NefMoto

Technical => Flashing and Chipping => Topic started by: nyet on January 27, 2013, 02:54:24 AM



Title: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on January 27, 2013, 02:54:24 AM
This project is under BSD open source license. Its on the most unrestrictive
freeware license possible. No warranty implied or given.

It is a tool written in C for management of Bosch ME7.1 firmware dumps. It's a command line tool, as in just clicking it does nothing! You have to know how to use cmd.

The latest binary releases are always available here:
http://nyetwurk.github.com/ME7Sum/

The latest version (as of 24 July 2017) is v1.0.5

To output corrected checksums you must specify an output file:

 me7sum image.bin out.bin

If you omit "out.bin" it me7sum will only CHECK the file, not correct it.

Note that if me7sum cannot completely detect checksum/CRC locations correctly, it will not output a file!

** Always use me7sum on a original version of your bin first to make sure it is compatible! **

** Make sure to check all corrected bins with ME7Check.exe before flashing them! **

Source code:
https://github.com/nyetwurk/ME7Sum/

Readme:
https://github.com/nyetwurk/ME7Sum/blob/master/README.md


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: bofh on January 05, 2014, 03:53:24 PM
thank you for this great tool!  :)

btw: seems to work with ME7.5 (APX 8L0906018M). ME7Check says file is ok after running ME7Sum.  ;D



ME7Check_linux v1.12 (c) mki, 06/2004-05/2012
Checking file test.bin (size=524288)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 42/1/ME7.5/5/4018.10//F19x6/Dst02o/101299/
-> Contents of ECUID data table:
   - '0261206797'         (SSECUHN)         
   - '1037354094'         (SSECUSN)         
   - '8L0906018M  '       (VAG part number)
   - '0002'               (VAG sw number)   
   - '1.8L R4/5VT         '   (engine id)       
-> Contents of ECUID data table:
   - 'HW_MAN004'                           

-> No errors found. File is OK.   *********************


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: AARDQ on September 24, 2014, 10:50:19 PM
4Z907551R with modified KFZW.  ME7Check results at the bottom.  This is OK, as common lore would have it?  Epic tool!  I've been dreading the day when my ancient laptop with MTX Tunerpro plugin dies.

c:\me7checktest>me7sum me711testA.bin me711testcorr.bin
ME7Tool (v0.0.6) [ Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'me711testA.bin'

Step #1: Reading ROMSYS ..
 Startup section: word[0x00008000]+word[0x0000FFFE]
 @8038 Add=0x00004AEB CalcAdd=0x00004AEB  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @803c Add=0x0099D9E5 CalcAdd=0x0099D4E0 ** FIXED **
 All param page: word[0x00010000]+word[0x0001FFFE]
 @1e182 Add=0x971D CalcAdd=0x971D  ADD OK

Step #2: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data checksum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 1) Adr: 0x010002-0x013FFE CalcCSM: 00129311
 2) Adr: 0x014382-0x017F4E CalcCSM: 0029DE60
 3) Adr: 0x018192-0x01FBDC CalcCSM: 004795AD
 4) Adr: 0x026A00-0x02FFFC CalcCSM: 00A6913D
 @abee6 CSM: 00A68D2B CalcCSM: 00A6913D ** FIXED **

Step #3: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @27f90 [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF  SKIPPED CalcChk: 0x23DDE12D CalcCRC: 0x585F363E
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chksum: 0xA58D3F15 CalcChk: 0xA58D491F ** FIXED! **

Step #4: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...SKIPPED
 Searching for multipoint block descriptor #2...OK
 Multipoint #1: [64 blocks x <16> = 1024 bytes]

*** Found 69 checksums in me711testA.bin

Attempting to output corrected firmware file 'me711testcorr.bin'
├╛ Opening 'me711testcorr.bin' file for writing
├╛ Writing to file
├╛ Validating size correct 1048576=1048576
├╛ All OK, closing file

*** DONE! 6/6 errors corrected in me711testA.bin! ***


c:\me7checktest>me7check me711testcorr.bin
==============================================================================
me7check v1.12 (c) mki, 06/2004-05/2012
Checking file me711testcorr.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.02
-> EPK = 43/1/ME7.1.1/5/6011.02//A25an/Dst5A/150502/
-> Contents of ECUID data table:
   - '??????????'         (SSECUHN)
   - '??????????'         (SSECUSN)
   - '4Z7907551R  '       (VAG part number)
   - '    '               (VAG sw number)
   - 'U25AN34.hex LEV'    (engine id)
-> Contents of ECUID data table:
   - 'HW_MAN004'


Warning: the bootrom copy in flash contains modified code
RSA signature failure found
-> Found 1 error!!!   *******************************


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 24, 2014, 11:09:32 PM
Yea the RSA error is as expected - I have no idea how that is done still.

Also, there is one multipoint checksum area not checked yet for ME7.1.1 - 0x0 - 0x3fff ... hopefully not too many people modify that area.

I'm currently trying to figure that one out too.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: hopsis on September 25, 2014, 02:44:08 AM
Some problems with ME7.1 also.

C:\Users\Käyttäjä\Desktop\tunettamiset\temp\new me7 check>me7check testi.bin
==============================================================================
me7check v1.12 (c) mki, 06/2004-05/2012
Checking file testi.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = embedded in CPU, asume 05.12/05.32
-> EPK = 42/1/ME7.1/5/8000.07//X22fc/Dstt2g/100699/
-> Contents of ECUID data table:
   - '0261206373'         (SSECUHN)
   - '1037352378'         (SSECUSN)
   - '4D0907559D  '       (VAG part number)
   - '0002'               (VAG sw number)
   - '4.2L V8/5V      '   (engine id)

WARNING: flash should be 512kB of size, but the file is 1MB !!
-> trying to analyze only the first 512kB of the file

Page checksum failure(s) found
Data area checksum failure(s) found
-> Found 2 errors!!!   *******************************

C:\Users\Käyttäjä\Desktop\tunettamiset\temp\new me7 check>me7sum testi.bin
ME7Tool (v0.0.7) [ Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'testi.bin'

Step #1: Reading ROMSYS ..
 Startup section: word[0x00008000]+word[0x0000FFFE]
 @8038 Add=0x00005DCB CalcAdd=0x00005DCB  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @803c Add=0x00B80C1B CalcAdd=0x00380C9B  ** NOT OK **
 All param page: word[0x00010000]+word[0x0001FFFE]
 @1b12a Add=0x971D CalcAdd=0x971D  ADD OK

Step #2: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data checksum blocks...FAIL
 Searching for main data CRC offsets...OK

Step #2: ERROR! Skipping main data checksums ... UNDEFINED

Step #3: Reading Main Program Checksums ..
 Searching for main program checksum..OK
Step #3: ERROR! Skipping Main Program Checksums.. UNDEFINED

Step #4: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...OK
 Multipoint #0: [2 blocks x <16> = 32 bytes]
 Searching for multipoint block descriptor #2...OK
 5) <1fc60>  Adr: 0x010000-0x013FFF Chk: 0x09E1B29B CalcChk: 0x09E25A84 ** NOT O
K **
 Multipoint #1: [32 blocks x <16> = 512 bytes]

*** Found 37 checksums in testi.bin

*** ABORTING! 2 uncorrectable error(s) in testi.bin! ***


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 25, 2014, 09:05:51 AM
Some problems with ME7.1 also.

   - '4D0907559D  '       (VAG part number)
   - '0002'               (VAG sw number)
   - '4.2L V8/5V      '   (engine id)


Can you post the original bin for this file? Thanks!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: ddillenger on September 25, 2014, 09:19:06 AM
Here you are.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 25, 2014, 03:37:20 PM
ME7Check somewhat complains on that file:

ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file D.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = embedded in CPU, asume 05.12/05.32
-> EPK = 42/1/ME7.1/5/8000.07//X22fc/Dstt2g/100699/
-> Contents of ECUID data table:
   - '0261206373'         (SSECUHN)         
   - '1037352378'         (SSECUSN)         
   - '4D0907559D  '       (VAG part number)
   - '0002'               (VAG sw number)   
   - '4.2L V8/5V      '   (engine id)       

WARNING: flash should be 512kB of size, but the file is 1MB !!
-> trying to analyze only the first 512kB of the file

-> No errors found. File is OK.   *********************


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: ddillenger on September 25, 2014, 03:57:02 PM
That is just how those files are. From the factory they are just doubled up on 29F800BB flash chips-lol.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: hopsis on September 25, 2014, 10:04:08 PM
Yep. I have more of those ME7.1 bins, mostly from 40V 4.2 A6/S6 engines that produce the same results with ME7sum. Personally it's not that big a deal anymore and I don't know if anybody else even works with V8 ME7.1 cars.

DD is correct about the file being doubled up. I have one 4D0907558D ecu with the 29F400BB and the first 512k is practically identical to the 1024k 4D0907559D. I even tried flashing a 1024k file to the 512k chip with Galletto. Works like a charm, Galletto expectedly throws an error at 50% but the good stuff is already in the ecu at that point.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 26, 2014, 09:38:07 AM
Thanks for your patience guys! I have a new test version coming pretty soon that should address some of the issues reported.

I am still unclear on how the RSA stuff works, and there are a bunch of ME7.5 files that still don't work right, but I am making good headway.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: hopsis on September 26, 2014, 11:21:34 PM
Had a quick test with a few bins before leaving for work, seems to work better with the previously mentioned 40V V8 ME7.1 binarys. I hope it's a slow day at work, I'll put this to stress test with everything I have and cross-compare with Winols corrections of the same files.

If that is something that would be useful, I can do the grunt work for You, I have more free time than skills. What could go wrong with that combo? :)


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 26, 2014, 11:23:52 PM
Had a quick test with a few bins before leaving for work, seems to work better with the previously mentioned 40V V8 ME7.1 binarys. I hope it's a slow day at work, I'll put this to stress test with everything I have and cross-compare with Winols corrections of the same files.

If that is something that would be useful, I can do the grunt work for You, I have more free time than skills. What could go wrong with that combo? :)

YES! That is EXACTLY what I need!

Thank you!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: hopsis on September 27, 2014, 01:37:08 AM
Cool, about time I can give something back. Do You have any preference or a specific method that You want me to use? I have all the binarys in a folder with me7check and me7sum. I'm thinking of doing 1 minor change to a random map I can find in all the bins, say KFZW. I can then run me7check against the originals and me7sum/winols corrected files but that seems like a lot of data for You to sift through.

If I run:

ME7Check for original
ME7Check for modified
ME7Sum for modified
Winols for modified
ME7Check for ME7Sum corrected
ME7Check for Winols corrected

I end up with 4 binarys in total (ORI, MOD, WINOLS, ME7SUM) and a load of logs. I have about 10 bins and I can do all that, it's just a question of what is the most useful format for You. Is there any way to get any log from Winols when it does its checksum corrections? I'm thinking propably not. If there is, please let me know how and I'll add that info too.



Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 27, 2014, 09:05:06 AM
Yea, this is definitely what I need.

The only problem is, it is the more obscure checksum/crc blocks that might need testing (ROMSYS, bootblock) (meaning changes in odd places in the bin)... but they are also places people are very very unlikely to ever have to change... so i don't even know if that is relevant?

