NefMoto

Trying Me7Logger on a Volvo, late 01, early 02 S60 LPT auto. I put my ecu file in to create a template, it's a file I've not been able to find definitions for, although the odd maps are in the same place as in a defined older one I've got, I've managed to figure out a good few more just by spending time on all the different T5 auto and T5 manual newer and older bins too and actually got the car tuned up a bit so need some readings.

Found the page with the list of variables on it and was expecting to be able to find the alias and follow what I've got labelled and see if what I've done, is doing what I think it's doing. But I've pasted below what came up...

;
; Logging configuration template for file WinOLS (Volvo S60 (Original) - 359462).bin
;
; Template generated by ME7Info v1.20 (c) mki, 11/2010-03/2013.
; All automatically identified variables of the ecu are listed in this template.
;
; Make a copy of the template and uncomment the lines of variables which shall be logged .
; Optionally delete all unused lines and re-order the remaining lines as you like.
;

[Configuration]
ECUCharacteristics = WinOLS (Volvo S60 (Original) - 359462).ecu
SamplesPerSecond   = 20

[LogVariables]
;Name            [Alias]                             [; Comment]
wkra_0           ;{}                                 ; {last und drehzahlabh. Adaptionskennfeld f. wkr}
wkra_159         ;{}                                 ; {last und drehzahlabh. Adaptionskennfeld f. wkr}
zkrvf_0          ;{}                                 ; {Zähler, bestimmt die Frequenz der zyl.-individuellen Zündwinkelfrühverstellung}
zkrvf_1          ;{}                                 ; {Zähler, bestimmt die Frequenz der zyl.-individuellen Zündwinkelfrühverstellung}
zkrvf_2          ;{}                                 ; {Zähler, bestimmt die Frequenz der zyl.-individuellen Zündwinkelfrühverstellung}
zkrvf_3          ;{}                                 ; {Zähler, bestimmt die Frequenz der zyl.-individuellen Zündwinkelfrühverstellung}
zkrvf_4          ;{}                                 ; {Zähler, bestimmt die Frequenz der zyl.-individuellen Zündwinkelfrühverstellung}
zkrvf_5          ;{}                                 ; {Zähler, bestimmt die Frequenz der zyl.-individuellen Zündwinkelfrühverstellung}
zkrvf_6          ;{}                                 ; {Zähler, bestimmt die Frequenz der zyl.-individuellen Zündwinkelfrühverstellung}
zkrvf_7          ;{}                                 ; {Zähler, bestimmt die Frequenz der zyl.-individuellen Zündwinkelfrühverstellung}
zzylkr           ;{}                                 ; {Zylinderzähler der Klopfregelung}



Is the file just one of those awkward one's, or have I missed something ? Can I find and add the rest manually? Havent connected to the car yet, no point if I don't know what I'm looking at. Anyone logged these cars? What did you get?

Any advice would be much appreciated, I've attached my ori file if anybody fancies having a look and seeing if they get the same, I am working on a map pack for this layout but it's no where near complete. My car is now a HPT from what I've got so far but need to make sure before I can start going any further with it as I need to change hardware next then start scaling things I can't currently find...

You have missed that this here is a VAG focused forum.

Diagnostics, especially deep logging is always on manufactor specific protocol base.

VAG protocol in ME7 is completely different to Volvo ME7 protocol.


Furthermore the trick to find the addresses in VAG ME7 (finds label addresses in fixed diagnostic table) will not work on Volvo ME7 because this diagnostic table does not exist in any Volvo Bin.

What do you mean, this is a normal me 7 made by bosch like like any VAG car, it also has the standart odb2 requirments for logging(obviously) etc. If he wants to find more ram adresses for logging, AFAIK ( im not expert on this) he needs IDA or some way to trace them.

No, it is not.

It is a ME7, indeed.

But only generic OBD2 over CAN protocol is implemented in both (ISO15031).
With that you can only log the predefined labels in that standard (pids for Service 0x01 and Service 0x02).
Volvo supports about 15 fixed ones and you can not request address values.


