but the neighbor PINs are not touched by the pliers:
(http://i771.photobucket.com/albums/xx354/killerpitou/20140316_105552_zpsf84fbfe9.jpg)
Battery side:
(http://i771.photobucket.com/albums/xx354/killerpitou/20140316_105455_zps1e70bedf.jpg)

Finally, the switch getting inside the car:
(http://i771.photobucket.com/albums/xx354/killerpitou/20140316_105700_zps29bcf4f0.jpg)

Got into boot mode right away once I had the 5k resistance and defused the cluster. You have to turn the switch on before you turn the ignition and wait for about 3-5 seconds. I did all this on the battery no charger but all accessories off, because the 7.1.1 is so picky and doesn't like voltage above 12.5v...
No more excuses. Might have to relocate this post somewhere else Tony....

 

For the Audi 7.1.1 I find just grounding the pin before I add ANY power at all does a fine job.
No resistors at all.
 Now the VW 7.1.1 is a different story. I still haven't found a sure fire 100% way to get that to bootmode everytime.

Hallo all!

I'm totaly new here and found my way when searching for info on eeprom for C167 ECUs. I got very curious when I found this tool, since the whole scene of car electronics claims that it is not possible to read/write eeprom of the ME7.3.1 used in Alfa Romeo. Since this is a hybrid ECU it's not possible to open up the ECU and connect to the eeprom directly (at least with out special tools and a big risk to damage the ECU). The cars that uses this ECU is getting ten years old or more. Sometimes the ECUs fail (not uncommon that a capacitor breaks loose), so I'm interested in learning how to male these ECUs virgin, in order to swap them between cars. It would be great for Alfistis around the world if they could get a spare ECU of the scrap yard.

The info on the ME7.3.1 is very limited, but I found one reference that it uses the 95040 eeprom, so I tested the tool on the ME7.3.1, and with version 1.40 I had a successful reading (as far as I can tell). In the dumped file you can find the Bosch part number, the software version number, and some other numbers printed ont the ECU label, so I take it the data is not corrupt. Reading is done on the bench in boot mode (pin 20 to +12V with a 5k pull-up resistor). Interface is a standard USB VAG 409.1 KKL standard blue Ebay costs-nothing. Laptop running XP.

On must foras everyone claims that there's no way to make the ME7.3.1 virgin. The only reference I have found on virginizing (great word!) claims that you can just fill the eeprom with FF. Is there anyone here that has some input or comment on that?

/RedTop

Pictures of the hex dump and my bench setup is attaches. Also the dump file.

Screen dump from the run:

C:\Documents and Settings\My Documents\Google Drive\Alfa\Motor ECU\ME7_
95040>ME7EEPROM_1.4.exe --bootmode 95040 -r -p2 dump.bin
ME7_EEPROM v1.40
COM: 2, Baud Rate: 10400
Memory type: 95040, size: 512
Opening COM2 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P4.7
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x0080
Reading EEPROM ... OK
File saved
Closing COM2

C:\Documents and Settings\My Documents\Google Drive\Alfa\Motor ECU\ME7_
95040>

I think the eeprom may be larger than you think.

I did dump the eeprom with all four switches for memory type. 95040 and 95P08 looks the same, only the P08 dump is twice the size (512 byte vs. 1024 byte), and from 0x0200 and on it is filled with FF.

95080 and 95160 dumps are identical to each other, but differs from the other two.

Can anyone tell med which dump is correct?

/RedTop

Found someone that had made a dump from this ECU, and the file size is 1024 byte, and the format matches my 95080 and 96160 dumps, so I take it that it is a 95080 eeprom then.

This guy also filled the eeprom with FF and it seems that he could start the car. After that he dumped it again, and some data has been recreated. Maybe this will work for making the ECU virgin?

Both dumps (before/after) are attached.

Today, I had a Freelander airbag module with memory errors that I needed the dump from....and no chip programmer...This airbag module uses a 95080....so i soldered the 95080 in where the 95040 was in an old 3B0907551BQ that I had laying around.... the programmer worked perfectly!

Used "me7eeprom --bootmode 95080 -p6 -r FREELANDERDUMP.bin --CSpin P4.7"

would not read in OBD, and would not fine the chip select pin automatically...but definatly got me out of a bind.

And saved my a$$ on an allroad the other day by allowing me to get the pin and adapt a used ecu.

Thank you so much for a very useful tool.

hi, i have a problem with this programmer,  error is in the picture
(http://www.iv.pl/images/61829153743914178710_thumb.jpg) (http://www.iv.pl/viewer.php?file=61829153743914178710.jpg)

 I have used this programME7_95040 (V1.4) on an Alfa 156 ME3.1/7.3.1 Selespeed ECU to read successfully but although
I get also a successful write OK.I don't think it has actually been programmed.
Any views on this please?

Further to my post above regard not knowing if an actual write has taken place or not can someone explain the various lines on a successful run what they show .
1.does a successful run show if the correct CS pin was used?
2.What are the actual pins called that output from the microprocesor?
3.What are the actual pins called that input to the eeprom?
There are a lot of these questions I would like answered if some helpful soul care to answer please.
I am dying to learn how to writ to this damm ECU of mine,out of the car.( Alfa 156 2.0 selespeed Bosch 0261204949)
As I said I have successfully read & written to it but I still cannot get it to actually fix whats written to it.

done some test today on an EDC15C2 1 plug .
everything works fine when you use CSpin P4.7 and 95P08 driver .

I'm not sure if this was posted in here before but for anyone having issues, I could not get this to work properly until I right clicked the .exe went to properties and under compatibility checked off run as administrator

Hi, I am trying to connect via obd to read eeprom . I can not find a way to change the baudrate in the program and I can't change the baudrate to the cables to 10400 in order for it to read. is there a work around? I've been car-less for 3 weeks now  :'(

uh, wut?

"-b, --baudrate BAUDRATE   Set BAUDRATE, default: 57600. Allowed baud rates: 9600, 10400, 19200, 57600."

I am trying to read using the OBD port... not in boot mode. I can not change the Baudrate from default 10400 to 9600 or anything else in the program. Nor can I change my OBD cables baudrate to match the default bd of the program (10400).

You can only read the eeprom with the CPU in boot mode. Hence the banner that clearly states:

"Allows to program ME7 ECU's EEPROM (95040) in boot mode."


Yes you can. That is what the -b option does.


You cannot set the baudrate of the "cable" itself. Whatever program talks to the cable sets the baudrate it wants.

Hmm interesting.. Maybe I misread this post  ???

You can under port settings in device manager.

Has no meaning. Most apps set the baudrate they desire.

I found a way to read the eeprom without going into boot mode by changing the baudrate to match the default programs' baudrate....  ;)

If the -b option wasn't working, might want to email the author.

You could always read over OBD, but writing the eeprom is what requires bootmode. Otherwise any idiot (including myself) would be stealing VAG's

(https://fbcdn-sphotos-b-a.akamaihd.net/hphotos-ak-xfp1/t1.0-9/10262176_852659558329_9055796853003591092_n.jpg)

Why is it starting in boot mode? I believe that maybe my issue. Also does the ecu have to have the immobilizer defeated?

