|
Title: ME7.8 Bricked [fixed] Post by: walt on August 04, 2015, 08:38:08 AM Hello, I am trying to help a friend get a Porsche ecu to run again.
Some details: 2004 GT3RS W: 0261206579 SW: 1037350598 Engine: HW Ver.: SW upg.: 0041610047207630 Installation: ME7.8 / ME7.8 min I was given the original, unmodified bin file, which I copied to a new flash prom 29F800BB, and put that in the ecu. I have read in the noob intro, that the next step is to use a VAG-KKL cable, and the nefmoto software to clear any error codes in the ecu, caused by the previous bad bin file. This is where I am having no luck. The software recognizes the cable, but it cannot connect to the ecu. The only successful connection has been with Galletto cable, and ecu in boot mode. My friend tried this, and I saw it work, but all he could get out of it was the ecu info. I have no idea what path to take next. Is there something I can check on the nefmoto software+KKL cable, or maybe it will not work on ME7.8.4? Is there a path using the Galletto? Can the flash prom still be incorrect, and messed up enough so that the nefmoto software is not able to clear the ecu codes? Thanks in advance. Title: Re: ME7.8 Bricked Post by: ddillenger on August 04, 2015, 08:42:30 AM Nefmoto is for VAG only. It won't work for Porsche :(
Title: Re: ME7.8 Bricked Post by: walt on August 04, 2015, 08:45:19 AM Thanks for the quick reply. Not sure I can be as quick to pass on the bad news.
We were just going by the DME number, and figured it might work. Thanks again. Title: Re: ME7.8 Bricked Post by: walt on August 13, 2015, 04:47:21 PM Hello again. I have been reading a lot of 'immo off' threads, where a member offers to
add 'immo off' code for another member's non starting car. Maybe I still haven't read enough, but it seems like this never works. I mean for the person asking for help, I'm sure it works fine every time for the pros. Maybe because the less knowledgeable, by the time they ask the question, have messed things up so badly that only a melting down and recasting of the silicon will fix their problem? :). Personally I have been trying several eeprom fixes in the last week. From the posts, it looked like only the second and third lines of the code (in 95p08 at least) need to be modified. My first few fix attempts were to just copy and paste the 2nd and third lines of the posted, fixed, code into my eeprom. Next I found explicit instructions on which bits to change (in second and third lines). This didn't work either. I should mention that this was all chip removal/program/resolder. Must have done that at least 10 times. Now I am beginning to suspect something else is wrong, maybe the cluster? Maybe some code in the microcontroller's internal ROM or eeprom? I was given a supposedly original (to this ecu) flash eeprom (29F800BB) code. The eeprom has (maybe) the correct 'immo off' code, with correct checksums. The owner of the car has made contact with someone in another forum, that supposedly owns one of these cars. They have offered to fix the eeprom code, which was sent today. My confidence in the outcome is 0, but will post the file here if it works. At this point I'm not in a race to fix it myself, it just bugs the heck out of me. Today I found this thread, with instructions on a possible fix: http://nefariousmotorsports.com/forum/index.php?topic=6719.0 (http://nefariousmotorsports.com/forum/index.php?topic=6719.0) Quote Open your file in a hex editor and find the follwing string: "DB 00 28 02 84 00 ?? ?? C2 F4 ?? ?? 