NefMoto

I edited the program a bit to clean up the language. I was tired of the terrible mixed english, and figured it would not only make me cringe less, but prevent new users from getting confused. I concentrated mainly on the me7, but streamlined everything. Do with it as you wish.

(http://i49.tinypic.com/2n7qv0m.jpg)


Since this has been stickied, I'll add a few more points.

You don't need a Galletto cable to run this software. What you do need is to edit the executable to match the serial number of your FTDI based cable. This is very easy to do. The serial is stored at offset 0x249E90 in the galletto executable (shown below). As it is, that serial is 47514789. You need it to match the serial stored in your flashing cable.

(http://i.imgur.com/uvgP09g.png)

The software shown above is attached at the bottom of this post.

For those of you that are handy with m-prog you can always change the serial in your cable to match the program, but honestly this is just as easy.

Just tried this method and my cable serial is A100enyw ... how to put this letters in?

Look up the ASCII codes and use those.

I'm also interested in finding out more about this. How do I find the serial on my cable? And how exactly do I change the serial? I tried messing around with the .exe but it doesn't make sense to me. Can someone school me on this?


P.S. Thanks for the Proper English Galletto update.

Alright, I'll break it down a bit further.

Download M-prog. I've attached it here.

Unzip/install the program. Open it up, and in the TOOLS bar, select READ AND PARSE.

(http://i46.tinypic.com/s2tc8m.jpg)

Save that number. From here you can either: Edit the galletto executable with a hex editor (attached in the first post), browsing to the offset listed above and enter YOUR serial number into the program, or if hex editing isn't your thing, you can program your cable with the bundled galletto serial number. Those steps are listed below.

Select the FILE menu, and NEW.

Select your device type. FT232R.

(http://i49.tinypic.com/2ahdvfr.jpg)

Once you do this, check the box titled "select serial number". Enter the serial number shown above.

(http://i47.tinypic.com/2qc4bwz.jpg)

Finally, hit SAVE TEMPLATE AS (it's the small disc ICON in the menu), and specify the template name. Once it's been saved you can select PROGRAM.

(http://i48.tinypic.com/w03qkh.jpg)

Your cable now has the serial number of all galletto bundled cables, and will work when plugged in. Changing the serial number in your cable will NOT invalidate your nefmoto premium license, HOWEVER other licensing systems may be affected. Be sure to save your original cable details PRIOR to reflashing your cable!!!

OK. When I do the first step (Read and Parse) I get an error. Read EEPROM fail - device 0. I'm guessing it's not reading my cable? I tried it with the cable powered by the OBD2 port - still the same.

Are you sure your cable is FTDI equipped?

I'm not sure. It's a blue ebay cable that I use with VAG COM and Nefmoto.

Uninstall the VCP drivers using just the usb-serial converter, and retry connecting with m-prog. Try READING first, then Read and parse.

If it's still a no-go, open the cable and make sure it's ftdi.

Uninstalled the driver. When I read only
 
Read EEPROM successful Device 0
0000 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF   .. .. .. .. .. .. .. ..
0010 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF   .. .. .. .. .. .. .. ..
0020 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF   .. .. .. .. .. .. .. ..
0030 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF   .. .. .. .. .. .. .. ..
0040 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF   .. .. .. .. .. .. .. ..
0050 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF   .. .. .. .. .. .. .. ..
0060 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF   .. .. .. .. .. .. .. ..
0070 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF   .. .. .. .. .. .. .. ..

Here are the insides of my cable.

(http://i515.photobucket.com/albums/t356/mr_djsonic/IMG_20130125_175118.jpg)

That's a 232/245BM chip, not writable. You need another cable to use with galletto.

Sorry.

Oh, well. I ordered a Galletto cable already, just taking too long. Thanks again for your help.

Anytime.

OK. I got an FTDI cable, changed the serial as described above. I put my ECU in boot mode and tried to write. Here's what I get.

Writing ECU
Writing InitilizationOK
Seed key... OK
Erasing...OK
Start writing...Error writing

Any suggestions?

That's odd. Try the bootmode option with nefmoto to verify you're in bootmode. You won't be able to do anything, but at least it'll confirm.

I don't think it's going into Boot Mode. Or I totally screwed something up.

