NefMoto

(http://www.nefariousmotorsports.com/hosted_files/NefMoto ME7 ECU Flasher 1.4.0.2 screen shot.jpg)

Summary:
The NefMoto ME7 ECU flasher is a free tool that allows you to read and write the flash memory in your ME7 ECU in car over the OBD port. All that is required is a FTDI based USB OBD cable that works in "dumb" mode. Dumb mode cables pass the raw serial data straight through without applying any higher level protocols.

Features:
-ECUs can be read and written in car over the OBD port in about 4 minutes or less.
-User defined memory layouts allow for flashing any memory arrangement. Supplied with B5 Audi S4 ME7.1 29F800 layout for quick start.
-Writing erases and programs one memory sector at a time to allow you to recover the ECU in case of failure.
-Written and read data is verified with checksums to insure data was sent correctly.

This software does NOT:
-Does not update checksums or validate the file you are flashing in any way.
-Does not allow you to edit any maps, value, etc. It is just for flashing.

Features coming soon:
-Reading and clearing error codes (Next release)
-Allowing the user to select fast-init or slow-init connection modes (Next Release)
-Uninstalling previous version as part of install (After the bugs settle down)
-Support for Windows XP (Some future date after most of the immediate bugs are worked out)

System requirements:
-32bit or 64bit Windows Vista or Newer (Will work if run inside a virtual Windows machine on Linux as well)
-.NET 3.5 (installed as part of install process)
-FTDI USB D2XX driver version 2.06.00 or later
-3 megabytes of free hard drive space

Tested supported cables:
-eBay USB VAG KKL using the FTDI D2XX standard driver
-Ross-Tech HEX-KEY-CAN using the Ross-Tech FTDI D2XX driver ("boot in intelligent mode" must be unchecked in the VCDS options screen)
-Any dumb OBDII cable using the FTDI USB chip

Tested unsupported cables:
-Galletto (Does not support dumb mode)
-KWP2000+ Flasher (Does not support dumb mode)
-Old Ross-Tech KEY-USB (Does not support true dumb mode)

ECUs known to be supported:
-2000/01/02 Audi 2.7T
-2001/02/03 VW/Audi 1.8T

Tested supported ECUs list on the wiki:
http://nefariousmotorsports.com/wiki/index.php?title=NefMoto_ECU_Flashing_Software

Known issues:
-No known issues. Please let me know if you find any.

How to install:
Please uninstall any previous versions of the NefMoto ME7 ECU Flasher before installing the latest version.
To install, download and run the attached file ECUFlasherHostInstaller 1.4.2.2.msi.
Then ensure that you have the FTD2XX driver installed for your specific cable.
If you have a generic cable, download and run the CDM20600.exe to install the generic FTDI D2XX driver.

Great job, Tony !

Going to test&try it out asap.

Keep up the good work.

Thanks,

Pascal

Tony,
thank you for releasing new version - this installed correctly on Win7 x64. I ran the CDM20600.exe too.
As for future updates, maybe you can modify your VS setup project to automatically unistall previous version when installing next revision.

Did some test. I have 3 cables, original Ross-Tech, ebay Galletto clone and some old dummy cable for VAG-COM 409.1
With first two I could not read ECU info (see attachments).

I checked my ECU type (with galletto):
.D0907551G
2.7l V6/5VT
0261206776
1037354123
Flash:29F800BT

BT means Top Boot Block, so I created new MemoryLayout (which is BB's sectors in reverse order).
With dummy cable I managed to read ECU info after couple of failed attempts (screenshots in attachments).
And finally I was able to read file from ECU, but again first attempts failed.
Did not try to flash the file yet - I hope to get reading working correctly beforehand.

Should my other cables work? What's a dumb mode?
Hope you can help me, software is really cool.
Thanks again.

You are 100% right that I should uninstall the old version as part of my installer. I will add that to the next release. I really hate writing installers...

Creating a memory layout with the sector sizes in reverse order should work for the 29F800BT.

If you can, please verify the file you read from the ECU matches what Galletto read. I need the ECU reading to be tested more.

If you see "THIS-IS-THE-RAM-PROGRAM", that means the ECU is corrupt and has gone into fail safe mode.

Currently I am working on improving the slow init connection method to succeed in less attempts. I have to do it using a less reliable method, because that is the only way that works when the ECU go into fail safe mode when corrupt.

My software does not work with the Galletto cable. This is because it is an "intelligent" cable and does not pass the serial data straight through because it works on a higher level Galletto specific protocol.

For my software to work with the Ross-Tech KEY cables, the cable has to be put into "dumb" mode so that it will pass through the serial data straight through. To put the cable in "dumb" mode, run VCDS, goto the Options screen, and uncheck the "boot in intelligent mdoe" option, Apply, Save.

I will add a basic check in the next release to determine if the cable is running in "dumb" mode.

The file I read is identical to the file I wrote to ECU using Galletto, so reading function worked.
I checked my VCDS options, "Boot in intelligent mode" (which is "Force Dumb Mode" in older versions) is checked, so my cable should be in dumb mode?
I will wait for next release and then play with this option. Thank you for helping.

You would want "Boot in intelligent mode" unchecked.

I just posted a new installer for version 1.4.0.2

Changes from the previous 1.4.0.1 version:
-Reduced the number of connection attempts to achive a successful KWP2000 connection.
-Added a test for cables running in "intelligent" mode. Displays a warning message if detected.
-Removed message window pop ups if you do not have the FTDI drivers installed. Now it with display a message in the status window.

Well, I am 0 for 2 with the RossTech KEY-USB.  Tried it with your first release which would make 6 connection attempts and then fail.  I pulled the fuses as usual, tried again, no whammy.  Changed laptops since I had changed those driver INF's and still no luck.

Tried the latest release, and it still can't read.  No errors about dumb mode.  I then intentionally turned it off, and it identified dumb mode was off.

Any suggestions?

Got my Ross-Tech cable to work after switching into dumb mode.
Reading info and reading file both worked.
Yesterday I read with BT memory layout, today with BB - files are identical. How's so?

Really appreciated for Nefmoto's work for such a great software.
 
I had sucessfully read out my bin. file from my 2001 RS4 with 8D0 907 551 K ECU and Wettenraur Chip using the 1.4.0.2 release, took me 4min13 second, ebay cable, thank you Nefmoto ;).

But without any definition file I couldn't do anything about it, could anyone help here?

Oh yeah, this is my first post, Hello to everyone!

The sector order and sizes in the memory layouts are only required by the ECU for erasing when flashing new data.

The NefMoto software reads ECUs by sector for convenience, but if you have the sector sizes wrong it won't affect anything. Reading only requires the flash memory base address and size.

