NefMoto

Hello all,

This is my first post. First of all, thanks for making this forum what it is. Your commitment to making this community grow and helping people out is very admirable.

I'll try to make this short. I appreciate your attention.

Summary of what I have and some context:

• I have an 03 1.8t VW Jetta, has some minor mods. KN air Filter to the MAF housing, Bronze Clutch, Forge 008 DV, N249, SAI,Brake Booster Pump delete, 3 inch downpipe to a 2.5 inch catless exhaust with magnaflow muffler. In the next days I'll delete the PCV and run a catch can.
• It has an aftermarket "stage 2" tune in it.
• The car feel good and pulls hard but has terrible MPG. 190 miles per tank of 94 octane gas, with moderate city driving. All maintenance is in check. Makes me think it has a bad tune. It was put in by the pre-previous owner. I don't know anything about him.

This is what I want / wanted to do:

• Run a stock tune for a full tank to see how much of a difference I notice in the MPG and on power.
• If possible Read the stage 2 file in the ECU to try and investigate it.
• Create my own "Stage 1" or "1.5" bin based on that file, so that has similar power but is a bit less "turned up". Easier on the turbo and the MPG.

Summary of what I've got so far:

• Got an FTDI, Galletto and a blue CH340 cable.
• Got an Aliexpress bench harness and a 12v power supply.
• Got a spare ME7.5 ECU
• Spent hours reading this forum mostly.

My first obstacle was that nefmoto wasn't able to read the flash, I got the "Request upload may have been disabled by aftermarket engine software."

Obviously…

Went back to reading.

This is what I've accomplished so far:

• Learned bootmode and all that.
• Managed to IMMO off the spare ECU I got.
• Flashed a stock 06A906032HS bin into the spare ECU (I did verify checksum)
• Installed that ECU into the car, and it runs! Of course it has some codes, but it runs great.
• I managed to read the stage 2 bin using galletto and boot mode. So I have the stage 2 bin file.

Worth mentioning:

Right now the car has the spare ECU installed with the stock tune, I've been running it like that for some days, haven't been able to really tell if the MPG is better, the weather is terrible and I haven't had a chance to go on a road trip. Maybe next weekend I'll be able to.

With the stock tune, the codes I have were: SAI (N112 Open circuit), N249 Open circuit, and then later evap system large leak detected came on.

That last one really caught my attention. Maybe that's why I was getting such sh*tty MPG? An EVAP leak?

I investigated and decided to delete EVAP, since where I'm at, it's not needed to pass emissions.

In that process I found out that the system was like half deleted, some weird stuff was done there. I proceeded to remove the lines, the valve, and cap off the vacuum ports. Car runs great. Now I get the EVAP N80 open ciurcuit, as expected.

We'll see if that plus the stock tune helps the MPG.

I find it crazy that I had to run a stock tune to even notice that something might be wrong with the evap system. Stage 2 tune has all that turned off.


Now this is the most interesting part!

I've been looking into the stage 2 bin, comparing it to the stock bin. And goddamn, there's a lot of stuff that was changed. It's pretty crazy. Fair amount more than what I saw in the community Stage 1 topic.

I'm using Tuner Pro and this definition map pack: http://nefariousmotorsports.com/forum/index.php?topic=4936.0

I add the stock bin and the stage 2 bin, use the "difference tool" and have noticed a lot changes.

That XDF has a large number of definitions! And still, some of the values changed in the stage2 bin are not defined there!

The map addresses do match, it looks fine. Doesn't seem to be scrambled like some aftermarket tunes do as I've read around here. They just tweaked a bunch of stuff.

First thing I noticed is that the Launch Control methods in the wiki, were not used in this bin. The maps for Soft and hard limiters explained there are not touched. They used a different method. The tune has launch control at 3500 RPM. Might be ignition cut? It sounds like loud gunshots when you hit it.

Side note: When I read the EEPROM from the ECU with the stage 2 tune to do the immo off on the spare, guess what I noticed! It has IMMO ON! But the key doesn't have the little immo chip in it. Somehow the thing was running perfectly fine, with IMMO on EEPROM and no immo chip in the key! Some crazy magic was done to that bin.

So here's what I have in mind:

Are any of you high level members interested in investigating what was done to this bin to add more info to the wiki? The Immo method, the launch control, the tables that are tweaked.. etc

I'm working on getting the name of all the maps that were changed vs the stock, potentially to what values roughly they were changed to. I'm thinking this will help a lot of people build their bins.

Once I have that, hopefully you can share some guidance on what to add to my stage 1.5 project, and what can I leave stock. Basically I want to simplify what was done there, and create a less aggressive bin I can run and daily.

I can start a new thread to start looking into the maps.

What do you think?

Cheers

A lot of files may have user tags no read markers AL NLS script and changes which are not defined in most XDFs hence when comparing it doesn't have a definition attached. Your better of comparing in a hex editor and noting the address and go from there

Scripts inside the bin? How does that work?

I've been doing exactly that as well, comparing the 2 hex with beyond compare. I see some blank spaces in the stock file, which are filled with FF the tuned file for example. Some are empty on the stock and have different values on the tuned. Similar to what was done with the tag.

Does someone know which or what is the method used to block reading via obd? is it part of the tag? Or is it scrambling values on other addresses? There's a bit of everything in this bin.