66 F4 80 00 2D" I did that, and unfortunately found no exact match. Found some strings that matched the left hand side and the center bytes, then a whole lot more that matched the center and right hand side, but not both. I'll append the list at the end in case anyone is interested. I forgot to mention that some software reports that the ecu is stuck in programming mode. Unfortunately I can't remember which now. MPPS is the only one that is able to read and program the flash prom, but only one 64k sector of it. Hopefully this week-end we might be able to borrow an official Porsche laptop. It supposedly has the ability to put the correct code in everything. If the new eeprom code arrives before that, I'll try that as well. I thought I was going to post a question, but, apologies, it is just a rambling summary. However, it just occurred to me that it might be a good idea to attach the eeprom code. I found the checksum at the end of line 0020 was missing: 0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 0020 01 01 A5 00 00 00 00 00 00 00 00 00 00 00 00 00 Added the checksum, but the car still wouldn't start: 0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 0020 01 01 A5 00 00 00 00 00 00 00 00 00 00 00 57 FF I also tried turning immo off, with the following, but it didn't help: 0010 00 00 01 00 00 00 00 00 00 00 00 00 00 00 FE FF 0020 01 01 A6 00 00 00 00 00 00 00 00 00 00 00 56 FF Just in case, do not try the attached eeprom code. Unless someone knowledgeable says otherwise, treat it like it had a fatal car desease. ------------------------------------------------------------------------ P1681 Control Module Programming Not Finished Ref string: DB 00 28 02 84 00 ?? ?? C2 F4 ?? ?? 66 F4 80 00 2D Flash prom (29F800BB) strings that matched the left and center bytes: Address 51822 DB 00 28 02 84 00 (16 B8) C2 F4 (AE 8E) 68 41 2D 08 A8 519C0 DB 00 28 02 84 00 (36 B8) C2 F4 (B0 8E) 68 41 2D 08 A8 51AAC DB 00 28 02 84 00 (18 B8) C2 F4 (BA 8E) 68 41 2D 11 8A AF228 DB 00 28 02 84 00 (42 B8) C2 F4 (1D AC) 68 44 2D 0C A8 Strings that matched the center and right hand bytes: 005D4 24 47 F1 E8 EA 00 (9E 06) C2 F4 (F4 8D) 66 F4 80 00 2D 00BEE 24 47 B9 80 EA 00 (CC 0C) C2 F4 (F4 8D) 66 F4 80 00 2D 4AC84 76 F5 02 60 B8 50 (0D 2E) C2 F4 (B9 8D) 66 F4 80 00 2D 4C8DC C2 F4 DD AF 68 41 (3D 05) C2 F4 (E5 22) 66 F4 80 00 2D 4F24A 68 41 2D 02 77 FC (08 00) C2 F4 (3C 8C) 66 F4 80 00 2D 517FE 40 00 3D 07 9A 47 (07 90) C2 F4 (B2 01) 66 F4 80 00 2D 51B5A E6 F4 FD FF 64 F4 (BE 8E) C2 F4 (22 89) 66 F4 80 00 2D 51B92 E6 F4 7F FF 64 F4 (BE 8E) C2 F4 (22 89) 66 F4 80 00 2D 51BDC E6 F4 FF FD 64 F4 (BE 8E) C2 F4 (22 89) 66 F4 80 00 2D 51C06 E6 F4 FF F7 64 F4 (BE 8E) C2 F4 (22 89) 66 F4 80 00 2D 51C40 E6 F4 FF DF 64 F4 (BE 8E) C2 F4 (22 89) 66 F4 80 00 2D 51C7A E6 F4 FF 7F 64 F4 (BE 8E) C2 F4 (22 89) 66 F4 80 00 2D 51CB2 E6 F4 FD FF 64 F4 (C0 8E) C2 F4 (22 89) 66 F4 80 00 2D 51CEA E6 F4 DF FF 64 F4 (C0 8E) C2 F4 (22 89) 66 F4 80 00 2D 51D22 E6 F4 F7 FF 64 F4 (C0 8E) C2 F4 (22 89) 66 F4 80 00 2D 51D5A E6 F4 FF FD 64 F4 (C0 8E) C2 F4 (22 89) 66 F4 80 00 2D 51D92 E6 F4 F7 FF 64 F4 (BE 