NefMoto

Is there a trick to adding extra maps to unused FFed ares in ME7.11? Although maps are not as yet used in the code and I have turned off crc checks - 2 places in code and one in eeprom, the ecu crashes and get the flashing lights in the dash.

No there isn't. And if you just modify a random unused area of the flash then this does not cause a crash, your problem is elsewhere.

Did you modify the code?
I've got the same condition once with st10, spending tons of time to investigate crcs and so on and finally came up to incorrectly jmpr offset that I modify in original code.

What you Consider empty might not be empty or even exist. As fknbrkn said this can be a jump with the wrong offset.It might be a good idea to check the structure and the mapping of the areas you are working on.Easy way to check is to put your code without the jump or the call.


When i was working on my ST10 stuff i was using MPC for extra functions and storing the variables to Flash.

So.. on ST10 specially on 32CE like you are working on, the 8F1600+ area is free, personally put stuff there without issues.

But if you modified some code on MPC according to IDA you have to be very careful if you are using a KTAG read of the MPC, becuase it will be missing the 10000 offset(area rather) and your calls / code location wont match up.
so you need to put 10000 display offset in Winols, so that everything after the first 32kb(0-8000h) matches up adress wise.
It's kinda retarded, even if you have a full padded MPC and everything according to memory mapping Winols ignored the padding and shows wrong adresses/offset, if you get what I mean.

I've been testing the problem on the bench now, using vcds to communicate with the ECU as a check.

ECU is all back to stock except for the checksum off mods mentioned here

 http://nefariousmotorsports.com/forum/index.php?;topic=10926.0.

These mods have worked well so far, had no problem with either patched code in the mpc or modded maps, but with big modded chunks something isnt right.

I edit the bin directly with hexedit and upload it with galletto. If I copy some random maps and paste them on the free FF area after the last map at 8FEFD0 (also gave 8F1600 a go from above) , the ECU still boots and communicates via kwp2000, but VCDS cant get any info from it. No VAG number, no Component ID etc.
No fault codes show up either.
My logger also connects and disconnects straight away.
Its as if some part of the stock code is checking that area and partially crashes but the kwp2000 part still works??  A small amount of mod is tolerated but many bytes screw it up.
I will get rid of the checksum patches next and see if the same happens.....

What you are describing here is basically an active checksum doing its job.

+1

Thanks for all the suggestion, they made me look carefully for a mistake. I put everything back to stock and through trial and error found that while copying and pasting, somehow, the very end of the files that gave problems had a few bytes altered. Probably by accident, although I can't figure out how. In any case, the very last two bytes need to be A5 A5. I thought they were a checksum for the block, which changed when I added the extra maps, but they are not. A5A5 is  hard coded in the mpc and partially crashes the ecu if it doesn't find A5 A5 in the very last two bytes of the flash.

I may have missed something, but verifying even a 32-bit checksum takes time. So I believe that even with a bad checksum the ECU will work for a while.
If you are not changing CRC area everything will be fine for a couple of minutes.

Reset occurs for many reasons and usually it's a bad program code.

You are confusing the behavior of rsa signatures and normal crc32 checksums on me7 based ecus.

No, I'm talking about normal crc32. I tested it on MED17 and it takes a while for the ECU to detect the incorrect CRC.

You may have not read my last post entirely. It was due to some sort of additional check by the ecu of the very last two bytes of the flash. I accidentally overwrote one of them. These bytes are not part of the usual checksum that winols changes, they never change.