Connecting...
Starting bootstrap loader upload.
Sent bootstrap init zero byte.
Sent bootstrap init zero byte.
Sent bootstrap init zero byte.
Bootstrap loader upload failed. Failed to receive device ID response for init zero byte.
Disconnected

Start a new thread, I'm sure it'll get more exposure. Shoot me an email.

ddillenger84(at)gmail(dot)com

Thanx!

It's in boot mode alright. It takes me personally nuemrous tries to flash ECU successfully, escpacially late a6/allroad ones. Original M box S4 flashes each time successfully.

His ecu had some sort of water ingress at one time. One of the legs on his flash chip was corroded pretty badly, I think the attempts at bootmode aggravated the situation. He sent me his ecu, I had the same issue. When I did get it to flash it would drop connection with nefmoto/vcds periodically. I replaced the eprom and reflashed it, drove around with it for a few days and sent it back. All is well now.

BTW-I did all of this at no charge. Yeah, I know. I'm a boss.

aw man...now I have that song stuck in my head! I'ma Boss, I'ma Boss....please make it stop. lol

Kinda like that "IM ON A BOAT" song

WTF?

Has anyone used this on EDC16 successfully?

I can't get it to read anything.

It only works in bootmode. I've never had it work over OBD.

How do you boot mode EDC16?  I've done it on me7 before, but never EDC.

Same way as ME7

how exactly do you bootmode edc16 the same way as me7? edc15 maybe.

use bdm. clones are only around $30usd and you can make a full backup including e2p.

Oops. I could've sworn I read "EDC15"

EDC16 = no bootmode. Only BDM.

Bought a BDM - no Bosch adapter with it.  looking for frame and adapter now.

This is very nice. The original english version is hilarious.

Hi ddillenger!

How are you?

Did you solve the issue above? I have the same one in nefmoto flasher.

I've found answer on my question here http://nefariousmotorsports.com/forum/index.php?topic=3387.msg36674#msg36674
Thanks a lot!

ddillenger you are the man!!!
your approach has helped me, thanks a lot!!!

Am I correct in thinking doing this will make Galletto 1260 software work with any FTDI cable ?

Yes.

Thats great news, as I have lots of different FTDI cables :)

Thank you for this ddillenger!

Much easier to understand  ;D

Has anyone ever messed with the EEPROM option?
On every version I've seen it is grayed out and the flash is always selected.

Just curious :)

for anyone that has issues finding the offset posted above for hex'n galletto "0x249E90 in the galletto executable. As it is, that serial is 47514789"

for some reason in the latest version i couldn't find that offset.. if you have the same issue just search for the cable # you're replacing 47514789

then right click in the window in the hex editor to the right and select replace ... itll convert the binary/hex/acsii for you when you type in the number of your cable...


hope this helps some people  8)

My Serial has letters and numbers, I typed it in has shown in MProg. I checked again after i saved it and it is still there. I read above on this thread that I ASCII is used for conversion to digits, Since I typed in the serial with the letter am i going to have a problem?

Update.
It converts the serial (letters and number) to HEX.

I am going to try and see tomorrow if i can read my ECU and get a .BIN file. Also flash (write) a modified .BIN file

I need help.
I changed one setting on my ECU MSS54 BMW E46 M3, I changed the Enable Sport Mode Always ON. I tried to flash the ECU back and it stops at 72%. Can someone help me out why is not working?

E.

urgent help needed! i've done what it states in this thread over 10 times today using a couple of different tfdi cables, switched off anti virus ect and every time i open up program, select car and click read ecu it freezes on this screen! any suggestions?
(http://i1282.photobucket.com/albums/a532/mk4monster/gall_zpsc76c0968.png) (http://s1282.photobucket.com/user/mk4monster/media/gall_zpsc76c0968.png.html)

Only works via bootmode when not using a galletto cable.

Hi i use Galletto to read and flash edc15P via OBD, without any issue.

I use XP SP3 with latest FTDI drivers and Galleto clone.

Cheers

I am looking at that address and the only coding there is zeros, mk4 vr6 ecu KW1281 protocol flash chip 29F400BB, 9504903 immo chip me7.1 G, nothing I have tried for boot mode is working and my hex+can cable won't let me communicate with immobilser module 25 or security 16 also this is a AAA vr6 in 98 A4 shell I already ordered cynosure programmer with clip hut was hoping my galletto/ebayblue/hex+can would work but so far no dice.

