NefMoto

Technical => Data Logging => Topic started by: Pr3muToS on April 26, 2018, 02:03:58 AM



Title: Simos MK7 logging
Post by: Pr3muToS on April 26, 2018, 02:03:58 AM
Hey,

anybody knows a logger (instead of vcds) to log correctly Simos12/18 engines?

In VCDS i dont get the variables i need. Like boost target, actual, actuator position, PUT, ect ect..

I see JB4, Cobb and Meastro got high speed logger for this, but isnt there another "open" solution available? Any ideas?

Thanks
BR Patrick


Title: Re: Simos MK7 logging
Post by: gt-innovation on April 26, 2018, 06:45:05 AM
Hex Net V2 ?


Title: Re: Simos MK7 logging
Post by: Pr3muToS on April 26, 2018, 02:55:01 PM
wahts the difference to vcds hex-can , its faster?`

see here, than you know what i mean. Cobb, JB4, Meastro got highspeed logger in their flashing tools, with all needed values. Cant find the most important in vcds..

https://cobbtuning.atlassian.net/wiki/spaces/PRS/pages/143753246/Volkswagen+Mk7+Tuning+Guide

https://drivetribe.com/p/datalogging-part-i-cOsyc_klRqGESmuCiQTplw?iid=NUcQsrOPTU-CU4Hqt7vOaA
https://drivetribe.com/p/datalogging-part-iii-boost-BJ8Z30jKQD6j45c3rvY4cw?iid=LlC5Ic8ERNetPLe6i_G7lw


Title: Re: Simos MK7 logging
Post by: bobbyz0r on April 26, 2018, 07:46:31 PM
HEX-CAN is perfectly fine for MK7. You're probably looking for the wrong names of the variables. Boost = Charge air pressure, etc..

Only problems I have with VCDS logging is limit of variables which can be logged at a usable sample rate, as well MAF diag limit of 1389 mg/stk.


Title: Re: Simos MK7 logging
Post by: Pr3muToS on April 27, 2018, 12:42:40 AM
Max PUT from Turbo  - Protection Maximum pressure upstream throttle request from the ECU for turbo protection, from turbo protection folder.
Maximum Torque at Clutch - Maximum torque request at clutch from the maximum torque tables.
Maximum Turbo Speed Set Point - Maximum turbo speed modeled for turbo protection.
Pressure Upstream Throttle - Calculated pressure upstream throttle for boost control system.
PUT Set Point - Final pressure request after compensations.
Rail Pressure Actual - Fuel rail pressure.
Rail Pressure Set Point - Actual fuel pressure request.
Torque (Actual) - Calculated current torque output.
Torque Maximum Clutch - Calculated maximum torque derived from torque tables.
Torque Maximum Engine - Calculated maximum torque derived from torque tables.
Torque Reference Maximum -  Calculated maximum torque.
Torque Reference - Calculated modeled torque.
TPS Set Point - Throttle position set point.
TPS Throttle position sensor data.
Turbine Actuator Final Value - WGDC actuator position result after PID correction.
Turbo Shaft Speed - Modeled turbo shaft speed from lookup tables.
Valve Lift State Valve High lift position (1= High lift 0= Normal)
Wastegate Mass Flow Set Point - Mass air flow set point for turbine actuator position calculation.



looking for these and cant find some important of them in HEX v2... checked 2-3 times, aint blind, but dunno
next problem is, iam limited in the amount of channels to log, that another reason, if anyone knows another software/logger ect.

br


Title: Re: Simos MK7 logging
Post by: gt-innovation on April 27, 2018, 01:27:05 AM
Max PUT from Turbo  - Protection Maximum pressure upstream throttle request from the ECU for turbo protection, from turbo protection folder.
Maximum Torque at Clutch - Maximum torque request at clutch from the maximum torque tables.
Maximum Turbo Speed Set Point - Maximum turbo speed modeled for turbo protection.
Pressure Upstream Throttle - Calculated pressure upstream throttle for boost control system.
PUT Set Point - Final pressure request after compensations.
Rail Pressure Actual - Fuel rail pressure.
Rail Pressure Set Point - Actual fuel pressure request.
Torque (Actual) - Calculated current torque output.
Torque Maximum Clutch - Calculated maximum torque derived from torque tables.
Torque Maximum Engine - Calculated maximum torque derived from torque tables.
Torque Reference Maximum -  Calculated maximum torque.
Torque Reference - Calculated modeled torque.
TPS Set Point - Throttle position set point.
TPS Throttle position sensor data.
Turbine Actuator Final Value - WGDC actuator position result after PID correction.
Turbo Shaft Speed - Modeled turbo shaft speed from lookup tables.
Valve Lift State Valve High lift position (1= High lift 0= Normal)
Wastegate Mass Flow Set Point - Mass air flow set point for turbine actuator position calculation.



looking for these and cant find some important of them in HEX v2... checked 2-3 times, aint blind, but dunno
next problem is, iam limited in the amount of channels to log, that another reason, if anyone knows another software/logger ect.

br

 https://vector.com/vi_can_solutions_en.html

The next solutions cost a lot ..