8E) C2 F4 (22 89) 66 F4 80 00 2D 51DCA E6 F4 7F FF 64 F4 (C0 8E) C2 F4 (22 89) 66 F4 80 00 2D 51E04 E6 F4 FF F7 64 F4 (C0 8E) C2 F4 (22 89) 66 F4 80 00 2D 51E3E E6 F4 DF FF 64 F4 (BE 8E) C2 F4 (22 89) 66 F4 80 00 2D 53DA0 E7 F8 BF 00 65 F8 (2C 99) C2 F4 (26 08) 66 F4 80 00 2D 55CEE 2D 03 E1 18 F7 F8 (C2 89) C2 F4 (85 8B) 66 F4 80 00 2D 5604A E7 F8 BF 00 65 F8 (CF AF) C2 F4 (CF AF) 66 F4 80 00 2D 56220 68 42 3D 07 8A 08 (05 30) C2 F4 (C3 89) 66 F4 80 00 2D 63B3E BC 07 68 44 EA 20 (BC 3B) C2 F4 (35 9C) 66 F4 80 00 2D 63FF6 C2 F1 35 9C 68 11 (2D 05) C2 F4 (40 9C) 66 F4 80 00 2D 640E8 E7 F6 FE 00 65 F6 (34 9C) C2 F4 (33 9C) 66 F4 80 00 2D 6441A 2D 17 9A 13 01 B0 (0D 10) C2 F4 (69 8C) 66 F4 80 00 2D 647DC BC 07 68 44 EA 20 (58 48) C2 F4 (60 9C) 66 F4 80 00 2D 648B4 24 8F 18 9C 8A 13 (05 50) C2 F4 (1E 8A) 66 F4 80 00 2D 64C82 C2 F1 60 9C 68 11 (2D 05) C2 F4 (61 9C) 66 F4 80 00 2D 6546E 15 61 6D 09 8A 15 (05 30) C2 F4 (27 8A) 66 F4 80 00 2D 6547C 80 00 2D 0C 7E 15 (0D 0A) C2 F4 (27 8A) 66 F4 80 00 2D 658B6 0C 50 8A 16 01 20 (0D 09) C2 F4 (26 8A) 66 F4 80 00 2D 65DFC 65 F8 94 9C F6 8E (80 9C) C2 F4 (26 8A) 66 F4 80 00 2D 65E2A E1 28 75 F8 27 8A (0D 12) C2 F4 (26 8A) 66 F4 80 00 2D 65FE6 F6 F4 86 9C 9A 15 (4A 50) C2 F4 (27 8A) 66 F4 80 00 2D 66122 02 60 C4 40 02 00 (0D 20) C2 F4 (25 8A) 66 F4 80 00 2D 676A2 02 00 0D 13 D7 40 (E1 00) C2 F4 (7F 18) 66 F4 80 00 2D 6DDE2 F2 F4 44 9E 68 42 (3D 05) C2 F4 (64 8A) 66 F4 80 00 2D 6E242 76 F4 02 60 C4 40 (04 00) C2 F4 (64 8A) 66 F4 80 00 2D 724BA 68 8A 66 F4 08 00 (2D 0A) C2 F4 (22 0E) 66 F4 80 00 2D 73A46 C2 F4 C3 89 68 41 (2D 20) C2 F4 (33 BC) 66 F4 80 00 2D 745A4 E7 F8 7F 00 65 F8 (C7 9F) C2 F4 (C7 9F) 66 F4 80 00 2D 78486 E7 FA FE 00 65 FA (11 A1) C2 F4 (10 A1) 66 F4 80 00 2D 7D0D2 F3 FA 50 15 F7 FA (A4 8A) C2 F4 (D4 A1) 66 F4 80 00 2D 84BDC FF F0 C4 50 02 00 (0D 28) C2 F4 (74 A2) 66 F4 80 00 2D 84EB0 75 A2 66 F4 20 00 (3D 17) C2 F4 (75 A2) 66 F4 80 00 2D 86786 68 41 2D 07 D7 40 (06 02) C2 F4 (D2 14) 66 F4 80 00 2D 8E1B4 C0 A4 8A 3C 01 E0 (0D 05) C2 F4 (20 1E) 66 F4 80 00 2D 8E262 8A 22 09 60 9A 3C (05 E0) C2 F4 (20 1E) 66 F4 80 00 2D 97086 65 F8 84 8B D7 40 (06 02) C2 F4 (03 1B) 66 F4 80 00 2D 9725E 65 F8 85 8B D7 40 (06 02) C2 F4 (04 1B) 66 F4 80 00 2D 9ED5E 44 19 66 FC 08 00 (3D 27) C2 F4 (DC AF) 66 F4 80 00 2D 9EDBC 65 F8 3D 19 48 C0 (3D 28) C2 F4 (DC AF) 66 F4 80 00 2D 9F1A0 68 41 3D 07 D7 40 (E1 00) C2 F4 (43 19) 66 F4 80 00 2D 9F33A 65 F8 43 19 D7 40 (06 02) C2 F4 (E8 1D) 66 F4 80 00 2D 9F46C 65 F8 42 19 D7 40 (06 02) C2 F4 (E7 1D) 66 F4 80 00 2D 9F59E 65 F8 41 19 D7 40 (06 02) C2 F4 (E6 1D) 66 F4 80 00 2D A04F4 F2 F4 02 A8 68 41 (3D 19) C2 F4 (E1 8B) 66 F4 80 00 2D A08EE 65 F8 E1 8B D7 40 (06 02) C2 F4 (60 1D) 66 F4 80 00 2D A0ACE D7 40 E1 00 F7 F8 (25 00) C2 F4 (14 A9) 66 F4 80 00 2D A0B1C 66 F4 20 00 EA 20 (D0 0B) C2 F4 (11 B1) 66 F4 80 00 2D A0B26 11 B1 66 F4 80 00 (2D 0A) C2 F4 (1E B1) 66 F4 80 00 2D A0B7A E7 F8 7F 00 65 F8 (1E B1) C2 F4 (14 A9) 66 F4 80 00 2D A0B8C C2 F4 15 A9 68 41 (2D 13) C2 F4 (11 B1) 66 F4 80 00 2D A0BC8 65 F8 15 A9 EA 00 (50 0C) C2 F4 (11 B1) 66 F4 80 00 2D A0C00 E7 F8 80 00 75 F8 (11 B1) C2 F4 (14 A9) 66 F4 80 00 2D A0C12 C2 F4 15 A9 68 41 (2D 13) C2 F4 (11 B1) 66 F4 80 00 2D A0F32 E7 F8 FE 00 65 F8 (1D B1) C2 F4 (12 B1) 66 F4 80 00 2D A141C E7 F8 FD 00 65 F8 (1C B1) C2 F4 (15 B1) 66 F4 80 00 