NefMoto

Technical => Reverse Engineering => Topic started by: nyet on September 21, 2015, 09:44:13 PM



Title: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 21, 2015, 09:44:13 PM
Just curious if any TDI IDAPro users have done any reverse engineering of the controversial OBDII code yet.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: grifrowl on September 22, 2015, 11:07:44 AM
Just curious if any TDI IDAPro users have done any reverse engineering of the controversial OBDII code yet.

First thing I thought of after I read the story. The EPA might take interest in someone with these skills as I would expect it to be much cheaper to pay a few guys to disassemble ecu code than to road sniff every car on the market. Perhaps this job already exists?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: prj on September 22, 2015, 11:21:20 AM
lol i read only the title of the post, i didn't read the contents!

As for TDI.

NOx emissions are affected by combustion temperature, which means:
* EGR rate
* Start of main injection
* pilot injection count and start timing
And of course injection duration.

In case of vehicles with Urea injection:
* Urea injection rate

So it's enough to retard SOI heavily and increase EGR rate to lower combustion temperature and output less NOx.
Then advance SOI back again and lower EGR rate for improved fuel economy and low-end torque at the cost of NOx emissions.

Job done.
You don't need IDA Pro for this.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 22, 2015, 11:30:57 AM
Any reason to think there are ECUs that do not have special calibration for test mode?

I'm guessing this practice is nearly universal, and for gasoline motors as well.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: seishuku on September 22, 2015, 08:18:05 PM
I'm somewhat curious on this too, what exactly triggers this "clean mode"?

I am having a laugh though, its still a way cleaner than cars of past years, but CARB seems to think that if something isn't done right now, EVERYONE WILL DIE OR GET CANCER.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: vwaudiguy on September 22, 2015, 08:26:49 PM
I'm somewhat curious on this too, what exactly triggers this "clean mode"?

It is my understanding this applies to TDI's that don't have a urea injection system installed. The ecu recognizes it's being run on a dyno from the wheel speed and steering angle sensor (most likely more), and would access different maps during this time.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: hopsis on September 22, 2015, 09:27:52 PM
I read on some UK site that if You run with the hood open, the hood switch lights a service bulb on the inner side of the bonnet which in turn signals the ecu that it's test mode time. Sort of would make sense since there is no reason for anyone to drive with the hood open normally. Then again, other sites have made claims that there is a separate device installed between ecu and engine harness. That I don't believe as it would have been found on the first day after these cars rolled out of the factory.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: adam- on September 23, 2015, 12:06:26 AM
It is my understanding this applies to TDI's that don't have a urea injection system installed. The ecu recognizes it's being run on a dyno from the wheel speed and steering angle sensor (most likely more), and would access different maps during this time.

But what about actual mapping?  People without the know of this would put it on a dyno and wonder why real world is different.

Then, how many cars do they use as a base?  Do they use real world cars on a dyno, or just an engine mounted up on a dyno?  Even with a separate harness installed between the loom and the ECU, there still has to be a pathway that it follows.

If someone disassembles the code, they'll find it fast.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: prj on September 23, 2015, 01:11:54 AM
No need to disassemble, looking at a2l is moe than likely enough...

The thing is, it's not only VW. VW must have specifically ordered this from Bosch, who complied.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: adam- on September 23, 2015, 01:26:56 AM
So VW asked for a mode they could set with one code word that would allow a "test mode"?  Should Bosch have told them no, because that's the "moral" thing to do?

Then what happens with the compiled software?  Do Volvo, Alfa, BMW just take it and make slight amendments?  Then are all these manufacturers responsible, or is it Bosch, for compiling it in the first place?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: Geremia on September 23, 2015, 02:49:51 AM
But....aside the method to reduce emission, how does the ecu knows if car is on dyno or on road? From abs inertial measurement (speed changes but always zero accelerations on all axis)?
Is it bosch or conti/simos? (or both  ;D)
Any a2l file to take a look?
 