Title: Re: Simos MK7 logging
Post by: Pr3muToS on April 27, 2018, 02:30:20 AM
we had diagra, but couldnt work with that either, wasnt able to load A2L in Diagra X  cuz the formation of the file was not DIAGRA standart, in Diagra D i could load the A2L, but couldnt log, because the logging function for VAG is disabled if you dont got a VAG OEM clearance. (we only got this for BMW, to be able to buy the software)

if cobb and any other handflash tools are able to log, there must be anything without spending again 4-5k of money.. mhmm


Title: Re: Simos MK7 logging
Post by: prj on April 27, 2018, 05:49:43 AM
You must patch the ECU to allow memory reading without fancy handshakes.
And have a tool that will read memory. And have a matching a2l for your file or define stuff yourself.


Title: Re: Simos MK7 logging
Post by: Pr3muToS on April 30, 2018, 01:34:44 AM
You must patch the ECU to allow memory reading without fancy handshakes.
And have a tool that will read memory. And have a matching a2l for your file or define stuff yourself.

you dont need to patch the ecu for beeing read with Diagra D or Diagra X, that will read memory, its engineered for this..
and we have matching conti a2ls, also the Seed&Key.dll , which is need for "login" to enable reading. That doesnt help,
if the Diagra Software is disabled, not beeing verified as VAG OEM. BMW and other stuff, no problem to log.

https://www.rac.de/en/automotive-products/software/diagnostics/diagra-d/


Title: Re: Simos MK7 logging
Post by: prj on April 30, 2018, 02:34:15 AM
Read the entirety of my sentence before replying.
I told you it needs patching to read ram without seed key auth.


Title: Re: Simos MK7 logging
Post by: Pr3muToS on May 02, 2018, 01:10:21 AM
Read the entirety of my sentence before replying.
I told you it needs patching to read ram without seed key auth.

i dont get, that you want to say that with fancy handshakes..


Title: Re: Simos MK7 logging
Post by: IamwhoIam on May 02, 2018, 02:48:57 AM
Diagra CANNOT log RAM on a simos that's not patched specifically for it, what don't you get?


Title: Re: Simos MK7 logging
Post by: Pr3muToS on May 02, 2018, 01:47:28 PM
Diagra CANNOT log RAM on a simos that's not patched specifically for it, what don't you get?

it can...


Title: Re: Simos MK7 logging
Post by: IamwhoIam on May 02, 2018, 01:51:48 PM
LOL ok then, it's funny because I have Diagra and the only way I can log RAM is if the ECU is either:

-a native DEV ECU
-an ETK ECU
-a production ECU patched for RAM logging

I own all 3 of them, if you run a bone stock production ECU, you can't log SHIT in read memory by address mode.

Have fun, we could argue another 2 or 3 weeks about this, I am right and you are wrong. End of the story. Prj is right too, because he has a good source for his infos too.


Title: Re: Simos MK7 logging
Post by: Rick on May 04, 2018, 03:24:42 AM
it can...

In that case why didn't it work for you!


Title: Re: Simos MK7 logging
Post by: Pr3muToS on October 10, 2018, 01:52:37 AM
because i have a friend which is working @ audi prototype engineering, and they work with Diagra ect too.

on a free saturday he came to me with his system and VAG Diagra license, he was able to log our cars with the provided odx.

So it cant be 100% correct what you guys telling. Also RAC told me VAG OEM versions, got other licenses, there is no need to get a security access on bosch, or specified patches,  seedkey .dll files for simos types to get in.

Also RAC did support Simos A2L filetyp in DIAGRA X first this year, after we and some others complained about the not standart a2l format. There was a update released this spring, after analyzing our logs from testing the last few month.




Title: Re: Simos MK7 logging
Post by: prj on October 10, 2018, 03:11:37 AM
Probably log in mode 22, not in mode 23.
Mode 23 rejects access if ECU is not dev - maybe there is some secret handshake involved which allows it to pass, but I need to patch ECU, else it simply says the request is invalid. Mode 22 you can log with VCDS too.


Title: Re: Simos MK7 logging
Post by: NBR on October 11, 2018, 01:25:46 AM
This is something I've also been very interested in. I'm sure if someone created a proper logging tool for the Mk7 (high speed and logs the variables needed for tuning) they would sell plenty. But it seems from what prj said there's more to it. I'd love to be able to log the variables in the axes to the wastegate maps, and the turbo modelling variables, all which Cobb can do.


