NefMoto

Technical => Reverse Engineering => Topic started by: faqirafaq on April 11, 2025, 05:33:16 PM



Title: 1.8t 20v 032GT ecu FTOMN/tsrlydn? Or anything closer to a definition file
Post by: faqirafaq on April 11, 2025, 05:33:16 PM
Hello there

Been working on my friends 032DN, which was a breeze. ME7L basically got me all the definitions, even found fully premade definition files from here (Thanks again to their authors :D)
But now I got my hands on a Seat Alhambra. A big ass 7-seater with the well known 1.8t 20v. Engine code is AWC and the full ECU id is: 06A906032GT. Weirdly enough the contents are different from the DN.

I've heard of people flashing other ecu files onto other ecus, this might be a way?
I'd prefer not to, if theres any sort of way that someone could guide me with this rare ME7.5.5 ecu.
Would be really cool if I could get a full ecu file to log with.

Thank you all :D


Title: Re: 1.8t 20v 032GT ecu FTOMN/tsrlydn? Or anything closer to a definition file
Post by: rogerius on April 17, 2025, 10:30:50 PM
0x380D6E                 tsrldyn
0x81A08A             FTOMN=05


Title: Re: 1.8t 20v 032GT ecu FTOMN/tsrlydn? Or anything closer to a definition file
Post by: faqirafaq on April 22, 2025, 02:45:35 PM
0x380D6E                 tsrldyn
0x81A08A             FTOMN=05

Oh wow, seems to be right.

Thank you :D

Is there any way you could tell me your secrets on how you found these?


Title: Re: 1.8t 20v 032GT ecu FTOMN/tsrlydn? Or anything closer to a definition file
Post by: rogerius on April 22, 2025, 10:54:07 PM
Oh wow, seems to be right.

Thank you :D

Is there any way you could tell me your secrets on how you found these?
No secrets!
I disassembled your file and then compared patterns/functions/references with the disassembly of something similar (i.e.my file 018DC).
This is extensively explained by numerous users in this forum section (and not only).


Title: Re: 1.8t 20v 032GT ecu FTOMN/tsrlydn? Or anything closer to a definition file
Post by: faqirafaq on April 23, 2025, 01:23:15 AM
No secrets!
I disassembled your file and then compared patterns/functions/references with the disassembly of something similar (i.e.my file 018DC).
This is extensively explained by numerous users in this forum section (and not only).

Oooh. Tried to search before for some other solutions to find them, but no luck.

Ill keep this is mind, already found eskonf this way myself.
Thank you again rogerius


Title: Re: 1.8t 20v 032GT ecu FTOMN/tsrlydn? Or anything closer to a definition file
Post by: faqirafaq on April 25, 2025, 12:17:30 PM
No secrets!
I disassembled your file and then compared patterns/functions/references with the disassembly of something similar (i.e.my file 018DC).
This is extensively explained by numerous users in this forum section (and not only).

Sorry to bother again...

Had really long nights of disassembling and trying to find patterns.
This means that I've found (almost) all the rom adresses that i need!

Theres just these annoying two..

My List:

0x815623 DNWEK
KFZW/2 ?
KFTVSA 0x81890B
KFTVSAKAT 0x819A90
KFZWOP/2 ?
KFZWMN 0x8139B0
CWSAWE 0x8159FA

Tried me7romtool, which couldn't find KFZW either :(

All of this has been fun, now its hopefully time to whip out WinOLS soon :D

EDIT: Upon further searching, I found 0x81588A for KFZWOP? Seems wrong that it adds close to 60 degrees of timing??? I want to believe that the KFZWOP is wrong.. :C


Title: Re: 1.8t 20v 032GT ecu FTOMN/tsrlydn? Or anything closer to a definition file
Post by: _nameless on April 25, 2025, 05:18:25 PM
kfzw/2 is at 0x01622B and 0x0162EB


Title: Re: 1.8t 20v 032GT ecu FTOMN/tsrlydn? Or anything closer to a definition file
Post by: faqirafaq on April 28, 2025, 01:35:32 PM
Sorry to bother again...

Had really long nights of disassembling and trying to find patterns.
This means that I've found (almost) all the rom adresses that i need!

Theres just these annoying two..

My List:

0x815623 DNWEK
KFZW/2 ?
KFTVSA 0x81890B
KFTVSAKAT 0x819A90
KFZWOP/2 ?
KFZWMN 0x8139B0
CWSAWE 0x8159FA

Tried me7romtool, which couldn't find KFZW either :(

All of this has been fun, now its hopefully time to whip out WinOLS soon :D

EDIT: Upon further searching, I found 0x81588A for KFZWOP? Seems wrong that it adds close to 60 degrees of timing??? I want to believe that the KFZWOP is wrong.. :C

So, thank you _nameless!
I created my pops and bangs on AC, flashed the car and the car ran weird. I believe that KFZWOP was wrong, been stuck on it all night.

I'm going to try my best, find the map and report back if I do. This has been a very fun (and stressful) experience. Finally got use of my uni disassembly skills.
:D

(If someone finds it before I do, I'd appriciate it. The signatures I've found from 032HN ecu doesn't match up with anything compared to the 032GT. IDA Pro thinks that the map has no xrefs at all?)


Title: Re: 1.8t 20v 032GT ecu FTOMN/tsrlydn? Or anything closer to a definition file
Post by: rogerius on April 29, 2025, 11:23:59 AM
KFZWOP2maptablestart_byte_815889