Print Page - Polo GTI 9n3 CHECKSUM CHECK

Title: Polo GTI 9n3 CHECKSUM CHECK
Post by: armaan on January 26, 2020, 04:15:28 AM

Hi, Guys.

I humbly request you to please check if I have done my noob checksumming correctly.

I have tried to implement Setzi's Launch Control, no NLS

ECU: 06A906032TL

Attached is the Setzified file. Thanks in advance. ;D

Title: Re: Polo GTI 9n3 CHECKSUM CHECK
Post by: nyet on January 26, 2020, 10:11:48 AM

Why didn't you attach the output of me7sum?

In fact, why did you ignore the actual forum rules?

Quote from: nyet on February 28, 2013, 03:02:58 PM

If you have a ME7.1 or ME7.1.1 (and possibly ME7.5), please use me7sum instead of demanding someone else do it for you. That's plain rude.

Title: Re: Polo GTI 9n3 CHECKSUM CHECK
Post by: armaan on January 26, 2020, 12:26:56 PM

Hello Nyet, great work you have done with ME7Sum, its great, I have used it well for a bunch of other tunes.

Its just that I once used it checksum a file from an Audi A3 AUQ, which I had made using the php 2stepscript and it didnt work. So I assumed, at the time, that ME7Sum is only useful for as long as I dont use it for tunes where I have added hex lines.

I used MTX plugin ME7 (2002) for this reason.

But since this is my first time using the MTX plugin, I was asking if someone could check the file, as I didnt want to take risks with this ecu.

Will follow forums rules next time bro. Sorry

Title: Re: Polo GTI 9n3 CHECKSUM CHECK
Post by: nyet on January 26, 2020, 12:32:52 PM

Quote from: armaan on January 26, 2020, 12:26:56 PM

Its just that I once used it checksum a file from an Audi A3 AUQ, which I had made using the php 2stepscript and it didnt work. So I assumed, at the time, that ME7Sum is only useful for as long as I dont use it for tunes where I have added hex lines.

DO NOT DO THIS. Add your own hand written ASM. Do not trust in scripts. It has been explained over and over again why this is true.

Quote

I used MTX plugin ME7 (2002) for this reason.

You completely misconstrued why. The problem is the bad ASM floating around breaks the RSA checking, and the MTX plugin disables it.

One more time: Ditch that crap NLS/LC script junk.

Title: Re: Polo GTI 9n3 CHECKSUM CHECK
Post by: armaan on January 27, 2020, 02:21:12 PM

Thanks for the caution bro.
Deleted that script.

So if i add lines to the code as is done with setzis method (pdf), will me7sum work properly on it? Because it said that it corrected errors and file is ok.

I trust it with normal tunes but wasnt sure about with setzis.

Title: Re: Polo GTI 9n3 CHECKSUM CHECK
Post by: nyet on January 27, 2020, 02:43:48 PM

Quote from: armaan on January 27, 2020, 02:21:12 PM

The problem has nothing to do with uncorrected errors. It has to do with the ASM interfering with the actual RSA code.

Again, if you dont' know what that means you should be nowhere near any code that makes ASM changes.

Title: [RELOADED] Polo GTI 9n3 CHECKSUM UPDATE REQUEST
Post by: armaan on February 07, 2020, 11:22:56 AM

Hey all,

Following Nyet's advice from a previous post: (Thanks a lot btw @Nyet),
I have done the following steps to add LC/NLS to my Polo GTI 9n3. ECU: 06A906032TL 0040.

Code:

SpeedThreshold: 0x17EA0
LaunchRPM: 0x17EA2
IgnitionCutDuration: 0x17EA4
RPMThreshold: 0x17EA6
AccPedalThreshold: 0x17EA8
FTOMN 0x1A4DC

AB600 (This is where antilag function is) (becomes 8A 00 B6 when implementing the 'DA' part)
17E00 in my case is occupied, so using 17EA0 instead (being used for condition variables)
0x380BA2 (Taken from .ecu file, used for placing NLS counter)
0x00FD4E (b_kuppl hex address)
0x1000 (bitmask for b_kuppl, b_brems should have the same address but -2 for the bitmask, so 0x400, according to the document)



Used HxD editor

Final antilag function used (customized according to my ECU using ME7WIZZARD):

