NefMoto

Recently we've talked about getting a P1681 fault accompanied by a no-start condition after reading/writing certain files:

http://nefariousmotorsports.com/forum/index.php?topic=981.0

Here's the fix.

Open your file in a hex editor and find the follwing string:

"DB 00 28 02 84 00 ?? ?? C2 F4 ?? ?? 66 F4 80 00 2D"

After finding this, change the last byte from 2D to 0D

Example:

Before:
F4   80   00   2D   0D   E6   F4   F0   A5

After:
F4   80   00   0D   0D   E6   F4   F0   A5

Thanks ddillinger for this cool feature! :)

As always, make sure to correct checksums before flashing.

A ton of ram logging went into this. Anyone that can use a hex editor can now tune THEIR software without being relegated to switching versions :)

Mazer did beastwork here. Thanks go to him :P

I think all ME7 seems to have this, ME7.5 and ME7.1.1 too.

Have not seen it in any 2.7t ME7.1, only ME7.1.1 .. can anyone confirm?

4z7907551S should be a 2.7T :)

anytime i get this code, i just reflash the file and its fine.

When you're doing multiple revisions, that can get more than a little tedious. With this, flash one and done.

Have fun with A3 3.2, i can flash 100 times and the code is still present and engine isnt starting.

I could probably write a little patcher into visual logger when I get a chance.  I have two vehicles that this affects, so good deal for me.  :)

So what does this byte that we are changing mean?

7.1.1 :)

Code doesn't exist in ME7.1

If you don't have a car newer than 03, just ignore this entirely :)

The string i posted is to be used in winols 8bit hex search.

Yes, the original string with all of the ??'s ensures maximum discrimination against false positives, as well as allows for the best possible compatibility.

I'd say unless you have a SINGLE match, DO NOT MAKE THE CHANGE

If you search for the pattern given, you will find ONE match (and only in binaries that have this code, check the DTC table to confirm).

This pattern was derived running it against dozens of binaries, it's as refined as is possible.

Good work guys :)

Okay, yeah, you are very right.  I was fooled by my hex editor program not jumping to the next match when I searched again and thought there was only one result.   My bad.

Nice!

Is it worth putting together a 'features that should be included in Nef' thread, in case Tony opensources it, or starts developing again?

Would it be worth adding this feature to ME7Sum?

Yes, and hopefully he just open sources it.  :)

Considering ME7Sum only works on ME7.1 as of now, and the issue is (primarily I think) with ME 7.1.1 and ME 7.5.....  I don't think it'd make much sense.

Correct, this function does not exist in the dinosaur that is ME7.1

:P

I would say yes.

I spent some free time for last week going through the assembly code for the 2004 Allroad 4z7905551S and comparing it to the 2001 S4 8D0907551M. The memory address you are changing is for a function I have been looking at. The memory address is for code inside the function that sets the error code  P1681 for programming not complete. The change suggested will make the function never set the error code. I have yet to find where in code this function is called from or how the variable that is checked to control the conditional jump gets set. I'm hoping that when my Allroad ECU arrives in the mail I can get it fully tested an figured out.

PS: I'm also planning to eventually release as open source all of the reverse engineering work I have done disassembling the 2001 S4 ECU code.

Good to see things moving forward!!!!  Thanks Tony!

2nd. Thank you for your time, Tony!

This information couldn't be any more timely for me.  I just spent this weekend fighting P1681 on my allroad that's been down for 9months for a Stage3 upgrade, and this was the last hurdle I came across.  I managed to get past it with a lucky combination of flashing and reading, but it's great to know I can "fix" it and greatly simplify the tuning process.  Thanks for sharing, guys!

Glad you could work around the problem. The hope with the NefMoto software is that you would never end up in this situation; sorry for that.

No need to apologize at all!  Your software makes it far easier to flash over OBDII instead of carrying the ECU upstairs to my bench setup every single time I need to flash.   8)

I just wanted to verify that this does work. My 2003 allroad and a 2004 a4 both had this code.  Updated the hex and it was good to go.

I think i have a similar problem but different error code.
I read the file on a 2004 VW GTI with ecu number 06A906032N (that's what galetto sees) but i think its NK. I didn't flash any file on it.
If it makes any difference at all, the car is swapped to manual, (not by someone i know) and was running good since, never had a prob.

After I read the file and everything was ok, we drove the car for a complete day (regular use, on and off). The second day the car refused to start and I get error code 18089.

After that i tried writing its original file, and i still get the same error.

would this fix work for me?

