NefMoto

Technical => Flashing and Chipping => Topic started by: d0xx on January 22, 2023, 02:20:27 PM



Title: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: d0xx on January 22, 2023, 02:20:27 PM
A small contribution from Getcharged - maZer.GTi (http://nefariousmotorsports.com/forum/index.php?action=profile;u=822 (http://nefariousmotorsports.com/forum/index.php?action=profile;u=822)) and myself.

Hardware:
VAG KKL or VCDS

Features:
*Read calibration and 24C02
*Full write (F200) + checksum calculation

Works on OBD with PIN43 +12v or direct connection on bench.

Usage: m38_flasher.exe -h

---The calibration read is just for backup purposes and cannot be flashed, use a full file instead.

Have fun..

UPDATE01: Added option "-s" for a slower write of F200

File-MD5: 6d6a1c63a633d71c143716e3a0fb4157



Title: Re: Free M3.8/M5.9 Flasher (Read/Write/E2P)
Post by: maZer.GTi on January 22, 2023, 02:24:17 PM
Small present for people not want to disolder 24C02...
06A906018R - 359591
Immo Off in Flash


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: eliotroyano on January 22, 2023, 02:40:14 PM
A small contribution from Getcharged - maZer.GTi (http://nefariousmotorsports.com/forum/index.php?action=profile;u=822 (http://nefariousmotorsports.com/forum/index.php?action=profile;u=822)) and myself.

Hardware:
VAG KKL or VCDS

Features:
*Read calibration and 24C02
*Full write (F200) + checksum calculation

Works on OBD with PIN43 +12v or direct connection on bench.

Usage: m38_flasher.exe -h

---The calibration read is just for backup purposes and cannot be flashed, use a full file instead.

Have fun..

Really nice someone still consider these ECUs. Can you provide an example of a reading?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: d0xx on January 22, 2023, 02:42:50 PM
Really nice someone still consider these ECUs. Can you provide an example of a reading?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: Blazius on January 22, 2023, 03:29:42 PM
Cool. Cheers


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: eliotroyano on January 22, 2023, 03:37:03 PM
* 06A906018R_24C02_1674126097.bin (0.25 KB - downloaded 2 times.)
* 06A906018R_CALI_1674126097.bin (64 KB - downloaded 3 times.)

Looks really nice. Good work. I notice maps + RAM eeprom area, but what is included after that? I mean the big area after D000h in the CAL dump you sent.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: d0xx on January 22, 2023, 03:57:37 PM
Looks really nice. Good work. I notice maps + RAM eeprom area, but what is included after that? I mean the big area after D000h in the CAL dump you sent.

As mentioned, this file is just for backup purposes, it is what the ECU internally sees @0xD000. The main goal was, that there is a backup of the calibration area. It can be RAM as well as CPU content.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: eliotroyano on January 22, 2023, 04:13:00 PM
As mentioned, this file is just for backup purposes, it is what the ECU internally sees @0xD000. The main goal was, that there is a backup of the calibration area. It can be RAM as well as CPU content.

Ok. For example the 6500h-BFFFh area can be used a main CAL o Maps area and pasted in an 29F200 complete content (that can be found in the net) can generate a full writable file. Inclusive I notice after that the eeprom area, main immo + RAM backup. I have done something like that (read eeprom + maps) in the past using Monoscan software. Of course not as an automated procedure like your software. How much time do you estimate reading that 64Kb file?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: d0xx on January 22, 2023, 04:28:44 PM
Ok. For example the 6500h-BFFFh area can be used a main CAL o Maps area and pasted in an 29F200 complete content (that can be found in the net) can generate a full writable file. Inclusive I notice after that the eeprom area, main immo + RAM backup. I have done something like that (read eeprom + maps) in the past using Monoscan software. Of course not as an automated procedure like your software. How much time do you estimate reading that 64Kb file?

Actually, it is running slow to prevent reading errors, and it takes ~12min to read that 64KB area. It could probably done faster, but the chance of error's will be higher.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: prj on January 22, 2023, 05:49:45 PM
Source? Github?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: d0xx on January 22, 2023, 08:35:05 PM
Source? Github?