9A	27	13	C0	F2	F4	00	9C	D7	00	81	00	F2	F9	A0	7E
40	49	9D	0B	F2	F4	9E	F8	D7	00	81	00	F2	F9	A2	7E
40	49	FD	03	F7	8E	C5	8B	0D	2F	9A	27	29	C0	8A	27
22	A0	F2	F4	9E	F8	D7	00	81	00	F2	F9	A6	7E	40	49
FD	1A	C2	F4	BD	89	D7	00	81	00	C2	F9	A8	7E	40	49
FD	12	D7	00	38	00	F2	F4	A2	0B	D7	00	81	00	F2	F9
A4	7E	40	49	9D	11	F7	8E	C5	8B	08	41	D7	00	38	00
F7	F8	A2	0B	0D	09	D7	00	38	00	F6	8F	A2	0B	0D	04
D7	00	38	00	F6	8E	A2	0B	F3	F8	9F	89	DB	00	FF	FF

After that I used ME7Sum to update the checksums and this is the read out:

Code:

ME7Sum (v1.0.5) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'image.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for ECUID table...OK
 EPK         : '39/1/ME7.5/3/X505R//24C/SP24C91/270705/'
 Part Number : '06A906032TL '
 Engine ID   : '1.8l R4/5VT     '
 SW Version  : '0040'
 HW Number   : '0261208950'
 SW Number   : '1037378104'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @08038 Add=0x000106FF CalcAdd=0x000106FF  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01bf98 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @95b78-95bf8
           Modulus: @16a22-16aa2
          Exponent: @16aa2 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @169fe [32 bytes]:
 1) 0x00010002-0x00013FFE
 2) 0x00014252-0x00017F4E
 3) 0x00018192-0x0001FBDC
 4) 0x00026A00-0x0002FFFC
 EncrMD5: 65 80 59 89 5b ca 09 2e 68 41 74 da d3 af f3 35
 CalcMD5: 2a 34 7f 6f ef 34 63 c1 ed 77 8d d6 9b 44 a1 ce
 ** FIXED **

Step #4: Finding CRC table(s) ..
 Searching for CRC table(s)...OK
 CRC table(s) OK

Step #5: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 Main Checksums:
 1) 0x010002-0x013FFE CalcCSM: 0013974C
 2) 0x014252-0x017F4E CalcCSM: 0025F546
 3) 0x018192-0x01FBDC CalcCSM: 00440623
 4) 0x026A00-0x02FFFC CalcCSM: 00BFE050
 @8ffb6 CSM: 00BFD16A CalcCSM: 00BFE050 ** FIXED **

Step #6: ROMSYS Program Pages
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0xA19B73 CalcAdd=0xA19B73  ADD OK

Step #7: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @1fb72 [16 bytes]:
 1) 0x000000-0x00FBFF CalcChk: 48D09FE4
    0x00FC00-0x01FFFF CalcChk: 20D0C1BA CalcCRC: 08DD67B1 SKIPPED
 2) 0x020000-0x0FFFFF CalcChk: 2AE38CDE
 @fffe0 Chk: 2B11B637 CalcChk: 2AE38CDE ** FIXED **

Step #8: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK
 ..........
64) <1ffce>  0x0F4000-0x0F7FFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
65) <1ffde>  0x0F8000-0x0FBFFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
66) <1ffee>  0x0FC000-0x0FFFFF Chk: 1FFDE002 CalcChk: 1FFDE002 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

Step #9: Looking for rechecks ..
    <1fc6e>  0x01C000-0x01FFFF Chk: 062978B8 CalcChk: 062978B8 OK (recheck)

*** Found 70 checksums in image.bin

Attempting to output corrected firmware file 'out.bin'
├╛ Opening 'out.bin' file for writing
├╛ Writing to file
├╛ Validating size correct 1048576=1048576
├╛ All OK, closing file

*** DONE! 8/8 error(s) in image.bin corrected in out.bin! ***

Attached is my LC/NLS file & .ecu file.

Please let me know if the checksum is done correctly, and if I have implemented LC/NLS correctly.

Thanks in advance. :) :) :) :)

Title: Re: [RELOADED] Polo GTI 9n3 CHECKSUM UPDATE REQUEST
Post by: rogerius on February 07, 2020, 02:01:28 PM

I think you have at least a mistake at 0xAB68A, where 9F should be A0.

Title: Re: [RELOADED] Polo GTI 9n3 CHECKSUM UPDATE REQUEST
Post by: armaan on February 08, 2020, 12:15:38 PM

Quote from: rogerius on February 07, 2020, 02:01:28 PM

I think you have at least a mistake at 0xAB68A, where 9F should be A0.

Thanks a lot will have a look at that issue.

Which checksum program do you recommend I should use for my file.
Will ME7Sum work perfect? The log seems to be ok. But I just needed to know from your experience.

Title: Re: Polo GTI 9n3 CHECKSUM CHECK
Post by: nyet on February 10, 2020, 11:31:02 PM

Why would ME7Sum not work?

NefMoto

ECU Files => Checksum Update Requests => Topic started by: armaan on January 26, 2020, 04:15:28 AM