I was planning flashing another version, the 06A906032HN instead, will that work?

perhaps, but in all likelihood, you'll need to boot mode flash the EEProm to remove the death code first.

Damn, wish I found this thread a few hours ago. Oh well, there's always tomorrow.

Just wanted to say thank you for this... Had a little issue with a 2005 bbw 2l 8v 032pe and it worked like a charm. Daz & Andy thank you.

No Problem mate :D

This doesn't affect the 551R BEL 7.1.1? I have had no issues with BEL cars using the 551R base. Only the later B6 A4 518AK ME7.5.

On the later 7.5, is this the reason when flashing I get to 96%, then nefmoto pops a error message and the entire file has to be erased and start over again. This is flashing 518AK 0004 onto a 018DQ ECU. After the erasing and full reflash it finishes with no issues. Car runs and drives fine, no errors. Maybe just upset about the different .bin on the ecu from original?

The routine is not present in 551R. It is in 518AK, but it is rarely tripped. It has nothing to do with the flash hang though.

So, what is causing the flash hang? Its kinda annoying having to flash twice.

What baud rate? 38400 is what you want.

Yup, I have been defaulting to 38400 cause that all my allroad likes.

Could it be because the switch from 018DQ to 518AK was done with the MPPS on the bench? It was a spare DQ Passat box that I got for a song and I'm trying to use it in my B6 A4. It may also be worth noting that it will not enter boot mode and its still running the DQ 95040 with the immo off. Think its a combination of those factors?

trying to beat the APR Stg1+ 160whp/196wtq that I recorded today.

Thank you, maZer.GTi and  ddillenger for finding and posting this!

Got the P1681 after simply reading my 4Z7907551S (2004 Allroad 2.7T manual). Been banging my head against the wall for hours, reflashing, powering down, disconnecting the battery and reflashing again. Nothing helped. The car wouldn't start. Edited this byte and the car started from a quarter turn and been running great ever since.

BTW, although flashing the 4Z7907551R.bin into my ECU did indeed get the car to start again, it introduced a bunch of new codes. Needless to say I was not happy at all and began to look for the ways to fix my original 4Z7907551S.bin. I am so glad I have found this thread and was able to reflash the original bin into my ECU. I will post the VAG-COM scan log with these new codes introduced by the 4Z7907551R.bin in the relevant thread: http://nefariousmotorsports.com/forum/index.php?topic=981.0 (http://nefariousmotorsports.com/forum/index.php?topic=981.0).

Hey Fellas, Another start failure following a nefmoto read. 2004 BFB engined 1.8T Quattro manual. This ECU is 8E0 909 518 AM.

As a bit of a noob and certainly not bright enough to modify my own files yet (if ever). While I can probably find the string that needs modifying and change it. I don't know about the checksum correction or how to do it.

It seems from my reading of a number of threads that once this is updated and flashed into the ECU it should come back to life permanently. Is that correct?

I was reading it for a friend to get tune from ddillenger for him. Daz must be pretty busy right now as he hasn't replied yet.

Can anyone help me with the next steps?

TIA

Gavin

My best greetings to all.

Just question regarding hex editor and 4Z7907551S.bin that downloaded from ECU.

As it was described earlier in this post we require to change byte 2D to 0D then will save the file and upload using NF soft?

Am I right ? Would you guys help me please.

I just would like to upload my ori. bin back to ECU.

I think the consumption was better on S variant then on R.

Many many thanks to all.

  

Hey guys, I need some help. Over the last few years I have learned about flashing, built a bench flasher set up, and have flash me car with a few different files.

I am trying to flash me ECU back to the stock file so I can get through emissions testing here in NJ.

I can flash the two modified files I have with no problems. When I try to flash back to stock I get the code 18089-control module programming not finished. I've tried every trick I've read on here and elsewhere. I've tried known good bin files too.

I am stumped at this point. Any suggestions?

Tim

http://nefariousmotorsports.com/forum/index.php?topic=6719.0

 OR download a non modified file and write that. 1 or 2 1.8t software versions have bugs

I've tried all suggestions, 4 different bin files. Anything that is modified flashes fine without issue. Issue is only when I try to load a non modified stock bin.

The hex string mentioned in that thread is not present in my 1.8t file

attach your file pls

Uploaded, any help would be greatly appreciated. I've tried a few more stock files with same results. Car runs and drives but has CEL for above mentioned code. Everything else is fine with the car. 

Thank you for wasting everyone's time.

Excuse me? Wasting time? I am still learning, I searched for that string and saw that but the rest did not match. I did not know that the same string as mentioned would be partial or in a different order. Lighten up man.