Title: Re: Simos MK7 logging
Post by: Time 4 Rebuild on October 12, 2018, 11:00:08 AM
It would be interesting to see if Diagra actaully logged over CCP or is it just using readDataByIdentifier in a tight loop.  Also couldn't Cobb add some variables to the identifier table to log some extra variables? 


Title: Re: Simos MK7 logging
Post by: prj on October 15, 2018, 12:58:21 AM
readDataByIdentifier is 22.

Diagra does 23.


Title: Re: Simos MK7 logging
Post by: Ron28 on December 26, 2019, 01:58:04 PM
Hello,

Is there a way to rise diagnostic limit for MAF?

BRG


Title: Re: Simos MK7 logging
Post by: prj on December 27, 2019, 04:22:31 AM
Is it possible? Yes.

For you? No.


Title: Re: Simos MK7 logging
Post by: Ron28 on December 27, 2019, 07:34:15 AM
Is it possible? Yes.

For you? No.

Thanks for your answer, why not? Is it that hard?


Title: Re: Simos MK7 logging
Post by: prj on December 27, 2019, 04:02:16 PM
Thanks for your answer, why not? Is it that hard?
Because if you had a tool that is capable of loading custom ODX you probably would not need to do this.
If you have mode 23 you just log the extended range MAF.

Best you can do using VCDS (because the scaling is inside the encrypted CLB file, and you can't change it), is to modify the memory location of the Mode 22 ID to the extended one and then you will have MAF value 2x smaller than it should be...

Really, if your question is "is it possible" - then you are so far from this that my explanations probably make zero sense in the first place.


Title: Re: Simos MK7 logging
Post by: Ron28 on December 28, 2019, 12:25:48 PM
Thanks, my english isnt the best, so maybe i wrote not correct. I know possible is more or less everything.
I have an old diagra-d. Rhere is an odx import option, so the bigger problem is i dont have any experiance with odx files and i dont have the file.
Maybe you can help me out and i can test how it works.


Title: Re: Simos MK7 logging
Post by: prj on December 29, 2019, 02:12:50 PM
I helped you already by saying everything that needs to be done.
If you don't have good knowledge of ECU comms layer and reverse engineering, you will not accomplish this.


Title: Re: Simos MK7 logging
Post by: Pr3muToS on May 05, 2020, 05:00:00 AM
so with normal tools its not possible to log at mode 23.
Tried with ATI Vision + A2L, but also rejects...

Anybody got info how to enable mode 23?
PM with offer


Title: Re: Simos MK7 logging
Post by: littco on May 05, 2020, 06:47:03 AM
so with normal tools its not possible to log at mode 23.
Tried with ATI Vision + A2L, but also rejects...

Anybody got info how to enable mode 23?
PM with offer

Patch the ECU


Title: Re: Simos MK7 logging
Post by: Pr3muToS on May 05, 2020, 02:28:47 PM
Patch the ECU

what do you mean with "patch" , i already studied the FR but did not find any related topics to enable ccp connection or iam blind ^^


Title: Re: Simos MK7 logging
Post by: Basano on May 05, 2020, 11:43:31 PM
Service $23 is present and can be invoked same as all the other UDS services.

But it always replies back with ‘Error – Conditions not correct’

The workaround is to jump over the condition checks at the start of the routine. This means patching the ASM to jump over these checks.


Title: Re: Simos MK7 logging
Post by: Pr3muToS on May 06, 2020, 12:12:13 AM
ah oke...

well this isnt rly my job, if anyone is able to offer me this, please get me a pm
Nearly impossible to find interventions via VCDS on BT Setup. :-/


Title: Re: Simos MK7 logging
Post by: prj on May 06, 2020, 02:43:02 AM
Service $23 is present and can be invoked same as all the other UDS services.

But it always replies back with ‘Error – Conditions not correct’

The workaround is to jump over the condition checks at the start of the routine. This means patching the ASM to jump over these checks.


Or even better, implement your own service and get much faster logging speed.
I will release my logger this month. Wait a little more :)


Title: Re: Simos MK7 logging
Post by: Basano on May 06, 2020, 03:14:38 AM
Your own bespoke service ?!?!

Good grief man  ;D


Title: Re: Simos MK7 logging
Post by: Pr3muToS on May 06, 2020, 03:16:37 AM
Or even better, implement your own service and get much faster logging speed.
I will release my logger this month. Wait a little more :)

sounds good, let me be up2date


Title: Re: Simos MK7 logging
Post by: prj on May 07, 2020, 12:45:09 AM
Your own bespoke service ?!?!