Does the program window title say 1.4.0.2 in it? Just want to make sure you are really on the latest version.
If the cable isn't in dumb mode, the operation will fail almost immediately without ever trying to connect.

Can you send me your log file? The file will be in your Windows users AppData folder in the Nefarious Motorsports sub-directory.

Do you have any other cables besides the Ross-Tech KEY-USB?

Yes, verified I was running 1.4.0.2...  See attached.  

ninja edit:  I don't have any other cables... if you have one you recommend I will buy it :)

Log file doesn't indicate any issues other than getting no response at all from the ECU.

By any chance are you running on a slow computer? I'm wondering if maybe the computer is running too slowly to read the slow init sync byte in time. I am working on a better connection method at the moment to try to avoid this situation.

And you are using an official Ross-Tech KEY-USB cable? I personally test on Ross-Tech HEX-USB-CAN and eBay VAG 409.1 KKL cables.

Maybe the next connection method improvement I am working on will solve your problem.

If you want to try another cable in the meantime, buy a eBay VAG 409.1 KKL USB cable for $12 shipped.

It's a dell Precision M4500 i7 920XM Extreme 2.0ghz quad core... I hope it's not too slow, LOL.

Let me ask you this - each connection attempt turns the light solid red on the HEX-USB, whereas with lemmiwinks for example, it seems to blink rapidly with communication.  Is this normal?  I am however running a genuine but somewhat old HEX-USB from when they first came out - don't know if that matters - I can post the version number when I get home.

I just found a cable on ebay that's close to me so I should have it in the next day or two...  It was more money but it won't get here by boat.  :D

All I can think is that Lemmiwinks communicates at a slow enough baud rate that you can see the light blink when data is transmitted, or some part of that cable has been wired differently.

Just posted another minor update to version 1.4.0.3.

This change switches the slow init connection method to a more reliable technique.

Please see the first post for the attached installer, and please uninstall any previous versions before installing the new version.

The read ECU info seems successful now with my ross-tech cable, however it either fails, or the app hangs on attempt 2 when I try to read the flash.  I let it sit for about 10 minutes, and then the app unfroze and attempted more connections when I cycled the ignition.  Attached logs :)

I'm glad you can get farther with your cable now.

In the first log I see what looks like a 5 minute hang when trying to connect. That is most likely a bug on my part, but most likely the correct behaviour would have been to not connect. EDIT: It appears as though the connection thread ran and connected, but then the send/receive communication thread never started. Very strange, especially because this doesn't appear to be happening consistently. I will add some checks to detect this happening in the future.

Currently the program will not allow you to close it while an operation is in progress. This is to prevent you from closing the program while flashing.

The log shows a lot of messages with invalid checksums, or messages that time out before they complete. My only guess is that there is something strange happening with your cable, or on your computer. Do you have an anti-virus software running that could be interfering, or any background software?

I am hoping your cable is the problem and the VAG 409.1 cable you ordered will fix the problem. I will try to contact Ross-Tech to see if they might know anything about why one of their old cables is not working.

At the moment, you are the only user reporting problems. Unless there are lots of silent unhappy users out there. So if you are an unhappy user, and the NefMoto software does not work for you, please let me know so I can fix it!  ;D

Yeah, when I say "hang" I really should have said "pegs the CPU at 100% utilization".  The cable I have is I believe a rev C with the 3.01 firmware on it.  I am going to bring another laptop home with just a base W7 x64 install on it just for grins, but there's no A/V software or anything out of the ordinary on this machine.

The 100% CPU utilization is the connect thread continually checking to see if the send/receive thread has successfully setup the connection after the slow init finished. The connect thread sleeps after each check, so it shouldn't cause an issue, but maybe it is on some processors. Maybe I need a longer sleep in this case.

Do you know how many cores your computer processor has? Maybe I have a issue with running on single core machines.

Yeah, it's a quad core.  The machine I'm bringing home is only a dual core.  

edit:  I suppose I could try setting the CPU affinity for the process to a single core...

Tonight I am going to either combine my two threads into one thread, or drop the busy loop with sleeps and replace it with some thread waiting events.

Either way, I should be able to get this issue fixed in the next couple of days.

Got my ebay cable today... hooked it up... and now I'm seeing "ServiceNotSupported" in the log...  It seems like it is working and that my ECU is not cooperating?  Is it possible the existing flash is blocking this?

Glad the cheap eBay cable works.  ;)

Hopefully you can still test your Ross-Tech cable for me once I rewrite a bit more of the connection code.

As for "Service Not Supported", is this ECU stock or has it been flashed/chipped? I have seen some tuners disable the RequestUpload message handler, which prevents reading the ECU using the standard methods.

I will be glad to help test the Ross-Tech cable.  :)

This ECU is flashed.  I really intend to completely start over with the tune, but would like to keep the flash dump in case I ever need to switch back.  I have 29F800BB that has a flash on it as well, but that seems like a lot of work to swap the chips when I should be trying to find another ECU to buy or going through boxes in the garage to find my spares :p

Before I wrote the ECU reading code, I had some written some code to read the ECU without using any of the standard protocols. I haven't release it because it may not work on many ECUs, because it has to use some hard coded addresses for doing it's tricks. Maybe I will look at it again....

I know you have a lot going on, but I'm happy to help any way I can, even if I need to setup a box that you can RDC into :)

It looks like the HS ECU on a VW 1.8t reads just fine.  This also happens to be an APR chipped ECU (not that it matters as they protected the flash area).  HS.bin was dumped from Ton'y flasher this morning (in about 3m 41s!) and the 06A906032HS was dumped from a KWP2000+.

Awesome. Thanks for letting me know it worked.

I have the single thread method working for the connection and communication protocols now. I need to clean it up and do more testing before I release it though. So an update won't be available until next week.

I also managed to find the KWP2000 code that activates the other method for reading flash memory. This method allows reading ECUs that have had the UploadFromECU service disabled, which is the standard method for reading ECUs. I will look into this more over the next couple of weeks.

woohoo!   I will be the first to donate to the NefMoto beer fund.  :D

Where can I send donations to?  Cause i really want to help this guy out.

No rush on sending me donations. Because deep down I am evil, and ultimately I will be releasing premium features which won't be free.

My goal is to release free software that can do anything that any other cheap tool can do, and only charge for features that only my software is capable of doing.

I am hoping that 90% of the software I write will be free, and only the extra 10% fancy stuff will cost anything.

Sounds like a good plan.   

Im really looking forward to the tuner program, as right now tunerpro and winlos are not exactly the nicest to use!