Either way I appreciate the help, minus the arrogance.

Whoa whoa, he's 100% right.

The original post did not make it at all clear that variant was possible.

Merged with original topic so this information does not get lost.

hehe, I think the thread DID make it clear because of the ?? wildcards.
Only thing i did was to search this for you and i am still learning too.

Please report back if this solved your problem with the dtc.

Anyone could help with My ME 7.1.1 ? it's a 022906032CA ecu. Have the same problem and tried various things but none of tchem helped. Also when im trying to upload file to its flash i got some kind of loop:

Wake ecu
switch to high speed
clean ecu data

and that goes over and over again.
Only possibility to upload the file is Boot Mode, but with that still got the fault Programing not finished.

I have tried couple tools: FgTech and MPPS and nothing, anyone had such a problem before ?

Use a proper tool or boot mode . CMD has no issues...Neither should the original mpps which i suppose you are using.

Yes its the stock software im uploading but anyways it wont start no matter what i do.

Then do something else. Eeprom error? Are you sure theres no hardware issues? Are you sure the ecu isnt partly bad

Since i have the car it was impossible to upload files to the ecu. Always there was an error after erasing flash - so i had to go into a boot mode and then it was fine.
Did some modifications to the software and tried again upload it and it eventually went thru and after that it says Programming not finished, checksums are fine,
have a look into my epprom maybe there is something not as it should after flashing. Also attached the original ecu file which was in before any mods/

it is 800BB chip, and using NEF tool to read it slowly doesnt help at all, tried several Times with different read speeds. As well i have tried to flash it with NEF tool but no luck, somehow the ecu doesnt let the flash to be rased in NEF flasher it just fails, then it goes to speed negotiation and it fails again and thats it. Not sure what else i can try.

I dont even know how to check eeprom if it has been modified or not. I would be thankfull if someone could have a look in it

Where are you from?
Maybe someone is near by you who can help?

This is a can ecu and it should be write over can..

NEF Tool is kline?..

Regards

yes, NEF is kline only

I will try over can and will let know about progress.
Thanks for advise :)
Im from Poland but i live in Scotland, in a town where no one does such things. Sending my ecu to someone will not gain any experience for me.
I like sort out things by myself, even if it will take a lot of time.

Same thing over CAN. Can read it but i cant flash it in the car or on the bench. FGtech says:
 silentkey error
wake ERASE ERR.
 :( :( :( :( :( :( :(

Will virginising eeprom help ??

Fgtech not work (clone) on this ecu..

Take ori Mpps can driver or
Kess v2 can driver

Try different speeds

Regards

Virgin eprom helped, car started straight away

Glad its set

What am I doing wrong? I am still very new at this but I tried full read with nefmoto on my 2004 a6 2.7t, the. It wouldn't start and was throwing codes po602, p1681 and p18089 programming not finished. After reading several posts on the issue I tried full read several times a long with full write/flash, delete codes, not deleting codes, cycling key, disconnecting battery, writing the 4z7907551r .bin instead of stock 4z7907551s .bin with no luck on either file. I don't want to brick my ecu as I haven't had luck with getting it in boot mode with galletto 1260 yet either. I started looking through the hex editor in tuner pro for this threads fix but after an hour of searching I felt like an idiot thinking there is probably a hex search option that would find it quicker. Please tell me what I'm doing wrong and point me in the right direction.

Sent from my SM-G930V using Tapatalk

affects 8N0906018CJ

This thread is about patching your the ECU code so it doesn't cause the problem.

The flashing thread here:
http://nefariousmotorsports.com/forum/index.php?topic=981.0title=
covers more general info

Both threads contain extensive answers to your questions, you'll have to be more specific if you want something else.

In short, you will not be able to fix p1681 without moving to a ECU bin that doesn't suffer the problem, or by hand patching ASM.

That said, flashing the R file should have worked. You may have to it in flash boot mode if the ECU is bricked.

It supports pretty much all of the ME7.1.1 and ME7.5 files I can find right now (but not ST10 files of course)

I will add this to ME7Sum time permitting.

Welp, getting this code after attempting to READ the flash on my 2004 Allroad 2.7t, which I assumed would be safe.

I'm stuck at work. I can continue to attempt to read the ECU, but whenever I save the file, it saves as 0 bytes. I also cannot save a new file, only overwrite an existing file, otherwise I get a windows exception saying "the file could not be found." When writing the just-read binary.

Lame first post, I know, but I'm just trying to get home.

edit: I am using a blue ebay OBD2 cable. I was able to get to 100% of the read, which opens up the save prompt. Not sure why its having issues actually saving the file.

