|
Title: Error when attempting to read Allroad ECM. Post by: SteveAR on November 11, 2016, 05:21:39 PM Greetings all.
Car: 2004 Audi Allroad 4.2L V8 / Auto ME7.1.1 VAGCOM Reports the ECU PN as: 4D0907560BE Several years ago I downloaded the EEPROM tool from this site and was able to extract the SKC from my 2.7T Allroads ECM. I now have a 4.2L Allroad and I'm attempting to do the same. I opened up both ECM's and transferred the boot mode toggle switch from the 2.7T ECM to the 4.2L ECM. They look virtually identical on the inside. I then ran the EEPROM tool and attempted to read and I got the error in the photo below. Can anyone shed some light on this? ECM seems to be coming up in Boot mode. Car acts differently when I power it up in boot mode and the command prompt feedback seems to indicate boot mode was successful. Just not sure why I'm getting this particular error. Thanks! (http://i1092.photobucket.com/albums/i401/swamper81/IMG_20161111_190008_865_1.jpg) (http://s1092.photobucket.com/user/swamper81/media/IMG_20161111_190008_865_1.jpg.html) 4D0907560BE Title: Re: Error when attempting to read Allroad ECM. Post by: f1torrents on November 12, 2016, 03:07:32 PM I dont think the ME7.1.1 had a 95040 in it.
I think its 95160 or 95P08 Look at the chip and use that option and it should work. Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on November 12, 2016, 03:36:57 PM Well I opened up the ECM I'm currently working with and I also opened up the ECM i had previously cracked/flashed etc a few years ago.
I thought the IC in question was the 8 pin IC on the back side of the ECM. At least that's what the 95040 looks like. Current ECM: ST 5P08C3 last ECM: ST 5P08C3 So even though neither is the 95040, I WAS at one point, a few years ago, able to connect/read/extract the SKC from my previous Allroads ECM. And both these ECM's have the same IC however I cannot access the current ECM. So there must be something else going on? Title: Re: Error when attempting to read Allroad ECM. Post by: f1torrents on November 12, 2016, 04:14:54 PM You still will be able to get it.
And you are correct it is the 8 pin SOIC8 But you must use me7_95040 --bootmode 95P08 -r -p3 eeprom.bin the program is able to read the following memory types -95040 -95080 -95160 -95P08 But you have to specify the correct chip on your board. The 95040 is by far the most common so I guess thats why he named the program as such. Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on November 12, 2016, 04:38:33 PM So I had previously accessed the tools help menu to see all the command line options. checked again, didn't see the --bootmode switch. I attempted it anyway exactly as you had it in your last post. The error that came back is "unrecognized option '--bootmode'
thoughts? Title: Re: Error when attempting to read Allroad ECM. Post by: prj on November 12, 2016, 05:40:55 PM You are using a really old version of the tool.
Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on November 12, 2016, 06:18:50 PM V1.31
downloaded it from the opening entry in the ME7_95040 thread in this forum. I assumed this entry got updated as new versions came out. Or do I need to dig through additional pages of the thread to get to newer versions? Title: Re: Error when attempting to read Allroad ECM. Post by: f1torrents on November 13, 2016, 02:13:12 AM It's at 1.4 I believe.
Sent from my iPhone using Tapatalk Title: Re: Error when attempting to read Allroad ECM. Post by: f1torrents on November 13, 2016, 10:34:28 AM 1.40 Found on page 12
Attached below. Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on November 13, 2016, 06:38:28 PM Thank you for that. I also posted in the actual thread for the software and it looks like the first post is going to get updated with the latest version. I will try out V 1.4 tomorrow to see how it works!
Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on November 14, 2016, 05:35:47 PM OK well some progress! But not enough....
First off, I downloaded V1.4. Attempted to communicate with the ECM with the --OBD option. result = FAIL. Expected, that would be too easy. Went back and put the ECM in boot mode and entered the command line as you (F1Torrent) recommended. I've attached the result. Closer! but it's having a problem with the chip select I guess. Any way to figure this out? Sorry for the quality of the photo. It choked on the chip-select. error 70301 (http://i1092.photobucket.com/albums/i401/swamper81/Mobile%20Uploads/IMG_20161114_191424_553.jpg) (http://s1092.photobucket.com/user/swamper81/media/Mobile%20Uploads/IMG_20161114_191424_553.jpg.html) Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on November 14, 2016, 06:26:57 PM While I appreciate the wealth of knowledge that exists on this site, the search function f'ing sucks!!
