NefMoto

Hello,

trying to tweak a 2007 Canadian Golf 2.0. It is an ME7.1.1 wideband car with 06A906032RF. I have found KRKTE (0x1BCC6) and TVUB (0x149AA). I am trying to find MLHFM.

The only thing that resembles it starts at 0x13B50 but it is reversed and the numbers seem high. Anybody have insight? Thank you kindly. I believe it has a 63mm MAF from factory.

File is attached.

138D2

129x1

dd,

Thanks. Looks like you got it but I think you are off by a few bytes????? The first few cells look off. Maybe I'm doing something wrong.

How does this look?:

0x13906
103x1

Never mind. 129x1 MLHFM is correct. The first 26 values are negatives but since it is a Bosch MAF sensor, I assume MLOFS offsets it. Thanks again.

I do not think it is using MLOFS as values are in fact negative.
Does it still use 0.1 as factor (to convert into kg/h)?

There is no offset, it is factored into the map. Factor is still .1

Map is of course signed (negative offset)

Do you know since when Bosch started to use 129x1 MAF linearisation in ME7 ECUs?
Should it still be called MLHFM or MSHFMU?

Would I scale this map the same way as a Bosch MAF B5 S4?

Yes but keep in mind you do not have to add/subtract 200kg/h in the beginning/end.

EDIT:
What have you done to this engine so you need bigger MAF housing? Stock should be able to measure up to ~800kg/h...

So add 200, so that all numbers are positive, scale the maf up a bit and then subtract 200?

The car has a big snail on it and 440cc injectors.

It's different in different binaries. The earliest I have seen it in VAG is 2004 in the B5.5, but then the 2005 audis still used 512x1. It's all over the place.

In short, I am sorry, I don't have a definitive answer.

No!
To properly scale MAF when "normal" MLHFM is used you have to subtract 200 (MLOFS), multiply by constant depending on area difference between new and old housing, and add 200 (MLOFS).
Since here MLOFS is not used you just multiply values. You can always try to find ME7 ECU with same style MAF linearisation from turbocharged engine (it should have bigger MAF housing).

EDIT:
And what about proper naming? MLHFM or MSHFMU? Do you know any 1.8T ECU using that type of linearisation?

Oh yeah sorry I read your post wrong. Other maps I am currently searching for:



I will update this post when I find them:

KFLBTS [2B0B3]
LAMFA
KFLAMKRL
KFLAMKR

KFZW

CWKONABG [2A037]
CDSLS [2A027 ???]

CDKAT [2A016 ???]
CDHSH
CDHSHE
CDLATV
CDLASH
CDLSH

CLRSHK
CLRSKA

Keep in mind those addresses are nothing more than "educated guess":
 - KFZW: 0x11B65
 - KFZW2: 0x11C25
Unfortunately it seems those could be only 12x12 maps


EDIT:
LAMFA is easy - 0x1BE90

Thanks for the help. I can't find CLRSKA or CLRSHK.

Any other maps I haven't listed the address to are also proving difficult to find. Anybody have these addresses or any tips? Also I was wondering why I am finding maps in this binary above 0x1FFFF. Are DPPs for this binary different because of this? Thanks.

KRKTE [1BCC6]
TVUB [149AA] (149A5)
MLHFM [138D2]

KFLBTS [2B0B3]
LAMFA [1BE90] (1BE74) (1BE84)
KFLAMKRL [2ADF4] (2AE2D) (2AE1F)
KFLAMKR [2ADD0] (2AE2D) (2AE26)

KFZW [11B65]
KFZW2 [11C25]

CWKONABG [2A037]
CDSLS [2A027]

CDKAT [2A016]
CDHSH [2A011]
CDHSHE [2A012]
CDLATV [2A01F]
CDLASH [2A01D]
CDLSH [2A025] ??
CWKONLS [2A03A]

CLRSHK [117FE] ??
CLRSKA

ESKONF [1040A]

If you are sure KFLBTS is located at 0x02B0B3 then KFLAMKR and KFLAMKRL should be located at 0x02ADD0 and 0x02ADF4 respectively.

CLRSHK could be located at 0x0117FE.

Unfortunately I am not able to help you with CLRSKA.

My guess about ESKONF is it that it could be located at 0x01040A if it is constructed like in ME7.1 ECUs.

Extremely helpful.

Looks like you are correct on KFLAMKR and KFLAMKRL. I believe I found the axis data as well. Not sure about CLRSHK. It is zero in this bin. ESKONF also looks correct. Thanks.

KFLAMKRL [2ADF4] (2AE2D) (2AE1F)
KFLAMKR [2ADD0] (2AE2D) (2AE26)

CLRSHK [117FE] ??

ESKONF [1040A]

Trying to remove secondary air from this car. Anybody know the location for MSLUB/MSLBAS or CDSLS? Thanks.

$50 paypal bounty for CDSLS MSLUB MSLBAS.

You knew there was a catch, didn't ya? :P

At first I was like "heh, easy fifty bucks", but three hours later I don't think so anymore, lol. Your bin is so very different to everything I've seen so far.
It looks very similar to Porsche 997T HEX+A2L floating around. Granted, the latter is ME7.8 based on ST10, but the internal program flow is very very similar.

Anyways.
CDSLS is 0x2A02C
MSLUB is 0x1EC84

...but I'm running out of patience for MSLBAS.
Too funny! :D
There is no such thing as MSLBAS in this binary!

CLRSHK 0x2BDA1


Another EDIT:
Since I'm done with it, attaching an exported list of names from my IDA project, might be of use to someone. Definitely contains some errors.

Thanks man, you're all set.

Any idea where CLRSKA might be?  :-X

It's pretty elusive. It -might- be at 0x2A018, but I'm far from being sure.
I'll let you know if I find it in the future.

Hey guys I think KRKTE is wrong. Can anyone confirm?

1BCC6 8-bit?

It appears to be correct. :\
D'oh, location is correct, but it's a 16 bit!

While at it, here are:
KVB 0x2C5B1, byte
FKVA 0x2C5AF, byte