But I think that can easily be solved; just also change the first byte in the file (yea, it will probably result in a bad bin, so dont run it!) but it would be fine for testing the checksum.

As far as getting winols to tell you where things changed... nope. it doesn't do that. They really don't want you knowing how checksums work.

They also go out of the way to hide checksum value areas from the hex view, and from the diffing tool (but that makes sense, when tuning, you don't really want to be told those are differences).

The only foolproof way is to use a binary diffing tool. There are several out there for windows, but I have not found one i like best yet.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 27, 2014, 09:07:07 AM
I have about 10 bins and I can do all that, it's just a question of what is the most useful format for You

All I really need is ok or fail.

If you find a set that doesn't work, i'll have to hand test them anyway.

If you want to keep a complete document that describes the results for yourself, hey, thats fine too :)

Thanks in advance, its not going to be a fun job :)


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: hopsis on September 27, 2014, 11:41:01 AM
Yeah I can do that. I've gone awol for a while. Decided to take the gf for dinner and a movie. It's 9.30PM here just now and the way things are looking, it'll probably be monday before I can sink my teeth into this.

I did some testing earlier today when at work and the program worked flawlessly. Didn't get a chance to compare against Winols as I only have the demo version on my work laptop.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: hopsis on September 28, 2014, 08:08:58 AM
I managed to find some time to test these today. I had eleven different binaries. I changed one cell in KFZW + changed the first byte to FF in all the files. ME7Sum managed to correct all but two files. The results are in the info included in the archive.

Sorry about the lack of scientific approach. I have zero previous experience in beta testing :) Let me know if and what You need done differently. As mentioned earlier, I have tons of free time at work. I sit at my computer all day and usually just watch Family Guy or whatever. I'll gladly put that time to a more meaningful use in the boundaries of my skills.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 28, 2014, 10:42:31 AM
Thanks! Neither of those look easy to fix right off the bat, unfortunately.

For ref:


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 28, 2014, 11:20:47 AM
Thanks! Neither of those look easy to fix right off the bat, unfortunately.

I lied. You can ignore the RSA error in 4D1907558

I was wrong. DO NOT IGNORE RSA errors until ME7Sum has been fully tested, or you are willing to be a test subject.

I haven't figured it out yet RSA checking (and signing) is still very much not working. However, a failed RSA signature will not prevent a file from working, as far as i know, the ECU never checks the RSA signature.

The other image (4D0907558S) i have found a fix for; working on a new release.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: ddillenger on September 28, 2014, 08:58:40 PM
I lied.

You can ignore the RSA error in 4D1907558, I haven't figured it out yet RSA checking (and signing) is still very much not working. However, a failed RSA signature will not prevent a file from working, as far as i know, the ECU never checks the RSA signature.

The other image (4D0907558S) i have found a fix for; working on a new release.

RSA checking is very much a problem on some of the 1.8t binarys.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 28, 2014, 09:21:28 PM
RSA checking is very much a problem on some of the 1.8t binarys.

In that case, I'm going to need some help. The main question being: what area(s) does the RSA signature cover?

I have the rest in place (I think).


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 30, 2014, 03:21:18 PM
v0.1.0 added. (see OP for link).

NEED TESTERS! Prelim RSA support is there, but for some reason, ME7Check does not like the way I correct RSA signatures.. WinOLS seems not to mind.

If you have a bin that has a RSA signature *and you know what you are doing and don't mind being stranded* I could use your help testing...



Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 01, 2014, 11:14:36 PM
v0.1.1 released.

This should fix all RSA signature problems.

ALWAYS check your bins with ME7Check.exe.. if you see any errors, DO NOT flash it to your ECU.

Post the bin here and/or email me directly.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 04, 2014, 04:57:09 PM
v1.0.0 released. See OP for download link

First feature complete (but probably still buggy) version.

Added -s option to dump ecu info only.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: ddillenger on October 04, 2014, 06:48:22 PM
You are a beast nye. Congrats!

Every binary I tested it on seemed to work. Sorry I don' have that many cars here :P


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: AudiMan85 on October 04, 2014, 10:03:03 PM
Sweet job. Will this do .bins for the 518AK?


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 04, 2014, 10:06:53 PM
Maybe. I don't have a car to try it out on.

ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file '8E0909518AK.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '40/1/ME7.5/5/4012.31//24H/Dst04o/010903//'
 Part Number : '8E0909518AK'
 Engine ID   : '1.8L R4/5VT'
 SW Version  : '0004'
 HW Number   : '0261208230'
 SW Number   : '1037369307'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x010D43 CalcAdd=0x010D43  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0x921CB5 CalcAdd=0x921CB5  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01e50c Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @a595c-a59dc
           Modulus: @16962-169e2
          Exponent: @169e2 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @1693e [32 bytes]:
 1) Adr: 0x00010002-0x00013FFE
 2) Adr: 0x00014252-0x00017F4E
 3) Adr: 0x00018192-0x0001FBDC
 4) Adr: 0x00026A00-0x0002FFFC
 EncrMD5: b0 1c d5 90 b6 8e ed f5 0a bc e0 32 69 6f f8 21
 CalcMD5: b0 1c d5 90 b6 8e ed f5 0a bc e0 32 69 6f f8 21
  OK

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 1) Adr: 0x010002-0x013FFE CalcCSM: 0014741B
 2) Adr: 0x014252-0x017F4E CalcCSM: 002E7CC4
 3) Adr: 0x018192-0x01FBDC CalcCSM: 004DBFB7
 4) Adr: 0x026A00-0x02FFFC CalcCSM: 00878190
 @9ffee CSM: 00878190 CalcCSM: 00878190  Main data checksum OK

Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @2bbca [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x2626C9D7 CalcCRC: 0x8EAFE566
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0xAD05A414 CalcChk: 0xAD05A414  Main program checksum OK

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0E59D5C8 Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x1077FB35 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0E59D5C8 CalcChk: 0x0E59D5C8 OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x1077FB35 CalcChk: 0x1077FB35 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 70 checksums in 8E0909518AK.bin

*** DONE! 0/0 error(s) corrected in 8E0909518AK.bin! ***


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: AudiMan85 on October 04, 2014, 10:29:04 PM
I can test on a friends car if someone can for sure tell me how to boot mode that ecu. Same chip and pin as ours? I have never looked at the ecu but can take some 16mp pics if anyone needs to see the PCB.

Lmk my friend wants me to make him file anyways, I have found enough info so far as xdf's. I know I told him that MTX wants a different checksum tool for his ecu and he didn't wanna pay for me to have the plug-in. So his SOL right now.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: SB_GLI on October 05, 2014, 08:12:56 AM
Wow!  It works! This is great news!  The MTX plugin never worked on this file.  Thanks for this Nye!

BEFORE:

ME7Sum:
Code:
C:\Users\Steve>Z:\me7sum\me7sum.exe "Z:\ECU Files\Jetta\checksumtest.bin"
ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'Z:\ECU Files\Jetta\checksumtest.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '42/1/ME7.5/120/4013.00//24D/Dst03o/051202/'
 Part Number : '06A906032PL'
 Engine ID   : '1.8L R4/5VT'
 SW Version  : '0003'
 HW Number   : '0261208188'
 SW Number   : '1037367517'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x007DEB CalcAdd=0x007DEB  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0x99BB9F CalcAdd=0x99BB9F  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01be66 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @9cf30-9cfb0
           Modulus: @169d6-16a56
          Exponent: @16a56 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @169b2 [32 bytes]:
 1) Adr: 0x00010002-0x00013FFE
 2) Adr: 0x00014252-0x00017F4E
 3) Adr: 0x00018192-0x0001FBDC
 4) Adr: 0x00026A00-0x0002FFFC
 EncrMD5: 4f 35 b2 d2 c8 13 c1 02 1f 16 8f e7 af 08 83 a6
 CalcMD5: 59 e5 99 70 f3 e1 b2 b7 96 83 3c 75 31 82 04 52
 ** NOT OK **

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 1) Adr: 0x010002-0x013FFE CalcCSM: 0013E994
 2) Adr: 0x014252-0x017F4E CalcCSM: 002D6462
 3) Adr: 0x018192-0x01FBDC CalcCSM: 004C1261
 4) Adr: 0x026A00-0x02FFFC CalcCSM: 00BCA7DB
 @9d776 CSM: 00BCA80F CalcCSM: 00BCA7DB ** NOT OK **

Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @27f0e [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x25890F63 CalcCRC: 0x214758FB
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0x05017844 CalcChk: 0x05017844  Main program checksum OK

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF CalcChk: 0x0FA0F5CF OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 CalcChk: 0x0F4716B3 OK
10) <1fc6e>  Adr: 0x01C000-0x01FFFF Chk: 0x06C1FA64 CalcChk: 0x06C1F03A ** NOT O
K **
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 70 checksums in Z:\ECU Files\Jetta\checksumtest.bin

*** WARNING! 3/3 uncorrected error(s) in Z:\ECU Files\Jetta\checksumtest.bin! **
*

ME7Check:
Code:
==============================================================================
ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file \\DESKTOP\ECU Tuning\ECU Files\Jetta\checksumtest.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 42/1/ME7.5/120/4013.00//24D/Dst03o/051202/
-> Contents of ECUID data table:
   - '0261208188'         (SSECUHN)        
   - '1037367517'         (SSECUSN)        
   - '06A906032PL '       (VAG part number)
   - '0003'               (VAG sw number)  
   - '1.8L R4/5VT     '   (engine id)      
-> Contents of ECUID data table:
   - 'HW_MAN004'                            


Page checksum failure(s) found
RSA signature failure found
Data area checksum failure(s) found
-> Found 3 errors!!!   *******************************

Correction:

Code:
C:\Users\Steve>Z:\me7sum\me7sum.exe "Z:\ECU Files\Jetta\checksumtest.bin" "Z:\EC
U Files\Jetta\checksumtest.bin"
ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'Z:\ECU Files\Jetta\checksumtest.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '42/1/ME7.5/120/4013.00//24D/Dst03o/051202/'
 Part Number : '06A906032PL'
 Engine ID   : '1.8L R4/5VT'
 SW Version  : '0003'
 HW Number   : '0261208188'
 SW Number   : '1037367517'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x007DEB CalcAdd=0x007DEB  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0x99BB9F CalcAdd=0x99BB9F  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01be66 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @9cf30-9cfb0
           Modulus: @169d6-16a56
          Exponent: @16a56 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @169b2 [32 bytes]:
 1) Adr: 0x00010002-0x00013FFE
 2) Adr: 0x00014252-0x00017F4E
 3) Adr: 0x00018192-0x0001FBDC
 4) Adr: 0x00026A00-0x0002FFFC
 EncrMD5: 4f 35 b2 d2 c8 13 c1 02 1f 16 8f e7 af 08 83 a6
 CalcMD5: 59 e5 99 70 f3 e1 b2 b7 96 83 3c 75 31 82 04 52
 ** FIXED **

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 1) Adr: 0x010002-0x013FFE CalcCSM: 0013E994
 2) Adr: 0x014252-0x017F4E CalcCSM: 002D6852
 3) Adr: 0x018192-0x01FBDC CalcCSM: 004C1651
 4) Adr: 0x026A00-0x02FFFC CalcCSM: 00BCABCB
 @9d776 CSM: 00BCA80F CalcCSM: 00BCABCB ** FIXED **

Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @27f0e [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x25883F28 CalcCRC: 0x948996F1
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0x05017844 CalcChk: 0x04FFC6F4 ** FIXED **

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF CalcChk: 0x0FA0F5CF OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 CalcChk: 0x0F4716B3 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 70 checksums in Z:\ECU Files\Jetta\checksumtest.bin

Attempting to output corrected firmware file 'Z:\ECU Files\Jetta\checksumtest.bi
n'
├╛ Opening 'Z:\ECU Files\Jetta\checksumtest.bin' file for writing
├╛ Writing to file
├╛ Validating size correct 1048576=1048576
├╛ All OK, closing file

*** DONE! 6/6 error(s) corrected in Z:\ECU Files\Jetta\checksumtest.bin! ***


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: SB_GLI on October 05, 2014, 08:14:27 AM
AFTER:

MESum
Code:
C:\Users\Steve>Z:\me7sum\me7sum.exe "Z:\ECU Files\Jetta\checksumtest.bin"
ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'Z:\ECU Files\Jetta\checksumtest.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '42/1/ME7.5/120/4013.00//24D/Dst03o/051202/'
 Part Number : '06A906032PL'
 Engine ID   : '1.8L R4/5VT'
 SW Version  : '0003'
 HW Number   : '0261208188'
 SW Number   : '1037367517'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x007DEB CalcAdd=0x007DEB  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0x99BB9F CalcAdd=0x99BB9F  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01be66 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @9cf30-9cfb0
           Modulus: @169d6-16a56
          Exponent: @16a56 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @169b2 [32 bytes]:
 1) Adr: 0x00010002-0x00013FFE
 2) Adr: 0x00014252-0x00017F4E
 3) Adr: 0x00018192-0x0001FBDC
 4) Adr: 0x00026A00-0x0002FFFC
 EncrMD5: 3d fe 51 0f 61 85 c9 fe a4 48 d2 ef 8a 47 ce 9c
 CalcMD5: 3d fe 51 0f 61 85 c9 fe a4 48 d2 ef 8a 47 ce 9c
  OK

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 1) Adr: 0x010002-0x013FFE CalcCSM: 0013E994
 2) Adr: 0x014252-0x017F4E CalcCSM: 002D6852
 3) Adr: 0x018192-0x01FBDC CalcCSM: 004C1651
 4) Adr: 0x026A00-0x02FFFC CalcCSM: 00BCABCB
 @9d776 CSM: 00BCABCB CalcCSM: 00BCABCB  Main data checksum OK

Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @27f0e [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x25883F28 CalcCRC: 0x93C07182
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0x04FFC6F4 CalcChk: 0x04FFC6F4  Main program checksum OK

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF CalcChk: 0x0FA0F5CF OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 CalcChk: 0x0F4716B3 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 70 checksums in Z:\ECU Files\Jetta\checksumtest.bin

*** DONE! 0/0 error(s) corrected in Z:\ECU Files\Jetta\checksumtest.bin! ***

ME7Check
Code:
==============================================================================
ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file \\DESKTOP\ECU Tuning\ECU Files\Jetta\checksumtest.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 42/1/ME7.5/120/4013.00//24D/Dst03o/051202/
-> Contents of ECUID data table:
   - '0261208188'         (SSECUHN)        
   - '1037367517'         (SSECUSN)        
   - '06A906032PL '       (VAG part number)
   - '0003'               (VAG sw number)  
   - '1.8L R4/5VT     '   (engine id)      
-> Contents of ECUID data table:
   - 'HW_MAN004'                            


-> No errors found. File is OK.   *********************


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: SB_GLI on October 05, 2014, 09:11:23 AM
There was a thread/post in the past about adding either ME7Sum or ME7Check to the custom tools of Tunerpro.  Does anyone know where I can find this post?

I have these tools integrated into Tunerpro now, but the command window closes up at the end so I can't see the output.  I swear the post that I am referring to had it setup where the command window would stay open after execution.  Can someone help me find this?

Edit:  Found it

In tunerpro's custom tools editor:

Tool path:  cmd
Cmd line params:  /k <path to me7sum> "$(CurBinPath)" "$(CurBinPath)" & pause & exit

I did this for ME7Sum for both correction and verification, and also setup another tool for ME7Check verification as well.

Woohoo!  A nice "built-in" checksum corrector for tunerpro!!!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 05, 2014, 01:12:44 PM
Thanks for the feedback guys.. Glad it's working! Please let me know if you guys find any files it has problems with.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Tshirt2k on October 05, 2014, 02:52:33 PM
This is great work. Seems to work for me too. ;D

Before:

Me7check
Code:
me7check v1.12 (c) mki, 06/2004-05/2012
Checking file 1ML906032A_mods.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 41/1/ME7.5/51/4518.06//24B/Dst01o/150104/
-> Contents of ECUID data table:
   - '0261208221'         (SSECUHN)
   - '1037370535'         (SSECUSN)
   - '1ML906032A  '       (VAG part number)
   - '0002'               (VAG sw number)
   - '1.8l R4/5VT     '   (engine id)
-> Contents of ECUID data table:
   - 'HW_MAN004'

Page checksum failure(s) found
Data area checksum failure(s) found
-> Found 5 errors!!!   *******************************

Me7sum:
Code:
ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file '1ML906032A_mods.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '41/1/ME7.5/51/4518.06//24B/Dst01o/150104/'
 Part Number : '1ML906032A'
 Engine ID   : '1.8l R4/5VT'
 SW Version  : '0002'
 HW Number   : '0261208221'
 SW Number   : '1037370535'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x0092A1 CalcAdd=0x0092A1  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0xA05D86 CalcAdd=0xA05D86  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01bfe8 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...missing
 Searching for RSA offset #1...missing

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...OK
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...OK
 0) Adr: 0x0183C8-0x0183D1                      CalcCRC: CDB0E1BC
 1) Adr: 0x010002-0x013FFE @8e9ec CRC: 5B1259BE CalcCRC: D8CCF95B(r) ** NOT OK *
*
 2) Adr: 0x014252-0x017F4E @8e9f2 CRC: 64839505 CalcCRC: ADF453AB(r) ** NOT OK *
*
 3) Adr: 0x018192-0x01FBDC                      CalcCRC: A7D23F05(r)
 4) Adr: 0x026A00-0x02FFFC @8e9f8 CRC: 7446AB8A CalcCRC: 0FAAF81C(r) ** NOT OK *
*

Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @1faf4 [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x212D9F51 CalcCRC: 0xE2DD2B90
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0x50886315 CalcChk: 0x50886315  Main program checksum OK

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF CalcChk: 0x0FA0F5CF OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 CalcChk: 0x0F4716B3 OK
 7) <1fc3e>  Adr: 0x010000-0x013FFF Chk: 0x07A152A5 CalcChk: 0x07A21665 ** NOT O
K **
 9) <1fc5e>  Adr: 0x018190-0x01BFFF Chk: 0x06DB7B08 CalcChk: 0x06DB7807 ** NOT O
K **
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 71 checksums in 1ML906032A_mods.bin

*** WARNING! 5/5 uncorrected error(s) in 1ML906032A_mods.bin! ***


Corrected:

Code:
ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file '1ML906032A_mods.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '41/1/ME7.5/51/4518.06//24B/Dst01o/150104/'
 Part Number : '1ML906032A'
 Engine ID   : '1.8l R4/5VT'
 SW Version  : '0002'
 HW Number   : '0261208221'
 SW Number   : '1037370535'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x0092A1 CalcAdd=0x0092A1  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0xA05D86 CalcAdd=0xA05D86  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01bfe8 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...missing
 Searching for RSA offset #1...missing

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...OK
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...OK
 0) Adr: 0x0183C8-0x0183D1                      CalcCRC: CDB0E1BC
 1) Adr: 0x010002-0x013FFE @8e9ec CRC: 5B1259BE CalcCRC: D8CCF95B(r) ** FIXED **

 2) Adr: 0x014252-0x017F4E @8e9f2 CRC: 64839505 CalcCRC: ADF453AB(r) ** FIXED **

 3) Adr: 0x018192-0x01FBDC                      CalcCRC: A7D23F05(r)
 4) Adr: 0x026A00-0x02FFFC @8e9f8 CRC: 7446AB8A CalcCRC: 0FAAF81C(r) ** FIXED **


Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @1faf4 [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x212D9F51 CalcCRC: 0xE2DD2B90
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0x50886315 CalcChk: 0x50897079 ** FIXED **

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF CalcChk: 0x0FA0F5CF OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 CalcChk: 0x0F4716B3 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 71 checksums in 1ML906032A_mods.bin

Attempting to output corrected firmware file '1mltest.bin'
Ý Opening '1mltest.bin' file for writing
Ý Writing to file
Ý Validating size correct 1048576=1048576
Ý All OK, closing file

*** DONE! 7/7 error(s) corrected in 1ML906032A_mods.bin! ***

AFTER:

Me7check:

Code:
me7check v1.12 (c) mki, 06/2004-05/2012
Checking file 1mltest.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 41/1/ME7.5/51/4518.06//24B/Dst01o/150104/
-> Contents of ECUID data table:
   - '0261208221'         (SSECUHN)
   - '1037370535'         (SSECUSN)
   - '1ML906032A  '       (VAG part number)
   - '0002'               (VAG sw number)
   - '1.8l R4/5VT     '   (engine id)
-> Contents of ECUID data table:
   - 'HW_MAN004'

-> No errors found. File is OK.   *********************

Me7sum:
Code:
ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file '1mltest.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '41/1/ME7.5/51/4518.06//24B/Dst01o/150104/'
 Part Number : '1ML906032A'
 Engine ID   : '1.8l R4/5VT'
 SW Version  : '0002'
 HW Number   : '0261208221'
 SW Number   : '1037370535'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x0092A1 CalcAdd=0x0092A1  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0xA05D86 CalcAdd=0xA05D86  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01bfe8 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...missing
 Searching for RSA offset #1...missing

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...OK
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...OK
 0) Adr: 0x0183C8-0x0183D1                      CalcCRC: CDB0E1BC
 1) Adr: 0x010002-0x013FFE @8e9ec CRC: D8CCF95B CalcCRC: D8CCF95B(r) CRC OK
 2) Adr: 0x014252-0x017F4E @8e9f2 CRC: ADF453AB CalcCRC: ADF453AB(r) CRC OK
 3) Adr: 0x018192-0x01FBDC                      CalcCRC: A7D23F05(r)
 4) Adr: 0x026A00-0x02FFFC @8e9f8 CRC: 0FAAF81C CalcCRC: 0FAAF81C(r) CRC OK

Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @1faf4 [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x212D9F51 CalcCRC: 0xC2F58DDC
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0x50897079 CalcChk: 0x50897079  Main program checksum OK

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF CalcChk: 0x0FA0F5CF OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 CalcChk: 0x0F4716B3 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 71 checksums in 1mltest.bin

*** DONE! 0/0 error(s) corrected in 1mltest.bin! ***


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: AudiMan85 on October 05, 2014, 06:03:45 PM
I had posted a guide on how-to add ME7SUM and ME7CHECK into TunerPro and setup keyboard shortcuts.

