|
Title: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on January 27, 2013, 02:54:24 AM This project is under BSD open source license. Its on the most unrestrictive
freeware license possible. No warranty implied or given. It is a tool written in C for management of Bosch ME7.1 firmware dumps. It's a command line tool, as in just clicking it does nothing! You have to know how to use cmd. The latest binary releases are always available here: https://nyetwurk.github.io/ME7Sum/ The latest version (as of 24 July 2021) is v1.1.1 To output corrected checksums you must specify an output file: me7sum image.bin out.bin If you omit "out.bin" it me7sum will only CHECK the file, not correct it. Note that if me7sum cannot completely detect checksum/CRC locations correctly, it will not output a file! ** Always use me7sum on a original version of your bin first to make sure it is compatible! ** ** Make sure to check all corrected bins with ME7Check.exe before flashing them! ** Source code: https://github.com/nyetwurk/ME7Sum/ Readme: https://github.com/nyetwurk/ME7Sum/blob/master/README.md Known ECUs with problems: • Some 4.2 ME7.1.1 (e.g. 8E0910560H) • ST10 ECUs Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: bofh on January 05, 2014, 03:53:24 PM thank you for this great tool! :)
btw: seems to work with ME7.5 (APX 8L0906018M). ME7Check says file is ok after running ME7Sum. ;D
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: AARDQ on September 24, 2014, 10:50:19 PM 4Z907551R with modified KFZW. ME7Check results at the bottom. This is OK, as common lore would have it? Epic tool! I've been dreading the day when my ancient laptop with MTX Tunerpro plugin dies.
Code: c:\me7checktest>me7sum me711testA.bin me711testcorr.bin Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 24, 2014, 11:09:32 PM Yea the RSA error is as expected - I have no idea how that is done still.
Also, there is one multipoint checksum area not checked yet for ME7.1.1 - 0x0 - 0x3fff ... hopefully not too many people modify that area. I'm currently trying to figure that one out too. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: hopsis on September 25, 2014, 02:44:08 AM Some problems with ME7.1 also.
C:\Users\Käyttäjä\Desktop\tunettamiset\temp\new me7 check>me7check testi.bin ============================================================================== me7check v1.12 (c) mki, 06/2004-05/2012 Checking file testi.bin (size=1048576) Reading Version Strings... -> Bootrom Version = embedded in CPU, asume 05.12/05.32 -> EPK = 42/1/ME7.1/5/8000.07//X22fc/Dstt2g/100699/ -> Contents of ECUID data table: - '0261206373' (SSECUHN) - '1037352378' (SSECUSN) - '4D0907559D ' (VAG part number) - '0002' (VAG sw number) - '4.2L V8/5V ' (engine id) WARNING: flash should be 512kB of size, but the file is 1MB !! -> trying to analyze only the first 512kB of the file Page checksum failure(s) found Data area checksum failure(s) found -> Found 2 errors!!! ******************************* C:\Users\Käyttäjä\Desktop\tunettamiset\temp\new me7 check>me7sum testi.bin ME7Tool (v0.0.7) [ Management tool for Bosch ME7.x firmwares] Inspiration from Andy Whittaker's tools and information Written by 360trev and nyet [BSD License Open Source]. Attempting to open firmware file 'testi.bin' Step #1: Reading ROMSYS .. Startup section: word[0x00008000]+word[0x0000FFFE] @8038 Add=0x00005DCB CalcAdd=0x00005DCB ADD OK Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF @803c Add=0x00B80C1B CalcAdd=0x00380C9B ** NOT OK ** All param page: word[0x00010000]+word[0x0001FFFE] @1b12a Add=0x971D CalcAdd=0x971D ADD OK Step #2: Reading Main Data Checksums .. Searching for main data CRC pre block...missing Searching for main data checksum blocks...FAIL Searching for main data CRC offsets...OK Step #2: ERROR! Skipping main data checksums ... UNDEFINED Step #3: Reading Main Program Checksums .. Searching for main program checksum..OK Step #3: ERROR! Skipping Main Program Checksums.. UNDEFINED Step #4: Reading Multipoint Checksum Blocks .. Searching for multipoint block descriptor #1...OK Multipoint #0: [2 blocks x <16> = 32 bytes] Searching for multipoint block descriptor #2...OK 5) <1fc60> Adr: 0x010000-0x013FFF Chk: 0x09E1B29B CalcChk: 0x09E25A84 ** NOT O K ** Multipoint #1: [32 blocks x <16> = 512 bytes] *** Found 37 checksums in testi.bin *** ABORTING! 2 uncorrectable error(s) in testi.bin! *** Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 25, 2014, 09:05:51 AM Some problems with ME7.1 also. - '4D0907559D ' (VAG part number) - '0002' (VAG sw number) - '4.2L V8/5V ' (engine id) Can you post the original bin for this file? Thanks! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: ddillenger on September 25, 2014, 09:19:06 AM Here you are.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 25, 2014, 03:37:20 PM ME7Check somewhat complains on that file:
ME7Check v1.12 (c) mki, 06/2004-05/2012 Checking file D.bin (size=1048576) Reading Version Strings... -> Bootrom Version = embedded in CPU, asume 05.12/05.32 -> EPK = 42/1/ME7.1/5/8000.07//X22fc/Dstt2g/100699/ -> Contents of ECUID data table: - '0261206373' (SSECUHN) - '1037352378' (SSECUSN) - '4D0907559D ' (VAG part number) - '0002' (VAG sw number) - '4.2L V8/5V ' (engine id) WARNING: flash should be 512kB of size, but the file is 1MB !! -> trying to analyze only the first 512kB of the file -> No errors found. File is OK. ********************* Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: ddillenger on September 25, 2014, 03:57:02 PM That is just how those files are. From the factory they are just doubled up on 29F800BB flash chips-lol.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: hopsis on September 25, 2014, 10:04:08 PM Yep. I have more of those ME7.1 bins, mostly from 40V 4.2 A6/S6 engines that produce the same results with ME7sum. Personally it's not that big a deal anymore and I don't know if anybody else even works with V8 ME7.1 cars.
DD is correct about the file being doubled up. I have one 4D0907558D ecu with the 29F400BB and the first 512k is practically identical to the 1024k 4D0907559D. I even tried flashing a 1024k file to the 512k chip with Galletto. Works like a charm, Galletto expectedly throws an error at 50% but the good stuff is already in the ecu at that point. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 26, 2014, 09:38:07 AM Thanks for your patience guys! I have a new test version coming pretty soon that should address some of the issues reported.
I am still unclear on how the RSA stuff works, and there are a bunch of ME7.5 files that still don't work right, but I am making good headway. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: hopsis on September 26, 2014, 11:21:34 PM Had a quick test with a few bins before leaving for work, seems to work better with the previously mentioned 40V V8 ME7.1 binarys. I hope it's a slow day at work, I'll put this to stress test with everything I have and cross-compare with Winols corrections of the same files.
If that is something that would be useful, I can do the grunt work for You, I have more free time than skills. What could go wrong with that combo? :) Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 26, 2014, 11:23:52 PM Had a quick test with a few bins before leaving for work, seems to work better with the previously mentioned 40V V8 ME7.1 binarys. I hope it's a slow day at work, I'll put this to stress test with everything I have and cross-compare with Winols corrections of the same files. If that is something that would be useful, I can do the grunt work for You, I have more free time than skills. What could go wrong with that combo? :) YES! That is EXACTLY what I need! Thank you! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: hopsis on September 27, 2014, 01:37:08 AM Cool, about time I can give something back. Do You have any preference or a specific method that You want me to use? I have all the binarys in a folder with me7check and me7sum. I'm thinking of doing 1 minor change to a random map I can find in all the bins, say KFZW. I can then run me7check against the originals and me7sum/winols corrected files but that seems like a lot of data for You to sift through.
If I run: ME7Check for original ME7Check for modified ME7Sum for modified Winols for modified ME7Check for ME7Sum corrected ME7Check for Winols corrected I end up with 4 binarys in total (ORI, MOD, WINOLS, ME7SUM) and a load of logs. I have about 10 bins and I can do all that, it's just a question of what is the most useful format for You. Is there any way to get any log from Winols when it does its checksum corrections? I'm thinking propably not. If there is, please let me know how and I'll add that info too. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 27, 2014, 09:05:06 AM Yea, this is definitely what I need.
