NefMoto

Attached is a little utility that will recalculate checksums and create output ready to flash bin file. Thank all Setzi to make this possible with his description of how it works.

Usage:

Checksum85040.exe file.in file.out


Enjoy.

nice nice. 

Julex,
   Does your utility use (in part) Setzi's Checksum Checker?  I ran your utility on a few .BIN's (which I pulled with Argdub's ME7_95040) and I didn't get any errors; it produced the output .BIN no problem.    However when I run Setzi's Checksum Checker on the same .BIN I get the following:

ME7Check: binary file test.bin has not correct length (is 0x200 bytes long, 0x80000 or 0x100000 bytes expected)

 ??? I believe (I haven't personally used it) Setzi's is for the main FLASH EEPROM (500kb-1MB)...this is for the serial EEPROM ST 95040 chip.

Ok, that makes sense if true.  I get my terms mixed up because the "main flash" is also a EEPROM technically.  I have a 95080 on my ECM so it has twice the capacity of the 95040.  I imagine Audi did this because the 95040 went obsolete. So far it doesn't seem to have caused me any problems.

I believe I saw somewhere, sometime, a description of checksum calculation for main ROM. I will research and see if I can whip out a calculator for it. I will take donations in beer :)

Cheers.

cool, I'm still trying to follow Setzi's text document describing the EEPROM checksum math. Don't think I'll ever want to attempt to do it manually for the main ROM!

Another winning contribution by Julex. Nice.

This is a great tool, but I have just always used windows calculator and the fact the checksum for each line is just FFFF - 1 for each line down from row 2. Ie to calculate the check sum in row 1X just add the totals bar the last 2 ,subtract from FFFF to give the checksum value for these last 2 values lo/hi.

In the case of Immo removal where you change the bits from 01 to 02 you just need to subtract 1 from the checksum value.

But if you struggle with that this looks a good tool. Thumbs up

Thanks!

I wrote this for people who want to retain their immo functionality and be able to use third party ECUs. One could just copy EEPROM content from one ecu to another, granted, but what if somebody has a dead ECU and they need used ECU which will have different immo data on it or none at all?

I am such a case. My original ECU died a long time ago right after I moved to m-box tune on my allroad. I am without a valid EEPROM for my key/cluster combo. Only way to go back to original allroad programming is to hijack another ECU, flash allroad tune, read off EEPROM  and copy/paste immo ID into EEPROM file. Then just run this program and it will output valid EEPROM file which one can immediately flash back without doing a lot of manual math jugling.

Limited clientele, I know, but I am sure it will be a life saver for some.

I've been thinking about how to activate the immobilizer in a B5 (as some around the world had it).  Any idea on how to source a chip for the keychain that one could potentially pair with an activated EEPROM/cluster?

I am certainly not one to pass any comment as I am sure that in the future I will need this program :-) I think it is a very good and valuable tool to have and I personally appreciate anything like this that makes my life easier or gets me out of a fix.

It gets my vote and sorry if you thought I was complaining which I certainly had no intention of.

Awesome! thanks.

Handy tool, helped a lot!  8)

Nice work!
Does this mean that I can change my SKC in byte $032 $033 and run it in this program, and then flash that file back into the 95040?

Is there a Checker (not a Fixer like this great tool) for 95040 dumps that i can use prior to this?
I tried setzis ME7Check but like user SteveAR stated before is wont work here.

hello!
can somenone help me how exactly to use this program?
if i start the program i get fault window.

I have Win XP prof.

many thanks

run it in dos

start -> run as -> cmd

i try to run it in dos already, same fault window..

what fault?

friend of mine did some quick and dirty gui version out of the sourcecode

unfortunately german..
(not able to initialize program. click "ok" to close program)

thanks @aef, great help!
(framework was missing)

Thanks for this excellent program!

Hello.
I have some mistake like s-company.

How you solved problem?
Thanks.

Thx for this great program!

I have remove immo from this file, but the car doesn't start, my checksum is it really ok?
thx

http://www.microsoft.com/en-us/download/details.aspx?id=17851

Can this tool be used to take a bin which is know to be an IMMO-rom and write over NON-IMMO-code for a non-IMMO-car?  How can that be done if not?

I'm not sure I understand your question, but if you are talking about the K box issue, can't you just immo defeat the K box EEPROM binary and use that?

Yes but what needs to be done?  Just take binary and run it through this routine?  If not where is the IMMO-defeat routine?