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: spacey3 on September 23, 2015, 03:03:00 AM
So VW asked for a mode they could set with one code word that would allow a "test mode"?  Should Bosch have told them no, because that's the "moral" thing to do?

Then what happens with the compiled software?  Do Volvo, Alfa, BMW just take it and make slight amendments?  Then are all these manufacturers responsible, or is it Bosch, for compiling it in the first place?

You seem to be thinking along the lines of exactly what has been brought to light now.

http://www.bbc.co.uk/news/world-europe-34328689


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: adam- on September 23, 2015, 03:10:28 AM
Wonder if now is a good time to buy shares?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: aef on September 23, 2015, 03:33:10 AM
No you have to wait


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: prj on September 23, 2015, 04:39:12 AM
Do Volvo, Alfa, BMW just take it and make slight amendments?  Then are all these manufacturers responsible, or is it Bosch, for compiling it in the first place?

Usually only Bosch changes the code and adds or removes functionality. The only thing the OEM can do is request a functionality from Bosch or calibrate the existing functionality.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: silentbob on September 23, 2015, 10:27:23 AM
Today a lot of functions are object code that is developed by the OEM and the supplier has to provide the software interface. How much depends on the OEM. GM for example has their own software and only buys the hardware.
The stupidity involved in the VW case is really unbelievable.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: prj on September 23, 2015, 10:46:53 AM
Well considering every S-tronic gearbox contains (very conservative) shift maps for "Emissions mode", I doubt VW is only doing this in murica.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: silentbob on September 23, 2015, 11:23:05 AM
It's a significant difference between optimizing the calibration for the emmision test which is "legal" and using a "test mode". Probably others will be that stupid as well but every sane person will not pull a stunt like this especially in the US.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 23, 2015, 11:26:44 AM
It's a significant difference between optimizing the calibration for the emmision test which is "legal" and using a "test mode"

I always assumed that car manufacturers did this commonly. It works that way in EVERY other industry with government testing... you make up the test, specify the conditions for the test, and publish that along with the results.

The certification organization doesn't give a rats ass if it was done in a "special" test mode. They don't even double check the results; they assume you are being honest. All they care about is the big check you write them to get your rubber stamp.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: vwaudiguy on September 23, 2015, 02:17:27 PM
Here's another article.

http://www.wired.com/2015/09/vw-fool-epa-couldnt-trick-chemistry/?mbid=social_fb


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: AARDQ on September 23, 2015, 04:53:17 PM
I always assumed that car manufacturers did this commonly. It works that way in EVERY other industry with government testing... you make up the test, specify the conditions for the test, and publish that along with the results.

The certification organization doesn't give a rats ass if it was done in a "special" test mode. They don't even double check the results; they assume you are being honest. All they care about is the big check you write them to get your rubber stamp.

Not combustion equipment (boilers, combustion turbines).  Testing in a special test mode may net you an orange jump suit.  Most of such equipment is equipped with real-time monitoring with results often dumped right to the friendly monitoring folks.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 23, 2015, 04:58:50 PM
Here's another article.

http://www.wired.com/2015/09/vw-fool-epa-couldnt-trick-chemistry/?mbid=social_fb

Quote
How this happened is pretty neat. Michigan’s Stefanopolou says computer sensors monitored the steering column. Under normal driving conditions, the column oscillates as the driver negotiates turns. But during emissions testing, the wheels of the car move, but the steering wheel doesn’t. That seems to have have been the signal for the “defeat device” to turn the catalytic scrubber up to full power, allowing the car to pass the test

prj or anybody, can you confirm this?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: adam- on September 24, 2015, 12:08:58 AM
What happens if you put it on a dyno for tuning, rather than for measuring? 

You'd never get a good tune, because it would always be restricted; as per prj's description for reducing NOx.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: SB_GLI on September 24, 2015, 05:28:26 AM
What happens if you put it on a dyno for tuning, rather than for measuring? 