I think that's a solid plan.  Rest assured most of us would pay for live map tracing and stable high speed data logging among other things :)

Why not start making money now? Isn't that the way evil capitalism works?  ;D

I would like highspeed datalogging software without fancy gauges nor realtime ploting. Just plain text output at more than 3 samples per second will do me good. You can charge us for updates when you add all the features.  :)

Once the flashing software is a better more stable, I am planning to either work on data logging or checksum updating. I already have systems for doing both, BUT, they were written specifically for my 2001.5 Audi S4. So before I can really release them, I need to do a bunch of work to make them work on other cars.

Also, I am still trying to source a VAG OBDII cable which is guaranteed to use a FT232R chip. Most cables seem to use the FT232B chip, and for some of the extra features I am hoping to sell I will need an FT232R chip. I could produce my own cable, but that would easily triple the cost of the cable.

i have sucessfully read 3 crazy mboxs. they shouldnt really be posted due to the tuning. tony you should contact me

I just posted an update to hopefully fix all remaining connection issues. The latest version is 1.4.1.0.

Jason, please let me know if this solves the connection problem with your VAG-COM cable.

No whammy :(

I did several attempts with no success, and I attached that log "NefMotoECUFlasherLog-1.4.1.0 - vag-test.txt"

I also did an ebay cable test after key off/close app/swap cables/key on, which is attached "NefMotoECUFlasherLog-1.4.1.0 - ebay cable.txt" in case it's any use comparing against the vag-com test.

One thing I noticed is that you can't close the app after the vag-com dumb mode error message and you have to terminate the process.

Thanks for working to resolve this :)

I bought the ES#6928 cable from ECS Tuning.  It has the FT232R chip in it.  I don't know if they can guarantee that it will always have that chip, but maybe you could ask them.

Cool, thanks for letting me know. $32 isn't cheap enough in my opinion though, but maybe I can find out who their supplier is.

I have a fix for the program not able to be closed if anything goes wrong when trying to setup the FTDI device when connecting. I found that one this morning myself as well. I will try to post a small update to solve that problem tonight.

Thanks for posting the logs. eBay cable seems to work great. Logs show that the VAG-COM cable is connecting better now (Hurray!), but it is not transmitting messages properly sometimes. Looking through all of the different logs you have sent, it always seems that the AccessTimingParameters message seems to get corrupted. Strange that this only occurs with your VAG-COM cable. I will contact Ross-Tech and see if they have any insite.

I just posted a new installer for version 1.4.1.1.

This version fixes the problem that Jason reported, where if the cable is running in intelligent mode, you can no longer close the program.

There are other changes under the hood to work toward a future release supporting ECU reading that bypasses the normal methods blocked by some tuners.

Please uninstall the old version before installing the new one.

I am trying to download the bin from my GIAC X chipped L box. However, I only get the results below. This is after about an hour with no progress. I had to use Task Manager to close the program. I say chipped because it actually has the chip soldered in. Am I doing something wrong or is it the chip that is preventing me from pulling the bin. I have also attached the log file, but I don't think it will help much. Any help will be much appreciated. I have a stock J box that I will try, but I wanted to compare the GIAC tune to the stock L box bin that I have. I am using the JHM (ebay) vag cable and running Windows Vista. I tried "Read Info" and "Read Flash" with the same results.

(http://i845.photobucket.com/albums/ab15/phila_dot/screenshot.jpg)

The log file doesn't seem to show anything, and it doesn't coincide with what is shown in the status window. Can you try running again, and then try to attach the log file one more time?

I posted an update in my other thread, but I just wanted to say again that the NefMoto flasher is awesome. 

just remove the ecu and use boot mode. thats a pretty much guaranteed read.

i used this application today for the first time. first thing is thanks.  :)

i wanted to make 2 points though. well, 1 point and 1 question.

first point: several times the program would error when it was finished writing. as in, it would write 100% then say there was an error writing and disconnect. it did this several times. each time it flashed correct because the ecu would boot ok (dtc light came on) and the engine would start. the last time it did it i was away from the laptop and the last % on the screen was 94%, so i dont know if it made it to 100% but the car still started. im assuming it finished considering the chksum in the 2nd to last line of the file.

and then my question. when you select a file to flash, does it load this file in to a buffer or does it read directly from the file each time? what im trying to ask is, if i had a file on the desktop, example.bin, i select that file to flash and i flash the ecu. then i overwrite that file with a new file, still named example.bin, must i reselect the file because the old file is still in the buffer or will it read the new file i created? im assuming it loads the file in to buffer. im asking because i think i flashed the same file twice today. :p even though i had overwritten the old file with a new file.

again, thanks for all your work.

It loads the file to flash when you specify the file in the file open dialog, or when it loads the last used file when the program opens. Currently it does it this way so that it can validate the file against the memory layout to determine if it should let you flash the ECU. But I think I should change it based on your feed back, because it ends up being confusing like you experienced.

Can you attach a log file of the flashing process failing? The log file should be located in the Nefarious Motorsports directory in your Users AppData folder. Let me know if you have a problem finding it.

I will add more messages to indicate whether or not a flash write is expected to work even if it doesn't get to 100%. It seems strange that this would happen though.

i have a file to flash tomorrow (wont be the only one im sure). if i encounter any more of the write error messages i will attach the log file.

thanks for your support.  :)

Tony, i have some compatibility issues over here.

I've installed Win7-32bit freshly. Did some hardware-driver-installs to get
all hardware running on my HP-9010 laptop, and everything works. Then
i installed the driver for the FTDI-chip of my blue KKL interface, which came
with your driverpack that you'd advised to install.

Afterwards i installed the Nefmoto flasher, V1.4.1.1.
No problems. Started the software up, and it recognised my blue KKL-lead.

I have made a benchflash-cable and use this to read-out and program ME7.5 boxes and this one only has the K-line connected,
plus +12v and mass. It works with the KWP2000+ box and the Galleto-1260-interface.

The blue KKL-lead is tested, and works fine with vagcom 311.

i tried to read-out a ME7.5 box, and it could only read-out the boxnumber : 06A906032 HN

After installing some other programs, and doing a few windows updates, your
program doesn't want to start up anymore. Did some driver cleaning, uninstalling,
reinstalling the drivers, and the flasher, but it won't open-up the main-screen anymore.
Any suggestions ? i'd really hate it, if i have to install win-7 again... 

Greetings,

PvL

here is a log file. i did 1 read and a dozen or so writes today. only 2 errors i think. one crashed after only 8% or so. that was the last log. i had to take the ecu out and bootpin flash it. i cut the log file down to where it was just the last write that crashed, the file was 21mb.

The log file doesn't show anything going wrong, it just stops part way through writing one of the status messages. Did you cut anything off from the end of the file? What happened when the program stopped working?

As far as I know, you are the first person to test on an ME7.5. The log file just seems to end abruptly, was there any more to the log that what you posted?