The only problem is, it is the more obscure checksum/crc blocks that might need testing (ROMSYS, bootblock) (meaning changes in odd places in the bin)... but they are also places people are very very unlikely to ever have to change... so i don't even know if that is relevant? But I think that can easily be solved; just also change the first byte in the file (yea, it will probably result in a bad bin, so dont run it!) but it would be fine for testing the checksum. As far as getting winols to tell you where things changed... nope. it doesn't do that. They really don't want you knowing how checksums work. They also go out of the way to hide checksum value areas from the hex view, and from the diffing tool (but that makes sense, when tuning, you don't really want to be told those are differences). The only foolproof way is to use a binary diffing tool. There are several out there for windows, but I have not found one i like best yet. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 27, 2014, 09:07:07 AM I have about 10 bins and I can do all that, it's just a question of what is the most useful format for You All I really need is ok or fail. If you find a set that doesn't work, i'll have to hand test them anyway. If you want to keep a complete document that describes the results for yourself, hey, thats fine too :) Thanks in advance, its not going to be a fun job :) Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: hopsis on September 27, 2014, 11:41:01 AM Yeah I can do that. I've gone awol for a while. Decided to take the gf for dinner and a movie. It's 9.30PM here just now and the way things are looking, it'll probably be monday before I can sink my teeth into this.
I did some testing earlier today when at work and the program worked flawlessly. Didn't get a chance to compare against Winols as I only have the demo version on my work laptop. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: hopsis on September 28, 2014, 08:08:58 AM I managed to find some time to test these today. I had eleven different binaries. I changed one cell in KFZW + changed the first byte to FF in all the files. ME7Sum managed to correct all but two files. The results are in the info included in the archive.
Sorry about the lack of scientific approach. I have zero previous experience in beta testing :) Let me know if and what You need done differently. As mentioned earlier, I have tons of free time at work. I sit at my computer all day and usually just watch Family Guy or whatever. I'll gladly put that time to a more meaningful use in the boundaries of my skills. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 28, 2014, 10:42:31 AM Thanks! Neither of those look easy to fix right off the bat, unfortunately.
For ref: Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 28, 2014, 11:20:47 AM Thanks! Neither of those look easy to fix right off the bat, unfortunately. I was wrong. DO NOT IGNORE RSA errors until ME7Sum has been fully tested, or you are willing to be a test subject. I haven't figured it out yet RSA checking (and signing) is still very much not working. The other image (4D0907558S) i have found a fix for; working on a new release. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: ddillenger on September 28, 2014, 08:58:40 PM I lied. You can ignore the RSA error in 4D1907558, I haven't figured it out yet RSA checking (and signing) is still very much not working. However, a failed RSA signature will not prevent a file from working, as far as i know, the ECU never checks the RSA signature. The other image (4D0907558S) i have found a fix for; working on a new release. RSA checking is very much a problem on some of the 1.8t binarys. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 28, 2014, 09:21:28 PM RSA checking is very much a problem on some of the 1.8t binarys. In that case, I'm going to need some help. The main question being: what area(s) does the RSA signature cover? I have the rest in place (I think). Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 30, 2014, 03:21:18 PM NEED TESTERS! Prelim RSA support is there If you have a bin that has a RSA signature *and you know what you are doing and don't mind being stranded* I could use your help testing... Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 01, 2014, 11:14:36 PM This should fix all RSA signature problems. ALWAYS check your bins with ME7Check.exe.. if you see any errors, DO NOT flash it to your ECU. Post the bin here and/or email me directly. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 04, 2014, 04:57:09 PM First feature complete (but probably still buggy) version. Added -s option to dump ecu info only. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: ddillenger on October 04, 2014, 06:48:22 PM You are a beast nye. Congrats!
Every binary I tested it on seemed to work. Sorry I don' have that many cars here :P Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: AudiMan85 on October 04, 2014, 10:03:03 PM Sweet job. Will this do .bins for the 518AK?
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 04, 2014, 10:06:53 PM Maybe. I don't have a car to try it out on.
ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares] Inspiration from Andy Whittaker's tools and information. Written by 360trev and nyet [BSD License Open Source]. Attempting to open firmware file '8E0909518AK.bin' Step #1: Reading ROM info .. Searching for EPK signature...OK Searching for P/N...OK EPK : '40/1/ME7.5/5/4012.31//24H/Dst04o/010903//' Part Number : '8E0909518AK' Engine ID : '1.8L R4/5VT' SW Version : '0004' HW Number : '0261208230' SW Number : '1037369307' Step #2: Reading ROMSYS .. Startup section: word[0x008000]+word[0x00FFFE] @008038 Add=0x010D43 CalcAdd=0x010D43 ADD OK Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF @00803c Add=0x921CB5 CalcAdd=0x921CB5 ADD OK All param page: word[0x010000]+word[0x01FFFE] @01e50c Add=0x00971D CalcAdd=0x00971D ADD OK Step #3: Reading RSA signatures .. Searching for RSA offset #0...OK Searching for RSA offset #1...OK Signature: @a595c-a59dc Modulus: @16962-169e2 Exponent: @169e2 = 3 Searching for MD5 ranges...OK MD5 Block Offset Table @1693e [32 bytes]: 1) Adr: 0x00010002-0x00013FFE 2) Adr: 0x00014252-0x00017F4E 3) Adr: 0x00018192-0x0001FBDC 4) Adr: 0x00026A00-0x0002FFFC EncrMD5: b0 1c d5 90 b6 8e ed f5 0a bc e0 32 69 6f f8 21 CalcMD5: b0 1c d5 90 b6 8e ed f5 0a bc e0 32 69 6f f8 21 OK Step #4: Reading Main Data Checksums .. Searching for main data CRC pre block...missing Searching for main data CRC/csum blocks...OK Searching for main data CRC offsets...missing Searching for main data checksum offsets...OK 1) Adr: 0x010002-0x013FFE CalcCSM: 0014741B 2) Adr: 0x014252-0x017F4E CalcCSM: 002E7CC4 3) Adr: 0x018192-0x01FBDC CalcCSM: 004DBFB7 4) Adr: 0x026A00-0x02FFFC CalcCSM: 00878190 @9ffee CSM: 00878190 CalcCSM: 00878190 Main data checksum OK Step #5: Reading Main Program Checksums .. Searching for main program checksum..OK ROM Checksum Block Offset Table @2bbca [16 bytes]: 1) Adr: 0x000000-0x00FBFF 0x00FC00-0x01FFFF SKIPPED CalcChk: 0x2626C9D7 CalcCRC: 0x8EAFE566 2) Adr: 0x020000-0x0FFFFF @fffe0 Chk: 0xAD05A414 CalcChk: 0xAD05A414 Main program checksum OK Step #6: Reading Multipoint Checksum Blocks .. Searching for multipoint block descriptor #1...missing Searching for multipoint block descriptor #2...OK 1) <1fbde> Adr: 0x000000-0x003FFF Chk: 0x0E59D5C8 Boot: (whitelisted) OK 2) <1fbee> Adr: 0x004000-0x007FFF Chk: 0x1077FB35 Boot: (whitelisted) OK 3) <1fbfe> Adr: 0x000000-0x003FFF Chk: 0x0E59D5C8 CalcChk: 0x0E59D5C8 OK 4) <1fc0e> Adr: 0x004000-0x007FFF Chk: 0x1077FB35 CalcChk: 0x1077FB35 OK Multipoint #2: [66 blocks x <16> = 1056 bytes] *** Found 70 checksums in 8E0909518AK.bin *** DONE! 0/0 error(s) corrected in 8E0909518AK.bin! *** Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: AudiMan85 on October 04, 2014, 10:29:04 PM I can test on a friends car if someone can for sure tell me how to boot mode that ecu. Same chip and pin as ours? I have never looked at the ecu but can take some 16mp pics if anyone needs to see the PCB.
Lmk my friend wants me to make him file anyways, I have found enough info so far as xdf's. I know I told him that MTX wants a different checksum tool for his ecu and he didn't wanna pay for me to have the plug-in. So his SOL right now. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: SB_GLI on October 05, 2014, 08:12:56 AM Wow! It works! This is great news! The MTX plugin never worked on this file. Thanks for this Nye!