You'd never get a good tune, because it would always be restricted; as per prj's description for reducing NOx.

This is my biggest question as well.  How have performance tuners not noticed this for the last decade?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: Rick on September 24, 2015, 06:41:50 AM
What's interesting is that EDC17CP14 cars do not function on the Dyno without ABS disconnected - i.e. they will not give full power.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: spacey3 on September 24, 2015, 06:52:26 AM
What's interesting is that EDC17CP14 cars do not function on the Dyno without ABS disconnected - i.e. they will not give full power.

I think that answers the question then! It's all very naughty...


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: adam- on September 24, 2015, 07:05:06 AM
But it doesn't.  If what prj said is correct, to reduce emissions, cylinder temperatures have to be low.  And if they're low, power is restricted.

So surely if they're on the dyno for testing, power is low.  Rick said that if the ABS is disconnected on the dyno, power is restored.  Makes no sense, since you don't want power, you want emissions?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: Rick on September 24, 2015, 07:23:12 AM
they run, but will not give full power.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: spacey3 on September 24, 2015, 07:23:34 AM
But it doesn't.  If what prj said is correct, to reduce emissions, cylinder temperatures have to be low.  And if they're low, power is restricted.

So surely if they're on the dyno for testing, power is low.  Rick said that if the ABS is disconnected on the dyno, power is restored.  Makes no sense, since you don't want power, you want emissions?

I'm not sure I quite get you... As Rick said, they have low power on the dyno, which would make for low emissions wouldn't it? (I think this is what you're also saying)

The ABS sensor being disconnected I would assume deactivates this 'test mode'. Along with all these steering angle sensors etc. if one part of the system goes down then surely interventions would stop?

I guess you could try disconnecting only the steering angle sensor and seeing if that 'restores' power on the dyno also.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: adam- on September 24, 2015, 07:31:28 AM
Yes, so leave the ABS connected and you have limited power?  Is that just because it doesn't understand why the front wheels are spinning and the back's aren't, so it limits power? 

Torque intervention?  Rather than emissions control.  Not sure that's right.  Don't understand the steering angle sensors either.  From a point of view of tuning, why has no-one complained on poor results because the ECU is in "test mode"? 

I'm convinced there's gotta be a codeword setting it.  Do we even know how they test them?  What if they're not installed in the car and on test beds instead?  There would be no steering sensors.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: spacey3 on September 24, 2015, 07:43:10 AM
Yes, so leave the ABS connected and you have limited power?  Is that just because it doesn't understand why the front wheels are spinning and the back's aren't, so it limits power? 

Possibly it's just that - I don't know the reasons/ways they are doing it.

Torque intervention?  Rather than emissions control.  Not sure that's right.  Don't understand the steering angle sensors either.  From a point of view of tuning, why has no-one complained on poor results because the ECU is in "test mode"? 

If there is no/very little steering input, then I guess they could assume that the car is being tested (obviously comes into question what happens when you're on the motorway for instance, is this where ABS sensors come in?)

I'm convinced there's gotta be a codeword setting it.  Do we even know how they test them?  What if they're not installed in the car and on test beds instead?  There would be no steering sensors.

I wouldn't be surprised if they were set with a codeword and only for test vehicles... But I think (this is only my opinion) this would be a bit risky and would have been discovered a lot earlier.

Besides, with the coming investigations I'm sure all will be revealed!


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: Rick on September 24, 2015, 07:47:11 AM
The test in question is very specific and done on a Dyno, so it would be easy to detect.



Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: elRey on September 24, 2015, 09:43:53 AM
Codeword - third party discovered this on cars in market, not 'test vehicles'. That's the way I read article linked in page 2.

Dyno tuning using high load runs could fall outside of emission testing procedures, thus never triggering this test mode. I've never had my car ran at WOT for emission testing.  So, it is possible this does not affect dyno tuning enough to be obvious.