As long as you have .NET 3.5 installed, the program should run. If you install something like WinICE that is a kernel mode debugger, or try to attach a debugger to the program, then it will not run. That is all I can think of off the top of my head. I will try to add some more logging to the program startup that could help us track this down.

Hi Tony,

Well, i think i'm aside k0mpresd and Argdub the ones which are testing the ME7.5 boxes, and reporting back on the forum
for the moment.

Argdub has tested many : http://nefariousmotorsports.com/wiki/index.php?title=NefMoto_ECU_Flashing_Software
(audi TT and the golf bora jetta ones)

k0mpresd  has tested the 4B0906018CH box

I noticed Microsoft offered me 2x a update on the .net thing. 3.5.1. Which is not removeable after installing b.t.w. (nice job microsoft).
I therefore re-installed completely win-7-32bit Ultimate, but withouth the update on the .net-thing, and the flasher is running again !

Need to test a bit more, but people be carefull in updateing the .net thing. It could render the flash-tool non-startable.

Greetings,

Pascal

tell me exactly what update you mean and I can help you telling howto uninstall.
if you mean Version 3.5 SP1 of the .NET Framework, it is already shipped with Windows 7....?

You're right, my brain wasn't working last night.


I tried installing those two updates on my Win-7-64bit Enterprise machine at the office, and I could still run the NefMoto flasher. I will test those two updates tonight on my Win-7-32bit Ultimate machine at home.

nope. didnt touch a thing. it just stopped flashing.

btw, any plans for a linux based flasher? my macbook is the only laptop i have with a good battery and i run ubuntu linux on it via bootcamp. id love to be able to flash from that. ive been using my wifes laptop and it lasts a whopping 30 minutes on the battery.

You can run Nef flasher on a virtual machine. I'm using VirtualBox, has usb support and is free. http://www.virtualbox.org/

score. thanks.  :)

No plans for anything but support for Windows Vista/7 at the moment. Once the software is more stable, I will try to support Windows 2000 and XP. It would take too much time and effort to move to Mac or Linux because they don't support .NET 3.5.

I will look into finding out what is wrong with my logging system. It seems that sometimes the logs get cut off.

I wasn't able to reproduce any issues on my Win-7-32bit Ultimate machine at home with all of the .NET updates installed.

I will look into adding more logging to the program startup to see if I can figure out what the problem may be.

Bug to report. I just tried connecting (reading ecu data and writing) to a 06A 906 032 LP 1.8T GTI. The program hangs on "Switching to KWP2000 session"
The log contains nothing

Can you double check the log file again. If you check the log before the program closes, you sometimes don't see everything.

The program hangs, I have to end the task, and nothing appears in the log.

I had some results getting a log from 1.4.0.2 which I've attached.

Thanks for checking. I will investigate my logging code and see if I need to flush the data to the file or something.

Hello,

I thought, why not modify the current only selectable memory-layout, and do 2 custom ones for the ME7.5 boxes ?

I've picked the B5 S4 one, and just renamed it to the according chip (800 chip). Then copied it, and corrected it
to be able to correctly read ME7.5 chips with a 400 chip inside.

What wonders me, is that only the 800-files doesn't grey-out the option to read the flashmemory. The 400-layout can't
read the flash. This option is greyed out ?!?

Also, the reading of the flash isn't successfull. Very strange...  As i'm doing a bench-job with a bench-cable (only k-line
as of data connected, plus 12v voltage and ground). Via the same setup i can get proper connection via vagcom 311
and readout DTC's no problem.  With the ME7.xx tool from Cartech and the kwp2000 interface i can also read-out the boxes
flashmemory. So it seems the hardware-setup should be o.k ?

I've added the extra memory-layout-files. If someone can take a look at them and comment if they're right or wrong ?

The results of my readouts is also viewable, i've added a archive with all tried&tested boxes. No write-attempts made, as i
firstly want them to read-out properly.

Tested boxes :

6K0 906 032 AA
8L0 906 018 M
8N0 906 018 BD
8N0 906 018 H

Thanks.

Pascal

The memory layouts were made as simple XML, so that users can always make their own. So what you did makes perfect sense.

I looked at your two layouts, and they look correct based on the AM29F800BB and AM29F400BB data sheets.

If the option to read is greyed out, then most likely there is an error in the memory layout or USB device. If there is an error, one of those fields in the user interface will appear red, and if you hover your mouse over top, it will tell you the problem.

As for the problem with reading, looking at the logs you posted, it appears as though the ECU is not allowing the programming diagnostic session to start. I will add more logging to the next release to try and record what is happening. Thanks for testing.

You guys are crazy. I'm surprised, but happy my code works while running inside a virtual Windows environment on a Linux machine.

I've made lp ecu with 29F800BB memory layout, no problems apart from one or two failed attempts to connect.


Pascal, I also had problems reading and writing on bench, have you tested with the ecu installed in the car? Try rising the priority of flasher to high in task manager.

@ Tony : indeed the 400bb has an error in it..  i will have to find out what the correct Sum of Sectorsizes for that one has to be.
The error stated (thanks for that hover-tip !) is : Sum of Sectorsizes does not match.

@ ArgDub: Good thinking. Thanks for the head-up. Will try this asap on a audi S3 of a friend of mine in the UK coming thursday.
Hopefully the read-option then also works on his 1meg me7.5 box. It has modified software in it...  so it's quite a thrill to see
if all works ;)

I already tested that on the bench, and isn't it strange that 'on the bench' isn't as good as in the car ?
Makes me wonder why....  Perhaps Tony or other forum-members can provide us some usefull info on this matter. Is the L-line
perhaps also needed to trigger the ecu ? Or do we need a specific delay in signalling ?

Thanks,

Pascal

I do all of my testing on the bench... my couch specifically. So no ideas from me....

Last time I tried flashing on bench I got "programming preconditions have not been met, Precondition unknown" but it was with first release. I'll try again with lastest version.

Tony, could you add an option to force to use default timing and baud rate?

Instead of negotiating the maximum fastest timing? I can add an option for that. Why do you want it, and what problem are you trying to solve?

Some times flasher fails to connect, I would like to test if it is due to pc speed, as you know I'm running it in a virtualpc which decrease the system performance.

The baud rate and timing is only changed after the communication connection is established to the ECU. While connecting the program uses the standard KWP2000/KWP1281 message timings, and a baud rate of 10400.

If the problem is connecting, and is caused by latency in the virtual pc, then all I could think that would help is allowing more time for responses when doing the slow init to setup the connection.

Is the problem opening the connection, or does it occur after the connection is already open is communication is happening?

Problem occurs when trying to connect, but I can't find the log file, is it permanently stored? where?

/users/username/appdata/roaming/nefarious motorsports/nefmotoecuflasher/

I just posted version 1.4.2.1 to the first post of this thread.