I found the link, but the thread must have been removed. Idk if a higher ranking person could bring it back, but here is the link I had posted in the noobs guide to me7sum.

http://nefariousmotorsports.com/forum/index.php?topic=5877.0title=

Here is away to do me7check. My thread explained it more on how to do me7sum but I can post a screenshot of my settings and people could adapt it to there needs, I can't re-explain so maybe someone can bring my old thread back.

http://nefariousmotorsports.com/forum/index.php?topic=4698.msg46235#msg46235

--------------------------------------------------------------------------------------

Tunerpro examples to add ME7Sum and ME7Check


(http://i62.tinypic.com/2112vxu.jpg)


(http://i59.tinypic.com/207qc8z.jpg)


(http://i61.tinypic.com/eai646.jpg)




Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: hopsis on October 06, 2014, 12:41:26 AM
Sweet. Did some quick testing with latest ME7Sum and Winols. ME7Sum_fixed and Winols_fixed files are identical, at least with the ME7.1 and ME7.1.1 files I had at hand. Implemented the custom tools from previous post to Tunerpro. Felt like typing IDDQD and IDKFA :)

Thanks nyet.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 06, 2014, 10:13:48 AM
ME7Sum_fixed and Winols_fixed files are identical, at least with the ME7.1 and ME7.1.1 files I had at hand.

Thank you for testing! Note that because of the way RSA signing works, ME7Sum and WinOLS will sign things differently (I don't have the private key that WinOLS uses, and I don't care to hack it :)


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: SB_GLI on October 06, 2014, 01:22:27 PM
As long as it works, it's okay by me.  I am glad there's an explanation of why the files are different at least.  That's the only thing that makes me hesitant from using ME7Sum on everything right now. 

But in time, trust will come, and we can say "peace out" to all the other methods of checksumming our ME7 files!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: SB_GLI on October 06, 2014, 03:07:01 PM
Nyet, Sent you an email on an issue with an 032HS.  :P


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 06, 2014, 04:56:26 PM
Hopefully fixed in v1.0.1!

Thanks for the feedback, as usual.

Affected bins (probably others):

06A906032HS
4B0907551AH
4B0907551AL
4B0907551M
4Z7907551L
4Z7907551M
8D0907551AA
8D0907551T


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: dgpb on October 12, 2014, 01:56:48 PM
Nyet, and all the people that have helped. Many thanks.

I've just corrected one of my modified but uncorrected files. Checked it and was free of errors, and then compared it to the corrected one via WinOLS by someone on the forum. The result was "Identic Files"

So It seems to work perfectly on 06A906032HJ


Hope my post to be helpful, and again, many thanks mates  ;)

Ps: For the future, If ME7Check says it's OK with no errors... for sure it's OK?


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 12, 2014, 05:53:58 PM
Ps: For the future, If ME7Check says it's OK with no errors... for sure it's OK?

I have yet to find a case where ME7Check provably has been wrong.

It gets things right where even winols does not. I have found at least one instance where winols has corrected a file incorrectly!

Also *there are still known bugs in me7sum* so please make sure you test all bins before running them!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: funnix on October 12, 2014, 09:36:41 PM
Sometimes i get this failure! I 've integrated me7sum and me7check in tuner pro's custom tools. What i'm doing wrong?


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Tshirt2k on October 13, 2014, 01:39:12 AM
Sometimes i get this failure! I 've integrated me7sum and me7check in tuner pro's custom tools. What i'm doing wrong?

What is your syntax for the tool?s

I had this problem. I had to take the directory location out of the custom tool command line . Ie: c:\ecu\me7sum. As it was already in the correct directory.

HTH


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: funnix on October 13, 2014, 03:35:59 AM
This is my configuration:


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Tshirt2k on October 13, 2014, 09:50:20 AM
I had to get rid of cmd line Params upto. Eg(C:\users\mkoehler\) for mine to work as it was already in directory.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 13, 2014, 10:59:29 AM
v1.0.2 released.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: TijnCU on October 13, 2014, 02:51:30 PM
Not so much bins to test it on, but on my weirdo 1024-but-actually-512kb bin it works perfectly! With this tool I feel much more able to modify files  ;)
Keep up the good work!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: em.Euro.R18 on October 13, 2014, 07:42:11 PM
I'm getting a Access denied when attempting to use the me7sum.exe in CMD. I've tryed using different directories and setting them to run as administrator. Still no dice. any ideas?

C:\>C:\ME7Sum-master>me7sum.exe testinput.bin testoutput.bin
Access denied.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 13, 2014, 08:30:30 PM
I'm getting a Access denied when attempting to use the me7sum.exe in CMD. I've tryed using different directories and setting them to run as administrator. Still no dice. any ideas?

C:\>C:\ME7Sum-master>me7sum.exe testinput.bin testoutput.bin
Access denied.

No doubt some stupid antivirus program or something.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: em.Euro.R18 on October 14, 2014, 09:39:09 AM
GOT IT!!!!! I'll see if it will work on the my daily 4 motion 1.8t passat today! Idk how anyone can stand driving a car that feels slower then a hybrid prius.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: em.Euro.R18 on October 16, 2014, 11:37:18 AM
4B0906018DQ Confirmed with me7checksum 7 checksums were corrected. Well done on this tool nyet!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: AudiMan85 on October 16, 2014, 08:42:58 PM
Just wanted to add to the great job karma. For the 1st time I had gotten a pop-up that MTX Plugin couldn't correct my file.

Ran it thru your newest ME7SUM and ME7Check and 7 Errors corrected. I attached the message pop-up that I had gotten.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: ddillenger on October 16, 2014, 10:22:43 PM
Just wanted to add to the great job karma. For the 1st time I had gotten a pop-up that MTX Plugin couldn't correct my file.

Ran it thru your newest ME7SUM and ME7Check and 7 Errors corrected. I attached the message pop-up that I had gotten.

Be careful. That could mean you made changes outside the typical map space.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: cpp on October 18, 2014, 02:23:37 PM
works perfectly on 06a906032hp !!!
Thank you so much !!!!
are reaping the rewards and haunting the neighborhood !!!!
up + launch control !!!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: AudiMan85 on October 20, 2014, 09:35:16 AM
I had to redo or recovery windows 8.1 on my desktop. It's doing this now to every file no matter what I change. Any ideas what I did wrong? I had to reinstall tunerpro my guess is my xdf file I have pre-installed my MTX plugin and maybe I need to go back and put my license file etc back in the root folder of Tunerpro.

Good news is now ECUxPlot works now on desktop. Nothing like seeing your logs and graphs on a 40" screen in 1080p. If my video card supported it I'd have it displayed on my 60" Samsung 4K-UHD TV and really make the wife happy on movie nights!!!

But my loving wife, I just gotta view these logs I been out data logging and using $20 in gas on while your home getting mad I'm out wasting gas etc lol.... this is all a bad thing if you didn't guess!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 30, 2014, 03:44:26 PM
v1.0.3 released

* Detect (and properly detect) case where checksum to be corrected is within the block it belongs to.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: thelastleroy on October 30, 2014, 06:39:30 PM
v1.0.3 released

* Detect (and properly detect) case where checksum to be corrected is within the block it belongs to.


Just a heads up:

Nyet, your version 1.0.3 download page is showing error 404 (no github page here)

Love the software. Keep up the good work!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on October 30, 2014, 06:55:02 PM
Just a heads up:

Nyet, your version 1.0.3 download page is showing error 404 (no github page here)

Love the software. Keep up the good work!

Ooops :)

Should be there now.

Thanks for the heads up!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: mushtafa on November 07, 2014, 01:02:40 PM
Nice software! Where can I donate?


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: AARDQ on November 09, 2014, 12:58:51 PM
Sometimes i get this failure! I 've integrated me7sum and me7check in tuner pro's custom tools. What i'm doing wrong?

No spaces in path names allowed, e.g. Tunerpro Files won't work.  The prog thinks 'Files' is the name of the bin, and, of course, it isn't.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: SB_GLI on November 10, 2014, 02:48:34 PM
Spaces should work fine as long as you put quotes around the file names.  Although it is wise advice, especially when dealing with open source / free software that uses file IO, to make sure your folders don't have spaces in them.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: slappynuts on May 14, 2015, 06:52:27 PM
I am having issues trying to run a bigger MAF on this ecu B0906018P. ME7 sum says it corrected everything and it is good, but ME7check says it fails.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on May 14, 2015, 07:00:50 PM
Please don't make me download those files, cut and paste the output you are seeing.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: slappynuts on May 15, 2015, 03:39:13 PM
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>cd..

C:\Windows>cd..

C:\>me7\me7sum me7\bigmafstockatwgood.bin me7\bigmafstockatwgood_fix.bin
ME7Tool (v1.0.3) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'me7\bigmafstockatwgood.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for ECUID table...OK
 EPK         : '42/1/ME7.5/3/4012.00//F22id/Dst06g/250899/'
 Part Number : '4B0906018P  '
 Engine ID   : '1.8L R4/5VT     '
 SW Version  : '0006'
 HW Number   : '0261206537'
 SW Number   : '1037352750'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x007CD1 CalcAdd=0x007CD1  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0x7FFFF
 @00803c Add=0x3972A5 CalcAdd=0x3972A5  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01b560 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...missing
 Searching for RSA offset #1...missing

Step #4: Finding CRC table(s) ..
 Searching for CRC table(s)...OK
 CRC table(s) OK

Step #5: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...missing
 Falling back to default 512k CRC blocks...OK
 Searching for main data CRC offsets...OK
 Searching for main data checksum offsets...missing
 Main CRCs:
 1) 0x010000-0x013FFF @70000 CRC: AB605C52 CalcCRC: E2FDA8ED    ** FIXED **
 2) 0x014300-0x017F67 @70006 CRC: 534DE7C2 CalcCRC: 534DE7C2    CRC OK
 3) 0x018191-0x01FBFF @7000c CRC: A323DCA6 CalcCRC: A323DCA6    CRC OK

Step #6: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @1dfec [16 bytes]:
 1) 0x000000-0x00FBFF CalcChk: 47EF557E
    0x00FC00-0x01FFFF CalcChk: 2CEDD2F0 CalcCRC: 668F1A38 SKIPPED
 2) 0x020000-0x07FFFF
    <7ffe0>  Chk: D81EDC5F CalcChk: D81F6097 ** FIXED **

Step #7: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...OK
 1) <14224>  0x024000-0x02658D Chk: 0AFD060F CalcChk: 0AFD060F OK
 2) <14234>  0x014000-0x014243 Chk: 005CAABC CalcChk: 005CAABC OK (i)
 3) <14244>  0xFFFFFFFF-0xFFFFFFFF  END
 Multipoint #1: [2 blocks x <16> = 32 bytes]
 Searching for multipoint block descriptor #2...OK
 1) <1fc00>  0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK
 2) <1fc10>  0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK
 3) <1fc20>  0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK
 4) <1fc30>  0x004000-0x007FFF Chk: 0F4716B3 CalcChk: 0F4716B3 OK
 Multipoint #2: [34 blocks x <16> = 544 bytes]

*** Found 41 checksums in me7\bigmafstockatwgood.bin

Attempting to output corrected firmware file 'me7\bigmafstockatwgood_fix.bin'
├╛ Opening 'me7\bigmafstockatwgood_fix.bin' file for writing
├╛ Writing to file
├╛ Validating size correct 524288=524288
├╛ All OK, closing file

*** DONE! 5/5 error(s) in me7\bigmafstockatwgood.bin corrected in me7\bigmafstoc
katwgood_fix.bin! ***

C:\>







me7check v1.12 (c) mki, 06/2004-05/2012
Checking file C:\me7\bigmafstockatw_fix.bin (size=524288)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 42/1/ME7.5/3/4012.00//F22id/Dst06g/250899/
-> Contents of ECUID data table:
   - '0261206537'         (SSECUHN)         
   - '1037352750'         (SSECUSN)         
   - '4B0906018P  '       (VAG part number)
   - '0006'               (VAG sw number)   
   - '1.8L R4/5VT     '   (engine id)       
-> Contents of ECUID data table:
   - 'HW_MAN004'                           

Romsys checksum failure(s) found
-> Found 1 error!!!   *******************************



Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on May 15, 2015, 04:20:29 PM
That doesn't look good :(

try running the _fix file back through ME7Sum..