Just re-flash file to it( original read ). If your having trouble connecting, disconnect negative cable to battery then reconnect, switch ignition on and you should be good to go. I had this issue with my Passat.

Thanks, that's the current plan. Thankfully no connection issues. I was nervous at first because my first few read attempts ended up just saving a 0-byte file...
I also found an image from Daz from 2014 specifically to fix this issue that I may use as my starting point, or I'll diff the binaries. I'm assuming its the single-byte fix here.
Also to avoid further thread derail, I'll shift my troubleshooting discussion over to http://nefariousmotorsports.com/forum/index.php?topic=15459.0.

2004 B5.5 Passat 1.8t AWM

This post saved my butt. Im not new to tuning bmw with siemens ms42, so imagine the brick in my undies after doing my first read on our main vehicle and it becoming inoperable. Thank you to those who figured this out, and those who have built these pieces of software.

2021 and this post is still helping people out.

8E0909518AS Audi a4 2004 bex 1.8t 190hp 6 speed manual quattro, attempted to read ecu flash and this code appeared and would no longer start.

Read ecu flash via galletto and ftdi cable, made this change using hextor as TunerPro doesnt allow wildcard ?? searches in hex.

Please see post for full info and steps taken on page 2:
http://nefariousmotorsports.com/forum/index.php?topic=19962.msg148718#msg148718

Ok so I had to replace my ecu and I replaced it with an ecu with the same numbers
MY ECU 4Z7907551R ME7.1.1 0003
EBAY ECU 4Z7907551R ME7.1.1 0003
I done a full backup of new ecu with ktag which katag does not read the eeprom so I also saved a copy with ME7eeprom.exe then I did a full restore with ktag of original ecu backup then I did a restore of original eeprom bin with ME7eeprom.exe. After that I wanted to do a read with nefmoto just because lol... well after i did the read and saved file but ecu in car and no start.. checked codes and yup P1681 I tried doing the read the ecu writing back to ecu with nefmoto and ktag and none of that worked. The one thing that did take care of the issue was to write the eeprom bin back to the ecu with  ME7eeprom.exe turn car of then back on and start code gone...

now after all that im wondering if I should have not done anything to replacement ecu except write eeprom and go
also it seems the new ecu had a tune because in eepromtool.exe the bin for the new ecu says
Tuner Tag:  ←Cx |

I am running into this same issue. Programming not finished P1681 008. Any idea how to fix? I can clear that fault and rewrite the flash but everytime I cycle the key this fault comes back. Any ideas? 4D0907560DD Me7.1.1 vw phaeton ecu.

Its the first post in this thread...

Here's the fix.

Open your file in a hex editor and find the follwing string:

"DB 00 28 02 84 00 ?? ?? C2 F4 ?? ?? 66 F4 80 00 2D"

After finding this, change the last byte from 2D to 0D

Example:

Before:
F4   80   00   2D   0D   E6   F4   F0   A5

After:
F4   80   00   0D   0D   E6   F4   F0   A5

Yes I read that and tried doing that yet the fault remains. Perhaps its because I don't have an exact match but this is the closest thing in the flash file :

DB 00 28 02 84 00 A6 B6 C2 F4 80 86 66 F4 20 00 2D this is located at 797C0 however I don't think its correct as changing this value changed my checksum values and it bricks the ecm and I need to read it in bootmode again to reflash. So perhaps I am looking for something else. Attached is my flash file for the ecu 4D0907 560DD me7.1.1.

Ok I think I may have found my mistake. I found a match at the very end of the flash. That was my issue I was modifying elsewhere. Thanks again.

In my case it was located at 0x00088220 thru 88230. I was editing in the wrong spot earlier which would explain all the issues I was having.

Found in 2 seconds. Use the tools in ols it makes your life easy

Yes I was using a generic hex editor took forever to find lol. But got it sorted out thank you for confirming.

VW Caravelle 2.0 AXA MT
ME7.1.1
P1681 Control Module Programming Not Finished
ME7.1.1 0261S05220 06A906012AC 7280 509723
fix "DB 00 28 02 84 00 ?? ?? C2 F4 ?? ?? 66 F4 80 00 2D" - not found

How to fix flash?

Ok and?

How to fix flash?

The string is a few bits off, however it was still easy to find...
File attached

EDIT: I just went for it and flashed the hex edited & corrected bin and everything works. Thanks for founders of this fix :)

Hello,

8E0909518AQ Audi A4 1.8T 2006, found single match using https://hexed.it/
Could someone please verify that the file has been edited correctly? Thank you.