For requesting addresses you would need implementation of ISO14230, especially SID 0x23 (readMemoryByAddress).
This protocol is NOT implemented in Volvo application layer. Volvo uses its own protocol there and no VAG approach will work.


For addresses you can use ida and search for your functions. Sure. In VAG you can find a table with about 500 fixed labels for all bins and corresponding addresses for that specific bin. Again that is NOT suitable in Volvo Bins.

I didn't miss that but thanks. I've read that some people here put some serious work into the Volvo's too and didn't think I'd be the first attempting this. Might just buy a dice unit then.

Hmm, interesting, so you are saying volvo me7  does not have the standart kwp2000 or kw1281 layer, but some propertiary one ?

ISO14230 has nothing to do with KWP

KWP is just a transport protocol standard.

Yes, proprietary protocol.

ISO14 230 is standartised as kwp2000 though.


I was thinking of a 5 cylinder volvo in the future but , this throws me off a little bit :/ now. VR5 is my new goal though, that is VAG and it has some support.

It uses kwp as a transport.

kwp does not specify things that use it as a transport protocol.

HTTP is TCP/IP. That doesn't mean that every device that supports TCP/IP supports HTTP

No way! :D

VIDA + DICE on it's own is still crap, logs very few params.

Looks like ME7Logger uses a table in vag ecus which is used for the Measurement Blocks and other stuff which is not available in other ME7s.

The Volvo ECU might support readMemoryByAddress, but ME7Logger uses readDataByLocalIdentifier and a hack to circumvent the limits of
dynamicallyDefineLocalIdentifier. It directly writes to the memory address of the dynamic identifier table as the limit checks are not done upon reading but when defining.

So ME7Logger should rather be called VAGLogger IMHO.

This stuff does not work on my alfa ecus too, thats why i am working on a (patched) mcmess logging method.
Alfa/Fiat ECUs dont support dynamicallyDefineLocalIdentifier, but readMemoryByAddress, which can be used for logging but is a bit slow for many variables.
writeMemoryByAddress is implemented in some but does not work as it always reports an invalid format no matter how hard i tried.
And no its not a needed securityAccess login, i patched out the check for this, not even all ecus have securityAccess implemented anyways.

An opensource drop-in replacement workalike to ME7Logger and Me7Info would be amazing, if it had the same capabilities.

ME7Logger would not be hard to do, i basically have the cfg and .ecu parsing running and a KWP2000 HM-2 layer implemented,
but i do not own any VAG car and most likely never will, the ddli hack only applies to them.

So looks like i will not get around to replicate this part of ME7Logger, but it should not be too hard to implement.

ME7Info is another story, but i guess 360trev`s code could be expanded into something as capable or even more capable.

ME7Info is also quite VAG specific, will not find anything more than the stuff posted above on non VAG ecus.

Not to give you more work, but ME7Logger will log an ECU sitting on the bench...

I've posted the Volvo DHA tool on here somewhere - take a look at it, you might find it useful. I cobbled together my own logging stuff for P1 and P2 D2 vehicles using information I gleaned from it. I had problems with my host application crashing and not being able to handle too many frames coming back, but it was also combined with the J2534 adapter crashing, so I suspect my J2534 adapter probably is shit. I didn't look any further as I didn't have time to look into the issues I was having any more and managed to get the information I needed, but will probably come back to it when I've another car I need to log.

My ME7.3.1 is on the bench too, winter is coming ;-)

What would be the cheapest ME7Logger compatible ecu to get in the EU ?
The audi v6 ones are like 100+€ too much for somehing i can not use.
Maybe some 1.8T ?

yea any ME7.5 1.8t older than 2002/3 should work.

@fluke9

I'm all in on helping get a fully working ME7Logger that works on non-vag roms... I've just done a bit of an upgrade to SAK tool... here's what it can do now... Uploading to github shortly


me7romtool.exe -romfile "2001.5 Audi S4 8D0907551M 0261207143.bin" -vsv
Ferrari 360 ME7.3 Rom Tool. *BETA TEST Last Built: Nov 19 2019 18:22:37 v1.71
by 360trev.  Needle lookup function borrowed from nyet (Thanks man!) from
the ME7sum tool development (see github).