Updates include:

• Reloading the memory layout and file to flash when the flash writing operation is started
• Fix logging issue that was causing logs to not be fully written. Log file writing is now flushed after each write.
• Added the ability to quit the program while an operation is in progress. User is prompted to confirm.
• Added menu items to open the log file, and to open the folder containing the log file
• Added more logging and status messages to better explain what the program is doing
• Changed the delay when trying to start a KWP2000 session after ending the initial KWP1281 session
• Support extra fields in flash writing protocol that may be needed by certain ECUs
• Program uninstall entry now correctly lists the program version

Please uninstall any previous versions before installing the new one.

With the latest release, ECU reading appears broken. I'm working on a fix currently.

I just posted another quick update to version 1.4.2.2.

This update fixes the problems that occurred sometimes while reading the ECU flash memory.

Please see the first post in this thread for the new installer.

Please uninstall any previous versions before intalling the latest version.

I cant get 1.4.2.2 to open.  Getting an error that says application was unable to start correctly.  Previous versions worked fine though.

Boo-urns to the maxx....

Works fine on my home PC, and I also get a error about the application not being able to start when I try it on my work PC.

As far as I know, this is only occurring on 64bit machines at the moment.

I will try and sort this out today, but I'm unsure about what changed at the moment...

I attached the last stable release to this post in case anyone needs to use it in the mean time.

I just posted a new version of release 1.4.2.2 to the first post in the thread.

I believe this fixes the issue with installing on Windows 64 bit.

Hi Tony,

I'm unable to ''Read Flash''.... Here's the info and log file:

(I'm using version 1.4.2.2 with Vista 64 bit)

------------------------------------------------------------------------------------
Reading ECU Flash Memory.
Disabling Windows sleep mode.
Connection attempt number 1.
Successfully sent slow init.
Switching to KWP1281 session
KWP1281 connect info: 8D0907551M  2.7l V6/5VT     G   0001
Successfully sent slow init.
Switching to KWP2000 session
Connecting...
Connected
Starting diagnostic session.
Successfully started diagnostic session.
Negotiating communication timings.
Reading current communication timings.
Reading communication timing limits.
Requesting communication at timing limits.
Successfully changed to new commumication timings.
Requesting security access.
Security access granted.
Starting to read data block.
Validating flashed data checksum for address range 0x800000 to 0x803FFF.
Flashed data checksum doesn't match new data.
Requesting upload from ECU for address range 0x800000 to 0x803FFF.
Received negative message response with code: ServiceNotSupported
Request upload from ECU failed.
Disconnecting...
Restoring Windows sleep mode.
Reading ECU Flash Memory Failed.
Disconnected
------------------------------------------------------------------------------------

Do you have an aftermarket flash?

Yes, GIAC's.

Further back in the thread I posted about this.  Basically, the function used to read the contents of the ECU have likely been disabled by the tuner, in this case, GIAC.

I know that Tony is working on a workaround to this issue.

If you absolutely need a read, you should be able to read the contents with Galletto in boot mode.  That is how I was able to read my ECU (from a different tuner).

I did read your previous post about this. As I succesfully was able to "read info" with version 1.4.2.2 and you weren't back then... I'm wondering why that is, is it a version issue...

We have identified that my vag-com cable is very old and does not support dumb mode entirely.  When I bought a KWP cable off ebay, that fixed the communication issue.  But I still needed to use my Galletto 1260 to read my aftermarket tune.  Now I can flash/read with the KWP cable and Tony's software, as long as my ECU has a bin loaded that isn't crippled by a tuner.  If I flash my old tune back, I can't read it with Tony's software.  If I overwrite it with a stock mbox bin, I can read it.  So it has everything to do with the software that's currently on the ECU.  Hopefully that makes sense :)

that makes sense. bootmode should let you read any file off the ecu though.  :)

That is correct... I just didn't have a Galletto setup, lol.  Tony's software seems faster than Galletto.

My software is faster than Galletto/KWP2000Plus and anything that supports boot mode. But my software only works if the tuner hasn't disabled the few different services in the ECU that allow me to use the KWP2000 protocol to read from the flash memory.

If you get a message about "ServiceNotSupported" while trying to read from the ECU, then that means the tuner has disabled the RequestUpload KWP2000 service. This prevents reading from the ECU using the standard documented KWP2000 protocol. The only way to read the ECU flalsh at this point is to use boot mode, or to do some fancy code injection ECU hacking which I am working on. Don't hold your breath waiting for me to implement this feature though, because it is a the end of a long list of things I need to do.

Hi,
Does anyone have a memory layout for RS4 2001 or can I use S4's.
Tnx

Try using the S4 memory layout to do a read. That should let you know if it is the correct size and location for the flash memory chip. There is no way that I know of currently to determine if the flash chip is a BB or BT though.

Tony,

Tried the newest version of your software, still on the bench and i still have readout-issues.
This time i added the logs, so this should perhaps explain to you a bit more why it fails.

I also corrected the 400BB-chip setupfile, and it was a little mistake that was quickly
ironed out. It now works withouth red error state indication and both info and read work.

Hopefully i am able to test the setup on a car, as you'd recommended, but that perhaps can
take a few days. Need to find a guineypig for this.

If any other forum-member has a good idea to help me (us) out on this matter, please do post
all recommendations. I will test them asap.

Thanks,

Pascal

Thanks for the log file, this message seems to identify the problem:

"Received negative response for service ID: StartDiagnosticSession, with response code: ConditionsNotCorrectOrRequestSequenceError"

This only appears to be occurring when trying to start a programming session, because you have no problems starting a standard session to read the ECU info.

My only thought at this point, is perhaps it will work in the car, but not on the bench, or there is something I am missing that the ECU requires before entering programming mode.

Tony,

Before i'm going to program (WRITE FLASH) a ecu...  i should be able to first read it, i think?
And thats the thing that fails.. Programming itselfe not tested yet, while the READ FLASH function fails... 

Hopes this helps you a bit.

Thanks,

Pascal

The log file you posted, shows that the problem it is having will prevent you from reading and writing. So I don't believe there is any reason to test writing at this point. But perhaps reading from inside the car may work.

Hi,

When I use S4 memory layout, it reads out and flashes OK. No errors.
In dashboard ESP and ABS lights are on. And VAG shows errors, but engine runs very fine.

Arne

@ arne_rs4 :

Please be so kind, to add the logfile of the nefmoto flasher. This will perhaps tell why you get the 'incorrect coded' error.

Press in the grey area, above File to Flash :  the Log File button. Then choose Open Log File. Save this file to disc please,
and post over here in the forum.

Thanks,

Pascal

Here it is. First I read from my friends RS4 ECU witch is SKN and then I flashed mine.
Same errors when I flash original RS4 binary.