Because you didn't specify --OBD

Got it! thanks where does the EEPROM save?

C:\

The directory in which you run the utility.

you can change the directory by typing the following command:

cd (directory)

First post on the forum.

For a start, thank you to all who have contributed to my knowledge thus far.

I have read this (and other) threads many times through but I still find myself needing a fundamental piece of guidance.

I get:

Starting boot_mode ... No echo from cable. <error=0x07>

when I attempt to read the EEPROM in an ME7.5

Is this indicative of a PC/cable issue or what I might expect if the ECU is not in boot mode (or cant it be determined from the error)?

An educated answer would allow me to focus on the right area.

Thanks for your wisdoms.

Hello

I think you have chance to got your answer couple of post before yours. if you don't want read in bootmode you need to specify --OBD in your command prompt.

But the best way are to read/write in bootmode. anyway I think you absolutly need to bootmode to write.

You know how to enter boot mode ?? if not go here you will find the information
http://nefariousmotorsports.com/forum/index.php?topic=5068.0title=

Also make sure to match the command prompt comport# with the port used in device manager

good luck

Hi,

this is my first post in this forum, and i have a problem to write with the Me7eeprom V1.4
The ECU is the same of the Redtop user, an Alfa 147 ME7.3.1

i can read in bootmode, and i have read on 95040, 95080 and 95160 eeprom type (with 512, 1024 and 2048 kb file)
but
when i write, i always obtain this:
WRITING EEPROM ................................ OK
VERIFIYNG EEPROM WRITE ........ FAIL (error=0x70101)

i compare the two file (read from one ECU and the read after a write in an other ECU) with FC /b (file compare in windows) and it's different

In the FerrariWorld says that the ME 7.3 H4 of the 360Modena have a 95040....

05 Jetta 2.0 Any thoughts?

Hi! My first post as well. Great tool, thanks to author! I have 1 problem though. Have a blue cable with RL chip. Tried to read eeprom from my A8s (2 - 2000,2002). On 2 of them it was flawless - result as expected from the first read via OBD... on 1 A8 2000 SKC I can verify with result from cluster (skc is the same), on 2002 - extract SKC - test it - looks ok. But when I trying to read my another 2000 (it has the same ECU as the first one, specially open it up - 95040 chip as well) - it fails in the end... see the screenshot... Tried to put this ECU on another A8 2000 - same result with error... Did not try on the bench yet - waiting for the plugs and wires to do it nice, but maybe somebody can give me some advise about the error? it looks like it happened just in the end of the reading routine before saving it to the dump file... Thanks in advance  (sadly on this one cluster eeprom is crypto one - looks like it was replaced before - so I cannot extract SKC same way as on another one)

You can always use bootmode. It never fails.

Will do, thanks... by the way-is it better to do in complete bootmode or only bench environment to eliminate any affection of other components? Which baudspeed better to use?and iwould like to know more about the subject- could you point meto some knowledge base, i.e. what does CS mean in our mofules, how to detect proper ME for particular ecu, etc?

CS=Chip Select

I have never changed the baudrate.

I bootmode in a controlled environment (on the bench).

Thanks. I already got it, what cs stands for spi protocol< just want to understand< what lets say 4.7 mean?is that 4th side on the main ecu, 7 pin? Is there away to know which motronic on paticular ecu?

I just wanted to thank you and everyone else in this forum ...with all the information and great response to us all. I had swapped Aeb me 3.8 into my corrado ran fine until k03 and k03s blew .... i then threw in td04 15t much bigger turbo and then i had fueling issues ... i read on here that i couldnt flash me 3.8 so i went to scrapyard and pulled me 7.5 with harness foot pedal and all sensor for $50 bucks wired it in and immo issue. Followed through this thread bench flashed it in bootmode read and saved eeprom and 95040... picked up dump on here with immo off and wrote it ... car fired up like a champ and i am thrilled and so thankfull... had some issues with 0x01 and 0x07 error codes i was shorting pin 24 to the board as shown on forums and that didnt work for me i then shorted it with other grounds everything worked like charm ... took 20sec to load... the harness i have is from 2005 passat 1.8t ecu 4B0 906 018 DQ.  0 261 208 527 ... if you cant get files to read check your directory from which you are writing/reading.... if i can be of any assistance or help full i will do my best to respond

trying to write EEprom and failed, please see attached.(http://)

hi my friends , how are you?.

i have a problem with my immo, my car broken motor (water sucks) some 2 years ago, now, we tried to start but immo blocked engine.

The car is a Audi A4 1.9T BEX , ecu Part No SW: 8E0 909 518 AT HW: 8E0 909 018 A

i need know how write 95040 via OBD, anyone could tell me if this tool or another work OK with KKL?

also i have, vag tacho 4.8, tacho pro 2.0 (blue) , tacho universal , vag cmd 5.5, galetto, kwp, mpps.

Thanks in advanced my friends

Could you explain where this needs to go in the line, or does it matter? Example mexxx -r -p 8 -b 10400 -cs 4.6 output name.bin? Also... Is there somewhere I can find the short list of what cs#'s for what e2p's? Thanks, man!

Hi,

yesterday i tried to read the EEPROM.
The saved file from the 95040 eeprom seems good and i can see that is data of the eeprom 95040.

Today i read the same ECU with the ME7_95040.
But i get a different file, with different informations.
If i open the read file i get other information for 93c66 eeprom?

Where is my mistake or what did i wrong?

In fact the ECU is 100% the same, because it's not in the car! So it's impossible that the ECU is changed.

Thanks

Changed baud rate to 9600 and worked fine.

Thanks for this forum, and all the users, especially argdub and ddillenger.

Friends sorry to ask a dumb question, OBD mode can be used on bench? or ECU detecting no cluster, no key, etc.... immobilizer DTC error generates that it avoid read eeprom on OBD mode?

Yes you can use ODB mode on the bench.

Then I can read whole 95040 serial eeprom content through ODB on Bench or in car, but to write it, it should be in bootmode, can not be done in OBD mode too, right?

Exactly !

Thanks a lot for you help friends.

I just want to add that ,I always find bootmode more accurate with this tool.I always bootmode for read and write .
If you want to read on the bench , just boot it :)

Now if you read it only by obd on the car , read it a couple of times just to be sure

Just made some more experiments with the ME7.3.1 for Alfa Romeo.

I made an EEPROM dump from a ECU, then made the ECU virgin by using a special flash file, and made another EEPROM dump. When comparing the two dumps I found that one byte is changed from 25h to DAh (complement). Also two other bytes where changed, but I thing these two are a checksum of some kind. Can anyone help me figure out how the checksum is calculated?
It would sure be a good thing to be able to make a ME7.3.1 ECU virgin just by using the ME7_95040 tool.

Dumps are attached. Changed byte are on address 0058h and 0068h. The supposed checksums at 005Eh and 006Eh.