Tried:
Ground pin 24 2-3 sec
Installvdrivers every which way
Uninstalled vag com and drivers
Nefmoto tool nothing will communicate with ecu but hex+can on vag system
note I cannot set the com port in device manger it gives no option under lpt/com port only in USB section I see ftdi device with no com settings 

Ground pin, hold grounded WHILE turning on key. Wait 10 seconds. Remove ground from pin24.

Ok I will try that now, thanks.

Tried that method to no avail, my cable has the same serial # as gallerying and everything but still no boot mode....should I connect doc pin 15 L-linw to ecu pin 21? As of now pin 21 is left blank at ecu

Ok good news! I followed tutorial and programmed my blue cable and it works with gallerying program ecu data only shows 0261206485 over 1037381490 goes to 100% read then says reading done turn off ignition gallatto error is that normal?

For a while, I've been thinking i could make a (small) contribution to this message board.  Would any one see any value or have any use for a little wrapper program that you open instead of galletto that lists your attached cables, asks you to pick one, automatically modifies galleetto exe to match the hardware ID, then opens galletto?

Obviously this is an easy enough change to make manually, but for those less experiencde or those that just want it to be quicker/easier i'd think this would be helpful, no?

If people think it's a good idea, I'll throw it together.  If not i'll have to think of something else to contribute lol.

How about helping me just remove all serial number requirements completely?

I'd be more than happy to help with that... if i can.  I don't have much/any experience reverse engineering something like this.  My background is primarily focused around web development (PHP and C#) and iOS app development.  I've done minimal work in other languages as well.  If you can point me in the right direction of how to get started reverse engineering the software, i'm willing/able/eager to learn and contribute.  I do have a degree in Comp Sci, so my theoretical understanding is good -- i just need to know where to get started learning.

Change address 173a73 from 7e to eb.

Damn it!! I was planning on sitting down and decompiling this thing this week as a learning experience. If it's that simple, my motivation Is lost lol!  Nice work though!

guys if you flash your cable to galletto will it still work with vcds and me7 logger ? I tried briefly this morning and it didn't... but me thinks I smoked another cable

I'm using the same cable with VCDS, me7logger and galleto from this topic.

Okay thanks I think I keep frying my cables cause power supply but Idk ......I post elsewhere but do you think 13.8 , 7 amp power supply will fry my cables?

7 amp - it seems too much.

This does not work for me.

This seems to have the unfortunate effect of causing Galletto to not connect :(

I have restored the original software to the thread until this can be resolved.

Thank you so much ddillenger!

BTW, it's very simple to convert ftdi usb-kkl cable in full functional galleto cable.
In most ftdi cables is enough to add one diode and one resistor.

Details? It'd be nice to use without bootmode, but I know that the galletto cables don't typically work with nefmoto.

Main idea - must add elements beetween DTR - TxD - Vcc points on cable pcb board.
Because galletto software use "brake" function to compose 5-baud init sequence.
Shematics example is on the attached picture.

So how do I get my cable back to a regular non Galletto cable. If possible ?

I don't understand the question. This will not change how your cable functions with 95 percent of the software out there.

So I should be able to use bundled gelletto with me7 logger and vcds? I've tried and it was a no go ...but maybe I'm doing something wrong

No, but you can use your VCDS cable with galletto. There is a post in the thread with diagrams on how to mod the galletto to work with other programs.

Here's some .EPT files from my cables.

All work with the software you can down load from the net. IE vagtacho, galletto, etc only issue is I can't get the vagtacho.ept to load onto the cheap vagcom cable.. Not that its an issue as I have the cable..

Maybe useful

Hi from Brazil and sorry for bad english!

2 asks from 1 newbie:
1) I have a CH340 chipset KKL cable, should be work?
2) I must use the same options in MProg?
3) Ops, 3rd question: if not possible to write the cable, is not possible re-write "galletto.EXE" with the real serial number of my interface?

TKS "InAd"

Galletto requires an FTDI cable. MPROG is an FTDI utility. What about that makes you think you can use a CH based cable?

lol.

No, I am sorry, but your cable will work for nothing but me7logger andVCDS light.

Well, I'm pretty sure my legitimate Chinese Interface does not work with FTDI drivers with only CH340!!! hahaha (almost equal?)