I will take a look time permitting. Thanks for reporting the issue..


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: slappynuts on May 17, 2015, 08:54:00 AM
Oh it worked! TY sir! Kicking myself for not thinking of that.   ::)


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on May 17, 2015, 11:37:16 AM
Oh it worked! TY sir! Kicking myself for not thinking of that.   ::)

No worries, it is a known bug I haven't figured out how to fix yet :(

Thanks for providing an image I can use to test further!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: TLS4 on June 23, 2015, 09:43:38 AM
No worries, it is a known bug I haven't figured out how to fix yet :(

Thanks for providing an image I can use to test further!
I get the same problem, I have to run ME7Sum twice to fix all checksums.
The bins are more or less stock 8D0907551K and Q. Just a couple of codewords changed (CW_CAR_R_0___A = 0 on first try and the a few more). If you need test files I can post one of these.



Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on June 23, 2015, 10:09:45 AM
I get the same problem, I have to run ME7Sum twice to fix all checksums.
The bins are more or less stock 8D0907551K and Q. Just a couple of codewords changed (CW_CAR_R_0___A = 0 on first try and the a few more). If you need test files I can post one of these.



Please do, thanks!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: TLS4 on June 24, 2015, 03:15:35 PM
Please do, thanks!

Here is a K-bin and a Q-bin and corresponding output from me7check and me7sum


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: redtop on September 16, 2015, 01:30:12 AM
Hi!
I'm working with ME7.3.1 in Fiat/Alfa Romeo/Lancia and trying to sort out what happend with the ME7Sum development. As I understand it when reading old threads, the functionality of calculating the checksum for the Ferrari ME7.3h4 made by 360Trev was never implemented in Nyet's ME7Sum software? Still there's another ME7Sum by 360Trev on Github that is intended for the Ferrari ECU: https://github.com/360trev/ME7Sum ?

Have I got this right? And is there anyplace I can get hold of 360Trev's software compiled for Windows?


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on September 16, 2015, 10:01:25 AM
Hi!
I'm working with ME7.3.1 in Fiat/Alfa Romeo/Lancia and trying to sort out what happend with the ME7Sum development. As I understand it when reading old threads, the functionality of calculating the checksum for the Ferrari ME7.3h4 made by 360Trev was never implemented in Nyet's ME7Sum software? Still there's another ME7Sum by 360Trev on Github that is intended for the Ferrari ECU: https://github.com/360trev/ME7Sum ?

Have I got this right? And is there anyplace I can get hold of 360Trev's software compiled for Windows?


That software was never completed and
1) does not compute all the checksums
2) does not automatically locate checksum locations.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: redtop on September 16, 2015, 10:54:10 PM
That software was never completed and
1) does not compute all the checksums
2) does not automatically locate checksum locations.

Thank you for the clairification!
I guess I'll have to find another tool for checksums on the Alfa ECUs.  :'(


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Awaken on November 25, 2016, 06:26:19 PM
Hello, is MD5 hash failure same as RSA failure?

Hope this thread is still alive and hopefully I can get some info.

I have a problem with a file for a 2002 S3 BAM 8N0906018BP. I use TunerPro with the MTX plugin. I have made only one simple change to the ori file, as a proof of concept and I get this when I run ME7Check:

ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file C:\Users\Ceco\Desktop\Audi S3 225HP 8N0906018BP 0261208054 366474_modified.ori (size=1048576)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 40/1/ME7.5/5/4018.20//24B/Dst02o/290702//
-> Contents of ECUID data table:
   - '0261208054'         (SSECUHN)         
   - '1037366474'         (SSECUSN)         
   - '8N0906018BP '       (VAG part number)
   - '0002'               (VAG sw number)   
   - '1.8L R4/5VT     '   (engine id)       
-> Contents of ECUID data table:
   - 'HW_MAN004'                           


RSA signature failure found
-> Found 1 error!!!   *******************************

However! When I run ME7Sum on the same file, I get what I can identify as a md5 hash error, and not the RSA:

ME7Tool (v1.0.3) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'asd.ori'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for ECUID table...OK
 EPK         : '40/1/ME7.5/5/4018.20//24B/Dst02o/290702//'
 Part Number : '8N0906018BP '
 Engine ID   : '1.8L R4/5VT     '
 SW Version  : '0002'
 HW Number   : '0261208054'
 SW Number   : '1037366474'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x00CD15 CalcAdd=0x00CD15  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0xA0B46E CalcAdd=0xA0B46E  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01bf7a Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @8ec6a-8ecea
           Modulus: @167c2-16842
          Exponent: @16842 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @1679e [32 bytes]:
 1) 0x00010002-0x00013FFE
 2) 0x00014252-0x00017F4E
 3) 0x00018192-0x0001FBDC
 4) 0x00026A00-0x0002FFFC
 EncrMD5: b6 87 d5 35 c6 9b 50 b3 d5 c5 1d eb 9a 73 2b 58
 CalcMD5: a1 6b 4d e4 20 39 c5 92 ac c2 ba 43 a9 70 9c c2
 ** NOT OK **

Step #4: Finding CRC table(s) ..
 Searching for CRC table(s)...OK
 CRC table(s) OK

Step #5: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 Main Checksums:
 1) 0x010002-0x013FFE CalcCSM: 001327A6
 2) 0x014252-0x017F4E CalcCSM: 00286183
 3) 0x018192-0x01FBDC CalcCSM: 00452742
 4) 0x026A00-0x02FFFC CalcCSM: 00C338F7
 @8f4b0 CSM: 00C338F7 CalcCSM: 00C338F7  Main data checksum OK

Step #6: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @1fb92 [16 bytes]:
 1) 0x000000-0x00FBFF CalcChk: 48D10B05
    0x00FC00-0x01FFFF CalcChk: 2198346D CalcCRC: 2E660DB7 SKIPPED
 2) 0x020000-0x0FFFFF
    <fffe0>  Chk: 425F5982 CalcChk: 425F5982 OK (i)

Step #7: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK
 4) <1fc0e>  0x004000-0x007FFF Chk: 0F4716B3 CalcChk: 0F4716B3 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 70 checksums in asd.ori

*** WARNING! 1/1 uncorrected error(s) in asd.ori! ***

I have attached the binary. Thanks in advance and sorry if I failed to find an answer to this, but I am pretty sure I read the whole forum already... :)


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on November 25, 2016, 07:26:46 PM
yes


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Awaken on November 26, 2016, 02:37:51 AM
Is there a way for Me7Sum to correct this, or is it something it cannot do yet? I read that some RSA support was added.
Thank you!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on November 26, 2016, 02:50:18 AM
Does it not work?


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Awaken on November 26, 2016, 06:40:14 AM
Unfortunately not, unless I use it wrong. I do ME7Sum.exe {filename}.bin. The output I just posted 2 posts ago is from ME7Sum, not ME7Check and the output is following (just pasting the problematic areas):

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @8ec6a-8ecea
           Modulus: @167c2-16842
          Exponent: @16842 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @1679e [32 bytes]:
 1) 0x00010002-0x00013FFE
 2) 0x00014252-0x00017F4E
 3) 0x00018192-0x0001FBDC
 4) 0x00026A00-0x0002FFFC
 EncrMD5: b6 87 d5 35 c6 9b 50 b3 d5 c5 1d eb 9a 73 2b 58
 CalcMD5: a1 6b 4d e4 20 39 c5 92 ac c2 ba 43 a9 70 9c c2
 ** NOT OK **

*** Found 70 checksums in asd.ori

*** WARNING! 1/1 uncorrected error(s) in asd.ori! ***

I am attaching the bin in question again. For the function call I had renamed it to asd.bin since it does not accept spaces in file names.

Does it matter if I used the MTX plugin prior to using ME7Sum? Because MTX seems to fix the checksums, just not the RSA.

Thank you for your replies, I appreciate it!




Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Awaken on November 26, 2016, 11:48:20 AM
Actually, I was using it wrong, I was missing the out file. It worked perfectly now.

Still this might turn useful to somebody: don't forget to give an out file name to the command.

Me7Sum.exe in_file.bin out_file.bin


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on November 26, 2016, 11:49:26 AM
Me7Sum.exe in_file.bin out_file.bin

yea, it is in the first post. Literally.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Awaken on November 26, 2016, 12:50:44 PM
:) Sorry about that, too much information in one piece, some things are bound to slip thru.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Colt45 on May 19, 2017, 04:35:40 PM
Hi, I tested this file with an 07K ECU (2.5L NA 5cyl from mkV a-platform cars), ME7.1.1, early one that is C167 and not ST10.

I don't intend to use this one for anything so it's not critical ME7Sum supports it, but I thought the data point might be helpful for greater support, I don't know.

I pulled the file off an eBay ECU, maybe someone was in it before, maybe not (case was a bit mangled)

can attach the files if any interest.