Good grief man  ;D


Why patch the (slow) mode 23, when you can just roll your own service and have ~2000 bytes/sec ? :)


Title: Re: Simos MK7 logging
Post by: Pr3muToS on May 08, 2020, 12:21:10 AM
btw anybody ever tried to enable developer messages via GEKO ?
Yesterday i got a information that its possible to enable delevoper messages for measurment on can bus, but a FAZIT/GEKO account is need (account isnt the problem)


Title: Re: Simos MK7 logging
Post by: jamespinger on October 04, 2020, 08:58:59 AM
Why patch the (slow) mode 23, when you can just roll your own service and have ~2000 bytes/sec ? :)

@prj, I'm assuming the "mode" you reference is the UDS diagnostic mode.
Much of this is outside my realm of expertise but I'm trying to come up to speed.

I've noticed that the maestro "HSL" isn't using 23, but rather 2C. There's 0x10 and 0x4F sent (which I believe references "extended diagnostic sessions?). 

After that there's a level 3 security check that gets performed (seed response that you refer to somewhere else, followed by a simple summing of the seed and a predefined 4 byte array). Then 0x2C is sent followed by a list of all the memory addresses (and their lengths) to be logged. Is this a custom ASW patch that handles things or is this the default extension of "read memory by address". The UDS points to 2C being "dynamically defined data" and it does say it implements readmemorybyaddress

Any way you can elaborate on what's going on? Or point me to where I can learn more (as the UDS documents I've found just reference how certain parameters are reserved, without actually stating what they do)



Title: Re: Simos MK7 logging
Post by: Basano on October 05, 2020, 02:22:00 AM
@prj, I'm assuming the "mode" you reference is the UDS diagnostic mode.
Much of this is outside my realm of expertise but I'm trying to come up to speed.

I've noticed that the maestro "HSL" isn't using 23, but rather 2C. There's 0x10 and 0x4F sent (which I believe references "extended diagnostic sessions?). 

After that there's a level 3 security check that gets performed (seed response that you refer to somewhere else, followed by a simple summing of the seed and a predefined 4 byte array). Then 0x2C is sent followed by a list of all the memory addresses (and their lengths) to be logged. Is this a custom ASW patch that handles things or is this the default extension of "read memory by address". The UDS points to 2C being "dynamically defined data" and it does say it implements readmemorybyaddress

Any way you can elaborate on what's going on? Or point me to where I can learn more (as the UDS documents I've found just reference how certain parameters are reserved, without actually stating what they do)



$2C?

Which ECU ID (xxx906259xxx) are you looking at?

Agreed, $2C is the UDS service ‘Dynamically Define Data Identifier’ and if it was available then life would be simpler…

In the SIMOS 18.1 and 18.10 bins that I’ve been looking at, I only ever came across $22 (Read Data By Identifier) and $23 (Read Memory By Address). But $2C was just not there to start with. Not hidden, not deactivated, but really just not even there. There wasn’t even ASM code to implement it, at least that I could see...

And whilst $23 is at least there in the ASM, I had to patch it (by jumping over some conditional checks it does at the beginning of the routine, checks related to IMMO I think?) before it would work.

In the 18.1/18.10 bins you can find a table which shows what services are available and also where the ASM for that service starts. Strictly speaking there are two tables, one in ASW for the services when the ECU is running from ASW and second in CBOOT when the ECU is running from CBOOT.

(you might also notice that $35 ‘Request Upload’ is missing from CBOOT, which is why you can’t read stuff out and it’s always a virtual read instead)

Clearly you have gotten some working version of $2C, I am just curious how it was implemented if it was indeed on SIMOS 18...

Code:

5G0906259C_0002

ASW UDS Services

PFLASH:8005E498                 .word sub_801DC438
PFLASH:8005E49C                 .byte 0x10 <- $10 Diagnostic Session Control
PFLASH:8005E49D                 .byte 0x19
PFLASH:8005E49E                 .byte    0
PFLASH:8005E49F                 .byte    0
PFLASH:8005E4A0                 .word sub_801DC844
PFLASH:8005E4A4                 .byte 0x11 <- $11 ECU Reset
PFLASH:8005E4A5                 .byte 0x18
PFLASH:8005E4A6                 .byte    0
PFLASH:8005E4A7                 .byte    0
PFLASH:8005E4A8                 .word sub_801DBC50
PFLASH:8005E4AC                 .byte 0x19 <- $19 Read DTC Information
PFLASH:8005E4AD                 .byte 0x18
PFLASH:8005E4AE                 .byte    0
PFLASH:8005E4AF                 .byte    0
PFLASH:8005E4B0                 .word loc_801DC878
PFLASH:8005E4B4                 .byte 0x22 ; " <- $22 Read Data By Identifi er
PFLASH:8005E4B5                 .byte 0x18
PFLASH:8005E4B6                 .byte    0
PFLASH:8005E4B7                 .byte    0
PFLASH:8005E4B8                 .word sub_801E494C
PFLASH:8005E4BC                 .byte 0x23 ; # <- $23 Read Memory By Address
PFLASH:8005E4BD                 .byte 0x10
PFLASH:8005E4BE                 .byte    0
PFLASH:8005E4BF                 .byte    0
PFLASH:8005E4C0                 .word loc_801E4AB0
PFLASH:8005E4C4                 .byte 0x27 ; ' <-$27 Security Access
PFLASH:8005E4C5                 .byte 0x10
PFLASH:8005E4C6                 .byte    0
PFLASH:8005E4C7                 .byte    0
PFLASH:8005E4C8                 .word loc_801E5004
PFLASH:8005E4CC                 .byte 0x28 ; ( <- $28 Communication Control
PFLASH:8005E4CD                 .byte 0x11
PFLASH:8005E4CE                 .byte    0
PFLASH:8005E4CF                 .byte    0
PFLASH:8005E4D0                 .word sub_801E511C
PFLASH:8005E4D4                 .byte 0x2E ; . <- $2E Write Data By Identifi er
PFLASH:8005E4D5                 .byte 0x10
PFLASH:8005E4D6                 .byte    0
PFLASH:8005E4D7                 .byte    0
PFLASH:8005E4D8                 .word sub_801E597C
PFLASH:8005E4DC                 .byte 0x2F ; / <- $2F Input Output Control By Identifi er
PFLASH:8005E4DD                 .byte 0x10
PFLASH:8005E4DE                 .byte    0
PFLASH:8005E4DF                 .byte    0
PFLASH:8005E4E0                 .word sub_801E5B1C
PFLASH:8005E4E4                 .byte 0x31 ; 1 <- $31 Routine Control
PFLASH:8005E4E5                 .byte 0x10
PFLASH:8005E4E6                 .byte    0
PFLASH:8005E4E7                 .byte    0
PFLASH:8005E4E8                 .word loc_801E6930
PFLASH:8005E4EC                 .byte 0x3E ; > <- $3E Tester Present
PFLASH:8005E4ED                 .byte 0x19
PFLASH:8005E4EE                 .byte    0
PFLASH:8005E4EF                 .byte    0
PFLASH:8005E4F0                 .word sub_801E6968
PFLASH:8005E4F4                 .byte 0x85 <- $85 Control DTC Setting
PFLASH:8005E4F5                 .byte 0x11
PFLASH:8005E4F6                 .byte    0
PFLASH:8005E4F7                 .byte    0

CBOOT UDS Services

PFLASH:80022DE0                 .word unk_D0013522
PFLASH:80022DE4                 .byte 0x10
PFLASH:80022DE5                 .byte 0x11
PFLASH:80022DE6                 .byte    0
PFLASH:80022DE7                 .byte    0
PFLASH:80022DE8                 .word unk_D0013990
PFLASH:80022DEC                 .byte 0x11
PFLASH:80022DED                 .byte 0x11
PFLASH:80022DEE                 .byte    0
PFLASH:80022DEF                 .byte    0
PFLASH:80022DF0                 .word unk_D0013A6E
PFLASH:80022DF4                 .byte 0x22 ; "
PFLASH:80022DF5                 .byte 0x10
PFLASH:80022DF6                 .byte    0
PFLASH:80022DF7                 .byte    0
PFLASH:80022DF8                 .word unk_D0014756
PFLASH:80022DFC                 .byte 0x27 ; '
PFLASH:80022DFD                 .byte    2
PFLASH:80022DFE                 .byte    0
PFLASH:80022DFF                 .byte    0
PFLASH:80022E00                 .word unk_D0014EFE
PFLASH:80022E04                 .byte 0x28 ; (
PFLASH:80022E05                 .byte 0x11
PFLASH:80022E06                 .byte    0
PFLASH:80022E07                 .byte    0
PFLASH:80022E08                 .word unk_D0014FB8
PFLASH:80022E0C                 .byte 0x2E ; .
PFLASH:80022E0D                 .byte 0x10
PFLASH:80022E0E                 .byte    0
PFLASH:80022E0F                 .byte    0
PFLASH:80022E10                 .word unk_D0015168
PFLASH:80022E14                 .byte 0x31 ; 1
PFLASH:80022E15                 .byte 0x10
PFLASH:80022E16                 .byte    0
PFLASH:80022E17                 .byte    0
PFLASH:80022E18                 .word unk_D0015798
PFLASH:80022E1C                 .byte 0x34 ; 4
PFLASH:80022E1D                 .byte 0x42 ; B
PFLASH:80022E1E                 .byte    0
PFLASH:80022E1F                 .byte    0
PFLASH:80022E20                 .word unk_D00158FC
PFLASH:80022E24                 .byte 0x36 ; 6
PFLASH:80022E25                 .byte 0x42 ; B
PFLASH:80022E26                 .byte    0
PFLASH:80022E27                 .byte    0
PFLASH:80022E28                 .word unk_D0015BBE
PFLASH:80022E2C                 .byte 0x37 ; 7
PFLASH:80022E2D                 .byte 0x42 ; B
PFLASH:80022E2E                 .byte    0
PFLASH:80022E2F                 .byte    0
PFLASH:80022E30                 .word unk_D0015C14
PFLASH:80022E34                 .byte 0x3E ; >
PFLASH:80022E35                 .byte 0x11
PFLASH:80022E36                 .byte    0
PFLASH:80022E37                 .byte    0
PFLASH:80022E38                 .word unk_D0015C4C
PFLASH:80022E3C                 .byte 0x85
PFLASH:80022E3D                 .byte 0x11
PFLASH:80022E3E                 .byte    0
PFLASH:80022E3F                 .byte    0
PFLASH:80022E40                 .word unk_D0015CD4
PFLASH:80022E44                 .byte 0x87
PFLASH:80022E45                 .byte    3
PFLASH:80022E46                 .byte    0
PFLASH:80022E47                 .byte    0