It took me several days (and some neurons) to get... http://nefariousmotorsports.com/forum/index.php?topic=4803.msg63644#msg63644

In the correct conditions it works very well, now.

Nyet thank you so much for this info! Your instructions were well written and I had no questions about what to do. Thank you.

Anyone using Windows 10 and this?  Which cable/driver etc?

I've got an OLD vagcom cable (FDI non write) and a genuine hex-can lying here.

Works fine for me with hexcom usb vagcom cable on windows 10 using the RT vcpi driver. Have not tried generic FTDI cable.


[does not work]

bump

Since we have ressurrected this thread... any chance some IDA pro experts can come up with a proper solution?

I'll take a quick look

Thanks!

I can't find those bytes in the exe

Galletto 1260 or 1250 (also, for clarity, I'm talking about removing serial checking, not windows 10 support heh)?

lol I was looking for the bytes not offset lol.  ok so it's not so easy it get's pushed on-to the stack twice.

I'll work on it when I can late here now.

First thing first: Thank you ddillinger for the OP



A week ago or so I wasn't able to read an ibiza cupra AQX 6k0906032 from a good friend with NMS. (I think putting a direct K-line would fix this issue)

So I downloaded this galletto exe and edited it to work with my KKL409.1.
It seems to work OK but I haven't tried to read the car yet.

But an important fact is that there isn't any me7 car when you select "seat". There are only edc.

Is there a way to update the ecu list?

Can I normal read/write it by selecting any other me7 29f400bb car?

Can I boot-mode read/write it by selecting any other me7 29f400bb car?

This will only work in bootmode, and you can write any C16x ecu by selecting the appropriate memory layout. No need for the car to be listed.

Very helpful walkthrough.
Thanks for creating it..

Having a bit of a problem, tried this with a ebay spec INPA cable and it seemed to work. Now I've purchased a better built INPA cable from one stop electronics and it doesn't seem to work.
I've tried galletto drivers , automatic drivers and ones direct from FTDI.  I'll either receive a opening port impossible error or it'll just freeze up when IDing before giving loads of 0s

Any ideas where I'm going wrong?

INPA cables will not work with Galletto afaik.

I had a cheapo INPA cable working just the more expensive one doesn't seem too

Or is there any ways of improving the reliability of 1260 cables?

hello I still can't get the 1260 message "boot mode not active" to work I tried with a blue kkl but impossible to write on it A50285BI (are some cables locked?). I tried a hex usb clone that I can modify without problem with mprog. can the galletto 1260 work with a modified usb hex? it is well recognized in the FT8U2XX device bus controller under virtual xp, galletto drivers FTD2XX.sys FTD2XX.dll FTD2XXUN.ini FTDIUNIN.exe I tested xp and 7 32 bit but in the file galletto info ftdi it is written for win 98/00?? should I put more recent drivers in the galletto file?

Are you sure the ECU is in bootmode? Try blue cable with me7eeprom as a test.

 I tried many galletto drivers recognize the cable hex because it writes boot mode not active instead of "door impossible to open" but no communication between cable and ecu. on win 7/64 impossible to load the galletto drivers. on xp and 7 32bits it loads well in FT8U2xX with hex usb.
i just tried again, so kkl bleu driver 409. so in com port read eprom in bootmode ok if i unplug the cable i lose bootmode. galletto works fine in usb device? no need for com port? I'm a bit lost...

hex usb clone +drivers galletto 1260= drivers ok recognized usb device ft8u2xx reading...no boot mode active and error stop 10sec...it does not communicate, without the ecu same response. I ordered a china 1260 cable maybe I will have better luck

I solved my problem with a china 1260 clone.read/write in 185/190sec. it was impossible to reprogram my blue cable kkl 409 with mprog ... maybe some are locked

Hello,

I order a galletto 1260 from China and I have to run it on Windows 10 64.

Possible or not ?

What driver should I install ? I have seen Windows 10 drivers on ftdichip.com and the one supplied in cd seems to be very old.

Thank you for sharing

Answer is yes it's working. I tried to install the driver supplied with cable but Windows 10 automatically installed the latest driver from ftdichip.com.
Then I ran the software in XP compatibility mode and with admin rights. Worked flawlessly.