Not that the article discloses everything, but it only mentions cat injection functions post engine. How does that affect performance?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 24, 2015, 10:50:42 AM
Besides, with the coming investigations I'm sure all will be revealed!

Knoll's Law of Media Accuracy suggests otherwise.

I'd rather trust the knowledgeable reverse engineering types here :)

Specifically, somebody who has looked at the emissions code with IDAPro...


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: silentbob on September 24, 2015, 12:33:33 PM
There is a lot of bullshit written in the media. Best is to read the EPA letters to VW
http://www.arb.ca.gov/newsrel/in_use_compliance_letter.htm
http://www3.epa.gov/otaq/cert/documents/vw-nov-caa-09-18-15.pdf

It's pretty clear what is done:
-Reduce/turn off the regeneration of the NOx cat for better fuel consumtion
-Reduce/turn off AdBlue injection to reduce fill up cycles

Every modern vehicle has a "test mode" that is needed to turn of ESP s.o. when on the dyno. This is a normal procedure even when the certification test is done. So the ECU knows when it's on the dyno. There are a million other ways to detect the cyle as it has precise temperature/time/speed/gear specifications.
Every manifacturer optimizes the calibration for the emission test. There is nothing wrong with it. Typical engineering target is 50% of the emission limits on a new vehicle to have headroom with a aged cat. In the US you have to ensure that the vehicle complies to the limits even with a 150000mile old cat. Every action that reduces the effectiveness of the emission control system (enrichment for component protection for example) has to be explained to the EPA otherwise you won't get a certification.
Everybody in the industry knows how strict the US authorities are and what can happen if they find out that you cheated so it's a unbelievable stupidity that was done here.
Winterkorn is gone. The press wrote today that Audis head of development Dr. Hackenberg, the head of development from Porsche Mr Hatz, and the current head of development from VW Dr Neußer will follow tomorrow.
In my opinion they deserve it because all indicators tell me that they took that risk just to safe a few pennies for better hardware. 


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 24, 2015, 01:18:45 PM
I think a 3rd factor is

-Reduce EGR cycle frequency to prevent cloggage and increase EGR equipment longevity/reliability.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 24, 2015, 01:31:16 PM
And a 4th, given what Rick said

-Reduce power (alter injection time, lower boost) on the dyno so the car also runs much leaner (less soot) and combustion temps are lower (less NOx)


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: vwaudiguy on September 24, 2015, 01:43:02 PM
Dr. Hackenberg

I can just see the meme's now....


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: grifrowl on September 24, 2015, 02:24:21 PM
Someone post up a TDI flash. I have next to no clue when it comes to disassembly, but I'm looking to learn for sure.

I like how over this entire media phenomenon, no one has bothered to point out that vw likely saved over 2 billion gallons of diesel fuel, not to mention a "dirty" TDI is a magnitude of hundreds under NOx emissions limits for a similar output 2015 "heavy duty" engine in the United States (weight/power*time based output limits vs weight/distance so I used 35 mi/hr average speed to hopefully make this a somewhat valid comparison). Don't get me wrong it was a terrible stunt to pull, but if the EPA were serious about limiting NOx content, things would be a little different for commercial diesels.

My guess is that the current diesel car limits were set more based on lobbying from domestic car companies that didn't want to have to compete with German diesels and not based on scientific data.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: k0mpresd on September 24, 2015, 02:26:39 PM
I think a 3rd factor is

-Reduce EGR cycle frequency to prevent cloggage and increase EGR equipment longevity/reliability.

i think this is the main one.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: hopsis on September 24, 2015, 11:35:14 PM
My guess is that the current diesel car limits were set more based on lobbying from domestic car companies that didn't want to have to compete with German diesels and not based on scientific data.