############


$ ./me7check.exe ../ori/07k/07K906032_0261208870_377692.bin
==============================================================================
me7check v1.12 (c) mki, 06/2004-05/2012
Checking file ../ori/07k/07K906032_0261208870_377692.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = embedded in CPU, asume 06.02/06.05
-> EPK = 45/1/ME7.1.1/120/C1103B//24M/A4A05M50/110705/
-> Contents of ECUID data table:
   - '0261208870'         (SSECUHN)
   - '1037377692'         (SSECUSN)
   - '07K906032   '       (VAG part number)
   - '7826'               (VAG sw number)
   - 'R5 AT          '    (engine id)
-> Contents of ECUID data table:
   - 'HW_MAN004'


-> No errors found. File is OK.   *********************



#############

$ ./me7sum.exe ../ori/07k/07K906032_0261208870_377692.bin fixed.bin
ME7Tool (v1.0.3) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file '../ori/07k/07K906032_0261208870_377692.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for ECUID table...0 matches, missing
Step #1: ERROR! Skipping ROM info.. UNDEFINED

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x00AFB7 CalcAdd=0x00AFB7  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0x74A1A1 CalcAdd=0x74A1A1  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01e814 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @c8d10-c8d90
           Modulus: @16830-168b0
          Exponent: @168b0 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @1680c [32 bytes]:
 1) 0x00010002-0x00013FFE
 2) 0x00014502-0x00017EFE
 3) 0x00018192-0x0001FBDC
 4) 0x00026A00-0x0002FFFC
 EncrMD5: 17 c4 3f 60 e4 c3 21 e0 8d 7e 31 45 07 18 ae 35
 CalcMD5: 17 c4 3f 60 e4 c3 21 e0 8d 7e 31 45 07 18 ae 35
  OK

Step #4: Finding CRC table(s) ..
 Searching for CRC table(s)...missing
 Searching for CRC table(s) using fallback...*** WARNING: ASM detect failed, fell back (found 0) in ../ori/07k/07K906032_0261208870_377692.bin
OK
Step #4: ERROR! Couldn't find CRC table(s)

Step #5: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 Main Checksums:
 1) 0x010002-0x013FFE CalcCSM: 0013FFA9
 2) 0x014502-0x017EFE CalcCSM: 002B08FC
 3) 0x018192-0x01FBDC CalcCSM: 004A8ADD
 4) 0x026A00-0x02FFFC CalcCSM: 00AA0926
 @c9556 CSM: 00AA0926 CalcCSM: 00AA0926  Main data checksum OK

Step #6: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @294f8 [16 bytes]:
 1) 0x000000-0x00FBFF CalcChk: 4672F6E7
    0x00FC00-0x01FFFF CalcChk: 24A071FC CalcCRC: 46DB0B62 SKIPPED
 2) 0x020000-0x0FFFFF
    <fffe0>  Chk: 16C1A373 CalcChk: 16C1A373 OK (i)

Step #7: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  0x000000-0x003FFF Chk: 0E59D5C8 Boot: (whitelisted) OK
 2) <1fbee>  0x004000-0x007FFF Chk: 1077FB35 Boot: (whitelisted) OK
 3) <1fbfe>  0x000000-0x003FFF Chk: 10942779 CalcChk: 10942779 OK
 4) <1fc0e>  0x004000-0x007FFF Chk: 0E83C050 CalcChk: 0E83C050 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 70 checksums in ../ori/07k/07K906032_0261208870_377692.bin

*** ABORTING! 2 uncorrectable error(s) in ../ori/07k/07K906032_0261208870_377692.bin! ***



Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on July 22, 2017, 12:17:58 PM
v1.0.5 is released; hopefully making it so you don't have to re-run me7sum several times on the same file

http://nyetwurk.github.io/ME7Sum/downloads/me7sum-v1.0.5.zip


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on July 24, 2017, 11:34:08 PM
can attach the files if any interest.

Go for it. No guarantees I can make it work but I can try


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: Arti on January 03, 2018, 12:46:26 AM
Hi,
me7.5 file 1mb from winols (checksum calculated with winols 2.24) and after using ME7sum I get

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...missing
 Searching for RSA offset #1...missing

Searching for main data checksum offsets...missing RSA offset

finally program write
*** Found 71 checksums in v1.bin
*** DONE! 0/0 error(s) in v1.bin corrected in v1corr.bin! ***

but v1corr.bin file doesn't exist

Just to be sure: everything is ok file is not created because input file is 100% ok? (checksum in the file)?
"Missing..." is not an error?
Arti


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on January 03, 2018, 01:26:53 PM
RSA not found is fine, it means there's no RSA to correct.

As to your other issue, it looks like an actual bug. Thanks for reporting it!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 24, 2018, 12:12:00 AM
@ nyet

I've been doing some more work on the checksumming code recently as part of my recent bit of time to explore again.

After some more time analyzing the main rom checksums (byte-summing) I noted we inherited the use of 'hardcoded locations' to identify where it is. This isn't really the best approach. Also we always assume there are only 2 sections (since for most roms this is the case, however its not always so, i've found some with 3). This means with these updates for instance it ME7Sum can work to checksum Alfa's too :)

So I'm using the needle/mask approach to identify the rom sum function itself...



#define SKIP    0x00
#define XXXX    0x00
#define YYYY    0x00
#define MASK    0xff

//
// this is the needle (masked) for the Main Checksum function to extract Start Address and End Address then extract the segment offset function and the hi/lo words directly out of the code..
//

const unsigned char needle_2[] = {
 0xF6, 0x8E, XXXX, XXXX,     // mov  var_x, zeros
 0xF6, 0x8E, XXXX, XXXX,     // mov  var_x, zeros
 0xF7, 0x8E, XXXX, XXXX,     // movb var_x, zeros
 
 0xD7, 0x50, XXXX, XXXX,     // extp #XXXXh, #2       <--- * this is the segment offset
 0xF2, XXXX, YYYY, YYYY,     // mov  rX, var_y        <--- * this is the offset to the [checksum_1_hi] word (start address for main rom)
 0xF2, XXXX, YYYY, YYYY,     // mov  rX, var_y        <--- * this is the offset to the [checksum_1_lo] word (start address for main rom)
 0xF6, YYYY, XXXX, XXXX,     // mov  var_x, rY
 0xF6, YYYY, XXXX, XXXX,     // mov  var_x, rY
 
 0xE1, 0x18,                 // movb r14, #1
 0xF7, YYYY, XXXX, XXXX,     // movb var_x, rY

 0xD7, 0x50, XXXX, XXXX,     // extp #XXXXh, #2       <--- * this is the segment offset (typically 0x206 or 0x207)
 0xF2, XXXX, YYYY, YYYY,     // mov  rX, var_y        <--- * this is the offset to the [checksum_2_hi] word (end address for main rom)
 0xF2, XXXX, YYYY, YYYY,     // mov  rX, var_y        <--- * this is the offset to the [checksum_2_lo] word (end address for main rom)
 0xF6, YYYY, XXXX, XXXX,     // mov  var_x, rY
 0xF6, YYYY, XXXX, XXXX,     // mov  var_x, rY

 0xDB, 0x00                  // rets
};

const unsigned char mask_2[] = {
 MASK, MASK, SKIP, SKIP,     // mov  var_x, zeros
 MASK, MASK, SKIP, SKIP,     // mov  var_x, zeros
 MASK, MASK, SKIP, SKIP,     // movb var_x, zeros
 
 MASK, MASK, SKIP, SKIP,     // extp #206h, #2       // memory offset selection
 MASK, SKIP, SKIP, SKIP,     // mov  rX, var_y        // ***checksum1_hi***
 MASK, SKIP, SKIP, SKIP,     // mov  rX, var_y        // ***checksum1_lo***
 MASK, SKIP, SKIP, SKIP,     // mov  var_x, rY           // to ram address1_hi
 MASK, SKIP, SKIP, SKIP,     // mov  var_x, rY         // to ram address1_lo
 
 MASK, MASK,                 // movb r14, #1          // set boolean on
 MASK, SKIP, SKIP, SKIP,     // movb var_x, rY         // actually set variable

 MASK, MASK, SKIP, SKIP,     // extp #206h, #2       // memory offset selection
 MASK, SKIP, SKIP, SKIP,     // mov  rX, var_y        // ***checksum2_hi***
 MASK, SKIP, SKIP, SKIP,     // mov  rX, var_y        // ***checksum2_lo***
 MASK, SKIP, SKIP, SKIP,     // mov  var_x, rY         // to ram address2_hi
 MASK, SKIP, SKIP, SKIP,     // mov  var_x, rY         // to ram address2_lo
 
 MASK, MASK                  // rets
};



(pm me and I can send you the code which does this). And this is what the output looks like...




Opening '0261206715_SW127735611_VER_10A0Xw00_ME731_9_613_3_Alfa.bin' file
Succeded loading file.

>>> Scanning for Main ROM Checksum sub-routine #1 [to extract Start/End regions]
main checksum byte sequence #1 found at offset=0x6f7ec.

Main Region Block #1:
        lo:0x1d054 hi:0x1d056 (seg: 0x207 phy:0x81d054) : 0x800000
        lo:0x1d058 hi:0x1d05a (seg: 0x207 phy:0x81d058) : 0x80fe6d sum=4bcae83a ~sum=b43517c5 : acc_sum=0
Main Region Block #2:
        lo:0x1d05c hi:0x1d05e (seg: 0x207 phy:0x81d05c) : 0x820000
        lo:0x1d060 hi:0x1d062 (seg: 0x207 phy:0x81d060) : 0x837fff sum=63b0207e ~sum=9c4fdf81 : acc_sum=4bcae83a
Main Region Block #3:
        lo:0x1d064 hi:0x1d066 (seg: 0x207 phy:0x81d064) : 0x840000
        lo:0x1d068 hi:0x1d06a (seg: 0x207 phy:0x81d068) : 0x87ffff sum=c350f52 ~sum=f3caf0ad : acc_sum=af7b08b8

Final Main ROM Checksum calculation:  0xbbb0180a (after 3 rounds)
Final Main ROM Checksum calculation: ~0x444fe7f5



Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 24, 2018, 12:17:09 AM
And you can also use the same needle/mask approach to identify the location where these main rom checksums should end up going...



>>> Scanning for Main ROM Checksum sub-routine #2 [to extract stored checksums and locations in ROM]
main checksum byte sequence #2 block found at offset=0x6f894.

Stored Main ROM Block Checksum:
        lo:0x7ffe0 hi:0x7ffe2 (seg: 0x21f phy:0x87ffe0) : 0xbbb0180a
Stored Main ROM Block ~Checksum:
        lo:0x7ffe4 hi:0x7ffe6 (seg: 0x21f phy:0x87ffe4) : 0x444fe7f5

MAIN STORED ROM  CHECKSUM: bbb0180a ? bbb0180a : OK!     ~CHECKSUM: 444fe7f5 ? 444fe7f5 : OK!



Here's the needle I use for this ...




