NefMoto

Technical => Reverse Engineering => Topic started by: kaosman on July 31, 2017, 08:05:01 PM


Title: Need assistance with Minimon and ME7.8
Post by: kaosman on July 31, 2017, 08:05:01 PM
Hello,

I am having difficulties reading my Porsche 997 ME7.8 ecu in boot mode with Minimon. I have already used the Galetto tool to read the flash in boot mode successfully, and after disassembling the code in the flash I realized I needed to view the internal ROM to figure out the checksums and entry point for the flash. When using Minimon and a VAG dumb mode cable it will not connect no matter what I try. I get an Error: No ID byte received, followed by an ACK error. I've tried multiple baud rates, tried multiple configurations, nothing will get me past this point. I've read up on the bootstrap in the C167 documentation and believe there is an issue with the 0 byte or the timing following the 0 byte, but I am not completely familiar with the process and I'm ready to pull my hair out. Can anyone help a Minimon noob connect to his ecu? Thank you for taking the time to read all of this! :)

Title: Re: Need assistance with Minimon and ME7.8
Post by: dragon187 on August 01, 2017, 03:04:42 AM
Hi
Can you please share that minimon?
Where are you from?

Title: Re: Need assistance with Minimon and ME7.8
Post by: terminator on August 01, 2017, 04:19:33 AM
Piasini can read it.

Title: Re: Need assistance with Minimon and ME7.8
Post by: kaosman on August 01, 2017, 05:00:57 AM
Quote from: dragon187 on August 01, 2017, 03:04:42 AM
Hi
Can you please share that minimon?
Where are you from?

I'm from Florida in the US.

Here is what I'm seeing from Minimon when I try to connect. Each time I try, the byte received for ACK changes:
Code:
*Loader file Prepare
*Minimon file Prepare
*send Byte  0+ Loader + MinimonCore
*ERROR: No ID byte received
*ERROR: No Loader_ACK Byte received (MinimonCore not loaded)
*RECEIVE - Minimon ERROR:  Incorrect Minimon ACK received E6
58 01 00 9A B6 FE 70 E6 F0 60 F6 7E B7 9A B7 FE 70 A4 00 B2 FE 86 F0 E7 F7
3D F8 EA 00 06 F6 7E B7 7E B6 E1 31 BB 6E BB 73 F1 B0 E7 F1 AA 00 BB 69 E7
F1 EA 00 47 FB 31 00 3D 03 B5 4A B5 B5 0D 5F 47 FB 93 00 3D 01 0D 5B 47 FB
32 00 3D 03 BB 59 B7 48 B7 B7 47 FB 33 00 3D 05 F1 1A BB 52 E7 F1 EA 00 0D
4D 47 FB 84 00 3D 1E E1 0A BB 6A BB 71 A0 03 3D 01 0D 44 BB 4B F1 80 51 A8
(there was more hex but I didn't copy it)

And here is my Minimon INI file:
Code:
[Minimon]

IDLENGTH= 1
KERNEL=C16X_DEFAULT
TRANSFERBUFFERSTARTADDRESS=00FC80

[Communication]

PORT=COM4
BAUDRATE= 9600
PARITY= 0
DATA= 8
STOPBITS= 1
TIMEOUT= 2000
KLINE= 0
TMODE= 1
CONNECTTIMEOUT= 100
CONNECTRETRY= 10
CHECKCONNECTION= 0
INITCHAR= 0

[Controller]

MCTYPE=C167CS-4RM
CLK= 20000000


[Memory]

NAME=SFR
TYPE=IRAM
BLANK=0x00
BURSTSIZE=0x0080
ERASESIZE=0x0100
SECTION(0).STARTADDRESS(0)=0x00FE00
SECTION(0).LENGTH(0)=0x000200

NAME=ESFR
TYPE=IRAM
BLANK=0x00
BURSTSIZE=0x0080
ERASESIZE=0x0100
SECTION(0).STARTADDRESS(0)=0x00F000
SECTION(0).LENGTH(0)=0x000200

NAME=IRAM
TYPE=IRAM
BLANK=0x00
BURSTSIZE=0x0080
ERASESIZE=0x0100
SECTION(0).STARTADDRESS(0)=0x00F200
SECTION(0).LENGTH(0)=0x000C00

NAME=XRAM
TYPE=XRAM
BLANK=0x00
BURSTSIZE=0x0080
ERASESIZE=0x0100
ACTIVATEREGISTER(0)=SYSCON
ACTIVATEMASK(0)=0x0004
SECTION(0).STARTADDRESS(0)=0x00E000
SECTION(0).LENGTH(0)=0x000800