My thoughts exactly. I'm inclined to think that this whole charade is because domestic manufacturers in US were being overrun by modern European diesel cars.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: adam- on September 25, 2015, 12:04:32 AM
No one has bothered to point out that vw likely saved over 2 billion gallons of diesel fuel, not to mention a "dirty" TDI is a magnitude of hundreds under NOx emissions limits for a similar output 2015 "heavy duty" engine in the United States (weight/power*time based output limits vs weight/distance so I used 35 mi/hr average speed to hopefully make this a somewhat valid comparison).

This.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 30, 2015, 10:41:53 AM
Anybody have an affected bin and an xdf or kp to go with it? I'd like to take a look.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: Snow Trooper on September 30, 2015, 10:53:04 AM
My thoughts exactly. I'm inclined to think that this whole charade is because domestic manufacturers in US were being overrun by modern European diesel cars.

This. Exactly this.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 30, 2015, 06:21:18 PM
http://nefariousmotorsports.com/forum/index.php?topic=9017.0title=

2007 MK5 GOLF GTI 2.0T FSI 6SP 1K0907115H

Is this one of them?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: ddillenger on September 30, 2015, 06:23:47 PM
http://nefariousmotorsports.com/forum/index.php?topic=9017.0title=

2007 MK5 GOLF GTI 2.0T FSI 6SP 1K0907115H

Is this one of them?

That is a petrol car.




Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: nyet on September 30, 2015, 07:26:55 PM
LOL oops


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: elRey on October 03, 2015, 11:13:39 AM
http://youtu.be/GhvI2oeBPtY (http://youtu.be/GhvI2oeBPtY)


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: prj on October 03, 2015, 11:31:09 AM
http://youtu.be/GhvI2oeBPtY (http://youtu.be/GhvI2oeBPtY)
Useless


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: TijnCU on October 03, 2015, 11:43:57 AM
That car is running in limp mode all the way, I mean this is not really stealth with all of that lights on the dash  ::)


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: elRey on October 03, 2015, 12:28:30 PM
Useless

meaning?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: vwaudiguy on October 03, 2015, 03:15:46 PM
Today I'm getting bombarded with law firms trying to capitalize on the VW fraud on FB..It's pretty shocking how many adverts from different law firms there are..


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: adam- on October 05, 2015, 12:28:48 AM
Today I'm getting bombarded with law firms trying to capitalize on the VW fraud on FB..It's pretty shocking how many adverts from different law firms there are..

This.  It's an absolute joke.  People associate "clean" cars with ones that achieve high MPG's.  That's what they received.

Now that they've caught wind that they could get up to £2000 compensation for what?   Being so stressed/loss of work/sleep/whatever.  People are idiots.

They should make dashboards from the skin of people that try to sue.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: vwaudiguy on October 08, 2015, 04:44:59 PM
Damn

http://www.theregister.co.uk/2015/10/08/vw_german_offices_employees_homes_raided/


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: reset on November 02, 2015, 08:40:13 PM
Here's a full MPC, flash, eep from an affected car.
2011 golf DSG 03L906019DB SW7970

Hint: if you have an A2L find "short trip mode" look at the conditions for that.  ;D





Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: mbkr89 on November 06, 2015, 01:25:19 AM
Someone have A2L ?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: tmbinc on November 08, 2015, 05:40:06 AM
I've dumped 03L907309AE/03L906018PA 2288(R4 2,0L EDC, CFFB); the car it was taken from _should_ be affected (VIN according to EEPROM: WVWZZZ3CZCE10508000), "VW Passat Kombi, Bj. 2013" according to seller. Can someone verify that this car is indeed affected?

Unfortunately I wasn't able to find an A2L for it. I have an A2L for a TDI 2.0 Tiguan (DX55ZDCUJ0000.hex, DX55ZR4000000.a2l; part of this "10GB mappack" that is floating around), but I'm not sure if _that_ is affected.