//
// this is the needle (masked) for the Main Checksum function to extract the stored checksum Hi & Lo Words
//

const unsigned char needle_3[] = {

 0xF2, 0xF4, XXXX, XXXX,     // mov r4, var_Y
 0xF2, 0xF5, XXXX, XXXX,     // mov r5, var_Y
 0xD7, 0x50, 0x1f, 0x02,    // extp #21fh, #2                <--- * this is the segment offset (should be 0x21f - LAST SEGMENT IN 512Kbyte ROM)
 0x22, 0xF4, XXXX, XXXX,    // sub r4, var_Y                 <--- * this is offset to the [EndFirmware_hi] word (stored checksum)
 0x32, 0xF5, XXXX, XXXX,    // subc r5, var_Y                <--- * this is offset to the [EndFirmware_lo] word (stored checksum)
 0x3D, XXXX,                 // jmpr cc_NZ, offset_XXXX
 
 0xE6, 0xF4, XXXX, XXXX,     // mov r4, #XXXXh
 0xE6, 0xF5, XXXX, XXXX,     // mov r5, #XXXXh
 0xDC, 0x45,                 // extp r5, #1
 0xA9, 0x64,               // movb r13, [r4]
 0x77, 0xF6, 0x08, 0x00,     // orb  r13, #8
 0xE6, 0xF4, XXXX, XXXX,     // mov  r4, #XXXXh
 0xE6, 0xF5, XXXX, XXXX,     // mov  r5, #XXXXh
 0xDC, 0x45,                 // extp r5, #1
 0xB9, 0x64,                 // mov [r4], r13
 0x0D, 0x0E                  // jmpr cc_UC, +0xE
};

const unsigned char mask_3[] = {

 MASK, MASK, SKIP, SKIP,     // mov r4, var_Y
 MASK, MASK, SKIP, SKIP,     // mov r5, var_Y
 MASK, MASK, MASK, MASK,    // extp #21fh, #2                <--- * this is the segment offset (should be 0x21f - LAST SEGMENT IN 512Kbyte ROM)
 MASK, MASK, SKIP, SKIP,    // sub r4, var_Y                 <--- * this is offset to the [EndFirmware_hi] word (stored checksum)
 MASK, MASK, SKIP, SKIP,    // subc r5, var_Y                <--- * this is offset to the [EndFirmware_lo] word (stored checksum)
 MASK, SKIP,                 // jmpr cc_NZ, offset_XX
 
 MASK, MASK, SKIP, SKIP,     // mov r4, #XXXXh
 MASK, MASK, SKIP, SKIP,     // mov r5, #XXXXh
 MASK, MASK,                 // extp r5, #1
 MASK, MASK,               // movb r13, [r4]
 MASK, MASK, MASK, MASK,     // orb  r13, #8
 MASK, MASK, SKIP, SKIP,     // mov  r4, #XXXXh
 MASK, MASK, SKIP, SKIP,     // mov  r5, #XXXXh
 MASK, MASK,                 // extp r5, #1
 MASK, MASK,                 // mov [r4], r13
 MASK, MASK                  // jmpr cc_UC, +0xE
};





Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 24, 2018, 07:45:37 AM
And ofcourse you can also do this for the multipoint checksum blocks too.. tried it on a 1mb (rather than 512kbyte) file I downloaded from the ecu dump section on here for file 06A906032DS 0261207080 360930.

It reveals 66 multipoint checksums on a 1mb file that need correcting. I noted my code match for finding end of rom failed to find end of 1mb file.. I need to investigate that now... but it did find ALL of the multipoints with my new code..


 Opening '06A906032DS 0261207080 360930' file
Succeded loading file.

>>> Scanning for Main ROM Checksum sub-routine #1 [to extract Start/End regions]
main checksum byte sequence #1 found at offset=0x880b8.

Main Region Block #1:
        lo:0x1dfc0 hi:0x1dfc2 (seg: 0x207 phy:0x81dfc0) : 0x800000
        lo:0x1dfc4 hi:0x1dfc6 (seg: 0x207 phy:0x81dfc4) : 0x80fbff sum=48cf9ca6 ~sum=b7306359 : acc_sum=0
Main Region Block #2:
        lo:0x1dfc8 hi:0x1dfca (seg: 0x207 phy:0x81dfc8) : 0x820000
        lo:0x1dfcc hi:0x1dfce (seg: 0x207 phy:0x81dfcc) : 0x8fffff sum=4851122c ~sum=b7aeedd3 : acc_sum=48cf9ca6

Final Main ROM Checksum calculation:  0x9120aed2 (after 2 rounds)
Final Main ROM Checksum calculation: ~0x6edf512d



>>> Scanning for Main ROM Checksum sub-routine #2 [to extract stored checksums and locations in ROM] No match found
main checksum byte sequence #2 not found
Giving up.


>>> Scanning for Multipoint Checksum sub-routine #1 [to extract stored checksum list location in ROM]
Multipoint byte sequence #1 block found at offset=0x8b854.

Blk #01:
        lo:0x1fbde (seg: 0x207 phy:0x81fbde) : Start: 0x00000000
        lo:0x1fbe2 (seg: 0x207 phy:0x81fbe2) : End:   0x00003fff
        lo:0x1fbe6 (seg: 0x207 phy:0x81fbe6) : CRC32: 0x0fa0f5cf
        lo:0x1fbea (seg: 0x207 phy:0x81fbea) : ~CRC32 0xf05f0a30 Bootblock #1 ram/rom offset: 0x00000000 len=0x3fff
Blk #02:
        lo:0x1fbee (seg: 0x207 phy:0x81fbee) : Start: 0x00004000
        lo:0x1fbf2 (seg: 0x207 phy:0x81fbf2) : End:   0x00007fff
        lo:0x1fbf6 (seg: 0x207 phy:0x81fbf6) : CRC32: 0x0f4716b3
        lo:0x1fbfa (seg: 0x207 phy:0x81fbfa) : ~CRC32 0xf0b8e94c Bootblock #2 ram/rom offset: 0x00004000 len=0x3fff

... cut ... cut ... (message too big!)

Blk #64:
        lo:0x1ffce (seg: 0x207 phy:0x81ffce) : Start: 0x008f4000
        lo:0x1ffd2 (seg: 0x207 phy:0x81ffd2) : End:   0x008f7fff
        lo:0x1ffd6 (seg: 0x207 phy:0x81ffd6) : CRC32: 0x1fffe000
        lo:0x1ffda (seg: 0x207 phy:0x81ffda) : ~CRC32 0xe0001fff rom offset: 0x000f4000 len=0x3fff
Blk #65:
        lo:0x1ffde (seg: 0x207 phy:0x81ffde) : Start: 0x008f8000
        lo:0x1ffe2 (seg: 0x207 phy:0x81ffe2) : End:   0x008fbfff
        lo:0x1ffe6 (seg: 0x207 phy:0x81ffe6) : CRC32: 0x1fffe000
        lo:0x1ffea (seg: 0x207 phy:0x81ffea) : ~CRC32 0xe0001fff rom offset: 0x000f8000 len=0x3fff
Blk #66:
        lo:0x1ffee (seg: 0x207 phy:0x81ffee) : Start: 0x008fc000
        lo:0x1fff2 (seg: 0x207 phy:0x81fff2) : End:   0x008fffff
        lo:0x1fff6 (seg: 0x207 phy:0x81fff6) : CRC32: 0x1ffde002
        lo:0x1fffa (seg: 0x207 phy:0x81fffa) : ~CRC32 0xe0021ffd rom offset: 0x000fc000 len=0x3fff


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on August 24, 2018, 08:31:22 AM
This is FANTASTIC... i'd prefer a (working) pull request over a patch though :)


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 24, 2018, 08:31:55 AM
Fixed the missing detection of multipoint, it was I need to correct the mask on the segment !

const unsigned char mask_3[] = {

 MASK, MASK, SKIP, SKIP,     // mov r4, var_Y
 MASK, MASK, SKIP, SKIP,     // mov r5, var_Y
MASK, MASK, SKIP, SKIP,    // extp #XXXXh, #2                <--- * this is the segment offset (should be 0x21f in 512kb & 0x23f in 1024kb ROM)


Just change 3rd line for SKIP SKIP on last 2 entries... and it works for both 512kbyte and 1024kbyte roms...

Opening '06A906032DS 0261207080 360930' file
Succeded loading file.

>>> Scanning for Main ROM Checksum sub-routine #1 [to extract Start/End regions]
main checksum byte sequence #1 found at offset=0x880b8.

Main Region Block #1:
        lo:0x1dfc0 hi:0x1dfc2 (seg: 0x207 phy:0x81dfc0) : 0x800000
        lo:0x1dfc4 hi:0x1dfc6 (seg: 0x207 phy:0x81dfc4) : 0x80fbff sum=48cf9ca6 ~sum=b7306359 : acc_sum=0
Main Region Block #2:
        lo:0x1dfc8 hi:0x1dfca (seg: 0x207 phy:0x81dfc8) : 0x820000
        lo:0x1dfcc hi:0x1dfce (seg: 0x207 phy:0x81dfcc) : 0x8fffff sum=4851122c ~sum=b7aeedd3 : acc_sum=48cf9ca6

Final Main ROM Checksum calculation:  0x9120aed2 (after 2 rounds)
Final Main ROM Checksum calculation: ~0x6edf512d



>>> Scanning for Main ROM Checksum sub-routine #2 [to extract stored checksums and locations in ROM]
main checksum byte sequence #2 block found at offset=0x88160.

Stored Main ROM Block Checksum:
        lo:0xfffe0 hi:0xfffe2 (seg: 0x23f phy:0x8fffe0) : 0x9120aed2
Stored Main ROM Block ~Checksum:
        lo:0xfffe4 hi:0xfffe6 (seg: 0x23f phy:0x8fffe4) : 0x6edf512d
MAIN STORED ROM  CHECKSUM: 9120aed2 ? 9120aed2 : OK!     ~CHECKSUM: 6edf512d ? 6edf512d : OK!


>>> Scanning for Multipoint Checksum sub-routine #1 [to extract stored checksum list location in ROM]
Multipoint byte sequence #1 block found at offset=0x8b854.

Blk #01:
        lo:0x1fbde (seg: 0x207 phy:0x81fbde) : Start: 0x00000000
        lo:0x1fbe2 (seg: 0x207 phy:0x81fbe2) : End:   0x00003fff
        lo:0x1fbe6 (seg: 0x207 phy:0x81fbe6) : CRC32: 0x0fa0f5cf
        lo:0x1fbea (seg: 0x207 phy:0x81fbea) : ~CRC32 0xf05f0a30 Bootblock #1 ram/rom offset: 0x00000000 len=0x3fff
Blk #02:
        lo:0x1fbee (seg: 0x207 phy:0x81fbee) : Start: 0x00004000
        lo:0x1fbf2 (seg: 0x207 phy:0x81fbf2) : End:   0x00007fff
        lo:0x1fbf6 (seg: 0x207 phy:0x81fbf6) : CRC32: 0x0f4716b3
        lo:0x1fbfa (seg: 0x207 phy:0x81fbfa) : ~CRC32 0xf0b8e94c Bootblock #2 ram/rom offset: 0x00004000 len=0x3fff
Blk #03:
        lo:0x1fbfe (seg: 0x207 phy:0x81fbfe) : Start: 0x00800000
        lo:0x1fc02 (seg: 0x207 phy:0x81fc02) : End:   0x00803fff
        lo:0x1fc06 (seg: 0x207 phy:0x81fc06) : CRC32: 0x0fa0f5cf
        lo:0x1fc0a (seg: 0x207 phy:0x81fc0a) : ~CRC32 0xf05f0a30 rom offset: 0x00000000 len=0x3fff

... cut ... cut ...


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 24, 2018, 08:33:56 AM
This is FANTASTIC... i'd prefer a (working) pull request over a patch though :)

Just going out to dinner now but I will come back to you...

I'm going to need to work out how to do it on the old ME7sum (your version) since this is completely new code. Shouldn't be too hard though...


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 29, 2018, 01:36:04 AM
@ Nyet... Haven't been sleeping. Noticed that there are a few more variants of the checksum routines I could support so I've now got it working with Volvo roms too which took a little bit more effort since they don't use the same rombase addressing so I had to work out a way to do it without using hardcoded rombase addresses!!

Here's a sample output on a Volvo ROM I downloaded from here..


Ý Opening 'VOLVO S60R_AUT 2.5L B5254T4 300HP NoCarPartNo 0261208289 30684626A.bin' file
Succeded loading file.

Loaded ROM: Tool in 1Mb Mode

>>> Scanning for Main ROM Checksum sub-routine #1 [to extract Start/End regions]
main checksum byte sequence #1 found at offset=0xe3040.