Arne

@ Arne :

Thanks for the log. This will perhaps help Tony to work out this problem.

I have a question relating to your and your friend's ecu. Are these exactly the same ecu's ? :

8D0907551K 0001 - 0261207001 - 1037360387 RS4 - 0xCFCD

(thats the one i found on internet, and added the checksum to it)

On your car's ecu, the readout was the original file which was in it, and you'd wrote that back, and
suddenly it throws the coding-error in vagcom ?

I get the feeling that the little config-eeprom-chip inside the ecu got a bit mangled up when writing to the
ecu itselfe.. therefore the coding must be restored to remove this error. We need to investigate this.

Do you by chance also own interfaces like vagdashcom/ecutool or vag k+can commander ? then a readout is
possbile, and a compare against the original chip-content and the new content after writing.

Other forum-members did some writes to their ecu also, and perhaps they also have this error? Ifso, please
do post.

Thanks,

Pascal

Looking at your VAG errors and the NefMoto flashing log, it appears as though everything was fine with the reading and writing of the flash memory. The VAG errors indicate that the ECU coding is incorrect. Did you flash the ECU with the file from another ECU that was from a different year of car, or came with different transmission or something? The coding can be corrected via VAG-COM.

thanx for replying,

It works perfecly, only those errors. There is one good thing so, I dont have to switch off ESP like I always do ;)
Both cars are exactly same.
Via VAG? Can you help?

Arne

@ arne :

Have a look over here :

http://www.ross-tech.com/vag-com/tour/recode_screen.html

Be sure to note-down your original code as a backup, and check with your friend's RS4 to write-down his coding and apply it to yours.
That would do the trick. There are several items that can be recoded. It works very well.
I did a imported A6 from the US for a friend over here.
Now the speedo reads KM as of odometer-value digitally instead of miles, and all other values are metric instead of imperial.

Be sure that the car is exactly the same as of options and equipment, otherwise this will not work properly.

Have fun !

Greetings,

Pascal

Pascal, I had another look at your logs today. I am 99% sure your problem is caused by the ECU not being in the car. Your logs indicate that the programming mode preconditions have not been met. Currently the NefMoto flashing software only checks these when writing to the flash, and not when reading. Checking the flashing programming preconditions when reading is something I will add to the next version of the software.

Please let me know if reading or writing work when the ECU is in the car.

Thanks for help, changing Software Coding number in VAG-COM helped. No more errors.

Arne

@ Tony :

I will report back asap.

Need to test this on a few cars firstly, and then i'll report back.

Thanks,

Pascal

Cool just downloaded and will post back anything.

Great work!

Tony,
got 3 failed attempts today, 4th succeeded. See attached log, do you know what's causing those errors?
When do you plan to release premium version with sub 40 sec flashing time?
Thanks.

Tried on a 99 UK Audi S4.

Cable is a blue Chinese ebay item.

Works fine with VCDS.

No coms with flash tool.  My car has a tune for big injectors etc by a big tuning company currently on there.

Log file:


25/Aug/2010 07:07:41.356: Opened NefMoto ME7 ECU Flasher BETA 1.4.2.2
25/Aug/2010 07:11:29.084: Reading ECU Info.
25/Aug/2010 07:11:29.112: Switching to KWP2000 session
25/Aug/2010 07:11:29.217: Opened FTDI device.
25/Aug/2010 07:11:29.218: FTDI device info - Description: USB <-> Serial Serial Number:  Device Type: FT_DEVICE_BM Device ID: 0x4036001 Device Flags: 0x0
25/Aug/2010 07:11:29.219: FTDI ChipID DLL is loaded, checking chip ID...
25/Aug/2010 07:11:29.221: Unable to read FTDI device chip ID
25/Aug/2010 07:11:29.274: Starting send receive thread.
25/Aug/2010 07:11:29.296: Send receive thread now started
25/Aug/2010 07:11:29.299: Connection attempt number 1.
25/Aug/2010 07:11:29.782: Connecting to address 0x01.
25/Aug/2010 07:11:32.166: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:11:32.185: Failed to send slow init.
25/Aug/2010 07:11:32.205: Connection attempt number 2.
25/Aug/2010 07:11:32.510: Connecting to address 0x01.
25/Aug/2010 07:11:34.851: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:11:34.872: Failed to send slow init.
25/Aug/2010 07:11:34.891: Connection attempt number 3.
25/Aug/2010 07:11:35.198: Connecting to address 0x01.
25/Aug/2010 07:11:37.532: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:11:37.550: Failed to send slow init.
25/Aug/2010 07:11:37.569: Connection attempt number 4.
25/Aug/2010 07:11:37.874: Connecting to address 0x01.
25/Aug/2010 07:11:40.226: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:11:40.248: Failed to send slow init.
25/Aug/2010 07:11:40.293: Connection attempt number 5.
25/Aug/2010 07:11:40.598: Connecting to address 0x01.
25/Aug/2010 07:11:43.045: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:11:43.080: Failed to send slow init.
25/Aug/2010 07:11:43.119: Connection attempt number 6.
25/Aug/2010 07:11:43.442: Connecting to address 0x01.
25/Aug/2010 07:11:45.771: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:11:45.829: Failed to send slow init.
25/Aug/2010 07:11:45.862: Closing FTDI device.
25/Aug/2010 07:13:07.738: Closing NefMoto ME7 ECU Flasher BETA 1.4.2.2
25/Aug/2010 07:14:33.178: Opened NefMoto ME7 ECU Flasher BETA 1.4.2.2
25/Aug/2010 07:14:41.414: Reading ECU Info.
25/Aug/2010 07:14:41.423: Switching to KWP2000 session
25/Aug/2010 07:14:41.515: Opened FTDI device.
25/Aug/2010 07:14:41.517: FTDI device info - Description: USB <-> Serial Serial Number:  Device Type: FT_DEVICE_BM Device ID: 0x4036001 Device Flags: 0x0
25/Aug/2010 07:14:41.518: FTDI ChipID DLL is loaded, checking chip ID...
25/Aug/2010 07:14:41.519: Unable to read FTDI device chip ID
25/Aug/2010 07:14:41.571: Starting send receive thread.
25/Aug/2010 07:14:41.583: Send receive thread now started
25/Aug/2010 07:14:41.585: Connection attempt number 1.
25/Aug/2010 07:14:41.952: Connecting to address 0x01.
25/Aug/2010 07:14:44.321: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:14:44.342: Failed to send slow init.
25/Aug/2010 07:14:44.363: Connection attempt number 2.
25/Aug/2010 07:14:44.668: Connecting to address 0x01.
25/Aug/2010 07:14:47.006: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:14:47.027: Failed to send slow init.
25/Aug/2010 07:14:47.049: Connection attempt number 3.
25/Aug/2010 07:14:47.356: Connecting to address 0x01.
25/Aug/2010 07:14:49.709: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:14:49.730: Failed to send slow init.
25/Aug/2010 07:14:49.755: Connection attempt number 4.
25/Aug/2010 07:14:50.060: Connecting to address 0x01.
25/Aug/2010 07:14:52.391: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:14:52.410: Failed to send slow init.
25/Aug/2010 07:14:52.431: Connection attempt number 5.
25/Aug/2010 07:14:52.735: Connecting to address 0x01.
25/Aug/2010 07:14:55.074: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:14:55.094: Failed to send slow init.
25/Aug/2010 07:14:55.113: Connection attempt number 6.
25/Aug/2010 07:14:55.417: Connecting to address 0x01.
25/Aug/2010 07:14:57.771: Failed to read sync byte. Read 0 bytes.
25/Aug/2010 07:14:57.799: Failed to send slow init.
25/Aug/2010 07:14:57.819: Closing FTDI device.
25/Aug/2010 07:15:46.029: Closing NefMoto ME7 ECU Flasher BETA 1.4.2.2
25/Aug/2010 07:19:18.637: Opened NefMoto ME7 ECU Flasher BETA 1.4.2.2