Seems like the checksum in this case is calculated as: checksum = swap hi/lo [0DF1h - (sum of 14 first bytes)]

Is it possible to use the software with vag commander cable??

Getting this error

error 0x07

starting bootmode...FAIL...no response from ecu

Grounded pin 24 and switched on the power 5-6 secs after then removed the ground and pressed enter to start the 95040 programme.


I've been having issues getting galletto to write over the eprom too, new blank chip

Guys, still need help ... create workbench setup for boot mode... tried with test computer from 3.0l A6 2002 (95p08 chip) - 8e0909559d - ME7.1.1 - no luck at all...  (again, question - which ME is that? based on the plug and sticker - should be from ME7.XXXX family, but...  able to vagcom it with no issues... just wanted to got an experience with this ECU).  connect to the setup my CPU from 2000 A8 - first tried OBD mode - same error as before - 80401 at the end of reading... then tried in boot mode - see the screen... I suspect need to provide specific
cs parameter somewhere - afraid to do it incorrect so if somebody can give an advise will  really appreciate it

by the way - ECU  - 4d0 907 559

Will this work on edc16u34 ecu? ecu number 03G 906 021LR
 

Hi sorry to ask again, but I have been testing several ECUs in OBD mode on bench without sucess.
Here are the errors: me7_95040 V1.40 error=0x50501(06A906032A) error=0x21007(06A906032FN) error=0x50501(4B0906018CM) error=0x21007(06A906032NL)
Friends some help will be useful.
Thanks,

Hi. I've tried to use the programmer to read immo from ME7.3.1 Alfa 147 Ecu.
I've tried it on bench in boot mode and I get the following error:(see attached)

Any ideas?

Thanks!

I'm trying something very simple and am just trying to get the eeprom dump while its still in the car. It seems to be going through just fine but then I get an error "0x4E01". Any ideas?

Hello, Im having some issues reading my me7.1.1. Iv managed to read the eeprom twice in about twenty attempts.

I keep getting the error below.


When it did read, Ill attatch the files below. Someone has meesed around with it before me, The file size doesnt even seem right to me, But im completely new at this, Anyone have any ideas please?

UPDATE: Just incase anyone gets the same issue, I set my cable bit rate to 19200 in device manager and used the same in Argdubs tool (-b 19200)

It iss wonderful..... I have an ME7.1.1 from Audi A4 B6 V6 3,0 reading  Perfekt

Maybe im using this wrong

ecu put in bootmode (pin 24 earth then power on) then hit enter with this typed in CMD

me7_95040 -w -b 10400 -p 4 example.bin

Do i need to type

me7 --bootmode -w -b 10400 -p 4 example.bin??

I have a problem with the OBD Mode With my ME7.1.1 Audi V6 3,0 Bj 2003 ECU. In Bootmode read and write okay, but in OBD Mode no Chance  Please help..

Anyone ever get an error with 7.1.1 that the uC is unsupported?

Yes. Either it's not booted properly, or you've tried to connect once, and didn't completely power down to reboot.

this is what im getting - just tried powering down completely - same dealio.

its a 06a906032PD that a local guy needed immo done - stock ecu

heres what i read from each one through obd also - both old ecu and the new one im trying to rewrite with that one

try with v1.4

and like that...  its magical.

Thanks

Used v1.31 yesterday as i was having issues with the v1.somthing i had. worked a dream

Solved. Used v1.4.

For you GUI lovers, I've coded this.
The file includes ME7EEPROM.exe  1.40 and the GUI.
Make sure you have ME7EEPROM.exe in the same folder as ME7gui.exe, and simply run ME7gui.exe

It will open the command window for you, type the correct entries.

I've set it to use dot net 2.0, so most of the WinXP should be able to use it without a dot net update.

For the CSpin, I just took what I've saw in different posts, and added a button. You can always enter the values by hand.

Let me know if you like it.

Edit: get the latest version:
http://nefariousmotorsports.com/forum/index.php?topic=1168.435 (http://nefariousmotorsports.com/forum/index.php?topic=1168.435)

Nice little tool! Good work!
If you're planning on an update a "save as" dialog window, where you can choose in what folder to save the file, would be a nice feature.

Good point, I'll look into it !

This should work. Gui v1.01 (The Super Tomato version !)

Edit: get the latest version:
http://nefariousmotorsports.com/forum/index.php?topic=1168.435 (http://nefariousmotorsports.com/forum/index.php?topic=1168.435)

Must be a world record in UWTI (User wish to implemented) !!!  ;D

 ;D Thanks, I must have too much free time on my hands...
Some bugs fixed (nothing major, just refreshing the command text while entering the values) and added labels.

Edit: get the latest version:
http://nefariousmotorsports.com/forum/index.php?topic=1168.435 (http://nefariousmotorsports.com/forum/index.php?topic=1168.435)

thanks
I check it with galleto 1250 and works fine.
I read the eeprom of me731 and need to verginise it .
can some one make the file vergin
thanks again

Check out my guide in this thread:
http://nefariousmotorsports.com/forum/index.php?topic=6879.0

Please report your results!

And its me again - had a some time to play a little with my ECU - and still need help:
 Bench ECU - A6 3.0 - 7.1.1(written right on box) with 95P08 eeprom- no connect in OBD mode, fails on CS search in bootmode... Found some post when guy tried port P6.3 on 7.1.1. Decided to try - if burn it so be it... But surprisingly - it read eeprom correctly :)

But my main computer Im.interesting - ECU  - 4d0 907 559 from A8 2000 (I suspect it 7.1.1 too, but not sure) - and it fails during read in OBD mode, in bootmode it fails on CS search as well. but I`m really afraid to put CS value there by guessing - this is my car - dont want to fry ECU :(

Found some comment from ArgDub couple years ago:
"There are two option to find the chip select pin, first is disassembling.. or you can follow the CS track with a voltmeter to the ucontroller. Please use this option carefully, if you set an input pin as output you are making a short circuit, this can fry your ecu. "

Can somebody knowledgeable advise how safely find CS for my ECU? Thanks in advance... (desolder chip would be the only option then because does not want to read from clip - to much load to eprom reader - detects overcurrent)

ME7.1.1 CSpin P 6.3 Read and Write CSpin p 4.7 Not P6.3 or P4.7 in CMD My 7.1.1 can only read and write in Bootmode

Could you put some delimeters where the logic ends? Cannot get what do you mean... 7.1.1 CS6.3 for read and 4.7 for write? problem with my primary ECU - I dont know exact ME version :( and same ECU on my other A8 read via OBD just fine... (on both main number is the same - 4d0 907 559, only the problematic one has manually corrected version from 6 to 9 or so).. it has 95040 eeprom (not 5p08 as on my bench 7.1.1 ECU)

4B0907559 is ME7.1

did you mean 4D0907559? what would be CS in this case? Thanks in advance

Funny - had some time to play with my bench ECU 7.1.1. - unsolder 5p08 and tried to read using Willem CS866 programmer... sadly it does not have 5p08 in the list of supported chips, so I start with trying to read as 95080 ( they have same memory size) - but the results was kind of funny - first few pages looks like original read via bootmode(only shifted 1 byte) and then it became completely different with random garbage... But when I read it as 95040 - it returns exactly the same result as my original read for the 512 bytes  (other 512 bytes in original read are FF)... So I assume format/protocol of reading those 2 close memory types is different... and probably 5p08 chip can be replaced with 95040 one :)

Many non ST equipped ME7.1.1 may have larger eeproms, but there's still only 512kb of data. The rest, as you discovered, is FF.

