NefMoto

I want to read the internal ROM from the C167. 0x0 to 0x7FFF? I got Minimon working and read the attached bin. Does this match what others have pulled?

Also attached are screenshots of how I setup Minimon. Using ebay blue kkl cable. ECU is on the bench in boot mode.

Edit: The C167 IROM file I attached in this post read out wrong. Leave the configuration settings alone, it'll figure them out. Meaning the 2nd screenshot is wrong!

Here is what I read out of the primary C167.

Thanks Tony!

Odd, your internal rom bin matches up very closely with the first 32k of the HS flash. But it doesn't seem to match the first 32k of the 002 M-Box flash?  ???

I'm not good enough yet to figure this out by myself. Disasm makes sense when looking at your internal c167 rom, there are lots of handlers jumping to the 0x820000 area. (Assuming flash starts @ 0x800000) The data I read out doesn't make as much sense...lots of jumps to the 0xFA0000 area??

The internal ROM and Flash are completely separate and don't match at all. Andy Whittaker has incorrect info posted on his site if that is what you are referencing.

Any idea if it's different between ME 7.1 & 7.5? I'm working with the 06A906032HS ECU which is ME7.5 (VW 02 1.8T AWP NA)

Screenshot - Your internal c167 rom matches up really well with the start of the 06A906032HS flash oddly enough?

I know there are two different versions of the ME7.1 internal ROM. Setzi62 knows more about how many versions there are than I do.

The start of flash memory is similar to the internal ROM, but it isn't guaranteed to be the same, and they aren't memory mapped to the same memory or anything.

Thanks, I've still got a lot to learn. I'll keep messing around with Minimon. I'm getting a bad read or have my settings wrong. Every other byte is matching up to the first 32k of the flash. Then every next byte is a dupe of the previous one.

ME7.1/7.5 ECUs have 3 versions of IROMs content  with 16-bit add CSMs:
$5CF6 (ECUs with 512k flash)
$6DE5 and $DCA0 (ECUs with 1M flash)

Will the internal rom data I pull from this HS match the flash's first 32k?

No. It will be different.

The internal rom you pulled from the HS ecu is not correctly read.
In the file only the odd bytes are contained (doubled), e.g.:
00000000: fafa7070 fafa0404 fafa1818 fafa0c0c  ..pp............

Check your settings/program.

There are two main families of bootroms, 05.XX and 06.XX used in ME7.1/ME7.5.
Normally the first 32kB of the flash for a ME7.5 are matching the bootrom, but it is
not necessary.

Thanks! Back to the bench...

Eventually I want to find the code behind the alternate rpm limiter NMAXOG that was posted here for the stock launch control feature. Specifically the part where it compares TNMXH (gets set to 6800 seconds) to the elapsed time and patch the code to make the comparison always < or nop out the jump that turns off the alt rpm limit so the feature stays on all the time instead of returning the RPM limit to NMAX which is now the launch RPM [+DNMAXH]

Figured it'd be a good starting idea since I'm pretty new to the process and completely new to this processor.

It's happen because register config in C167 for external ROM bus in minimon was set wrong.

Got it to read correctly by leaving the Configure dialog alone instead of trying to define registers and memory myself.


BUSCON address(es)?

What tool you use to read prosessor data?

First post of the thread. Freeware program by the company that makes these CPUs.
If you aren't trying to disassemble the software then you likely won't have any use for it.

Yes.
For ME7.xx is it enough to set BUSCON = $4AD

If I want to make 100% clone i need prosessor data also.?

Not need. You can't rewrite CPU content.
If you want to make clone, you must take new ECU hardware based on the same CPU as your.

Why you can't write the IROM, isn't it flash type memory?


this what I use:

   {"SYSCON", 0xFF12, 0xE604},
   {"BUSCON0", 0xFF0C, 0x04AE},
   {"ADDRSEL1", 0xFE18, 0x3803},
   {"ADDRSEL2", 0xFE1A, 0x1007},
   {"ADDRSEL3", 0xFE1C, 0x0000},
   {"ADDRSEL4", 0xFE1E, 0x0000},
   {"BUSCON1", 0xFF14, 0x040D},
   {"BUSCON2", 0xFF16, 0x04AD},
   {"BUSCON3", 0xFF18, 0x0000},
   {"BUSCON4", 0xFF1A, 0x0000},

Thanks! For anyone else curious those addressees are in the datasheet as well. I found I could not enter any of it and it'd work for me still. When I tried defining addresses that's when it read wrong.

The C167 IROM is flash, but it is read only. According to the Infineon docs it is programmed on the CPU is manufactured.

Attached are my MiniMon settings.

how can i exactly copy the cpu ?? what setting do i need for minimon? i downloaded the .ini file from tony but i connect and after the einit the connection is lost.

i dont want to copy the eeprom of the me7.1.1 only the cpu data... please help

To exactly copy the ECU, you need the contents of the 95040 serial eeprom and the AM29F800 flash memory chip. The two C167 processors also have internal ROM programmed when the ECU was manufactured, but it is read only.

The INI file I posted will allow you to read the flash memory chip. You need a separate Minimon driver to read the 95040 serial eeprom. User Argdub made a tool for reading the serial eeprom in boot mode that should work for you though.

Great reply Tony Where can i get this driver from

I don't know anywhere that has the Minimon driver for reading the serial eeprom. If you use the tool that Argdub wrote though, then you don't need it.

ok 1 more important thing is how can i read teh IROM or the ecu ROM ? which adress is it i cant find it

btw.. what is exactly in the serial eeprom?

The IROM on the C167 chip is at 0x0000-0x7FFF if I recall. You can always read the C167 data sheet.


94050 SPI memory chip containing DTCs, Immo, adapatation, VIN, etc.

Hm damn Tony i tried this Adress so far
just Managed to read the Flash file 1024kbyte
That worked.
The datasheet says you have to enable the internal Rom
At initialisation but how in Minimon??

I don't recall off hand how to control if the IROM is enabled. I think a resistor connected to the processor or a read only factory setting in the processor does it.

If you are having trouble reading the IROM, the the issue is likely with setting up the bus configuration and address selection for the memory ranges. The processor is probably accessing the external flash memory because another memory range has not been defined with higher priority to access the IROM.