Title: Re: Simos MK7 logging
Post by: jamespinger on October 05, 2020, 03:40:07 AM
$2C?

Which ECU ID (xxx906259xxx) are you looking at?

I'm not looking at the bin, I'm looking at what Maestro is doing when you enter the logger.  It's for the "Simos18HSL", and it appears to apply to the whole family (at least when looking at the switch's). 

 
Quote from: Basano
In the 18.1/18.10 bins you can find a table which shows what services are available and also where the ASM for that service starts. Strictly speaking there are two tables, one in ASW for the services when the ECU is running from ASW and second in CBOOT when the ECU is running from CBOOT.


Where about are those tables (should they be in the same location in all the bins?).  New to reversing, but your snippet snows 8005Exxx, the bins I have are nowhere near that long. Ghidra also doesn't have the definition for this processor so I'm using the 176x, so maybe it's not showing me everything correctly?  If I know where to look for that table I can pull it out.


Title: Re: Simos MK7 logging
Post by: Basano on October 05, 2020, 05:34:57 AM
Quickest way is just to use a hex editor and search for a hex string like ’10 19 00 00’ or ‘11 18 00 00’. There’s only one occurrence (well for me at least), so when you find it you are in the middle of the table.

(I use IDA myself, just never got around to Ghidra)

I haven’t used / seen Maestro myself, so don’t know very much about it at all. How did you identify $2C? I assumed you used a CANBUS sniffer and saw the raw bytes being exchanged? Or does Maestro show some traffic log itself? If you are able to include a snippet of the log showing the exchange e.g. 10 4F, 27 aa bb cc dd, 2C xx xx xx xx etc it might be interesting to see if it’s really $2C or just some text saying $2C and the raw bytes are something else…


Title: Re: Simos MK7 logging
Post by: jamespinger on October 05, 2020, 06:34:03 AM
I actually tried that but I can't seem to locate the table.  I'll look in the stock bin since it should be the same and I'll go from there.

Sent you a PM so we can stop clogging up this thread with back and forth.


Title: Re: Simos MK7 logging
Post by: prj on October 05, 2020, 09:12:24 AM
http://docs.vehical.net/logger (http://docs.vehical.net/logger)

MEDC17, S18.1, S12, S18.10 implemented.

Approx 20-30hz with 300 simultaneous 16 bit ram cells logged.


Title: Re: Simos MK7 logging
Post by: sonique on October 05, 2020, 09:52:27 AM
read specifications great app
 but not run win7 64bit
only win10 ? :(


Title: Re: Simos MK7 logging
Post by: prj on October 05, 2020, 10:21:23 AM
read specifications great app
 but not run win7 64bit
only win10 ? :(

Win7 has been EOL in January this year. It's dead, no more updates, no more downloads.
That said, if you spent even a moment to read the page, you would see that I wrote, that Win7 will be supported, just not right now, it's still early beta.


Title: Re: Simos MK7 logging
Post by: jamespinger on October 05, 2020, 10:44:08 AM
Windows 10 is terrible, but get on a supported OS already...