Anyway, reset, do you have more information that it's indeed related to "short trip mode"? I would have expected it to affect the dosing strategy somehow, but so far I haven't found anything suspicious. The VW-specific code _does_ take the steering wheel angle, speed, TCS mode, measured forward acceleration etc., but I haven't yet found the connection between that function and the dosing strategy.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: tmbinc on November 11, 2015, 02:12:05 PM
Ok, I've checked both VINs (my dump and reset's dump) with http://info.volkswagen.de/checkVIN?vin=<vin> (and also https://www.vwdieselinfo.com/goodwill_package/, but it only complains about the VINs, even with corrected check digit), and both claim to be unaffected.

Does someone have a dump from a vehicle that's surely affected as indicated by any of the above URLs?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: seishuku on November 11, 2015, 03:51:20 PM
Mine is, as verified by that site. However, I don't have any way to pull the ROM.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: A4Rich on November 11, 2015, 03:55:53 PM
I have a affected 2013 Passat as verified by that site.  But am in the same boat unfortunately no way to read bin...  :(   Anyone in the Orange County California Area that can?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: reset on November 12, 2015, 12:48:22 PM
tell me the ecu part number and SW version and I will see if I have it

from VCDS please not the cover of the ecu  ;D


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: tmbinc on November 12, 2015, 12:57:58 PM

Address 01: Engine (J623-CFFB)       Labels: None
   Part No SW: 03L 906 018 HK    HW: 03L 907 309 Q
   Component: R4 2,0L EDC   H28 3533
   Revision: 44H28---    Serial number:
   Coding: 0019003A043601080000
   Shop #: WSC 00020 999 00000
   ASAM Dataset: EV_ECM20TDI01103L906018HK 003009
   ROD: EV_ECM20TDI01103L906018HK.rod
   VCID: 7AF1834CFDC446E


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: A4Rich on November 12, 2015, 01:29:27 PM
Address 01: Engine (J623-CKRA) Labels: 03L-906-012-CKR.clb
Part No SW: 03L 906 012 DE HW: 03L 907 309 S
Component and/or Version: R4 2,0L EDC H24 8401
Software Coding: 001D0012042400000000
Work Shop Code: WSC 63484 001 1048576
ASAM Dataset: EV_ECM20TDI01103L906012DE 004008 (VW41)
VCID: 6AD1C9128D2B216EE8-803E


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: seishuku on November 12, 2015, 04:02:06 PM
Address 01: Engine (CJA)       Labels: 03L-906-022-CBE.clb
   Part No SW: 03L 906 019 HE    HW: 03L 907 309 AA
   Component: R4 2,0L EDC G000SG  4606 
   Revision: 12H14---    Serial number:               
   Coding: 0050072
   Shop #: WSC 00066 000 00000
   VCID: 75EAF8541C686D894D9-8020


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: tmbinc on November 14, 2015, 06:00:16 AM
Ok, with FRF -> ODX and ODX -> BIN (using the two algorithms posted in the other thread), I was able to obtain FL_03L906018HK_3533. Now does anyone have an A2L for it?

There's some "changed" stuff in the DStgy calculation (the mask with required flags to enable AdBlue dosing), but it could just be some other functionality (I don't have a matching FR).


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: reset on November 18, 2015, 06:15:34 PM
Address 01: Engine (J623-CKRA) Labels: 03L-906-012-CKR.clb
Part No SW: 03L 906 012 DE HW: 03L 907 309 S
Component and/or Version: R4 2,0L EDC H24 8401
Software Coding: 001D0012042400000000
Work Shop Code: WSC 63484 001 1048576
ASAM Dataset: EV_ECM20TDI01103L906012DE 004008 (VW41)
VCID: 6AD1C9128D2B216EE8-803E

Here's the CKRA
might not be complete though as it is an OBD (virtual) read


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: reset on November 18, 2015, 06:21:43 PM
Address 01: Engine (CJA)       Labels: 03L-906-022-CBE.clb
   Part No SW: 03L 906 019 HE    HW: 03L 907 309 AA
   Component: R4 2,0L EDC G000SG  4606 
   Revision: 12H14---    Serial number:               
   Coding: 0050072
   Shop #: WSC 00066 000 00000
   VCID: 75EAF8541C686D894D9-8020


here's the CJAA (looks like 2013 golf or beetle)


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: reset on November 18, 2015, 06:22:18 PM
Ok, with FRF -> ODX and ODX -> BIN (using the two algorithms posted in the other thread), I was able to obtain FL_03L906018HK_3533. Now does anyone have an A2L for it?