2D A2064 E7 F8 FE 00 65 F8 (17 B1) C2 F4 (E0 8B) 66 F4 80 00 2D A24A0 C2 F4 1D B1 68 44 (2D 14) C2 F4 (15 B1) 66 F4 80 00 2D A250C F7 F8 23 00 EA 00 (EA 25) C2 F4 (15 B1) 66 F4 80 00 2D A4326 2D 03 DA 8A 88 40 (0D 1B) C2 F4 (E8 8B) 66 F4 80 00 2D A6C12 68 AA 66 F1 40 00 (3D 05) C2 F4 (68 AA) 66 F4 80 00 2D A8BF4 9A 48 02 40 9A 03 (16 30) C2 F4 (2D 8C) 66 F4 80 00 2D A8E6E 65 F8 B7 AA F7 8E (A1 AA) C2 F4 (B6 AA) 66 F4 80 00 2D AAC62 C2 F4 4E 8C 68 44 (3D 12) C2 F4 (4E 8C) 66 F4 80 00 2D AACD8 F3 F8 BA 24 F7 F8 (4A 8C) C2 F4 (45 8C) 66 F4 80 00 2D Title: Re: ME7.8 Bricked Post by: walt on August 15, 2015, 10:14:15 PM It runs!
We received the borrowed tool, but it turned out not to be from a dealer as I had assumed, it's an Autologic Porsche. https://autologic.com/products/bluebox (https://autologic.com/products/bluebox) After reprogramming the ecu, I checked the flash prom and the contents was exactly the same as before, except for an added entry for the vin number. This was in a previously blank area of the flash prom. The flash prom already had the correct vin number in it, so I don't know why another entry was added. The eeprom however had quite a few changes. I have attached it. Trying to guess at why the eeprom got corrupted, what comes to mind is reading about how the ecu keeps a copy of the eeprom in ram, then copies it back when ignition is switched off. When uploading a file with Kessv2, there are several key on/off sequences. Possibly, in some cases, Kessv2 is causing bad data to be written to the ram area where the eeprom data is temporarily stored? Specifically, this seems to happen consistently if you specify the wrong original file, before uploading the modified file. Example scenario: you try and upload a bin file from a different car, then specify that the original bin file is the file in your car. Result: kessv2 says that there is a checksum error. You try again, and tell kessv2 that the original file is the same one you are trying to upload. Result: kessv2 doesn't complain, uploads your file, but ecu is now bricked. Apart from the corrupted eeprom, it looks like there is a second problem which is harder to fix (needs Autologic tool). Once the problem happens, the ecu seems to become stuck in programing mode. The Autologic's last operation was "Resetting ecu". After this, the error in the dash dissappears, and the car will start. Any thoughts on what the Autologic "Resetting ecu" consists of? Seems to be the key to getting the ecu out of programming mode. PS In our case the Autologic tool asked for the immobilizer and ecu programming codes. You would have to get these from your hopefully friendly Porsche dealer. I found on this site, info on decoding this information from the eeprom bin. Unfortunately it did not apply to this ecu. I tried myself to figure out the coding, but haven't been able to yet. Title: Re: ME7.8 Bricked [fixed] Post by: ddillenger on August 15, 2015, 11:12:22 PM Usually it is sufficient to 00 the data at the end of the eeprom to exit programming :)
Title: Re: ME7.8 Bricked [fixed] Post by: walt on August 16, 2015, 12:00:39 AM Thanks ddillenger, I was hoping this might be the solution.
Just checked: All data from from 02C0h to 03FFh = 00h for both running and non running eeproms. Except for the checksums at end of each line. |