NefMoto

Here are the notes I have compiled for the McMESS protocol as I found it implemented
in ME7.  I collected this just for completeness, I believe that nobody could make something
really useful with this braindead protocol.

Very good information!

I have been curious about MCMESS for a while.
Reference to it is also found in Volvo M4.4, and I wonder if this protocol could be the one that can read and possibly write directly to CPU ports. In the communication code parts of M4.4 there are direct MOV P1, P2, P3 ... commands.

I'm quite sure that I can now waste a lot of time exploring this stuff based on your document :-)

Volvo is using 9-bit 187500bps to diagnose M1.8. Transparent blue KKL interfaces can handle this and also some PCMCIA-RS232 cards for laptop.

Any clue what kind of software tool to use for setup a McMess communication . Tried a lot of serial toolkits/analyzer but no one was able to do proper communication due to reasons like:
-no customize baud rate
-no puls init
-no proper scripting(if receive xyz send xyz)
-no 9bit
any helpful suggestion are welcome ;)

Probably only high-end tool(s) like INCA.

http://en.wikipedia.org/wiki/INCA_(software)
http://www.bosch-motorsport.de/content/downloads/Documentation/Archiv/08_Data_Logging_Systems/KIC_2.pdf

I'll probably try to make something in VB that can make the connection, but it will probably never do anything useful.

Inca  works only if you have seed, a2l and hex for your ecu ( beside the KIC 2 Interface).. It's not for reverse engineering ;)

I think it could be the right way to use atmega with level changer like this one (is on my bench) but his source (kwp1281 /kwp2000) is not opened for everyone. so you have to write your own one ;)

http://66.196.80.202/babelfish/translate_url_content?lp=de_en&url=http%3A%2F%2Fwww.blafusel.de%2Fobd%2Fwbhdiagpro_bt_b.html&.intl=de

Thanks for sharing the info.

I found the code for the 17 predefined values that you can read and write a long time ago when I was disassembling code. I never found out what communication system was calling into them though. Good to know it is part of McMESS.

Did you end up using any part of the McMESS protocol in the ME7 Logger you wrote?

I didn't use the McMESS protocol for logging, it is so braindead ...
Good luck to everybody trying to make some use of this protocol.

What do the <cks> symbols mean?

Checksum most likely...

I think so too. How to calculate it?

http://files.s4wiki.com/docs/kwp2000_recommended_guidlines.pdf

should be there somewhere.

but there are a ton of mcmess documents avail on the internet

Hi,

Is it possible with McMESS to change CWMDAPP and LDRAPP with running engine? I would like to log my N75 valve characteristic without reflash the ecu.

Your going to need to do some work. The McMess allows reading and writing to ram variables defined in its table. So you'd need to relocate any variables you wish to change at runtime from rom map section first.

How? You'd need to search and patched the code which references those ROM map area locations to relocate them to RAM and then initialized them to default values early on at boot before they are referenced. After that its relatively straight forward to accomplish what you want to do after adding them into the VSV table and its default values table. The number of entries in the tables also would need updating but yes it could be made to work as long as you have the available ram.

Is this how "quicktune" works in commercial software? One I've seen seems to update specific memory addresses and update checksums but the car has to be off.

This software is compatible with the J1939 communication protocol.??????????