Any difference between vw 1.8T 2000 ecu and 2001+, other than wideband o2 sensors.Will this software flash load my 2000 ME7 ecu? If so were would I get Maps for my vehicle?Newbie here so sorry for any inconvenience. :P

Any thoughts as to why I can't connect? 

Any protection wouldn't actually stop it reading info would it?  What about the fact it's a 512KB UK ECU?

Rick

Any chance this flash utility can be easily modified to do 29f200 based ECUs on older cars?
http://www.google.com/search?hl=en&client=firefox-a&hs=axr&rls=org.mozilla%3Aen-US%3Aofficial&q=29f200+flashable&aq=f&aqi=&aql=&oq=&gs_rfai= (http://www.google.com/search?hl=en&client=firefox-a&hs=axr&rls=org.mozilla%3Aen-US%3Aofficial&q=29f200+flashable&aq=f&aqi=&aql=&oq=&gs_rfai=)

AM29F200AB-90SI
datasheet: http://www.alldatasheet.com/datasheet-pdf/pdf/55521/AMD/AM29F200AB-90SI.html (http://www.alldatasheet.com/datasheet-pdf/pdf/55521/AMD/AM29F200AB-90SI.html)

AEB 1.8Ts

Thanks,
Rey

I don't believe the older ECUs support flashing via K-line...perhaps Tony knows for sure.

Hi,

Well some of them do it perfectly via the K-line. Only re-writeing the ecu. Take a look with
google and you'll see.

But at the moment a few interfaces only support this. Like Revo's one, CMD, MPPS, Byteshooter, and Frieling (M3.8.3 & M5.8).

The cheap interfaces won't do this,  untill there comes a hack for them. Or a new plug-in.

Let's focus on ME7 first. Too much differences already with these boxes. Tho would be happy if this could be
also included. Happy to test it also.

Tried the nefmotoflash-tool on a Seat Cordoba Cupra 1.8T with ME7.5.  It has a 29F400BB flash. 
I wasn't able to get any contact with this box. No info, nor readout.

I think this one runs via K, then via a canbus-reroute back to K-line, when i follow Seat electrical scematics for this
specific car... It is directly programmable via the ME7-tool and a KWP2000+ box with a benchflash-cable.

No probs with that.

I had no time to try out Nefmotoflasher on other 1.8T's yet..   a Golf MK-IV-R32 with CN-computer also wasn't doable.
Yet i have to look into the problems with aftermarket-radio's and protected ecu's (socketed flashroms where read-out
is disabled) to see if this is the case with that specific ME7.1.1 car. More to come soon.

Hope Tony can chime in, and fill us in about the status as of development on the software...  Dying to try out a (beta) update
from the software, and hopefully can get one of these cars read-out via the obd2-port on the car with the vag-com lead,
kwp2000+ interface or galletto 1260. You name it, i'll try it ! ;)

Thanks,

PvL

Hi Rick. Looking at your logs, I have really have no idea why you can't connect. Read protection only takes effect after the connection has been opened. Also, VAG-COM connects using the KWP1281 protocol, and my software using the KWP2000 protocol, but regardless it should still at least start the KWP1281 session and then fail to start the KWP2000 session.

What are the specs of the computer you are using? Maybe something is causing a slow down and preventing the slow init timings from being accurate. Could you try it on another computer?

I can see what is going wrong in your logs, but I have no idea why it is happening. The ECU appears to be sending back a response before the program has finished reading back in the echo. Given the way the FTDI USB chip buffers data, this shouldn't be possible. I will try to think of some ways to avoid this problem for the next release.

What ECU are you trying to flash?

In the next release I am planning on adding the option to try fast-init mode, in addition to the slow-init mode that I already use. This may improve the connection issues that some ECUs are having.

If the car is using the new CAN-BUS system, then it is hard to say if flashing over the K-line is still supported. If it requires communication over the CAN-BUS, then that would require a CAN-BUS supporting USB cable, and most likely a different flashing protocol. This isn't something I want to spend time on currently.

To test it out, you would need to create a memory layout file for the 29F200 flash memory. Then just try to read or write to the ECU. The log file from that test should let us know how feasible supporting these older cars would be. If they use the KWP2000 protocol to flash and communicate over the K-Line, then it shouldn't be very hard.

I don't have an ECU to test, so you will need to test for yourself and send me the log file.

In the next release I will be adding support for reading and clearing error codes, as well as allowing you to select between fast-init and slow-init methods of connecting. Hopefully this will fix some connection issues, as well as allow us to identify other errors that occur due to flashing.

After the next release, I am planning on adding support for license files to allow for premium features, such as fast flashing. Flash flashing only writes the memory sectors that are different, and not all sectors. This allows the flash to complete in about 45 seconds.

Ultimately, I don't want to work on the flashing tool anymore, and would rather spend my time working on data logging, map editing, and checksum correction. After I add support for licensing premium features, I plan on spending some time overhauling the user interface to allow for these other features.

You guys just keep finding too many strange connection and communication bugs when trying to flash all these obscure engine computers! ::)

All I ask is that you keep me up to date on which engine computers you have tried to flash. That way we can keep an accurate record of which ones are supported and which ones aren't.