I am really wondering how FRC has the possibility to read/writhe eeprom via OBD!
Do you have any ideas guys?

Also there is one more tool that does this job "VAG ECU TOOL"

I was under the impression that writing over obd is possible but argdub chose to only write in bootmode to reduce the chance of this tool being used for car theft.

oh, I just wanted to verify content of the eeprom on the lower level... Could you advise CSpin for 4D0907559? (as you said - it most likely 7.1)

There is no most likely about it. It IS 7.1.

As for the CSpin, it should autodetect. Failing that, it's the same as other ME7.1. Just look at the screen when they autodetect and use that.

Thats the problem - it does not want autodetect :( today I took same ECU from my another A8 (the one was read via OBD) and wanted to read it in bootmode to see what CS pin it would select - but it also failed on CSpin detection :(
You said CSpin should be the same as for the any other 7.1 ECU, but how can I tell from the screenshots in this topic which one is 7.1? in the output there no ME version ... :(

Finally figure that out :) luckily - CS line was traceable... although it raises additional questions, like: expected line to go to the big offcenter chip (on my test 7.1.1 ECU it has marks c167 - as I understand this should be an main CPU). But line ended on the center one :) surprisly in my module all those numbers ion the siemens chips got me no info, so I use C167 layout as a reference... Why there 2 looks like pretty close by function chips? anyway - CSpin in the hardware was 4.7, I specify this CS in cmd file and finally got the bin!!!! today modify it to turn immo off, write it back (for some reason it fails on eeprom verification, but next read show updated info)... will try tomorrow on the car

Very nice! Thanks for the update.

Sounds like it behaves exactly like the Alfa Romeo ME7.3.1. Fail on autodetect. I tested my way to CSpin 4.7. Also fails on verification, but if you read it manually and compare to the writing is OK. It seems you have to restart the ECU to do a reading after writing, and that is why the verification fails.

I think so as well... Can it be related to manual configuration for CSpin and some bug in program if it try to autodetect it for validation? Today pouring rain - cannot check everything on the car... Will update as soon as verify

I am trying to read a me7.5 immo in --ODB mode but i couldnt change the baudrate.
Tried it with win7 pc and xp netbook but no matter what i use the tool does not change the baud rate.

tried under 1.40, 1.39 and 1.30 version of the me7_95040.

i am under the impression that this worked before but i do this immo stuff rarely.
is this cable related?

does anytime the --OBD option works for any version? I don't have luck at all. It will be really nice to have this option working.

no i will have to open up the ecu and use the bootmode :/

I've added two options to the GUI, the reconnect and SKC commands. I've never used them, I assume they are called properly.
Feel free to correct me if I'm wrong !

Again, this is a frontend for ME7 v1.40, included in the zip file.

Edit: get the latest version:
http://nefariousmotorsports.com/forum/index.php?topic=1168.435 (http://nefariousmotorsports.com/forum/index.php?topic=1168.435)

SKC its wonderful but what iss reconnect...?

It's to avoid restarting the ECU after a read or write operation in bootmode, as per this page:
http://nefariousmotorsports.com/forum/index.php?topic=1168.30 (http://nefariousmotorsports.com/forum/index.php?topic=1168.30)

Some comments:

If I choose another folder in the "save as" dialog the GUI starts the command window in that directory, and expects the ME7EEPROM.EXE to be located there. Could there be an explicit path to the ME7EEPROM.EXE?

The "reconnect" option seems to be used wrong, at least when Cspin is specified. If i change --reconnectP4.7 to --reconnect in the command line below it works to read the eeprom again without rebooting the ECU.

C:\Documents and Settings\user\My Documents\ME 7.3.1\Test-ECU>ME7EEPROM --bootmode 95080 --CSpin P4.7 --reconnectP4.7 --SKC -p 2  -b 9600 -r "C:\Documents and Settings\user\My Documents\ME 7.3.1\Test-ECU\eeprom ori3.bin"
ME7_EEPROM v1.40
Error: unrecognised option `--reconnectP4.7'. (error=0x10201)

Reconnect -> Oh ! That's a Bug ! You shouldn't have the CSpin numbers again, right after the reconnect command... That's a "copy and paste" error, I'll fix it.

And for the startup directory, it should be easy to fix. Stand by !

Ok, temporary fix. The reconnect should work now, but I think I have timing issues with the commands being sent to the dos window.
When I specify a path that uses the user's profile (the desktop, for example) I sometimes see "Usr" instead of "User". I'll investigate later on. I guess for now I can only suggest to select a path not to far away from the root, or not using the user's profile, until it's fixed. Sorry !

By the way, these "typos" won't scramble whatever you read or write to the ecu. The GUI is only preparing the command, it's not processing the data sent or received.

Edit: get the latest version:
http://nefariousmotorsports.com/forum/index.php?topic=1168.435 (http://nefariousmotorsports.com/forum/index.php?topic=1168.435)
 

Thanks for the new version!
I also experienced "abbreviated" paths.

Ok, I think I got it. Uppercase is the key. The paths will all be converted to uppercase, but I'm keeping the filename as it was written.

Version 1.05...

*** edit: look down, version 1.06 is waiting there ! ***

finally tried my ecu (A8 2000) with immo off - works as suppose to :)   () Just to be consistent with VINS decided to map cluster to the ECU (it was my initial need - new cluster was with all working displays - and I swap everything before - cluster/ECU and immo chips). Turns out - I cannot link cluster with matched immo chips, had to swap immo chips first, then link cluster to the ECU (not sure - maybe it will work with virgin immo chips)... 1 side effect from such mapping - it shows additionally old VIN number in cluster general info page in vag com... Luckily this panel not encrypted, will try to modify all vins there directly when have a time

Just tried to read directly after write with the --reconnect parameter, and it works, so it's possible to read without rebooting the ECU.
If ArgDub could have a look at it and see if there is a bug, that would be great!

I have a very hard time getting this tool to work with my 4B0906018AA ECU, finally I managed to write my immo off bin to the EEPROM, but it failed to check? Can I consider the file to be done or should I keep trying to read it again? Would feel best to verify...

NVM, managed to pull the bin after a few more try's. 100% identical  ;D :-* yeah

Had the same problem minutes ago...