Title: Re: Error when attempting to read Allroad ECM. Post by: nyet on November 14, 2016, 06:28:16 PM Can you just copy/paste from the dos box? Or at least take a proper screen shot of the active window?
Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on November 14, 2016, 06:38:47 PM Sorry about that. I'm using a POS 7" Windows tablet to connect to the car while my IPAD is propped up on the steering wheel. Sometimes there's just no substitute for a laptop.....
It's free for hobby use. This software is provided "as is", with NO WARRANTY. email: agv.tuning@gmail.com C:\NEF>me7eepromv1.4 --bootmode 95P08 ME7_EEPROM v1.40 Error: com_port option not specified. (error=0x10601) C:\NEF>me7eepromv1.4 --bootmode 95P08 -r -p3 eeprom.bin ME7_EEPROM v1.40 COM: 3, Baud Rate: 10400 Memory type: 95P08, size: 1024 Opening COM3 ... OK Starting Boot_mode ... uC ID response 0xD5 ... OK Sending Loader + MonitorCore ... MonitorCore successfully launched Reading IDCHIP ... 0x0C43: C167CS ... OK Initializing registers ... OK Sending EEPROM driver ... OK Searching Chip_Select pin ... FAIL. (error=0x70301) Closing COM3 Title: Re: Error when attempting to read Allroad ECM. Post by: f1torrents on November 15, 2016, 12:57:26 AM C:\NEF>me7eepromv1.4 --bootmode 95P08 --CSpin P6.3 -r -p3 eeprom.bin
I'm 99% sure the CS is 6.3 for that ECU but if someone can confirm... Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on November 15, 2016, 07:21:18 PM So I rolled the dice with P6.3 and it worked first time. Read/saved/closed. Haven't gone to look at the file yet though. Anyways, thanks so much for your help! I definitely wouldn't have figured that out on my own, I would have just gave up and started monkeying around with my chip clip etc. Doing it in the car is way easier. So is this all tribal knowledge or is there some guide/document which outlines this stuff? EG what P6.3 is and how you knew that was correct. In my world, P6 would be the reference designator for the IC on the PCB and 3 would be the pin. However I am looking at my ECM's and they don't have silkscreened reference designators.....
Onward and upward! Title: Re: Error when attempting to read Allroad ECM. Post by: nyet on November 15, 2016, 09:47:38 PM So is this all tribal knowledge or is there some guide/document which outlines this stuff? This is EXACTLY the problem; I wish there was a central db to keep track of this crap. Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on November 16, 2016, 08:24:53 AM So might as well ask one more question. Or maybe 10. I understand that when using the ME7 flash tool (the one for flashing the main memory/tunes etc.) that the checksum will change. And on power up, the ECM compares a stored checksum value to the real-time value it reads. And if they don't match it won't start. Hence the need for updating the stored checksums.
Does the ECM also go through this process for the IMMO IC I've been working with? EG if I were to change the memory blocks where the VIN is stored, the IMMO IC would then technically have a different checksum. Is there a check process for this IC as well or only the main memory area where the ECM's tune/engine management code is stored? Title: Re: Error when attempting to read Allroad ECM. Post by: nyet on November 16, 2016, 11:04:04 AM Yes, the eeprom has it's own checksums.
Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 20, 2017, 06:22:27 PM OK well back at this project again. I've been re-familiarizing myself with everything in this post. I was able to again use the ME795040.exe program to do a EEPROM dump of my ECM. I then used the 95040tool to change the VIN of that dump BIN. My understanding of that tool is that it also corrects checksums unless otherwise specified. I then wanted to run another program just to do a double-check of the checksum. I've downloaded a few of the other programs off this site and here are the results I get when I run them on a few of my eeprom dumps:
Checksum85040.exe - Seems to work on a 2.7T stock EEPROM dump I have. (512K) Doesn't report any errors, doesn't report anything. When I run it on the BIN above, I get an error stating it expects to see 512K and it finds 1024K. Seems it's not happy with the chip used for my 4.2's EEPROM. ME7sum.exe - Tried on 2.7T dump and 4.2L dump. Reports "odd size" for both. I'm guessing this is a tool for the main firmware CS check? ME7Check.exe - Same as ME7sum except slightly different errors. Both errors indicate expected size vs. actual size. (note, someone else responded in another post that these tools are for firmware only) ME9sum.exe - This tool runs on both my experimental BINs. Except my 2.7T .BIN is stock, no mods, but this tool reports that it changed 76 checksums. Nothing should have had to been changed. This tool does the same thing with my 4.2 BIN's, both the stock dump and the VIN-modified version. I don't think this tool is working right since it's reporting it has updated checksum's for BIN files that have not been modified. SO, big question, what tool(s) can I use to check/correct the checksums of my EEPROM(s)? I like that the 95040tool (supposedly) corrected the checksums after the VIN modification, but I need to change the SKC over as well. I didn't see a option to update the SKC in the tools documentation, so I figured I'd have to go into the BIN and change the two hex values accordingly; then correct the CS's after. Help appreciated, I'm probably missing something simple. It's worth noting that my EEPROM on my 4.2L is a SP08C3 and is 1024 bytes. When I look at the BIN in a hex editor, 513-1024 is just all FF's. There's no data in that section of memory. Once I get this all sorted out and working as-is, I'd like to try putting a more common 512 IC in there to see what happens. ME7.1.1 4.2L V8 4D0907560BE EEPROM SP08C3 Title: Re: Error when attempting to read Allroad ECM. Post by: nyet on February 20, 2017, 06:47:17 PM ME9sum.exe - This tool runs on both my experimental BINs. Except my 2.7T .BIN is stock, no mods, but this tool reports that it changed 76 checksums. Nothing should have had to been changed. This makes no sense. Please post the bin and/or the output of me7sum Quote This tool does the same thing with my 4.2 BIN's, both the stock dump and the VIN-modified version. I don't think this tool is working right since it's reporting it has updated checksum's for BIN files that have not been modified. 4.2 support is not fully tested. Please post the bin and/or the output of me7sum As a future note, do not use "CS" to mean "checksum", it means "chip select", especially in the context of eeproms. Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 20, 2017, 07:03:57 PM Attached is a fresh dump from my Daily Driver. 2004 Allroad 2.7T/6MT. (file 27T.BIN)
I've also attached a fresh dump of my 4.2L ECM EEPROM. (42.BIN) Not sure how to get what's in my Command window into this forum other than doing a screen shot. Did you want the ME7sum info or the ME9sum info? Here's what they all say/do: c:\ME7SUM 27t.bin Attempting to open firmware file 27t.bin File is an odd size (512 bytes). Are you sure this is a firmware dump? warning! 1/1 uncorrected error(s) in 27t.bin! C:\ME7SUM 42.bin Attempting to open firmware file 42.bin File is an odd size (1024 bytes). Are you sure this is a firmware dump? warning! 1/1 uncorrected error(s) in 42.bin! C:\ME9SUM 27T.bin runs and reports 76 checksums corrected C:\ME9SUM 42.bin runs and reports 76 checksums corrected Thanks for the tip on CS/checksum. What a unfortunate coincidence.... Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 20, 2017, 07:15:25 PM ECM PN's:
27T.BIN came from a 4Z7907551S 42.BIN came from a 4D0907560BE Title: Re: Error when attempting to read Allroad ECM. Post by: nyet on February 20, 2017, 09:10:50 PM You did NOT provide the output of your command, nor did you provide the bin.
Furthermore, unless you specified an output file, no correction would be done at all, so "runs and reports 76 checksums corrected" makes zero sense. Code: $ ./me7sum bins/4Z7907551S.bin md5: Code: $ md5sum bins/4Z7907551S.bin Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 21, 2017, 06:12:46 AM Thank you, I will try specifying the output .BIN tonight when I get home. The MED9sum tool creates it's own output file if none is specified so I incorrectly assumed that ME7sum does the same thing.
"Usage is the same as ME7sum, and 95040sum: MED9sum [input.bin] [output.bin] Failure to specify output will result in the file being named [input]-CHKOK" I am getting all these programs mixed up..... As far as this comment: "Furthermore, unless you specified an output file, no correction would be done at all, so "runs and reports 76 checksums corrected" makes zero sense." This was the message I received when running my .BINs with MED9sum, not ME7sum. So I hope that makes more sense now? If not I can send you screen shots of me running my BIN's through MED9sum so you can see what it reports. C:\MED9SUM 27T.bin runs and reports 76 checksums corrected C:\MED9SUM 42.bin runs and reports 76 checksums corrected Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 21, 2017, 06:14:54 AM I don't know why I used med9sum, I just wanted to try it to see if it was backwards compatible to ME7.......
Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 21, 2017, 10:28:57 AM Still missing something here and I don't know what. Are these tools for EEPROM bins, FIRMWARE bins or both? Here are the instructions I found:
http://nefariousmotorsports.com/forum/index.php?topic=3347.0title= To check image.bin: ME7Check image.bin me7sum image.bin To output corrected checksums you must specify an output file: me7sum image.bin out.bin So I did: me7sum.exe 27T.bin output.bin Result: Attempting to open firmware file 27t.bin File is an odd size (512 bytes). Are you sure this is a firmware dump? Then I did: me7Check.exe 27T.bin output.bin Result: Just provides usage instructions. Then I did: me7Check.exe 27T.bin Result: me7check: binary file 27t.bin has not correct length (is 0x200 bytes long, 0x80000 or 0x100000 bytes expected) I scrolled to the very top of what you posted and I only see you calling "me7sum bins/4Z7907551S.bin" Did you re-name my 27t.bin to 4Z7907551S.bin or are you opening a 4Z907551S.bin file you already had on hand? $ ./me7sum bins/4Z7907551S.bin ME7Sum (v1.0.3-5-g2aec-dirty) [Management tool for Bosch ME7.x firmwares] Inspiration from Andy Whittaker's tools and information. Written by 360trev and nyet [BSD License Open Source]. Attempting to open firmware file 'bins/4Z7907551S.bin' Step #1: Reading ROM info .. Searching for EPK signature...OK Searching for ECUID table...10: '1037368391' 12: '4Z7907551S ' 4: '0020' 15: '2.7L V6/5VT ' OK etc.... I do not get all this info. Title: Re: Error when attempting to read Allroad ECM. Post by: nyet on February 21, 2017, 11:53:29 AM Still missing something here and I don't know what. Are these tools for EEPROM bins, FIRMWARE bins or both? Here are the instructions I found: SIGH Quote So I did: me7sum.exe 27T.bin output.bin Result: Attempting to open firmware file 27t.bin File is an odd size (512 bytes). Are you sure this is a firmware dump? This doesn't answer your question? Quote me7Check.exe 27T.bin Result: me7check: binary file 27t.bin has not correct length (is 0x200 bytes long, 0x80000 or 0x100000 bytes expected) Or this? Quote I scrolled to the very top of what you posted and I only see you calling "me7sum bins/4Z7907551S.bin" Did you re-name my 27t.bin to 4Z7907551S.bin or are you opening a 4Z907551S.bin file you already had on hand? Why would I rename your bin, which isn't flash image? Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 21, 2017, 01:32:00 PM It's my understanding of vernacular that a EEPROM dump is that of the 8 PIN IC on the back of the ECM which holds the VIN/SKC etc and the firmware is the main flash/tune of the ECM. In my post yesterday I was asking for direction to the best tool to check/correct the checksums for my EEPROM. If you or anyone else can direct me toward that I would appreciate it.
From Yesterday: SO, big question, what tool(s) can I use to check/correct the checksums of my EEPROM(s)? I like that the 95040tool (supposedly) corrected the checksums after the VIN modification, but I need to change the SKC over as well. I didn't see a option to update the SKC in the tools documentation, so I figured I'd have to go into the BIN and change the two hex values accordingly; then correct the CS's after. Help appreciated, I'm probably missing something simple. It's worth noting that my EEPROM on my 4.2L is a SP08C3 and is 1024 bytes. When I look at the BIN in a hex editor, 513-1024 is just all FF's. There's no data in that section of memory. Once I get this all sorted out and working as-is, I'd like to try putting a more common 512 IC in there to see what happens Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 22, 2017, 01:27:10 PM For the interest of anyone else reading/following this thread, I found a tool to check/correct my EEPROM BIN/checksums. It's 95040sum.exe. I ran this on my stock 2.7T EEPROM dump (512 bytes and likely a 95040 IC) and it reported no corrections needed. (expected result) I then ran it on my 4.2 EEPROM dump (1024 bytes) and unfortunately the program only works on 512 sized EEPROMS. It reported "file must be 512 bytes."