Main Region Block #1:
        lo:0x2c882 hi:0x2c884 (seg: 0xb phy:0x2c882) : 0xc000
        lo:0x2c886 hi:0x2c888 (seg: 0xb phy:0x2c886) : 0xdfff sum=41c6b73 ~sum=fbe3948c : acc_sum=0
Main Region Block #2:
        lo:0x2c88a hi:0x2c88c (seg: 0xb phy:0x2c88a) : 0x10b00
        lo:0x2c88e hi:0x2c890 (seg: 0xb phy:0x2c88e) : 0x1f7ff sum=1ba41a95 ~sum=e45be56a : acc_sum=41c6b73
Main Region Block #3:
        lo:0x2c892 hi:0x2c894 (seg: 0xb phy:0x2c892) : 0x1fc00
        lo:0x2c896 hi:0x2c898 (seg: 0xb phy:0x2c896) : 0xfffef sum=facf8c86 ~sum=5307379 : acc_sum=1fc08608

Final Main ROM Checksum calculation:  0x1a90128e (after 3 rounds)
Final Main ROM Checksum calculation: ~0xe56fed71



>>> Scanning for Main ROM Checksum sub-routine #2 variant #A [to extract stored checksums and locations in ROM] No match found
main checksum byte sequence #2 not found
Trying different variant.

>>> Scanning for Main ROM Checksum sub-routine #2 variant #B [to extract stored checksums and locations in ROM]
main checksum byte sequence #2 variant #B block found at offset=0xe30ce.

Stored Main ROM Block Checksum:
        lo:0xffff0 hi:0xffff2 (seg: 0x3f phy:0xffff0) : 0x1a90128e
Stored Main ROM Block ~Checksum:
        lo:0xffff4 hi:0xffff6 (seg: 0x3f phy:0xffff4) : 0xe56fed71
MAIN STORED ROM  CHECKSUM: 1a90128e ? 1a90128e : OK!     ~CHECKSUM: e56fed71 ? e56fed71 : OK!


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: DT on August 29, 2018, 02:48:28 PM
Nice, this needle mask routine could be very useful for finding other routines between different files too.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 29, 2018, 02:59:52 PM
Nice, this needle mask routine could be very useful for finding other routines between different files too.

That's exactly the way I'm using it. My latest ME7Sum tool is now working across multiple different (normally incompatible) checksummed rom's including both 512kbyte and 1024kbyte. Each with different rom base addresses, etc. Totally different locations, numbers of multipoint sums and numbers of entries. I now extract EVERYTHING directly out of the machine code include number of entries in the tables. Check out the latest log output on a Volvo rom (originally unsupported) but also working on Ferrari, Alfa, VAG, etc... Pretty much everything that's built with Siemens C167 that I've tried so far...


Opening 'VOLVO S60R_AUT 2.5L B5254T4 300HP NoCarPartNo 0261208289 30684626A.bin' file
Succeded loading file.

Loaded ROM: Tool in 1Mb Mode

>>> Scanning for Main ROM Checksum sub-routine #1 [to extract number of entries in table]
main checksum byte sequence #1 found at offset=0xe307c.
Found #3 Regional Block Entries in table

>>> Scanning for Main ROM Checksum sub-routine #2 [to extract Start/End regions]

main checksum byte sequence #1 found at offset=0xe3040.

Main Region Block #1:
        lo:0x2c882 hi:0x2c884 (seg: 0xb phy:0x2c882) : 0xc000
        lo:0x2c886 hi:0x2c888 (seg: 0xb phy:0x2c886) : 0xdfff sum=41c6b73 ~sum=fbe3948c : acc_sum=0
Main Region Block #2:
        lo:0x2c88a hi:0x2c88c (seg: 0xb phy:0x2c88a) : 0x10b00
        lo:0x2c88e hi:0x2c890 (seg: 0xb phy:0x2c88e) : 0x1f7ff sum=1ba41a95 ~sum=e45be56a : acc_sum=41c6b73
Main Region Block #3:
        lo:0x2c892 hi:0x2c894 (seg: 0xb phy:0x2c892) : 0x1fc00
        lo:0x2c896 hi:0x2c898 (seg: 0xb phy:0x2c896) : 0xfffef sum=facf8c86 ~sum=5307379 : acc_sum=1fc08608

Final Main ROM Checksum calculation:  0x1a90128e (after 3 rounds)
Final Main ROM Checksum calculation: ~0xe56fed71


>>> Scanning for Main ROM Checksum sub-routine #3 variant #A [to extract stored checksums and locations in ROM]
No match found
main checksum byte sequence #3 variant #A not found
Trying different variant.

>>> Scanning for Main ROM Checksum sub-routine #3 variant #B [to extract stored checksums and locations in ROM]

main checksum byte sequence #3 variant #B block found at offset=0xe30ce.

Stored Main ROM Block Checksum:
        lo:0xffff0 hi:0xffff2 (seg: 0x3f phy:0xffff0) : 0x1a90128e
Stored Main ROM Block ~Checksum:
        lo:0xffff4 hi:0xffff6 (seg: 0x3f phy:0xffff4) : 0xe56fed71

MAIN STORED ROM  CHECKSUM: 0x1a90128e ? 0x1a90128e : OK!         ~CHECKSUM: 0xe56fed71 ? 0xe56fed71 : OK!



>>> Scanning for Multipoint Checksum sub-routine #1 [to extract number entries in stored checksum list in ROM]
Multipoint byte sequence #1 block found at offset=0xe151e.
Found #64 Multipoint Entries in table
>>> Scanning for Multipoint Checksum sub-routine #2 [to extract address of stored checksum list location in ROM]
Multipoint byte sequence #2 block found at offset=0xe17a0.

Blk #01:
        lo:0x1f800 (seg: 0x7 phy:0x1f800) : Start: 0x00000000
        lo:0x1f804 (seg: 0x7 phy:0x1f804) : End:   0x000001ff
        lo:0x1f808 (seg: 0x7 phy:0x1f808) : CRC32: 0x00407600
        lo:0x1f80c (seg: 0x7 phy:0x1f80c) : ~CRC32 0xffbf89ff
Blk #02:
        lo:0x1f810 (seg: 0x7 phy:0x1f810) : Start: 0x00000000
        lo:0x1f814 (seg: 0x7 phy:0x1f814) : End:   0x000001ff
        lo:0x1f818 (seg: 0x7 phy:0x1f818) : CRC32: 0x00407600
        lo:0x1f81c (seg: 0x7 phy:0x1f81c) : ~CRC32 0xffbf89ff
Blk #03:
        lo:0x1f820 (seg: 0x7 phy:0x1f820) : Start: 0x00008000
        lo:0x1f824 (seg: 0x7 phy:0x1f824) : End:   0x0000bfff
        lo:0x1f828 (seg: 0x7 phy:0x1f828) : CRC32: 0x0ec1a3cb
        lo:0x1f82c (seg: 0x7 phy:0x1f82c) : ~CRC32 0xf13e5c34

... cut .... cut ...... cut .... cut ...... cut .... cut ...... cut .... cut ...




Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 29, 2018, 03:59:42 PM
Its pretty much still a work in progress (the new code will be retrofitted into latest Nyet ME7sum soon). If you want to try it out (or look at the source-code) here's a google drive share to it...

https://drive.google.com/open?id=1ajZYirUtiD7XBqXVrtv2flcoGsroUxZm (https://drive.google.com/open?id=1ajZYirUtiD7XBqXVrtv2flcoGsroUxZm)



Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on August 29, 2018, 04:06:31 PM
Please, do not do it this way. Github exists for a reason, and posting source code in dropbox or gdrive is pure insanity.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on August 29, 2018, 04:07:23 PM
You should already be making these changes, incrementally, under source control, based on an upstream repository.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 29, 2018, 08:32:57 PM
nyet, your absolutely right, it actually is already under github, just didn't yet check latest version upsteam. Done now.

Here it is here;

https://github.com/360trev/ME7RomTool_Ferrari (https://github.com/360trev/ME7RomTool_Ferrari)

Its not the same tool as me7sum as its going to do more than sum. I think we need to make a option to build the summing code as a shared library to be used by other kinds of tools in the future.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on August 30, 2018, 08:52:22 AM
Thanks, looking over it now. Merging is not going to be easy :/


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on August 30, 2018, 10:41:55 PM
Thanks, looking over it now. Merging is not going to be easy :/

I'd recommend just taking the sections of code which deal with the needles and substitue the hard coded assumed addresses.
Really this is the biggest difference between original and the new approach. Every address is discovered from probing the machine code itself and pulling out the necessary information.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: 360trev on September 03, 2018, 03:53:55 PM
Done quite a few updates today!

It can now identify a few more variants/strains of routine as well as detecting and then pulling the correct DPPx register out of a given rom. This makes it quite a bit easier to set things up for correct reversing. Also added the ability to do the calculations of the multipoints now too as well as finding the xorCalcuationTable in a given rom (if it exists) and dumping its xortable too ;)...

Have fun ;)

Here's what dppx analysis looks like...

Loaded ROM: Tool in 1Mb Mode

-[ DPPx Setup Analysis ]-----------------------------------------------------------------

>>> Scanning for Main ROM DPPx setup #1 [to extract dpp0, dpp1, dpp2, dpp3 from rom]
main rom dppX byte sequence #1 found at offset=0x64a6.

dpp0: 0x0000
dpp1: 0x0205
dpp2: 0x00e0
dpp3: 0x0003 (DPP3 is always 3, otherwise accessing CPU register area not possible)



Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: JKaunisto on June 16, 2019, 12:27:01 PM
Hi! New to this forum and ecu flashing, and now it hapeened. I'm facing a need for an answer.

So i started with babysteps, and was going to only delete the rear 02 sensors from my ecu. After fiquring out how to use Tunerpro, Nefmoto etc. i had the .bin file from my 4Z7907551N ecu. Used in Tunerpro the "R" box .xdf, and apparently succesfully modified the .bin.

So here it comes: when i pulled program from my ecu, i ran it through ME7Check. Result "OK". So after tweaking the file, i ran it through ME7Check again. Well, well, RSA signature error (from what i've understood, this is normal), but also checkusm errors etc. Total of 4 errors, including the RSA. So i ran the new file through me7sum. Found 7 bad checksums, corrected 7/7, everything ok.

After this pulled it again through ME7Check, still moaning about the 4 errors (3 if you drop the RSA away). So basically, what is normal, when i should be worried, and please help me to understand the basics of this.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: nyet on June 16, 2019, 02:43:24 PM
This is why it is pointless to modify tuned ecus. You have no idea what the person was trying to do.

Revert to stock, start from there.


Title: Re: ME7Sum: Open Source Checker/Corrector for ME7
Post by: fukenbroken on September 06, 2019, 04:50:00 AM
usage with explorer context menu

win+r
regedit
HKEY_CLASSES_ROOT\*\shell
make new dir name as you want ('fix cs' for example)
make new dir inside previous name it 'command'
so your final path should be \HKEY_CLASSES_ROOT\*\shell\fix cs\command
change default value at the right side to

C:\\windows\\system32\\cmd /k C:\VW\me7check\me7sum.exe "%1" "%1" & pause & C:\VW\me7check\me7check.exe "%1" & pause & pause & exit

with path changes to yours
now right click on a flash file, select 'fix cs'