It's 551G (euro S4). I have flashed more than ten times successfully with releases before 1.4.2.2, maybe had one or two fails too. But this release failed in 3 consecutive flashes. Using x64 Win7 and Ross-Tech cable.
Did one more test - flashed 100% but errors just before the end:

27.aug.2010 05:34:08.796: Successfully erased flash memory.
27.aug.2010 05:34:08.803: Starting data transfer.
27.aug.2010 05:34:08.807: Sent message with service ID TransferData at 05:34:08.805
27.aug.2010 05:34:08.823: Received message with service ID TransferDataPositiveResponse at 05:34:08.822
27.aug.2010 05:34:08.826: 100% complete.
27.aug.2010 05:34:08.828: Data transfer complete.
27.aug.2010 05:34:08.829: Requesting data transfer exit.
27.aug.2010 05:34:08.831: Sent message with service ID RequestTransferExit at 05:34:08.831
27.aug.2010 05:34:09.833: Read incorrect echo from ECU while sending message bytes
27.aug.2010 05:34:09.833: Expected: 01 37 38
27.aug.2010 05:34:09.834: Read:     03 7F 37
27.aug.2010 05:34:09.834: Failed to write message to FTDI device with service ID: RequestTransferExit
27.aug.2010 05:34:09.835: Read incorrect echo from ECU while sending message bytes
27.aug.2010 05:34:09.835: Expected: 01 37 38
27.aug.2010 05:34:09.836: Read:     31 01 37
27.aug.2010 05:34:09.836: Failed to write message to FTDI device with service ID: RequestTransferExit
27.aug.2010 05:34:09.837: Failed to send message 3 times, disconnecting
27.aug.2010 05:34:09.838: Disconnected
27.aug.2010 05:34:09.863: Closing FTDI device.
27.aug.2010 05:34:09.866: Restoring Windows sleep mode.
27.aug.2010 05:34:09.868: Writing ECU Flash Memory Failed.
27.aug.2010 05:35:28.072: Closing NefMoto ME7 ECU Flasher BETA 1.4.2.2

Thanks for the update. I will try to see what changed with release 1.4.2.2.

OK s4rmm, I think I know what is happening in your logs. It appears as though the program times out waiting for a response to the RequestTransferExit message. Then when it tries to resend the message, the resent message collides with the late response from the ECU.

I'm trying to figure out how to prevent this now. Thanks for posting the log.

All other PC's I have access to are Windows XP, which isn't supported?  My laptop uses Windows 7 64bit with a Celeron® ULV Processor 743 @ 1.3GHz, so I don't think speed is an issue.  Tried again yesterday and there is just no communication, but reset my airbag lights fine via VCDS.

Could you recommend a decent cable perhaps?

Rick

Can this software be used in boot mode?

Tony,

I have been told today that the C box does not support KWP2000, only KWP1281.  Can this be supported in a future release?

Rick

Switched back to version 1.4.1.1 and flashed couple of times without problems. Maybe this helps to analyze what's changed since that version.

Rick, sorry for the slow reply. If your cable works with VCDS then it isn't the problem. At this point I don't know what is wrong with your setup. I would recommend seeing if your computer and cable can connect to another car to rule out any problem with them. That way we could localize the problem to your car.

The only other idea I have is supporting fast init. I dropped support for fast init because slow init is much more supported and works better. I will try to add back in support for fast init in the next release, or the one immediately after that.

My software starts the connection via slow init to address 0x01 which is a KWP1281 connection method. Then it closes the connection and starts another connection, which VAG ECUs respond to with a KWP2000 connection. So my software already supports connecting using KWP1281, so that isn't the problem.

Nope this software does not work in boot mode. This software uses the KWP1281 protocol to connect, and then the KWP2000 protocol to communicate with the ECU. This allows the ECU to be flashed through the dashboard without opening the ECU up unlike boot mode.

Thanks for checking that. I found what changed between 1.4.1.1 and 1.4.2.2. It turned out to be a small change in the message time outs. I have a fix for this ready, but I am just finishing the next release and so my code is all intermixed with incomplete features at the moment. I hope to have the new version released in the next couple of days.

I have 03 1.8t ecu from an A4, Flashed it many times with galleto 1260 in boot mode, but wow it would be nice to leave the windshield wiper on the car while making revision!  It has a 29F800BB chip.  I'm getting some communication and timing sync, but it doesn't get past security.  I'm currently using a KII USB Ross Tech cable.  Curious if the cable is my issue or something else?  -Vista, Very fast Laptop, Good Voltage, Virus protections all disabled etc.  I also don't seem to be generating a log file?

When I attempt Read Info:

Reading ECU Info.
Switching to KWP2000 session
Connection attempt number 1.
Successfully sent slow init.
Connecting...
Connected
Starting diagnostic session.
Failed to start diagnostic session.
Disconnecting...
Reading ECU Info Failed.
Disconnected

Attempt to read Flash:

Reading ECU Flash Memory.
Disabling Windows sleep mode.
Connection attempt number 1.
Successfully sent slow init.
Connecting...
Connected
Starting diagnostic session.
Successfully started diagnostic sesion, but ECU reports security access required.
Negotiating communication timings.
Reading current communication timings.
Reading communication timing limits.
Requesting communication at timing limits.
Successfully changed to new commumication timings.
Requesting security access.
Received unknown message during security negotiation. Security negotiation failed.
Disconnecting...
Restoring Windows sleep mode.
Reading ECU Flash Memory Failed.
Disconnected




Thanks, -Dave

I really need the log file to figure out what is going wrong. If you are running version 1.4.2.2 there is a "log file" menu entry just below the NefMoto logo in the flashing program. Clicking on that menu item should let you open the log file.

Ah.. there it is, I was thinking the path to the log file would appear in the log file bar, similarly to the paths in the bars beneath it.

Here's the file, Looks like it can't negotiate security?
https://docs.google.com/document/edit?id=1CWCt27BzA1tGiP19quIyYzyawdUL5311ddrGunRRaEA&hl=en&authkey=CNuWnNkJ

Thanks for the help, -Dave

No access to any other cars sadly, even If i had I think they would be reluctant to connect!

You say your software connects initially via KWP1281, does it then switch to 2000?  The log says "switching to KWP2000" - does this mean it has succesfully done its thing in KWP1281?  This would make sense If it only supports KWP1281?  Also, as it's a 512KB flash, I think it's a 29F400 chip rather than 800.

Rick

I have posted a new version of the NefMoto Flasher: http://www.nefariousmotorsports.com/forum/index.php?topic=186.0

Now has support for reading and clearing error codes, as well as a lot of communication bug fixes. Also, reading and writing are about 10 to 15 percent faster. :D

I haven't managed to add support for fast init yet. Release after this one will have support for fast init, and allow you to stay connected between operations. After that I will be adding support for the final version of back door reading to bypass tuner protection.

Hi Dave, sorry for the slow reply. Your ECU appears to require the security login before starting the programming session, while every other ECU requires it after starting the programming session. I will try to support this in a future version.