Please use right-click->mark to copy paste the text output itself rather than using screen shots!

try p6.3 when writing

I've had this issue with version 1.40, while 1.31 writes with no complaints:

User@USER-PC /c/Mapping/Immo
$ me7_95040_old.exe --bootmode -wp1 4B0906018AD_A6_18t_2.bin
Ver: 1.31
Com Port: 1
Baud Rate: 10400
Opening COM1 ... OK
Starting Boot_mode ... uC identification response = 0xC5 (C167 derivatives) ...
OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P4.7
Configuring SPI Interface ... OK
Checking EEPROM status ... 0x00F0 ... OK
Writing EEPROM ................................ OK
Verifying EEPROM write ... OK
Closing COM1

User@USER-PC /c/Mapping/Immo
$ me7_95040_old.exe --OBD -rp1 4B0906018AD_A6_18t_readback.bin
Ver: 1.31
Com Port: 1
Baud Rate: 10400
Opening COM1 ... OK
Initiating communication ... OK
ECU ID response: 06A906032RT
                 1.8L R4/RTP
                 0002
                 SoftCod: 11500, WSC: 02325
Reading EEPROM ................................................................
...... OK
File saved
Closing COM1

User@USER-PC /c/Mapping/Immo
$ me7_95040.exe --bootmode 95040 -wp1 4B0906018AD_A6_18t_2.bin
ME7_EEPROM v1.40
COM: 1, Baud Rate: 10400
Memory type: 95040, size: 512
Opening COM1 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P4.7
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x70101)
Closing COM1

User@USER-PC /c/Mapping/Immo
$ me7_95040_old.exe --OBD -rp1 4B0906018AD_A6_18t_readback_after_failed_write.bin
Ver: 1.31
Com Port: 1
Baud Rate: 10400
Opening COM1 ... OK
Initiating communication ... OK
ECU ID response: 06A906032RT
                 1.8L R4/RTP
                 0002
                 SoftCod: 11500, WSC: 02325
Reading EEPROM ...................................................................... OK
File saved
Closing COM1

Wierdly whenever I write an eeprom to this ECU and read it back, 4 bytes change. If I write back the changed eeprom, the 4 bytes change again - Diff the attached files to see, 0x112 to 0x115.

I figured I could add both 1.31 and 1.40 versions in the GUI, since I see that sometimes 1.31 works better.

I've added 4 preset buttons after playing with the GUI yesterday. I guess I could add more of them, but I don't want a huge window, my workshop PC is an old laptop with an external screen, in low resolution...

So this is ME7gui version 1.06.
Included are the GUI, ME7 v1.40 and ME7 v1.31.

(screenshot attached)

Great job and nice man ArgDub !
many thanks !

Somebody so kind telling me
Does ver 0.2 not support setting new skc? if so how about other version

D:\VAG>me702 --in on.bin --out skc.bin --skc 01234
95040 Eeeprom Tool - 0.2 - No warranty implied or given, manually verify all cha
nges before saving eeprom to ECU, this tool could cause permenent damage to ECU
and prevent vehicle running

Not Yet Supported for ECU Bins
Traceback (most recent call last):
  File "95040tool.py", line 702, in <module>
  File "95040tool.py", line 677, in main
AttributeError: ecueeprom instance has no attribute 'setSKC'

No, Eeeprom tool doesnt support setting SKC in ECU eeproms, only in cluster eeproms (because I never needed to set it in an ECU). You could set the SKC in the bin using a hex editor and then use that tool to set the checksum, or add the function yourself, the source code is in the thread (and if you do, edit version 0.3).

Also, please ask about each tool on the thread for that tool, took me a while to figure out what you were talking about on this thread.

yes I got it and thank u very much
by this tool we get both skc,original ecu and swapping one
and then we can easily mach the swapping ecu by scan tools
dont need to set skc of the swapping ecu by hexeditor,really
thanks again

so been adviced to use this tool  ;D ;D

When I use a generic Galetto cable I can get it to read and will take about 30 seconds indicating it's working with an indication bar running accross the screen and fails.

If I use VCDS genuine in dumb mode with VCP port it fails almost instantly.
With or without the cluster connected. Thinking the K-line communication between ECU nad cluster is flooding communication.

C:\ME7>me7_95040 -r -p 1 95040.bin
Opening COM1 ... OK
Starting Boot_mode ... FAIL ... No response from ECU. (error=0x07)
Closing COM1

C:\ME7>me7_95040 -r -p 2 95040.bin
Opening COM2 ... Unable to open comport. (error=0x01)
Closing COM2

Which indicates to me that being a Euro ECU with Immo this maybe the cause?
So I would need to boot mode the ECU??

You should not need to boot mode the ECU to read the eeprom, but some people report issues reading it over ODB - the euro/immo should not affect this thou, I reguarly read 1.8T and 2.7T ECUs over ODB when they have immo active (In fact, I dont think I've ever read a eeprom in bootmode).

Make sure you do not click away from the window or try and do anything else while you are reading the ecu, this often causes it to fail to read. What ECU is it?

dear nefmoto forum

need source file for Re: ME7_95040 - EEPROM  please


because i do programation c , i want know how the soft work

best regards
jakani

thank very much

Not used/tried boot mode yet. Until I can get simple data logging first I won't play further.

Euro box code 511D.

I also only have the cmd prompt open to try and read ECU info or even data logging.

I can't seem to get this port setup to work with a USB cable.
Can anyone help .my laptop doesnt have any com port

I must be going crazy.  The me7_95040.exe program is running properly and is saying that the .bin file is saved - no obvious issues there.  But I cannot find the file that was supposedly saved.  It should be in the same folder as the .exe but it's not there.  I searched for the file as well, no luck.

Any ideas?

It is in the default directory unless you specify different.

"current working directory"

What does that mean exactly?  I was assuming that meant it would be in the same directory that the me7 program is running out of, but the files weren't there.

Sorry, I grew up after DOS/command prompt was relevant and I've never had a need to become familiarized with it.

No, it is the directory you are in when you run the .exe

Please provide a copy/paste of the dos box (including the output of the "dir" command after running the program). PLEASE DO NOT POST A SCREEN SHOT.

You can copy/paste text using the "mark" function.


Time to learn :)

http://dosprompt.info/

Command lines will always be relevant.

Exactly what I was about to post :)

ME7_95040 v1.31
Allows to program ME7 ECU's EEPROM (95040).
This software needs a dumb serial to k-line cable for connection with the ecu.

Usage: me7_95040 [OPTIONS]... [FILE]...
 -p, --comport COMPORT     Set COMPORT.
 -b, --baudrate BAUDRATE   Set BAUDRATE, default: 10400.
                           Allowed baud rates: 9600, 10400, 19200, 57600.
     --OBD                 Use this option to read the EEPROM over OBD port.
                           Currently, only read is supported in OBD mode.
     --bootmode            Use this option to program the EEPROM in boot mode.
 -r, --read                Save EEPROM contents to file.
 -w, --write               Write file to EEPROM.
 -s, --screen              Print EEPROM contents to screen.
     --help                Display this help and exit.