NAME=CAN
TYPE=XPER
BLANK=0x00
BURSTSIZE=0x0080
ERASESIZE=0x0100
ACTIVATEREGISTER(0)=SYSCON
ACTIVATEMASK(0)=0x0004
SECTION(0).STARTADDRESS(0)=0x00EF00
SECTION(0).LENGTH(0)=0x000100

NAME=CAN2
TYPE=XPER
BLANK=0x00
BURSTSIZE=0x0080
ERASESIZE=0x0100
ACTIVATEREGISTER(0)=XPERCON
ACTIVATEMASK(0)=0x0002
ACTIVATEREGISTER(1)=SYSCON
ACTIVATEMASK(1)=0x0004
SECTION(0).STARTADDRESS(0)=0x00EE00
SECTION(0).LENGTH(0)=0x000100

NAME=XRAM2
TYPE=XRAM
BLANK=0x00
BURSTSIZE=0x0080
ERASESIZE=0x0100
ACTIVATEREGISTER(0)=XPERCON
ACTIVATEMASK(0)=0x0800
ACTIVATEREGISTER(1)=SYSCON
ACTIVATEMASK(1)=0x0004
SECTION(0).STARTADDRESS(0)=0x00C000
SECTION(0).LENGTH(0)=0x001800

NAME=INTERNALROM
TYPE=IROM
BLANK=0x00
BURSTSIZE=0x0080
ERASESIZE=0x0100
ACTIVATED
ACTIVATEREGISTER(0)=SYSCON
ACTIVATEMASK(0)=0x0400
SECTION(0).STARTADDRESS(0)=0x000000
SECTION(0).LENGTH(0)=0x008000
SECTION(0).MAPADDRESS(0)=0x010000
SECTION(0).MAPREGISTER(0)=SYSCON
SECTION(0).MAPMASK(0)=0x1000

NAME=EXTERNALFLASH
TYPE=FLASH
BLANK=0xFF
BURSTSIZE=0x0001
ERASESIZE=0x0100

NAME=EXTERNALFLASH
TYPE=FLASH
BLANK=0xFF
BURSTSIZE=0x0040
ERASESIZE=0x0100
SECTION(0).STARTADDRESS(0)=0x800000
SECTION(0).LENGTH(0)=0x004000
SECTION(1).STARTADDRESS(0)=0x804000
SECTION(1).LENGTH(0)=0x002000
SECTION(2).STARTADDRESS(0)=0x806000
SECTION(2).LENGTH(0)=0x002000
SECTION(3).STARTADDRESS(0)=0x808000
SECTION(3).LENGTH(0)=0x008000
SECTION(4).STARTADDRESS(0)=0x810000
SECTION(4).LENGTH(0)=0x010000
SECTION(5).STARTADDRESS(0)=0x820000
SECTION(5).LENGTH(0)=0x010000
SECTION(6).STARTADDRESS(0)=0x830000
SECTION(6).LENGTH(0)=0x010000
SECTION(7).STARTADDRESS(0)=0x840000
SECTION(7).LENGTH(0)=0x010000
SECTION(8).STARTADDRESS(0)=0x850000
SECTION(8).LENGTH(0)=0x010000
SECTION(9).STARTADDRESS(0)=0x860000
SECTION(9).LENGTH(0)=0x010000
SECTION(10).STARTADDRESS(0)=0x870000
SECTION(10).LENGTH(0)=0x010000
SECTION(11).STARTADDRESS(0)=0x880000
SECTION(11).LENGTH(0)=0x010000
SECTION(12).STARTADDRESS(0)=0x890000
SECTION(12).LENGTH(0)=0x010000
SECTION(13).STARTADDRESS(0)=0x8A0000
SECTION(13).LENGTH(0)=0x010000
SECTION(14).STARTADDRESS(0)=0x8B0000
SECTION(14).LENGTH(0)=0x010000
SECTION(15).STARTADDRESS(0)=0x8C0000
SECTION(15).LENGTH(0)=0x010000
SECTION(16).STARTADDRESS(0)=0x8D0000
SECTION(16).LENGTH(0)=0x010000
SECTION(17).STARTADDRESS(0)=0x8E0000
SECTION(17).LENGTH(0)=0x010000
SECTION(18).STARTADDRESS(0)=0x8F0000
SECTION(18).LENGTH(0)=0x010000
DRIVER.PATH="C:\PROGRAM FILES\MINIMON\DRIVER\A29F800B\A29F800B.HEX"
DRIVER.BUFFERADDRESS=00FC80
DRIVER.MODE=0
DRIVER.FEATURES=ERASE,PROGRAM,STATUS


[Register]