There's some "changed" stuff in the DStgy calculation (the mask with required flags to enable AdBlue dosing), but it could just be some other functionality (I don't have a matching FR).


Which other thread?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: wannabee900 on November 19, 2015, 02:16:51 AM
Which other thread?
@ end of this
http://nefariousmotorsports.com/forum/index.php?topic=6583.0


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: seishuku on November 21, 2015, 09:05:47 AM
here's the CJAA (looks like 2013 golf or beetle)
Awesome, thanks!

Dumb question though, mpc file = raw binary dump?
In WinOLS it looks just like a plain ROM dump, but I'm new to these modern ECUs.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: aef on December 27, 2015, 07:15:43 AM
There was a stream at 32c3 which just ended where one showed and reversed it. I think the Video will ne available in some Hours.


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: aef on December 28, 2015, 05:40:53 AM
http://nefariousmotorsports.com/forum/index.php?topic=4401.0title=

here is the video from the talk


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: Cloudforce on December 28, 2015, 08:09:07 AM
Do we have access to the slides which Daniel mentioned? Theres one interesting part which he skipped out of time boundary and i´m super interested in this :)


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: aef on December 28, 2015, 08:39:56 AM
https://events.ccc.de/congress/2015/Fahrplan/system/event_attachments/attachments/000/002/812/original/32C3_-_Dieselgate_FINAL_slides.pdf


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: Cloudforce on December 28, 2015, 10:51:59 AM
Awesome, thanks alot


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: H2Deetoo on December 29, 2015, 01:42:33 AM
>Flash dumped by exploiting 0-day hardware bug in TriCore chip

What is meant with this 0-day bug?
Do they mean the bootmode feature?


Regards H2Deetoo,


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: aef on December 29, 2015, 04:39:38 AM
0day usually means it was unknown until he did it. So he used a way that no other chiptuner-hardwareguy did before.
but maybe it is the same way the kessv2 and other good tools read it. he is not interested and has not a inside view in the chiptuning world.
otherwise he would have used a ori from some forum.

so maybe his way was brand new or he only thought he was the one who discovered this.

just ask him :)


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: aef on January 13, 2016, 12:09:52 AM
http://www.npr.org/sections/thetwo-way/2016/01/11/462682378/we-didnt-lie-volkswagen-ceo-says-of-emissions-scandal

Quote
Matthias Mueller: Frankly spoken, it was a technical problem. We made a default, we had a … not the right interpretation of the American law. And we had some targets for our technical engineers, and they solved this problem and reached targets with some software solutions which haven't been compatible to the American law. That is the thing. And the other question you mentioned — it was an ethical problem? I cannot understand why you say that.

 ::)


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: metronet on March 11, 2016, 05:59:56 PM
Somewhat related:
http://www.greencarreports.com/news/1102587_vw-kept-earlier-audi-emissions-issue-from-regulators

Quote
But then an Audi official in Germany named Bernhard Grossman reportedly told Norbert Krause--the U.S. employee's supervisor--to "delete the EGT."

Does anyone know which Audi model was effected in the 3,900 cars that are turbo charged and had the EGT deleted?

I read about this somewhere but don't remember exactly which engine... 1.8T ?


Title: Re: Anybody reverse engineer VW's "test mode" yet?
Post by: seishuku on March 12, 2016, 06:16:03 PM
"said it would be a huge issue."?
Really? It's an EGT sensor! EGTs can be modeled with out a physical sensor and have been for a very long time.

These EPA people really are clueless...