..Now fixed and working on 64-bit hosts, Linux, Apple and Android devices ;)

├╛ Opening '2001.5 Audi S4 8D0907551M 0261207143(1).bin_corrected.bin' file
Succeded loading romfile #1.
Loaded Primary ROM in 1Mb Mode

-[ DPPx Setup Analysis ]-----------------------------------------------------------------

>>> Scanning for Main ROM DPPx setup #1 [to extract dpp0, dpp1, dpp2, dpp3 from rom]

main rom dppX byte sequence #1 found at offset=0xdc08.

dpp0: (seg: 0x0204 phy:0x00810000)
dpp1: (seg: 0x0205 phy:0x00814000)
dpp2: (seg: 0x00e0 phy:0x00380000) ram start address
dpp3: (seg: 0x0003 phy:0x0000c000) cpu registers

Note: dpp3 is always 3, otherwise accessing CPU register area not possible

-[ Basic Firmware information (Primary ROM) ]-------------------------------------------------------------------

>>> Scanning for ROM String Table Byte Sequence #1 [info]
found needle @ offset=0x20254
found table at offset=0001A8C8.

Idx=2   { 0261207143              } 0x18400 -> 0x1840a (10 bytes) : SSECUHN
Idx=4   { 1037360857              } 0x1840a -> 0x18414 (10 bytes) : SSECUSN
Idx=10  { 8D0907551M              } 0x110ed -> 0x110f9 (12 bytes) : DIF
Idx=11  { 0002                    } 0x1110d -> 0x11111 ( 4 bytes) : BRIF
Idx=19  { 2.7l V6/5VT             } 0x110f9 -> 0x11109 (16 bytes) : OTHERID
Idx=20  { ììBì                    } 0x82fb2 -> 0x82fb6 ( 4 bytes)

>>> Scanning for EPK information [info]

found needle at offset=0x2158.
EPK: @ 0x10007 -> 0x10060 (39 bytes) { /1/ME7.1/5/6005.01//22m/DstC2o/011200// }

>>> Scanning for ROM VerstellSystem Variables table...
found needle @ offset=0x236a2

Num of entries: 17
VSV        @ ROM:0x812c4e RAM:0x24b0c6e File-Offset:0x12c4e (seg=0x0204 val=0x2C4E)

 1) vszw             | 0x3809B2 | Ignition timing           | 0 KW  | Byte |-96..95.25 KW       | 0.75 KW   | ZUE
 2) vsfrk            | 0x3809AB | Mixture factor            | 1,0   | Byte | 0.75..1.25         | 0.001953  | ESGRU
 3) vsvw             | 0x3809B0 | Advancement angle         | 0 KW  | Byte | -768...762         | 6 KW      | ESVW
 4) vsns             | 0x3809AE | Nominal speed             | 0 RPM | Byte | 0..2550/min        | 10 RPM    | LLRNS
 5) vszwkr_0_A       | 0x3809B3 | Ignition timing firing 1  | 0     | Byte |-96..95.25 KW       | 0.75 KW   | KRRA
 6) vszwkr_1_A       | 0x3809B4 | Ignition timing firing 2  | 0     | Byte |-96..95.25 KW       | 0.75 KW   | KRRA
 7) vszwkr_2_A       | 0x3809B5 | Ignition timing firing 3  | 0     | Byte |-96..95.25 KW       | 0.75 KW   | KRRA
 8) vszwkr_3_A       | 0x3809B6 | Ignition timing firing 4  | 0     | Byte |-96..95.25 KW       | 0.75 KW   | KRRA
 9) vszwkr_4_A       | 0x3809B7 | Ignition timing firing 5  | 0     | Byte |-96..95.25 KW       | 0.75 KW   | KRRA
10) vszwkr_5_A       | 0x3809B8 | Ignition timing firing 6  | 0     | Byte |-96..95.25 KW       | 0.75 KW   | KRRA
11) vszwkr_6_A       | 0x3809B9 | Ignition timing firing 7  | 0     | Byte |-96..95.25 KW       | 0.75 KW   | KRRA
12) vszwkr_7_A       | 0x3809BA | Ignition timing firing 8  | 0     | Byte |-96..95.25 KW       | 0.75 KW   | KRRA
13) vske             | 0x3809AC | Knock detection threshold | 0     | Byte | -8..8              | 0,0627    | KRKE
14) vsdmr            | 0x3809A9 | Torque reserve            | 0 %   | Byte | 0..99.6%           | 0.3906%   | MDKOL
15) vsfpses          | 0x3809AA | Manifold air pressure     | 1     | Byte | 0..2               | 0,0078    | AES
16) vsrlmx           | 0x3809AF | max.rl for LDR            | 0%    | Byte | rel sb q0p75                   | LDRLMX  ** Note: This is a SY_Turbo=true Application**
17) vsldtv           | 0x3809AD | TV LDR for appl. control  | 0%    | Byte | tv ub q0p64                    | LDTVMA  ** Note: This is a SY_Turbo=true Application**


