NefMoto

Long story short, I have a well built stage 3 car that's just a toy (I have other transportation), with a tune that's notorious for being poor.  It doesn't matter what fuel I run (we have 100 unleaded and 110 leaded at the pumps here).  You may have seen me post about this before because this car is a ping machine.  CF's are always below 8, but the car likes to ping at high RPM tip in and mid-range in second gear.  The NefMoto tool can't read the tune due to the tuner disabling the RequestUpload function, and I'm contemplating just starting fresh today and waving goodbye to a 5 year bad tuning saga.  After all my read attempts these past few days, the car lost my lemmiwinks tweaks which I had made to correct most of the issues.  Not a huge deal, but I think I've passed the point of irritation with this tune.  

My intentions were to start fresh, but read the existing rom as a fallback in case I am not successful in this endeavor.  I ordered a galletto setup for this, but I am impatient as the weather is cool here this weekend (In the 90's... last week it was 118 during the days and my garage didn't fall below 100 until about 2am)

I have one other option and that's swapping the smd 29F800BB with another that has my old GIAC-X flash.  Obviously this is somewhat risky, but would allow me to keep the old tune, and then overwrite the flash I don't care about.

So, my question is - should I wait, or should I take the plunge?  I have spent quite a bit of time reading up on getting a baseline tune established, and it seems many here have had good success.

Thoughts?  Flames?

Considering that many tuners do it that way, I don't think it is that risky. It depends on the tools you have and your experience. But you will need a programmer if you want to read it after it is removed.

I do have experience swapping smd's but there is always the risk of lifting a pad or damaging a trace.  I have sneezed before and ruined things... lol.

That is why I said experiance rather than skill. Getting skilled involves screwing up things.. lol

Being it a stage 3, you aren't running stock injectors nor maf, right?

Correct... I've got an 85mm hitachi maf, and 440's.  Which is obviously going to make getting the maf and injectors scaled properly a pain.  I don't have a stock hitachi housing, and who knows where the stock injectors are... I can't even find my spare ECU's at this point so I am assuming they are in the same missing box.

Oh boy.  So, I took the ECU out this morning and when I removed the eeprom, I noticed two of the pads were missing from the board.  I guess I'm not surprised since this board had had a few eeproms on it over the years.  

I melted down the glob of Lowmelt and found them.  I scraped the solder mask away from their traces, laid the pad down, hit it with some flux, and was able to solder the pad to the traces.

At this point I decided this was the last time this eeprom would be swapped, and since the whole point of this operation was to keep my old tune as a backup, I elected to install the old eeprom so I not only have a backup, but so that I can help Tony test his alternate read methods.

I successfully soldered the old eeprom back on, and it works, despite being ugly.  I also ordered some ChipQuik as it melts at 138 degrees instead of 300, so it should be much gentler on any future work.

But that means I need to either buy another ECU or try to figure out where the heck my spares are.


Edit:  On the up side, last night I figured out how to fix the checksum on the 2001.5 Audi S4 - 8D0907551M - 0261207143 - 0002.bin that tony posted, so as soon as I have a good flashable ECU, I will be in business.

I will see if I can put together a special release for you to test out the security bypass ECU reading. It will be a few days though.

I'm sorry, but doesn't boot mode completely bypass whatever security options the "tuner" might have set?

Why not just read it out in boot mode?

I need a cable... I ordered it but as you know most of that stuff takes about 300 days to show up from China :p

You can do it in boot mode of course. But removing the ECU from the car and pulling the boot pin low is a pain.

So I can use your software in boot mode?

Nope. Boot mode is a completely different protocol, and it requires opening up the ECU and applying a ground wire to the ECU circuit board.

I'm working on a test release for you Jason, to see if my back door reading method will work for you.

Ok, that's what I thought... but I just wanted to make sure so I didn't have to leave work early to go try it since the ECU is just hanging there :D

Tonight has been a good night.

I successfully read the current tune in boot mode.  I ended up soldering a little 3 pin Molex PC fan pin strip header to the ECU (with a little pigtail so I can extend it outside the housing if I want), and then made a little extension cord to plug into it with a switch so that I could boot mode from within the car.  Ghetto, but it works :D

I then threw together a baseline tune to account for my big maf and injectors, fired up the NefMoto flasher, and flashed the new ROM in about 2 minutes.