Usage example:
   Read EEPROM over OBD port:         $ me7_95040 --OBD -r -p 1 95040.bin
   Print EEPROM contents to srcreen:  $ me7_95040 --OBD -p1 --screen
   Write file to EEPROM in bootmode:  $ me7_95040 --bootmode -wp1 95040.bin

It's free for hobby use.
This software is provided "as is", with NO WARRANTY.
email: agv.tuning@gmail.com

C:\WINDOWS\system32>"C:\Users\Fred\Desktop\A4 USP\bin\me7_95040.exe" --OBD -r -p
 4 readout.bin
Ver: 1.31
Com Port: 4
Baud Rate: 10400
Opening COM4 ... OK
Initiating communication ... OK
ECU ID response: 4Z7907551M
                 2.7l V6/5VT     G
                 0001
                 SoftCod: 06752, WSC: 27665
Reading EEPROM ............................................................... O
K
File saved
Closing COM4

system32 is your "current working directory" there. bad bad bad.

try not to run stuff from there, you don't want random files in that directory.

very very bad.

You want to learn how the "cd" command works.

Thanks for the tip.  I learned the cd prompt and have been navigating around.

Interesting point, changing absolutely nothing from what I was initially entering into the dos command, but using my older computer, I was able to read and save the file on the first try.

So there must be a safeguard in place on my current laptop.  I will now proceed to smash it with a large hammer of sorts.

In a modern laptop (win 7), you probably don't have write permission to ststem32 from a normal account. I have no idea why it defaulted to run from there.

When using the cd command, you can use the tab key to autocomplete directory names, to save on typing, and cd.. To go up a level.

Even when (using the cd command) I selected a different directory, i.e. C:\ECU\, it wouldn't save the bin files to the computer.

I'm logged in as an administrator on this computer as well.

Please post the output including the result of typing "dir" after running the program.

Your original command:

C:\WINDOWS\system32>"C:\Users\Fred\Desktop\A4 USP\bin\me7_95040.exe" --OBD -r -p 4 readout.bin

try changing the saved filename at the end:

C:\WINDOWS\system32>"C:\Users\Fred\Desktop\A4 USP\bin\me7_95040.exe" --OBD -r -p 4 C:\readout.bin


* I'm not sure if that's what you said you did with the "c:\ECU" in your previous post. If that's what you tried ("C:\Users\Fred\Desktop\A4 USP\bin\me7_95040.exe" --OBD -r -p 4 C:\ECU\readout.bin)
then you might want to move the file me7_95040.exe also in that directory.

Then:

"C:\ECU\me7_95040.exe" --OBD -r -p 4 C:\ECU\readout.bin

Just to be safe, make sure your prompt says C:\ECU>

If not, the quickest way is to type (one command at the time)

cd\

cd ecu

The first (cd\) will go to the root of the drive (c:\), and the second command will go to the "ecu" folder.
From there, the command should work fine. Windows shouldn't block anything there.

I just found myself needing to read a 2007 Rabbit ME7.1.1 with a 95160 and ran into this same problem.
Had to remove and read externally.
Can this "mod" be added into the me7 eeprom tool?

Excellent tool thankyou argdub, it worked great and I used the front end cabok made as it's been a while since I've done anything in dos! so thankyou both  ;D

For reference, it was a Euro 2001 A3 1.8T read over obd using v1.31, vag-tacho failed miserably to get the skc, but this tool no problem.

Hi, i'm having issues trying to read --SKC in my -00 a6 2.7 bit.
ECU is clearly responding and giving me tiny info of herself but when trying to read the eprom the problem appears,
Stock ecu with MTM chip could cause this? Should i read through bootmode?
I appreciate all the help i get in this matter!

Here's the log:


Ver: 1.31
Com Port: 1
Baud Rate: 10400
Opening COM1 ... OK
Initiating communication ... OK
ECU ID response: 4B0907551E
                 2.7l V6/5VT     G
                 0002
                 SoftCod: 05752, WSC: 00186
Reading EEPROM .................................................................
.FAIL. (error=0x01)
Closing COM1

Read it in bootmode

Ok, the thing is that i have a MTM chip installed, by our local tuner, now if i put it in bootmode what's gonna happen to the MTM chip / software?
Since i cant read the ecu eeprom without bootmode it means i cant save the current flash or anything?

I did call the tuner to get the SKC so i might someday be able to drive the car since i got new key but no way to recode it to my immo, they just told me that they are not willing to help.
More questions, when they installed the chip and retuned it, they changed the SKC of the ECU ofcourse? if they did does it mean they may have not changed the cluster SKC or does the cluster SKC automatically clone itself to match ECU SKC, or is it the very same code ONLY in the ECU?

And i only have 2 things to attend to, first to recode ECU since 6-speed swap and second to retrieve SKC to recode my new rfid key chip.
Main goal is to get the rfid chip recoded so i might be able to get the car to MTM dealer so that they can recode and reinstall their mess up!

problems started when i had hole in my pocket, keys drop on the floor at work and this one hippo drove over it with a minivan and broke it completely, my fault i know, but he's still a hippo!

You can put it into bootmode and there will be no issue with your tune.
They would not have changed your SKC when they tuned it.

Thank you for sharing the information! I'll be tryin'

Ok news, tried bootmode without success, grounded pin 24 for 3 sec and tried to read eeprom and gives me instant error.
It says "no communication from the ecu".

I tried to go to bootmode like this:
1.Ecu in car no power
2.grounded pin 24 on the flash chip
3.power on engine off
4.hold pin 24 grounded for 3 seconds
5.kept power on and tried to read eeprom in bootmode

with this procedure no success, am i possibly doing something wrong?

I usually ground it for 5-8s

ok, i kept it for 3 and almost 10 sec no success, maybe tomorrow go for 6-8 sec to make sure, btw noticed the chip i have is the "floating" type, stock chip is replaced with this one. Doesn't matter does it?

Yes. It matters a great deal. Make sure you are grounding the actual PCB pin on the ECU, not pin24 on the riser.

I was grounding the pin on the very root of the chip on the pin 24 (where stock chip pin 24 would be located), not on the 'floating' part, if that's what you mean?
Thanks for the reply.

I don't know but this makes me feel like i am the only one with this sort of problem since no other topic(s) problems are like this and could not find a solution from there,
even though they do seem a lot like. Certainly doubt this being software or lead related problem.

You may need to provide a non-standard  --CSpin for this ECU... dd would know more

Okay, ddillenger, aid me! PM incoming.

Thank you for sharing the information...

Good Job.

I just readed 95040 without boot-mode with galletto cable.
Is the file ok?

How the writing, only in boot mode?

Im needing immo-off, and some fault code disable
(ECU 0 261 207 323)

17931 Airbag signal
18058 CAN communication
18034 CAN communication (Transmission)
18057 CAN communication (ABS)
18320 Brake pressure sensor?
17978 (Need immo-off also)

Thanks in advance!

Update:

Readed ok with Galletto cable without bootmode.

Now i tried to write:

me7 --bootmode -wp1 95040.bin
ver: 1.31
com port: 1
baudrate: 10400
opening COM1..........OK
Starting boot_mode .... FAIL .... no response from ecu (error=0x07)
Closing COM1


Three times bootmode - grounded pin 24 with Galletto and Blue KKL cable and baudrate 57600, same result.