My car doesn't have IMMO and I am either feeling stupid today or not getting a straight answer from any of the threads I'm reading.
Don't really care which, just want to figure out how to take a bin and go:

cmd:  ImmoDefeatScript not_working_rs4.bin    and have the output be   working_rs4.bin for a car with no IMMO.

Take your dump, find two "05 01 01" hex strings at offsets 0010h and 0020h, change both hex strings manually to 05 01 02 (01 = Immo ON, 02 = Immo OFF), save the file. Then run the checksum calculator on it. On output you will get Immo OFF file with recalculated checksums.

I've been looking at a 95040 dump (from an S4 T-Box, used ECU) and the 0x12 and 0x22 values are 04. Not sure what this means - any ideas?

Thanks...

Factory settings, before being coded.

On 1.8t ME7.5 Ecus you can read out Channel 91 with vagcom/VCDS to get the IMMO Status.

Maybe you wanna try this?

Output should be 0,1 or 4
0 is not set, new
1 is immo off
4 is immo adapted and working (stock)

OK - never knew there was such a value. This is odd though considering the T-Box ECU is from an S4 which I believe was a 2002 model, and I got the ECU from a junk yard implying that it came from a used car - just wondering why it would have factory settings in it...?


Thanks, but using VCDS on Ch 91 showed other stuff on my ECU (difference between ME7.1 and ME7.5?), but nevertheless, 4 then means immo is adapted. I must be missing something though because if the general way to remove immo in ME7.1 would be to change the 01's to 02's, why is the value in my 95040 04 and not 01?  ???

I'm really confused now... Unless T-Box cars use the values 0,1 and 4 and the M-Box cars use 1 and 2? Can someone confirm this? This being the case I guess I would need to change the 04 to 01?

Could it be that this ECU is not stock and the previous owner of the car had it modified and this is the result?

Please dont mix the facts together...

The 0,1 and 4 in Channel 91 has nothing todo with the numbers in you hexeditor  ;)

For a moment you had me thinking there - but I am really getting 04 in the hex editor - here are the first 3 rows:

20 20 20 20 20 5A FF FF FF FF FF FF FF FF FF A5
05 01 04 00 4A 2B 00 00 00 00 69 C1 00 A5 B1 FD
05 01 04 00 4A 2B 00 00 00 00 69 C1 00 A5 B0 FD

What are you trying to do?

None of the cars you're referring to are equipped with IMMO.

I was under the impression T-box cars had IMMO...? I have installed this T-box ECU in a B5 A4 2.8 Quattro, did a 2.7T engine swop (from an AR) and I have an S4 cluster (without IMMO) that I'm trying to get going. But the car won't start - just trying to rule out any IMMO issues. Point is I have 04 where I thought I should see 01 ???

8D0907551T?

Correct.

What is also quite strange is that the SKC (if I'm looking in the right place) is FFFFH, and converting that to decimal (5 digits) I was unable to log into the ECU - VCDS stalled for a bit and then lost comms with the ECU. And in the hex editor the VIN detail is also not there, only 58H in all the fields where I think the VIN should be.

OK, according to the S4Wiki TBox and MBox ECUs are interchangable so I guess if MBox didn't have IMMO then TBox should not have IMMO also - my mistake. So to confirm, no NA B5 S4s had IMMO? I just need to be clear so I can look for no-start issues elsewhere...

Julex,

Many thanks for posting the source-code to your tool.

I've taken the liberty of re-writing it (in C), I hope you don't mind. I've added quite a lot of extra diagnostics information so people using the tool can see exactly whats happening. It also won't write out a new file if the checksums where valid in the first place and it will inform you which checksums and how many it corrected. Since its pure C it requires no runtime C# environment so will work without any additional downloads.

All up on github (full BSD Open source license)

https://github.com/360trev/ME7_95040sum (https://github.com/360trev/ME7_95040sum)

Regards,

Trev.

Here's an example dump...
--

EEPROM 95040 Checksum calculator 1.01

þ Opening '95040.bin' file
þ Getting length of '95040.bin' file
þ Allocating buffer of 512 bytes
þ Reading file to buffer
þ Validating size correct 512=512
þ Closing file