I can now add new variables to the VSV table and extend the table length too, all automatically...

... and use it as a basic command line disassembler...


me7romtool.exe -romfile "2001.5 Audi S4 8D0907551M 0261207143(1).bin_corrected.bin" -d 0x236a2
Ferrari 360 ME7.3 Rom Tool. *BETA TEST Last Built: Nov 19 2019 18:22:37 v1.71
by 360trev.  Needle lookup function borrowed from nyet (Thanks man!) from
the ME7sum tool development (see github).

..Now fixed and working on 64-bit hosts, Linux, Apple and Android devices ;)

Dissassemble offset: 145058 (0x236A2)

├╛ Opening '2001.5 Audi S4 8D0907551M 0261207143(1).bin_corrected.bin' file
Succeded loading romfile #1.
Loaded Primary ROM in 1Mb Mode


0x000236A2: (+0  )  D7 50 06 02                  extp     #0206h, #2
0x000236A6: (+4  )  F4 8C 2C 31                  movb     r14, [r12+312Ch]
0x000236AA: (+8  )  CC 00                        nop
0x000236AC: (+10 )  F0 5C                        mov      r5, r12
0x000236AE: (+12 )  5C 15                        shl      r5, #1
0x000236B0: (+14 )  D4 25 4E 2C                  mov      r2, [r5+2C4Eh]
0x000236B4: (+18 )  B9 82                        movb     [r2], r14
0x000236B6: (+20 )  08 C1                        add      r12, #1
0x000236B8: (+22 )  46 FC 11 00                  cmp      r12, #0011h
0x000236BC: (+26 )  8D F2                        jmpr     cc_C, loc_238A2
; ------------------------------------------------------------------------------

0x000236BE: (+28 )  DB 00                        rets
; ------------------------------------------------------------------------------

0x000236C0: (+30 )  C2 F4 7C E0                  movbz    r4, byte_E07C
0x000236C4: (+34 )  66 F4 F0 00                  and      r4, #00F0h
0x000236C8: (+38 )  46 F4 10 00                  cmp      r4, #0010h
0x000236CC: (+42 )  3D 02                        jmpr     cc_NZ, loc_236D2
; ------------------------------------------------------------------------------

0x000236CE: (+44 )  FF 07                        bset     MDL
0x000236D0: (+46 )  DB 00                        rets
; ------------------------------------------------------------------------------

0x000236D2: (+48 )  E1 08                        movb     r14, #0
0x000236D4: (+50 )  4A 07 F4 F0                  bmov     word_FEE8.0, word_FD0E.15
0x000236D8: (+54 )  49 81                        cmpb     r14, #1
0x000236DA: (+56 )  3D 02                        jmpr     cc_NZ, loc_236E0
; ------------------------------------------------------------------------------

0x000236DC: (+58 )  DA 82 9E 36                  calls    82h, loc_2369E
; ------------------------------------------------------------------------------

***

In this example using the -d option with address to start from (and optional length).

I'm just adding support for loading a definition file so it can automatically substitute known variable addresses and functions just like IDA does. This means you can literally use it as a poor mans IDA then ;)