Thanks PRJ - the tool is cool and no doubt accomplishes the high logging rate that's being discussed.  The page mentions bench, bflash, and PCMFlash.  PCMFlash is relatively cheap (though every time I've looked there's no SIMOS18 support). Are there other hobbyists out there actually spending for tools like bflash? Who is this targeted at?

I posted back to the thread to understand 'how' not 'whether' [it's possible].  I understand it's not doable without patching the ASW, I was curious if the things that I'm seeing mean there's patches already in place [in the software I'm running].


Title: Re: Simos MK7 logging
Post by: Blazius on October 05, 2020, 10:45:36 AM
Windows 10 is amazing. if you need a non bullshit version ( even though the 2 major latest builds are very customizable) get the LTSC version, you get none of the bollocks.


Nice tool, sure it will come in handy for people.


Title: Re: Simos MK7 logging
Post by: prj on October 05, 2020, 10:48:05 AM
Windows 10 is terrible, but get on a supported OS already...

Thanks PRJ - the tool is cool and no doubt accomplishes the high logging rate that's being discussed.  The page mentions bench, bflash, and PCMFlash.  PCMFlash is relatively cheap (though every time I've looked there's no SIMOS18 support). Are there other hobbyists out there actually spending for tools like bflash? Who is this targeted at?

I posted back to the thread to understand 'how' not 'whether' [it's possible].  I understand it's not doable without patching the ASW, I was curious if the things that I'm seeing mean there's patches already in place [in the software I'm running].

bFlash can patch the ECU over OBD.
You can use any other flasher that does SIMOS18 bootmode to patch it on the bench in boot.
PCMFlash only does MEDC17 and older stuff like S8.5/S8.4, but for the 3.0 TFSI SIMOS the Mode22 logger is good enough, and the ECU is dead easy to tune, so no point to invest time into that.

Patching is required either way, nothing is open in the ECU. If you don't have a tool that can write the ECU then you don't need the logger, I don't see the dilemma here.


Title: Re: Simos MK7 logging
Post by: Basano on October 05, 2020, 11:55:37 AM
Very well done.

Make no mistake, this is a non-trivial undertaking. To make a front-end, a back-end, a toolchain, a decent user interface, support for 3PP hardware, cater for multiple ECU variants with ASM differences even with the same family, a patching guide, A2L parsing, keeping it all current, the whole end to end shebang…

I couldn’t do it. I couldn’t even start.

After all that, the mechanics of moving the bytes out the ECU is almost the easy part :) To be clear, PRJ has made his own stack that doesn’t use the underlying UDS layers, so it’s not related to any UDS service. No $22, $23, $2C …

Because I’m endlessly curious:

  • Maybe the patch in flash is a RAM loader and you can then upload and execute the actual logging and comms out of RAM?
  • Could you define your own memory locations/blocks to log as well in addition to selecting an ID from a table? Like supply an address?
  • Perhaps a tie-in with the flash tool vendors (bFlash, AT, MMS etc) to run on their hw interfaces as well?
  • A hobbyist variant, perhaps limited in speed/number of variables?
  • A variant for Linux?

 ;D


Title: Re: Simos MK7 logging
Post by: jamespinger on October 05, 2020, 12:13:23 PM
Patching is required either way, nothing is open in the ECU. If you don't have a tool that can write the ECU then you don't need the logger, I don't see the dilemma here.

Not trivializing it in ANY way. It's a huge amount of work. Sell what you built.

My original question a few posts back was around the reference to different modes. I see Eurodyne send 0x2C.  I wasn't sure if that was the "mode" you refer to.

Some of this is highly specific and custom. Other parts are part of a standard. I'm trying to understand what parts of the standard have been implemented and what parts are custom in the bin on my box. There's no open flashing solution but that doesn't mean there can't be some information sharing.


Title: Re: Simos MK7 logging
Post by: jamespinger on October 05, 2020, 12:27:24 PM

Because I’m endlessly curious:

  • Maybe the patch in flash is a RAM loader and you can then upload and execute the actual logging and comms out of RAM?
  • Could you define your own memory locations/blocks to log as well in addition to selecting an ID from a table? Like supply an address?
  • Perhaps a tie-in with the flash tool vendors (bFlash, AT, MMS etc) to run on their hw interfaces as well?
  • A hobbyist variant, perhaps limited in speed/number of variables?
  • A variant for Linux?