I turned the key... and she started and drove around the block!  So that means my checksumming works right!

I then read the file back out of the ECU, and compared it to the original - it was identical.  Yay!

I then flashed the old tune back, and the car started up.  I then tried to read that old tune, and couldn't, so now I know I successfully accomplished my "failsafe" objective.

Now, the dirty work lies ahead.  I have to hook the N75 back up (I'm running an MBC) so I can start working on properly scaling the maf/injectors.

I will still run the MBC once I start boost tuning, simply because the driveability is much improved with the MBC - it spools sooner and the car just *feels* better.

All in all, thanks for all your hard work Tony! 

Minor update:

My wideband is kaput so I am in the market for a new wideband.  Digging around in my garage I found a NIB stock hitachi MAF, so I will be swapping that in, along with my stock injectors, and then hopefully picking up a new wideband setup this week, so I can get some good baseline logs so that I can properly scale the big maf and then get the big injectors setup.  This way I am not tuning them in relation to each other, so my load should be pretty accurate.  I will also be swapping the sensor element over, so the electronics will be the same and I won't be comparing a new vs old sensor in an stock vs big housing.

I think I am going to tune off the N75 for now, and then replace it with the MBC, simply because the MBC dramatically improves spooling.  Hopefully I will have some results next week.

In case anybody here is interested, here is a picture of the pigtail arrangement so I can quickly throw the ECU into boot mode:

(http://gallery.trumpio.com/main.php?g2_view=core.DownloadItem&g2_itemId=42841&g2_serialNumber=2)

This is my "development" ECU so when I am done with tuning I will replace it with an unmodified ECU.

Jason,

Any more pictures, instructions, details and whatnot on how to do this? Please excuse my newbyness, but we all got to start somewhere :)

I'm looking at an older post (from k0mpresd) on Audizine ( http://www.audizine.com/forum/showthread.php/243629-how-to-boot-mode-your-ecu ), but the image has been removed since...

I will get some pictures tonight.  It's pretty easy.

Thank you Jason!

...I'm aware that mostly all the information on tuning ECU's is available if I search for it, and I do, but it's scattered all over the internet. Without any structure, it's hard to retain what information is relevant, or not, for my application when reading on the subject. Take boot mode for example, I've seen this before, somewhere, on some forum. But I can't seem to find that useful page that I stumbled upon randomly before.

So I've been browsing all afternoon on the subject, and i guess what I'm trying to figure out is: Is it possible to install a switch that would put the ECU into boot mode - while still installed in the car? Enabling me to read/write via the diag port.

You can read/write via the diagnostic port using my free software.  ;)

As long as you aren't running a tuned file that has had reading disabled.

Check out my post here: http://nefariousmotorsports.com/forum/index.php?topic=170.0

I posted stock mbox files that have been tuned for an 85mm MAF and 60lb Siemens injectors. Hopefully this helps a bit.

Tony,

Unfortunatly that is the case.

In that case, you should just need to use boot mode once to read the ECU. After that you will only ever have to write to the ECU, and that won't require boot mode to do through the diagnostics port.

So logically, If I were to find a stock ECU file (with GIAC tune), I could modify it according to my mods and then flash it? Never having to read what I actually have on?

There is no reason to read the ECU unless you need to have a copy of what is on there.

Unable to read and able to write... I would've never thought.

Now I need to test this. I will have to wait for someone to post a worthy tuned file.

Thank you very much for your insight.

Nik

Very cool.   Thanks for this.  I swapped in the stock injectors and stock maf this weekend, then had a massive fuel leak, so I drank beer.

Nik, I just got home from work, but I'll see if I can get some pics in a bit.

Sorry for the poor quality... cell phone camera since the big camera is packed... but this should show everything you need to see.

(http://gallery.trumpio.com/main.php?g2_view=core.DownloadItem&g2_itemId=42846&g2_serialNumber=2)

Basically I have a harness that plugs into that pigtail, and has a switch on the other side.  When I close the circuit, I key on, wait 3 seconds, then open the circuit.  BAM! boot mode!

I don't think I'd recommend doing this on a permanent install because it obviously could introduce interference and cause issues.

This is awsome Jason!

Thanks again!