I have all the defined maps that were changed in the tuned bin, written down on a note. Some have descriptions, the most common ones. Some I have no idea what they are. Some of those I've googled and found something, some others, nothing at all.

I've counted 81 defined maps were changed. Undefined, I see around 20. Without counting the read tag. Not sure if its worth it to post all that.

My thoughts are that I've read so many discussions in here about how to change KFMIRL, KFMIZUFIL, KFMIZUOF, KFZW etc.... and I see lots of mixed information, lots of failed attempts resulting in bad response from the car, the info I have could help people avoid that trouble.

I guess my initial post was a bit to long, and no one is really interested in breaking down a tuned file to learn something from it.

As a side note, I've been driving with the stock map, and the mpg was slightly better, not really by much. The power is also significantly lower. Then I noticed I was running in open loop mode, because of the SAI, EVAP and N249 codes. I properly coded them out, fixed checksum, flashed, and now the DTCs are gone. I also disabled cat heating, and cold starts sound and feel great now. That was my first tune and flash. I'm happy I was successful with that. I still have to put some fresh gas in the car to see if it makes a big difference when running in closed loop, on stock fueling, timing and boost. I'll monitor the fuel trims. We'll see.


 

Software patches which add or change the factory functionality. These often add new tables or change references to existing ones in such a way that standard definitions are no longer useful.


Lots of ways to do this. Code patches to the diagnostic handlers (or just remove the RequestUpload one, like the Nef message says...), changing the seed/key constants, changing the table lookup system and altering the map layout, crappy riser board chip interceptors, so many different methods were invented over the years for these.

My big advice for you with this question and the last one is this: you need to start thinking of the binary as both code and data, not just data.


Are some of these checksums?


This is discussed at length in this forum and on the wiki. If you find the current information confusing, read the diagrams in the FR and fix up the documentation. Stealing a professional tuner's changes is pointless. They're just people too and are often either the people posting in those threads or even more incompetent. You risk getting led astray by garbage in garbage out by trying to infer what random tunes are doing even more than you do by reading the forum.


These ECUs are ancient and have been reverse engineered to death. The information is all out there. The FR defines the factory control strategies exhaustively. For most people, there's not much to learn from a commercial tune.

That's why the advice is posted everywhere on this forum over and over: start from scratch, read the wiki, learn the control strategy, and make a tune.

Not really. To mirror dirb's post: all of these ancient bins are of limited use. They were hacked together by people who did not have the resources and information readily available today, such that today, anyone smart enough to figure out what these old hacks do could most certainly do a better job themselves and work from first principles.

MIZUFIL/MIZUOF, wish that shit would be deleted entirely, as there is never a reason to change these maps.
If someone changed them they don't know what they are doing.

Wow, thanks for the replies.

d3irb


I'm not sure. How do the checksums look in these bins?

Here are some of the undefined maps I've seen:

C7000 to C708D, are empty on stock, but on tuned they have something.
A7000 to A70FF, are empty on stock, but  on tuned they have something.

A1CCC to A1CCF changed, not defined.
90B4E to 90B51 changed, not defined.
90B54 to 90B57 changed, not defined.
90B5A to 90B5D changed, not defined.
8FC3C to 8FC3E changed, not defined.
1F18C to 1F1FE all FF on tuned. Empty on stock

There are about 12 more that I haven't written down. Not sure if I should even focus on that...

FF000 to FF07F, Read tag
FF130 to FF17F, Read tag

I'm just curious about the undefined maps and if there could be script values in those addresses, trying to understand if those blank spaces in the stock bin were used for something. But I don't care that much about it at this point after what you all just said. I might as well not even look at that tune bin moving forward

I added the stock tune in case you want to check out the addresses I'm talking about and maybe see if they look like checksum/script/anti read method to you.


I get your point. I actually followed the info here and on the wiki for the sai/n249/n80 delete and the cat heating disable, and the car is idling better than it did with the tune. The tune didn't touch FKHABMN, CLATEVE, and had CWKONABG set to 1, which if I'm not wrong means cat is still installed. I zeroed all that out and it feels better. First clue that the tune isn't great lol... I was a bit overwhelmed and maybe impressed by the amount of changed maps when I fist opened it.

nyet


The tag in the tune says 2012, I totally get your point. Seems like a lot has been learned since then.

Thanks for reading my posts!

prj

Another legend replying here


haha sounds like you would puke if you see this bin then lol

They changed those tables entirely all to FF in the tune

KFMIZUFIL - Allowed indicated torque to torque limit before filter - all to FF
KFMIZUOF - Max permitted indicated set torque for torque limitation - all to FF

I guess they were trying to avoid level 1 torque intervention, which is a crappy thing to do based on the info.
Some other maps are also changed to all FF, like these:

KFVPDKLD - Max pressure ratio (throttle plate) for Idra Diag - all to FF
KFLDHBN - LDP altitud limitation, all to FF
KFDLULS - Delta pressure for overboost protection-  all to FF

Exactly what the wiki says no to do. lol

I'm glad I made this post and got your replies, I get it now. This tune is garbage. Not even remotely close to deserve any attention from anyone here. I'll make my stage 1 file entirely with the help of the wiki and the this forum.

I'll also delete the name of the tuner from my original post, just to keep this neutral.

Cheers