NefMoto

Technical => Reverse Engineering => Topic started by: fluke9 on November 03, 2019, 09:41:08 AM



Title: EEPROM descriptor table, where to find it and how does it work?
Post by: fluke9 on November 03, 2019, 09:41:08 AM
Does anyone have infos about where the eeprom descriptor table resides and how to get the real eeprom layout from it ?

I dumped the eepromMirror in ram using mcmess and got all the important stuff but the mirror is not a 1:1 copy of the eeprom.
For example the pages which are duplicated in eeprom (backup strategy?) or empty pages are missing, so my dump is not 1:1.

What i already found out is that i can read/write to the mirror using mcmess and it gets copied to the eeprom in the afterrun (KL15 off),
works like a charm.

Which brings up the idea of a simple tool which does not require bootmode.

Best would be to be able to find out the layout from ram (which i doubt is possible) or atleast by specifying a bin.


For my purposes (disable immo, reset some counters) its already good enought the way it is,
but .eep dumps which are not exactly like the real eeprom is might confuse people if they mix and match with me7eeprom or bench reading.





Title: Re: EEPROM descriptor table, where to find it and how does it work?
Post by: fluke9 on November 03, 2019, 09:49:54 AM
ram vs real:

(https://i.ibb.co/0Fxzc3V/mcmess-EEP.png) (https://ibb.co/LJ3s8fh)


Title: Re: EEPROM descriptor table, where to find it and how does it work?
Post by: fluke9 on November 03, 2019, 03:07:23 PM
Ok found it using some doc i found from setzi on how to calculate the checksum.
Easy as pie the routine using the table is the same in ~50 ME7 bins i tried.

Thread can be closed, solution is here:
http://nefariousmotorsports.com/forum/index.php?topic=16933.0title=