I'm going to try and figure out if there's a different version of this tool available or figure out who wrote it. Title: Re: Error when attempting to read Allroad ECM. Post by: nyet on February 22, 2017, 02:09:10 PM I then ran it on my 4.2 EEPROM dump (1024 bytes) and unfortunately the program only works on 512 sized EEPROMS. It reported "file must be 512 bytes." You don't need any other tool except the ability to truncate the file to 512 bytes. your clue is here in your very own post: It's worth noting that my EEPROM on my 4.2L is a SP08C3 and is 1024 bytes. When I look at the BIN in a hex editor, 513-1024 is just all FF's. There's no data in that section of memory. Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 22, 2017, 03:43:29 PM Fair enough, I figured the down and dirty way was to use my hex editor to create a BIN file of just the lower 512 of my 1024 dump. The only area with real data. Make changes to that, run that through the checker tool and then put that back into the original 1024 byte BIN. My understanding from reading is that in a 512 byte file, there's 32 addresses(?) each with 16 bytes. the first 14 bytes are data and the last two are the checksum. At work if I read or flash a file to an IC, there's a single checksum for the entire contents of the chip. Is this so with what I'm working with and is the ECM also checking that? If I modify just the lower 512 and leave the upper 512 alone, the checksum for the entire file will have changed. Whether that's relevant or checked by the system I don't know.
As I said I would eventually like to put a 512 byte chip on my ECM but for the time being I want to leave the 1024 byte chip in place. I don't know why they used it and don't want to create a problem for myself. I assume it was because the 512 went obsolete or they had trouble getting it. But, blank or not, in case the ECM is looking to verify the upper 512 I want to leave it in place. Unless someone can confirm that part of the memory is ignored. Title: Re: Error when attempting to read Allroad ECM. Post by: nyet on February 22, 2017, 04:42:21 PM Unless someone can confirm that part of the memory is ignored. It is ignored. Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 22, 2017, 05:14:20 PM OK thank you for this info. I was able to copy the lower 512 of my EEPROM dump into its own .bin file, make VIN/SKC/IMMO ID/Cluster ID changes to that file, run through checksum corrector and verify the data changed via the 95040tool --status output. I copied the lower 512 back into my 1024 BIN and flashed it to the ECM. It will still be nothing short of a miracle if it works but i'm hopeful.
I still can't find any info on changing the soft coding of the ECM from a auto to a manual. The 4.2L Allroad was never offered as a manual so I'm still slogging through that challenge. I know that on the 2.7T, you change the software coding from 07755 to 07715 (where 5=auto and 1=manual) but when I try and change my 4.2L/Auto ECM softcoding in the same manner, it reports an "out of range" error. Stock software coding is 0007755. I tried coding it to 0007715 with VCDS and it returned the "out of range" error. (I logged in with the SKC) Someone passed this post to me and I emailed the two gentlemen (PRJ and DDillenger) who claim they've handled this before...... http://nefariousmotorsports.com/forum/index.php?topic=3636.0title= Title: Re: Error when attempting to read Allroad ECM. Post by: nyet on February 22, 2017, 05:19:08 PM I wish I could help you there but I have no 4.2 AR experience :/
Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 22, 2017, 05:58:06 PM No Problem, thanks for the help. I'm much closer than I've ever been. Hoping to hear back from one of those guys. Or I may need to flash the ECM (main flash/tune) with a file from a car that offered both an Auto and Manual. EG a B6S4. That car has the same exact motor as the 4.2L Allroad but because it was an S4 they also offered a 6MT. I have a ECM from that exact car coming in the mail (EBAY) so I can examine the soft coding. Also maybe read the main flash off of it and copy it to my Allroad ECM. Or leave the EBAY ECM as-is and update the VIN/SKC/IMMO/CLUSTER info. I'll have several options to try when I pull the trigger on this swap which should be in the next couple weeks.....
Title: Re: Error when attempting to read Allroad ECM. Post by: AARDQ on February 23, 2017, 08:07:05 AM If it was never offered as a manual, most likely soft coding isn't going to work. DDillinger passed away last year.
You might reach out to Nubcake if prj isn't available; he's done similar work with the RS6. Title: Re: Error when attempting to read Allroad ECM. Post by: SteveAR on February 23, 2017, 08:57:51 AM Very sorry to hear that. I guess none of us are guaranteed a tomorrow.
I do hope to hear back from PRJ , I sent him a PM. Thanks for the suggestion of Nubcake. I will send him something as well. It was my fear that soft coding wouldn’t work for the reason you stated. And my best guess at the soft coding got rejected by the ECM (out of range!) so likely that confirms it. I have higher hopes that I can grab the factory baseline/flash off my B6S4 ECM and use that. Chomping at the bit for that to arrive. Or just use that ECM period. (after matching the SKC/VIN/IMMO/Cluster info) We shall see. I still have my fall-back plan of contacting JHM. |