And then? Are you able to read the flash using Tony's software?

Nik

Nope. This just allows you to read using boot mode. My software doesn't support boot mode. You will need a tool like Galletto or KWP2000Plus.

I will hold my breath for the version of your software that will be able to read already tuned ECUs then,  ha :S

Really, the only reason to read your existing flash is to re-flash it if you are unsuccessful at tuning it yourself.  It's worth spending the $20 on a Galletto 1260 cable for that purpose.  It's also important to have one in case there is an issue with a flash operation failing (due to a voltage drop, etc) and your ECU turns into a brick.  You will need boot mode to recover from this.

Additionally, most tuners move/encrypt/obfuscate maps and inject additional code for map switching which will require more time and knowledge to reverse-engineer than simply starting with a stock file will require.  And even if you are able to understand what they've done, you'll probably be appalled at how terrible they are at what they do, and will end up starting over anyway.

I started modifying a tune from a professional tuner. I gave up and retuned everything myself because it was so bad. This was from a large well respected Audi S4 tuner in the US.

The NefMoto flashing software should be able to recover from almost all programming errors. But if something goes horribly wrong, you will need to use a tool that supports boot mode to fix it. No one has reported a case of this happening though.

doh...  I had an issue last weekend with the flash bombing out and I couldn't re-flash or read the ECU, so that's when I installed the boot mode mod...  If I had known that I'd have dumped the flash so you could look at it.

Ordered the Galetto... See you guys in a month or so! Haha.

If that happens again, please send me the log file. ;D

Don't feel bad... I ordered mine from what I thought was Texas... 2 weeks later it showed up from Mexico.  Apparently e-bay doesn't check what the sender puts in the actual location field.

As said using boot mode to make the initial 'read' and then write back in.

Open the tuned file read out of bootmode into HEX, search for the NOREAD parameters and change to 00 or FF. Then you can read and write using the NEFMOTO.

That won't work. The NOREAD ASCII strings visible in HEX only affect loading the file in WinOLS.

I'm not thinking straight apologies.

Search for 8bit 009 010 011 012 015 013 and change 015 to 000 to protect the file, and vice versa to unprotect file.

Yup, that should work to allow reading over the OBD port. This of course assumes that all ME7 ECUs have the same layout of KWP2000 message handling functions in their function table.

All the ones so far I have seen :)

Does it mean that I could write the ECU Flash by NefMoto software if The ECU flash been prevented uploading by a aftermark software?
Could I use NefMoto to check the flash before writing, then write the flash with a good bin file.

I fully anticipate not being able to flash off my Revo tune for the same reason so I'd also be interested in such a facility. I'm not at all keen to remove my ECU and mess about with it in boot mode due to it being a daily driver.

Doug

I am in the same boat i have to go pick up my galetto cable at the post office tomorrow, I want to make sure i have a know working file for my ecu before I start to mess around. i feel 80% confident that I can do the boot mode read. But if there is a software work around that would be great.

When using the Galleto 1260 to flashing/uploading the ECU software in car, what kind of protocol been used, KWP-2000, or other special protocol? I saw somebody to reflash a ECU of Honda Civic by Galleto 1260 in car from the web video, the ECU does not been removed outside. Is it in KWP-2000 protocol?

The NefMoto software can write to ECUs that have had reading locked out. It is fine to overwrite your ECU that has software that prevents reading, but doing so means that you lose the tune that is on your ECU.

The NefMoto software uses the OEM KWP2000 flashing protocol for maximum compatibility.

Galletto using boot mode for flashing which is a feature of the Siemens C167 processor. Boot mode is not a full protocol unto itself. Boot mode simply allow a program to be uploaded to the processor to be run and nothing more. Galletto will have its own boot mode program that it uploads to allow reading and writing the ECU flash memory.

I built a bootmode flashing cable according to the instruction of this forum last night. Then, I open the software sellection manual of Galletto 1260, but I can not find the model of my car, VW Sharan 1.8T 29F800BB Bootmode. Since the 29F800BB is popular in the ME7.5 cars, what kind of similar model could I sellect? Or I do not need to choose any model car, but choose the 29F800BB BootMode for VW/Audi is enough?

The f800 boot mode is enough, but make sure that your ecu has f800 chip first. Hit the ecu info button first.