Feel free to ask, whatever you want to ask, and we will answer, but the sourcecode will not be released, it contains partially source of other people's work which is not released so far, and we will not release that either.
Our contribution was giving people the ability to use it, if someone want to.

Br


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: chacarita on January 22, 2023, 09:00:10 PM
Thank you gentlemen. Appreciate the collaboration!


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: prj on January 23, 2023, 01:56:21 AM
Feel free to ask, whatever you want to ask, and we will answer, but the sourcecode will not be released, it contains partially source of other people's work which is not released so far, and we will not release that either.
Our contribution was giving people the ability to use it, if someone want to.

Br
There is nothing I need to know about this long abandoned thing.
MPPS has also been writing it for ages and the cloned v18 even uses the untouched original digitally signed binaries.

On the other hand your executable has no digital signature, and there is no source release.
As a reminder not so long ago there was a tool posted that identified software numbers of various ECU's for free.
It also uploaded your entire WinOLS database to a certain Google Drive in the background. Also for free ;)

Now, I am not saying you are doing something malicious, but opening random exe files from the internet that aren't even signed is usually a bad idea.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: d0xx on January 23, 2023, 03:08:22 PM
There is nothing I need to know about this long abandoned thing.
Fine.

MPPS has also been writing it for ages and the cloned v18 even uses the untouched original digitally signed binaries.
Yes, but doesnt read it.

On the other hand your executable has no digital signature, and there is no source release.
As a reminder not so long ago there was a tool posted that identified software numbers of various ECU's for free.
It also uploaded your entire WinOLS database to a certain Google Drive in the background. Also for free ;)

Now, I am not saying you are doing something malicious, but opening random exe files from the internet that aren't even signed is usually a bad idea.

People who doesn't need it, must not use it. People who wants to use it, can trust us. And more advanced users, who doesnt trust us, feel free to test it in one of the sandboxes online first, or whatever possibility there is.
Just to make it clear, that someone who intents to do something bad to others, will probably use something which targets more then like 10 people, and they will probably not post that in a forum full of experts, like you.

However, the source will not be released. Have a nice evening.

Br


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: prj on January 23, 2023, 03:44:14 PM
Fine.
Yes, but doesnt read it.

People who doesn't need it, must not use it. People who wants to use it, can trust us. And more advanced users, who doesnt trust us, feel free to test it in one of the sandboxes online first, or whatever possibility there is.
Just to make it clear, that someone who intents to do something bad to others, will probably use something which targets more then like 10 people, and they will probably not post that in a forum full of experts, like you.

However, the source will not be released. Have a nice evening.

Br
Who exactly would they "trust"? Your binary is unsigned. There is no one to "trust".
I can take your binary, add a trojan to it and re-post it, and so can anyone else.

Get a code cert and sign it if you're remotely serious about software development. Even if you don't release the source.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: d0xx on January 23, 2023, 04:29:39 PM
Who exactly would they "trust"? Your binary is unsigned. There is no one to "trust".
I can take your binary, add a trojan to it and re-post it, and so can anyone else.

Get a code cert and sign it if you're remotely serious about software development. Even if you don't release the source.

Yes, fair, but you could also make an unsigned "trojan", which sideloads our then signed binary, so the user will not see what happens either.
The one who trust us, can download it here, and what others do, is not our "coffee" as we say in germany.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: prj on January 24, 2023, 05:40:34 AM
Yes, fair, but you could also make an unsigned "trojan", which sideloads our then signed binary, so the user will not see what happens either.
This is not how this works. The sideloading tool would be unsigned, and such behavior also very likely will get caught by the default AV in Windows.
Quote
The one who trust us, can download it here, and what others do, is not our "coffee" as we say in germany.
No, the reality is you are spreading an unsigned binary without source code in 2023. There is no one to trust, because the binary is unsigned, so there is no trust chain.
It's like putting up a website without https in 2023.
It just shows your level, or lack thereof, nothing else.

Had your binary been signed, I would not have written anything about the source.
Your assumption that I needed to learn anything from it was very misguided, it was from the start about security.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: _nameless on February 10, 2023, 11:45:32 PM
USA AEB M5.9.2 does not work.

Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator>cd desktop

C:\Users\Administrator\Desktop>m38_flasher
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx

m38_flasher.exe
    -rb                                 Read Calibration and 24C02 of ECU
    -wr filename.bin                    Write Firmware File to Flash
    -s                                  Slow Mode ( for Safety )
    -u                                  Print this usage Screen

C:\Users\Administrator\Desktop>m38_flasher -rb
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -ba used, doing Backup of ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 01
Baudrate set to 9600
Starting SlowInit to 01
Format: 9600 8N1 Set
KWP Protocol Version: 2031
Unknown KWP Version, only 1281 supported at the moment... abort!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...

C:\Users\Administrator\Desktop>m38_flasher -s
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -s used, slowMode active
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 01
Baudrate set to 9600
Starting SlowInit to 01
Format: 9600 8N1 Set
KWP Protocol Version: 2031
Unknown KWP Version, only 1281 supported at the moment... abort!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...



**UPDATE**
leaving pin 43 without 12v works, the ecu connects at kwp1281 and reads without issue.
Code:
C:\Users\Administrator\Desktop>m38_flasher -rb
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -ba used, doing Backup of ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 01
Baudrate set to 9600
Starting SlowInit to 01
Format: 9600 8N1 Set
KWP Protocol Version: 1281
KW1281 init success to : 8D0907557P

Reading 0x0FF0 ... 100%
Dumping finished, searching 24C02 EEPROM...  Success!
EEPROM written to 8D0907557P_24C02_1676098682.bin

Reading ROM_Calibration 0x0000 - 0xBFFF
Reading 0xBFFF ... 100%
ROM written to 8D0907557P_CALI_1676098682.bin
Closing KW1281 Connection


** UPDATE 2 **
Writing does not work at all

Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator>cd desktop

C:\Users\Administrator\Desktop>m38_flasher -wr 123.bin
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -w used, writing 123.bin to ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 11
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...

C:\Users\Administrator\Desktop>m38_flasher -wr 123.bin
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -w used, writing 123.bin to ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 11
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...

C:\Users\Administrator\Desktop>m38_flasher -wr 123.bin
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -w used, writing 123.bin to ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 11
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: Geomeo on February 11, 2023, 07:02:21 AM
9600 baud?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: maZer.GTi on February 11, 2023, 07:59:05 AM
USA AEB M5.9.2 does not work.

Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator>cd desktop

C:\Users\Administrator\Desktop>m38_flasher
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx

m38_flasher.exe
    -rb                                 Read Calibration and 24C02 of ECU
    -wr filename.bin                    Write Firmware File to Flash
    -s                                  Slow Mode ( for Safety )
    -u                                  Print this usage Screen

C:\Users\Administrator\Desktop>m38_flasher -rb
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -ba used, doing Backup of ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 01
Baudrate set to 9600
Starting SlowInit to 01
Format: 9600 8N1 Set
KWP Protocol Version: 2031
Unknown KWP Version, only 1281 supported at the moment... abort!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...

C:\Users\Administrator\Desktop>m38_flasher -s
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -s used, slowMode active
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 01
Baudrate set to 9600
Starting SlowInit to 01
Format: 9600 8N1 Set
KWP Protocol Version: 2031
Unknown KWP Version, only 1281 supported at the moment... abort!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...



**UPDATE**
leaving pin 43 without 12v works, the ecu connects at kwp1281 and reads without issue.
Code:
C:\Users\Administrator\Desktop>m38_flasher -rb
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -ba used, doing Backup of ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 01
Baudrate set to 9600
Starting SlowInit to 01
Format: 9600 8N1 Set
KWP Protocol Version: 1281
KW1281 init success to : 8D0907557P

Reading 0x0FF0 ... 100%
Dumping finished, searching 24C02 EEPROM...  Success!
EEPROM written to 8D0907557P_24C02_1676098682.bin

Reading ROM_Calibration 0x0000 - 0xBFFF
Reading 0xBFFF ... 100%
ROM written to 8D0907557P_CALI_1676098682.bin
Closing KW1281 Connection


** UPDATE 2 **
Writing does not work at all

Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator>cd desktop

C:\Users\Administrator\Desktop>m38_flasher -wr 123.bin
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -w used, writing 123.bin to ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 11
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...

C:\Users\Administrator\Desktop>m38_flasher -wr 123.bin
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -w used, writing 123.bin to ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 11
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...