Though, again, I can only speak to what I believe Eurodyne is doing.... But I can't imagine there's THAT many different ways to accomplish this:
- There's some application software that runs (kind of like an agent).  The "patching" process patches this in.  It gets memory addresses and feeds back their values.  In the case of Eurodyne, you can send it a number of memory addresses and it returns all their values each time you ask for an update.
- He's likely using the A2L to autodefine the memory locations, length, and factor/multiplier for each of the variables.  It's not *just* a memory location.
- Doubt there's any point in doing a "hobbyiest variant" since at this point in time there's really no hobbyiest flashing solution for the Simos18.  We'll have it one day, but until then there's no point.  I can't imagine this ASW patch would work well with any of the other [self]tuning solutions out there (i.e. Eurodyne and HPTuners), so there's little point in doing it anyway.


Title: Re: Simos MK7 logging
Post by: prj on October 06, 2020, 01:05:07 AM
Very well done.

Make no mistake, this is a non-trivial undertaking. To make a front-end, a back-end, a toolchain, a decent user interface, support for 3PP hardware, cater for multiple ECU variants with ASM differences even with the same family, a patching guide, A2L parsing, keeping it all current, the whole end to end shebang…
Add to that stuff like real time full text search over the entire A2L data and the fact that the tool can load around 60000 measurements in 3-4 seconds, and that's a pretty good list ;)
Don't forget the logistics of having A2L data for all the ECU's...
What I haven't done yet is make an A2L generator that compares similar files and generates A2L between them. But that is on the radar. That way I can support more box codes.
Quote
Because I’m endlessly curious:

  • Maybe the patch in flash is a RAM loader and you can then upload and execute the actual logging and comms out of RAM?
  • Could you define your own memory locations/blocks to log as well in addition to selecting an ID from a table? Like supply an address?
  • Perhaps a tie-in with the flash tool vendors (bFlash, AT, MMS etc) to run on their hw interfaces as well?
  • A hobbyist variant, perhaps limited in speed/number of variables?
  • A variant for Linux?

 ;D
* There is no remote code execution. The mechanism is similar to $2C, but it's custom.
* Custom addresses will be possible in the future
* J2534 makes the most sense, all the tool makers have their own tools and protocols, this is not how this world works.
* No hobbyist variant. This is my job. I need to eat. In fact I would dare to say it is super accessible for a Hobbyist. A Tactrix Openport is ~150 EUR and the license for a single ECU is 100 EUR. So if you are a hobbyist and you want to only log your car it's 250 EUR total investment. The Tactrix is usable for a whole lot of other things as well, so really it's 100 EUR you're paying.
* No Linux support for the front-end. The back-end is all fully Linux. I use WPF and this is a windows-only technology.


Title: Re: Simos MK7 logging
Post by: prj on October 07, 2020, 01:37:52 AM
Windows 7 is now supported:
https://docs.vehical.net/logger#windows_7 (https://docs.vehical.net/logger#windows_7)
https://docs.vehical.net/logger/changelog (https://docs.vehical.net/logger/changelog)


Title: Re: Simos MK7 logging
Post by: Pr3muToS on October 07, 2020, 01:19:48 PM
very good work, can you send me an API key please? iam gonna pm you...

maybe you think of kinda "dealer license" which is payed once for unlimited usage in future ;-)


Title: Re: Simos MK7 logging
Post by: gt-innovation on October 08, 2020, 01:42:33 PM
Windows 7 is now supported:
https://docs.vehical.net/logger#windows_7 (https://docs.vehical.net/logger#windows_7)
https://docs.vehical.net/logger/changelog (https://docs.vehical.net/logger/changelog)

Good work PRJ keep it up...

As for the price it is fair considering the amount of work that needs to be done in the background...

For the Hobbyists that don`t like the price... Drugs are cheaper than a simos18 car or a car in General :) :) :)


Title: Re: Simos MK7 logging
Post by: NBR on November 04, 2020, 07:31:41 AM
Very well done prj. A lot of guys have been looking for this and you've delivered well above what anyone expected.

Big ups


Title: Re: Simos MK7 logging
Post by: prj on November 05, 2020, 03:06:06 AM
There's been a lot of developments in my tool:
* All F-series and G-series BMW supported
* Mercedes MED17.7.x support (RAM logging)
* Porsche SDI10/SDI21 support

I also made an A2L generator (only ram cells, not maps), which can generate an a2l for any binary from another a2l+binary. As long as they're at least the same make, same cylinders and same processor.
So there's RAM data for basically any VAG ECU on the server now, as well as any MED17.7 Mercedes...

The tool will have it's protocols split into two:
Basic - this is Mode22 or 2C logging, based on DID's. Basically the same functionality like OEM scan tool or better, but with A2L names and descriptions instead of the idiotic names in tools like VCDS and no patching required. It's also about 4 times as fast as VCDS.
Advanced - RAM logging - usually patching required, speed is as fast/faster than CCP.

Basic will be on a subscription 50 EUR/month and unlimited use.
Advanced will be VIN based 50 EUR/VIN, and will work even if subscription is expired.