        : 0-------------------1-------|----|
        : 0 1 2 3 4 5 6 7 8 9 0 1 2 3 |4 5 |
Block 00: 20202020205aff40863037303230[325a]      Z.@.07020 2Z Desc ff18, Checksum Skip
Block 01: 05010100cb280000000069c100a5[36fd] .....(....i... 6. Desc 0017, New Chksum [36fd] 
Block 02: 05010100cb280000000069c100a5[35fd] .....(....i... 5. Desc 0117, New Chksum [35fd] 
Block 03: 0401f3063611d83e6fea3a000100[0efc] ....6..>o.:... .. Desc 0207, New Chksum [efc] 
Block 04: 0401f3063611d83e6fea3a000100[0dfc] ....6..>o.:... .. Desc 0307, New Chksum [dfc] 
Block 05: 07027502010206001f04ad090700[92fe] ..u........... .. Desc 0437, New Chksum [92fe] 
Block 06: 00007d0df20d0000810301000000[ecfd] ..}........... .. Desc 0533, New Chksum [ecfd] 
Block 07: 0504007af800000500000a2d0000[42fe] ...z.......-.. B. Desc 06b7, New Chksum [42fe] 
Block 08: 0504007af800000500000a2d0000[42fe] ...z.......-.. B. Desc 06f7, New Chksum [42fe] 
Block 09: 0080808080000080008080ff0000[78fb] .............. x. Desc 07b3, New Chksum [78fb] 
Block 10: 0080808080000080008080ff0000[78fb] .............. x. Desc 07f3, New Chksum [78fb] 
Block 11: 0507000010544d42424c01000000[67fe] .....TMBBL.... g. Desc 08b7, New Chksum [67fe] 
Block 12: 0507000010544d42424c01000000[67fe] .....TMBBL.... g. Desc 08f7, New Chksum [67fe] 
Block 13: 3231553633383636373335325301[09fd] 21U638667352S. .. Desc 09b3, New Chksum [9fd] 
Block 14: 3231553633383636373335325301[09fd] 21U638667352S. .. Desc 09f3, New Chksum [9fd] 
Block 15: 4b5a375a30423134313435383101[e0fc] KZ7Z0B1414581. .. Desc 0ab3, New Chksum [e0fc] 
Block 16: 4b5a375a30423134313435383101[e0fc] KZ7Z0B1414581. .. Desc 0af3, New Chksum [e0fc] 
Block 17: 0000b3dcaa880000000000000000[1111] .............. .. Desc 0b32, Checksum Skip
Block 18: ffffffffffffffffffffffffffff[ffff] .............. .. Desc 0b10, Checksum Skip
Block 19: ffffffffffffffffffffffffffff[ffff] .............. .. Desc 0b10, Checksum Skip
Block 20: 0101202020202020202020202000[8afe] ..           . .. Desc 0b10, Checksum Skip
Block 21: 0107000000000000000000000000[e3ff] .............. .. Desc 0c37, New Chksum [e3ff] 
Block 22: 0000000000000000000000000000[eaff] .............. .. Desc 0d33, New Chksum [eaff] 
Block 23: 0000000000000000000000000000[e9ff] .............. .. Desc 0e33, New Chksum [e9ff] 
Block 24: 6d6d000000000000000000000000[0eff] mm............ .. Desc 0f33, New Chksum [eff] 
Block 25: 0000000000000000000000000000[e7ff] .............. .. Desc 1033, New Chksum [e7ff] 
Block 26: 0000000000000000000000000000[e6ff] .............. .. Desc 1133, New Chksum [e6ff] 
Block 27: 0000000000000000000000000000[e5ff] .............. .. Desc 1233, New Chksum [e5ff] 
Block 28: 0000000000000000000000000000[e4ff] .............. .. Desc 1235, New Chksum [e4ff] 
Block 29: 0000000000000000000000000000[e3ff] .............. .. Desc 1235, New Chksum [e3ff] 
Block 30: 0102000000000000000000000000[dfff] .............. .. Desc 13b7, New Chksum [dfff] 
Block 31: 0102000000000000000000000000[dfff] .............. .. Desc 13f7, New Chksum [dfff] 

No checksums where corrected, file is OK already, skipping save.

--

This utility rocks! I think I can start my car again tonight!

Downloaded this last night but it wont run??

Ran it from start > run > CMD > Checksum85040.exe and nothing

The program is in the same directory too...

What message did you get when it didn't run?

This iss hot Stuff, wonderful :D

Please post the output of the command. Not a screen shot, just copy/paste the CMD window text.

Hopefully I can get some help even though this thread is being brought back from the dead.
This is what i'm getting:
Microsoft Windows [Version 10.0.17763.292]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\User>C:\Users\User\Desktop\ME7.X_Correction-master\Checksum95040\Checksum95040.exe C:\Users\User\95040ge.bin C:\Users\User\95040HS.bin
EEPROM 95040 Checksum calculator 1.0


C:\Users\User>

All it does it name the tool and then quits or something. WTH?