C:\Users\Administrator\Desktop>m38_flasher -wr 123.bin
GETCHARGED M38-Flasher Version 0.1 by maZer and d0xx
Parameter -w used, writing 123.bin to ECU
Connection to the chip opened successfully
Trying to Wake up ECU on ID: 11
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Baudrate set to 10400
Starting SlowInit to 11
Connection Timeout!
Error in init Connection, please Turn ECU OFF and wait 10 Seconds, Turn ON and t
ry again...

Did you connected the 12V to Pin 43? It looks like its not connected.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: _nameless on February 11, 2023, 09:57:24 AM
Did you connected the 12V to Pin 43? It looks like its not connected.
Yes, tried both with and without no luck. Tested with mpps to triple check pinout and wrote fine.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: leolux on March 20, 2023, 07:35:46 PM
AEB should not have a flash its a OTP PLCC44 and cnat be rewritten :/


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: _nameless on March 20, 2023, 11:33:43 PM
AEB should not have a flash its a OTP PLCC44 and cnat be rewritten :/
USA market AEB is M5.9.2 AM29F200... So yeah, it can.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: overspeed on March 21, 2023, 05:38:20 PM
Tried once and worked ok, then another Day never worked again, allways error when reading eeprom.

And no save of readed cal file.


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: d0xx on March 23, 2023, 01:50:09 PM
Tried once and worked ok, then another Day never worked again, allways error when reading eeprom.

And no save of readed cal file.

Sounds like a problem on your end, same circumstances and same PC/folder/permissions?
For the save problem, did you tried to run it as administrator, and no special characters in foldername?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: _nameless on March 24, 2023, 01:18:51 AM
Sounds like a problem on your end, same circumstances and same PC/folder/permissions?
For the save problem, did you tried to run it as administrator, and no special characters in foldername?
How about my experience? Its not 100% needed however it would be nice to have another alternative to MPPS for writing. 


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: overspeed on March 24, 2023, 06:15:39 AM
Sounds like a problem on your end, same circumstances and same PC/folder/permissions?
For the save problem, did you tried to run it as administrator, and no special characters in foldername?

tried on 3 diferent PC, 2 diferent ECU



Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: _nameless on March 24, 2023, 09:56:46 AM
This is not how this works. The sideloading tool would be unsigned, and such behavior also very likely will get caught by the default AV in Windows.No, the reality is you are spreading an unsigned binary without source code in 2023. There is no one to trust, because the binary is unsigned, so there is no trust chain.
It's like putting up a website without https in 2023.
It just shows your level, or lack thereof, nothing else.

Had your binary been signed, I would not have written anything about the source.
Your assumption that I needed to learn anything from it was very misguided, it was from the start about security.
On top of that, the software is broken, no source and dev won't do anything about it lol. Wtf is the point of posting it here if you have no plans on fixing  and keep source privet? Stroking contest?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: IamwhoIam on March 25, 2023, 12:51:56 AM
Who knows if the developer's goal wasn't to get a backdoor into unsuspecting users computers?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: overspeed on March 27, 2023, 10:56:35 AM
tried on 3 diferent PC, 2 diferent ECU



tried again, another PC (tested Windows 10 and XP now) and another ECU - no way too

read BIN

then searching 24C02 EEPROM ... ERROR  and donĀ“t save BIN or start reading EEPROM


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: ecuprog7 on May 02, 2023, 04:52:25 AM
Hi, i have the same problem , tool reads then writes "ERROR". I think the tool is searching for a pattern which is not present or not supporting older versions. I started to try it myself, on my 8D0907557S the eeprom starts at Ram 0xC27a and the backup page has 0x40 offset.
Does anyone know if i need to do a login and which for writing to ram?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: crackerx on January 26, 2024, 05:31:10 AM
Looks like you are the shadow of PRJ. He wrote that before, also explained without h8.

BTW, Wireshark installed on your PC will tell you.

Who knows if the developer's goal wasn't to get a backdoor into unsuspecting users computers?


Title: Re: Free M3.8/M5.9 Flasher (Read/Write - Flash | Read - E2P)
Post by: maZer.GTi on January 26, 2024, 05:39:19 AM
Who knows if the developer's goal wasn't to get a backdoor into unsuspecting users computers?

Is that the way you would do that?