Any help?

After some hours of getting to know how the command things work and reading this entire topic I started with the tool.

I've got a euro S4 b5 from 1999 (facelift, but analog clock)

I got this tool working, but it's giving me errors while it's attempting to read the EEprom, I can't find out what this error means or what's wrong.

See here:

While reading the ECU EEprom in version 1.31:

(http://i1009.photobucket.com/albums/af211/FalleNk810i/IMG_3291_zps3b4442e4.jpg)

The error in version 1.31:
(http://i1009.photobucket.com/albums/af211/FalleNk810i/IMG_3292_zps6455f987.jpg)

The error in version 1.40:
(http://i1009.photobucket.com/albums/af211/FalleNk810i/IMG_3293_zpsa06ba0cc.jpg)

So, the connection is there, but that's all I get.

This is what VAG+ K commander comes up with:

(http://i1009.photobucket.com/albums/af211/FalleNk810i/IMG_3283_zpsfc16f15f.jpg)[/quote]

I'm desperate because it's my daily and I don't have any soldering knowledge and experience. What is keeping the ECU or cluster from giving me the EEprom?

Anyone?  ???

Cable drivers? My galletto cable was bad, only blue kkl cable works with properly boot-mode.
Then try different baudrates, remember to change it from the driver setup too.

can someone take a look at this please

C:\Users\sylvain\Desktop\Downloads>me7_95040 -w --bootmode -p4 95040.bin
Ver: 1.31
Com Port: 4
Baud Rate: 10400
Opening COM4 ... OK
Starting Boot_mode ... uC identification response = 0xC5 (C167 derivatives) ...
OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... FAIL. (error=0x01)
Closing COM4

C:\Users\sylvain\Desktop\Downloads>

Rather than start a new thread I thought it'd be best to ask here.

I'm trying to immo off (only experimenting, so there's no urgency/need to do it) but no matter what I do it just won't write...

So I've read/can read the eeprom via the OBD (not in bootmode) - this is using a dumb blue KKL cable.

If I put the ecu in bootmode and try to do a bootmode read/write then it comes up with the below error.

Any ideas? I know that "it's not possible to write over OBD", does this mean it needs to be put on a bench harness, or simply put in bootmode and then can be done via OBD (in the car)?

C:\ME7>me7_95040 -r -p 1 95040.bin
Opening COM1 ... OK
Starting Boot_mode ... FAIL ... No response from ECU. (error=0x07)
Closing COM1

Things I've tried so far:-

- V1.02 & v1.39
- 3 different ecu's (ME7.5)
- Various on/off/reset procedures

It means that it needs to be put in bootmode. This usually means doing it on the bench, because its easier to put into bootmode on the bench.

I thought that... It's definitely in boot mode though. When the ignition is turned on the throttle doesn't cycle and tcs light comes on.

Will have to try a bench setup I guess, anyone had/know of any reasons why it would work on the bench and not in the car though? More things powered up or something?

Generally it's the other stuff that's connected to the Kline, clocks, radio, abs, tdi, etc

Thanks turboat, I thought that may be the case.

I'll knock up a bench harness when I get some spare time and give it another bash. Thanks again.

someone have tested if it works on me7.6.2 opel?
it have 95080

Quick update on this one - I knocked up a little bench harness and it worked fine!

Seems to not like being connected to the car and read/written in bootmode - Cheers Turboat.

No worries, glad you've got it working.

Also interested if anyone found a soloution yet for this? There was one post about mid thread where it was mentioned ver1.4 was "5 minute patched" to get it working, but the patched file wasn't shared.

Here is the post

Some of my experience on reading/writing me7.x ECUs
I made many unsuccessfull attempts on lower speeds (9600, 10400) and didn't know that reason was low baudrate.
Example1: ME7.5.10 030 906 032 CE (01-04-10) didn't want to read/write on speeds less than 19200.
After i set -b 19200 and --CSpin 4.7

c:\App\Auto\me7_95040eeprom>ME7EEPROM_1_4.exe --bootmode 95040 --CSpin P4.7 -w -
p 1 -b 19200 W.bin
ME7_EEPROM v1.40
COM: 1, Baud Rate: 19200
Memory type: 95040, size: 512
Chip Select pin: P4.7
Opening COM1 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x70101)
Closing COM1

c:\App\Auto\me7_95040eeprom>ME7EEPROM_1_4.exe --bootmode 95040 --CSpin P4.7 -r -
p 1 -b 19200 R.bin
ME7_EEPROM v1.40
COM: 1, Baud Rate: 19200
Memory type: 95040, size: 512
Chip Select pin: P4.7
Opening COM1 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore sleuccessfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Reading EEPROM ... OK
File saved
Closing COM1

On this speed it writes and reads successfully, but raises error on eeprom validation after writing, however when i read what was written - everything is OK, files match.

Example2:
On e-bay I bought a cheap ME7.5 06A906032FK (03-06-20) and wanted to make 06A906032HN from it. Hardware of the ECU was newer but identical, the 032FK ECU costed less than 032 HN. Usually i read/write 032HN without issues on speed 10400. But this ecu didn't want to write until i increased speed up to 57600. I didn't believe that this could be reason. I thought it was some kind of write protection of different CSpin. But after setting higher speed i've successfully written eeprom from 032HN into it
c:\App\Auto\me7_95040eeprom>ME7EEPROM_1_4.exe --bootmode 95040 --CSpin P4.7 -w -
p 1 -b 57600 W.bin
ME7_EEPROM v1.40
COM: 1, Baud Rate: 57600
Memory type: 95040, size: 512
Chip Select pin: P4.7
Opening COM1 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................................ OK
Verifying EEPROM write ... FAIL. (error=0x70101)
Closing COM1

c:\App\Auto\me7_95040eeprom>ME7EEPROM_1_4.exe --bootmode 95040 --CSpin P4.7 -r -
p 1 -b 57600 R.bin
ME7_EEPROM v1.40
COM: 1, Baud Rate: 57600
Memory type: 95040, size: 512
Chip Select pin: P4.7
Opening COM1 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Reading EEPROM ... OK
File saved
Closing COM1

I still got EEPROM validation error though. But I ignored the error since data written and read are the same, so everything was OK.
Maybe this experience with baud rate setting will help you to resolve similar unknown errors.

Thanks for the suggestions. I have a few on hand that I was unable to read, and will give them a try using different baud rates.

I cannot get this to work. I've been trying for hours and I keep getting an error stating starting boot_mode....fail erro=0x01

I'm using a generic kcan cable. I also tried the apr cheetah cable with no success, and a couple vag commander or vag k can, generic vag tacho cables, etc. Some of them say no echo from cable, so I feel like this cable seems to be working best....I just don't get it.

And I forgot to mention, I know it's in boot mode because I can read it with galletto after I get the error

Got it sorted, I ended up just having to use the Blue kkl cable. I tried a real vcds cable, a real vag tacho cable, Chinese vag tacho cable, chines vag k can and vag commander cables, and I got nowhere. so I suggest using the blue 9 dollar obd2 cablr special from Ebay.