SYSCON=0xE604
BUSCON0=0x04AD
BUSCON1=0x040D
ADDRSEL1=0x3803
BUSCON2=0x04AD
ADDRSEL2=0x1007
BUSCON3=0x0000
ADDRSEL3=0x0000
BUSCON4=0x0000
ADDRSEL4=0x0000

[Commands]



[Files]
SAVEFILE=C:\
SAVEFORMAT= 20
SAVEFILETYPE= 0
SAVERECORDSIZE= 32

LOADFILE=C:\
LOADFILETYPE= 0

CONFIGLOADFILE=C:\
CONFIGLOADFILETYPE= 0
CONFIGSAVEFILE=e:\Tuning\minimon.ini
CONFIGSAVEFILETYPE= 0

SCRIPTFILE=C:\
SCRIPTFILETYPE= 0

DRIVERFILE=C:\
DRIVERFILETYPE= 0

REGSETFILE=C:\
REGSETFILETYPE= 0

BINFILE=C:\
BINFILETYPE= 0

LASTSCRIPTFILE(0)=
LASTSCRIPTFILE(1)=
LASTSCRIPTFILE(2)=
LASTSCRIPTFILE(3)=
LASTSCRIPTFILE(4)=
LASTSCRIPTFILE(5)=
LASTSCRIPTFILE(6)=
LASTSCRIPTFILE(7)=
LASTSCRIPTFILE(8)=
LASTSCRIPTFILE(9)=
LASTSCRIPTFILE(10)=
LASTSCRIPTFILE(11)=
LASTSCRIPTFILE(12)=
LASTSCRIPTFILE(13)=
LASTSCRIPTFILE(14)=
LASTSCRIPTFILE(15)=

USERSCRIPT(0)=
USERSCRIPTNAME(0)=
USERSCRIPT(1)=
USERSCRIPTNAME(1)=
USERSCRIPT(2)=
USERSCRIPTNAME(2)=
USERSCRIPT(3)=
USERSCRIPTNAME(3)=
USERSCRIPT(4)=
USERSCRIPTNAME(4)=
USERSCRIPT(5)=
USERSCRIPTNAME(5)=
USERSCRIPT(6)=
USERSCRIPTNAME(6)=
USERSCRIPT(7)=
USERSCRIPTNAME(7)=

[Messages]

A_LOADER_STARTED=0x01
A_APPLICATION_STARTED=0x03

C_WRITE_BLOCK=0x84
C_READ_BLOCK=0x85
C_WRITE_WORD=0x82
C_EINIT=0x31
C_TEST_COMM=0x93
C_SWRESET=0x32
C_GO=0x41
C_CALL=0x9F
C_GETCHECKSUM=0x33
C_ASC1_CON=0xCC

A_ACK1=0xAA
A_ACK2=0xEA


[Frontend]

BLANK_CHAR=.
COLOR_BGMARKED=0xDDDDDD
COLOR_BGNORMAL=0xFFFFFF
COLOR_FGVALID=0x000000
COLOR_FGINVALID=0x0000FF
COLOR_FGMONITOR=0x007777
LOGFILE=0
REFRESHSFR=0

SFRSET(0)=ID
SFRSET(1)=
SFRSET(2)=
SFRSET(3)=
SFRSET(4)=
DISPLAY(0)=RP0H
DISPLAY(0)=SYSCON
DISPLAY(0)=SYSCON1
DISPLAY(0)=SYSCON2
DISPLAY(0)=BUSCON0
DISPLAY(0)=BUSCON1
DISPLAY(0)=BUSCON2
DISPLAY(0)=BUSCON3
DISPLAY(0)=BUSCON4
DISPLAY(0)=ADDRSEL1
DISPLAY(0)=ADDRSEL2
DISPLAY(0)=ADDRSEL3
DISPLAY(0)=ADDRSEL4
DISPLAY(0)=PSW

Title: Re: Need assistance with Minimon and ME7.8
Post by: kaosman on August 01, 2017, 05:01:44 AM
Quote from: terminator on August 01, 2017, 04:19:33 AM
Piasini can read it.

It can read the internal ROM?

Title: Re: Need assistance with Minimon and ME7.8
Post by: dragon187 on August 01, 2017, 07:21:29 AM
You can try with ktag boot

Title: Re: Need assistance with Minimon and ME7.8
Post by: kaosman on August 02, 2017, 01:48:32 PM
I was able to figure it out!

I tried a different cable and had to use K-Line for connecting, and was finally able to get in and get the full internal ROM.

Thank you for all of your suggestions!



Powered by SMF 1.1.21 | SMF © 2015, Simple Machines