NefMoto

Technical => Reverse Engineering => Topic started by: Colt45 on February 28, 2017, 08:17:28 AM



Title: ME7.5 95040 information / questions
Post by: Colt45 on February 28, 2017, 08:17:28 AM
I was wondering if someone had a good idea of what is stored on the eeprom?

I've found this image which explains some things.

(http://i83.photobucket.com/albums/j318/Cyril279/95050_explained_zpsa3d0abec.png)

It seems like most the bits after 0x130 are adaptations (and maybe DTCs? or are those not stored at all), as clearing codes resets most of the bits.

What I'm most curious about is the 4 bytes starting at 0x112. Does anyone know what they represent?

I have an ECU here, it seems every boot those bytes are different. When I write to it with argdubs tool it fails verification. If i dump the eeprom and do a diff to the last read though, the only bytes not matching are 112 - 116, which seem to be basically random data each read.

I think if I keep booting in bootmode it stays the same, though (so something in normal ECU running keeps writing different values there, I guess)

Any ideas?


Title: Re: ME7.5 95040 information / questions
Post by: formaldegid on August 11, 2024, 12:07:38 PM
Voting for this question too. I'm trying to read 06A 906 032 GR (Bosch code 0 261 207 352) which is also ME7.5 with Galletto 1260 FTDI cable using me7_95040 logger. ECU ID response is the following:
Quote
06A906032GR
2.0l R4/2V M6
4878
SoftCod: 00002, WSC: 00000

That is ECU for 2.0l gasoline engine (either ADY or ATM) from Seat Alhambra 2003.

I made some experiments and found out that the bytes keep changing if I read EEPROM over OBD. But if I read EEPROM in boot mode it remains the same. I converted HEX data in DEC but I don't see any other system in DEC too. The results of my experiments are in this table:
123456789101112
OBDBOOTBOOTOBDBOOTBOOTBOOTOBDBOOTBOOTOBDOBD
HEX
0x11286242413ACACACFBB4B433EB
0x1136A1E1E25C8C8C88B2B2B8DA6
0x114BAA9A98F4545453955551B2B
0x1159DE6E684E2E2E23CA3A34518
DEC
0x11213436361917217217225118018051235
0x1131063030372002002001394343141166
0x1141861691691436969695785852743
0x115157230230132226226226601631636924
Based on my results I think those bytes keep changing only if you read EEPROM over OBD. But that is only my assumption, I may be wrong. I'm playing with this ECU only for the first week :)


Title: Re: ME7.5 95040 information / questions
Post by: gremlin on August 11, 2024, 02:13:56 PM
Doesn't matter. This is a 4-byte rolling code. It is generated randomly in the ECU program every time the ignition is turned off and on.
In boot mode, the firmware program does not start and therefore this code does not change.
In ME.5 units, this code is not used for anything.


Title: Re: ME7.5 95040 information / questions
Post by: Colt45 on November 25, 2024, 12:34:01 AM
I had forgot I asked this so long ago, thanks :)