Great tool.

But I can read my ecu (8e0 909 518) only in bootmode so I was using older version. Don't know why, but also galletto can read flash of this ecu only in bootmode.

This program only opens and then closes for me on my Win7 PC? Must the ECU be connected when opening program? Or have i missed the manual?

It's a command line program, so either run it in dos or use the front end for windows which somebody kindly made, you should find it linked in this thread somewhere.

Thanks i´ll have a look on that. ;D

Can this software be used with this adapter:
http://www.amazon.com/Adapter-Cable-Connecting-Diagnostic-Interface-Compliant/dp/B007UKTW8E

It is a straight through OBD2 to 9-pin D-shell with no electronics inside. Or it needs to have some kind of chip?

Thanks!!

Suspect not as it doesn't mention kkl, most people use this with a blue kkl lead.

Reading through this thread i need to clarifie something here.
Is it true that ppl use blue china kable too write 95040.bin in bootmode???

Too answer my own question.
Yes!!! As i just bootflashed immo with cheap China blue cable

Good evening, this issue'm a little desperate, cable KKL 409. VAGCOM, I read the EPROM under code.
(program name) --bootmode 95040 -r -p 1 95040.bin
When writing the EPROM, everything OK least I get error verify 0x70101. the command is:
(program name) --bootmode 95040 -wp1 95040.bin
Anyone know why ?, what I can do?
It is a dead end.
A greeting
thanks for everything.

I have also a question to fault codes. I have 2 ECUs from a PSA V6 (ME 7.4.6), one is maybe broken, the other one should be ok.

Can anyone help me with this fault codes?

First:
D:\>v14 --bootmode 95160 -b 9600 -r -p 3 EEPROM.bin
ME7_EEPROM v1.40
COM: 3, Baud Rate: 9600
Memory type: 95160, size: 2048
Opening COM3 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... FAIL. (error=0x40F01)
Closing COM3

Second:
D:\>v14 --bootmode 95160 -r -p 3 EEPROM.bin
ME7_EEPROM v1.40
COM: 3, Baud Rate: 10400
Memory type: 95160, size: 2048
Opening COM3 ... OK
Starting Boot_mode ... uC ID response 0xC5: C167CR ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... FAIL. (error=0x40E01)
Closing COM3

The first EEPRom is a 95160, the second a 25C16. If the read/write is not possible, does anybody know, if I can change them (desoldering), even if they are not exactly the same? The size is identical...

Sry, I'm not so familiar with this "basic" electronic stuff and I do not find this fault codes in another post...

Regards,
Ben

Just as information:

I tried it out and it's possible to replace a 25C16 with a 95160 EEPROM. The engine runs.

Regards,
Ben

thanks for the tool argdub. ;D

I am having issues. I have version 1.40 and am using a vcds genuine hex+Can cable set to dumb mode. I also have a chinese Vag tacho cable I've tried too. Both are USB interfaces. The program isnt recognizing the port. Not sure if its my computer's fault or the program or my interface. Has anyone else ran into this issue?

Im getting:

Opening COM1 ... Unable to open comport. (error=0x20201)
Closing COM1

Any ideas?

does your cables's are set to com1 in device manager ?

If you are using RossTech you need the VCP driver to have it show up as a COM port.

Hello! I'm having problems reading my A6 C5 4.2l ecu. I am getting everytime error 0x01. I've tried v1.4 but then it gives error 0x07. I'm using blue KKL cable.

C:\Users\juuho\Desktop>me7_95040 -r -p5 --OBD 95040.bin
Ver: 1.31
Com Port: 5
Baud Rate: 10400
Opening COM5 ... OK
Initiating communication ... OK
ECU ID response: 4D0907558A
                 4.2L V8/5V      G
                 0002
                 SoftCod: 05752, WSC: 02335
Reading EEPROM ......................................................................FAIL. (error=0x01)
Closing COM5


Any help on this? :)

try to read in bootmode...

Works like a charm !
Thanks a lot !

Hi guys!
i have problem with reading my me73h4 :(
Anny sugestions?

I am having the exact same issues and my car is stuck in immo for some random reason.

Hello,

I'm getting this message. Any help will be much appreciated.

Ver: 1.31
Com Port: 3
Baud Rate: 1040
Opening COM3 ..
Initiating comm
Closing COM3

OBDII CHina Cable
WIndows 7
Bench cheap set-up

Post the cmd prompt log

Check and try setting the eeprom type and pin manually?

Never mind the first one, it's this one.

This is the current log, i can't find the file anywhere, it says it saved the file but i cannot locate it.

C:\Users\Sergio Mojarro>Desktop\me7\me7_95040 --bootmode -r -p 3 95040.bin
Ver: 1.31
Com Port: 3
Baud Rate: 10400
Opening COM3 ... OK
Starting Boot_mode ... uC identification response = 0xC5 (C167 derivatives) ...
OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P4.7
Configuring SPI Interface ... OK
Checking EEPROM status ... 0x00F0 ... OK
Reading EEPROM ... OK
File saved
Closing COM3

it will be a file called 95040.bin in the folder C:\Users\Sergio Mojarro

C:\Users\Sergio Mojarro\Desktop\me7\

You know you can search for files on Windows, right?

run cmd in admin mode if there is no file...

Amazing tool. But I need some advice...  ::)

I can't get my 032TL (Infineon CPU) to read over OBD. It opens the COM port, connects, begins to read for approximately 60 seconds, then fails. The car then logs a P0606 error code. It still starts and runs OK... so far.

Why can't it read? Immobiliser based issue? Low voltage despite using a battery charger?

I have successfully flashed my spare 032TL with an immo off (untested as to whether it starts the car or not, it's raining), and can read and write via bootmode on a bench. I can also read and flash via Nef outside of bootmode - so the immo off must be working at least for the most part.

However, with immo off, it reads just fine over OBD.

I'm at a total loss as to why I can't read in the car, I know my immobiliser is working?! :(

Looks good, as already said since you didn't specify a path the tool dumped it into the current working directory (normal practice)

I think I remember something about pulling the cluster fuse, search thread.  Bootmode seems to be much better imo.

meh - UAC :)

go it.

thank you gentlemen, much obliged!!

Good shout actually.  The cluster won't let me log, but it sure lets me pull the EEPROM.  Yours could be limiting everything totally.  Basically the cluster stops all traffic because its constantly pulsing data and the ECU never gets a second to breathe.

Pull the cluster fuse (ignition on first, then pull the fuse), until the needles go dead.  Don't know the fuse number, the the needles will fall down.

I seem to be getting slight changes in my 95040 dumps each time I read them (with both bootmode or OBD). Any reason for this? bytes 0x112 - 0x115 are different each time.

adaptions, DTC's etc

Ah, makes sense. Should've thought about that. Thanks!

so what do we say to a verify eeprom write fail?  <error 0x70101> ?