BEFORE: ME7Sum: Code: C:\Users\Steve>Z:\me7sum\me7sum.exe "Z:\ECU Files\Jetta\checksumtest.bin" ME7Check: Code: ============================================================================== Correction: Code: C:\Users\Steve>Z:\me7sum\me7sum.exe "Z:\ECU Files\Jetta\checksumtest.bin" "Z:\EC Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: SB_GLI on October 05, 2014, 08:14:27 AM AFTER:
MESum Code: C:\Users\Steve>Z:\me7sum\me7sum.exe "Z:\ECU Files\Jetta\checksumtest.bin" ME7Check Code: ============================================================================== Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: SB_GLI on October 05, 2014, 09:11:23 AM There was a thread/post in the past about adding either ME7Sum or ME7Check to the custom tools of Tunerpro. Does anyone know where I can find this post?
I have these tools integrated into Tunerpro now, but the command window closes up at the end so I can't see the output. I swear the post that I am referring to had it setup where the command window would stay open after execution. Can someone help me find this? Edit: Found it In tunerpro's custom tools editor: Tool path: cmd Cmd line params: /k <path to me7sum> "$(CurBinPath)" "$(CurBinPath)" & pause & exit I did this for ME7Sum for both correction and verification, and also setup another tool for ME7Check verification as well. Woohoo! A nice "built-in" checksum corrector for tunerpro!!! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 05, 2014, 01:12:44 PM Thanks for the feedback guys.. Glad it's working! Please let me know if you guys find any files it has problems with.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Tshirt2k on October 05, 2014, 02:52:33 PM This is great work. Seems to work for me too. ;D
Before: Me7check Code: me7check v1.12 (c) mki, 06/2004-05/2012 Me7sum: Code: ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares] Corrected: Code: ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares] AFTER: Me7check: Code: me7check v1.12 (c) mki, 06/2004-05/2012 Me7sum: Code: ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares] Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: AudiMan85 on October 05, 2014, 06:03:45 PM I had posted a guide on how-to add ME7SUM and ME7CHECK into TunerPro and setup keyboard shortcuts.
I found the link, but the thread must have been removed. Idk if a higher ranking person could bring it back, but here is the link I had posted in the noobs guide to me7sum. http://nefariousmotorsports.com/forum/index.php?topic=5877.0title= Here is away to do me7check. My thread explained it more on how to do me7sum but I can post a screenshot of my settings and people could adapt it to there needs, I can't re-explain so maybe someone can bring my old thread back. http://nefariousmotorsports.com/forum/index.php?topic=4698.msg46235#msg46235 -------------------------------------------------------------------------------------- Tunerpro examples to add ME7Sum and ME7Check (http://i62.tinypic.com/2112vxu.jpg) (http://i59.tinypic.com/207qc8z.jpg) (http://i61.tinypic.com/eai646.jpg) Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: hopsis on October 06, 2014, 12:41:26 AM Sweet. Did some quick testing with latest ME7Sum and Winols. ME7Sum_fixed and Winols_fixed files are identical, at least with the ME7.1 and ME7.1.1 files I had at hand. Implemented the custom tools from previous post to Tunerpro. Felt like typing IDDQD and IDKFA :)
Thanks nyet. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 06, 2014, 10:13:48 AM ME7Sum_fixed and Winols_fixed files are identical, at least with the ME7.1 and ME7.1.1 files I had at hand. Thank you for testing! Note that because of the way RSA signing works, ME7Sum and WinOLS will sign things differently (I don't have the private key that WinOLS uses, and I don't care to hack it :) Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: SB_GLI on October 06, 2014, 01:22:27 PM As long as it works, it's okay by me. I am glad there's an explanation of why the files are different at least. That's the only thing that makes me hesitant from using ME7Sum on everything right now.
But in time, trust will come, and we can say "peace out" to all the other methods of checksumming our ME7 files! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: SB_GLI on October 06, 2014, 03:07:01 PM Nyet, Sent you an email on an issue with an 032HS. :P
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 06, 2014, 04:56:26 PM Hopefully fixed in v1.0.1!
Thanks for the feedback, as usual. Affected bins (probably others): 06A906032HS 4B0907551AH 4B0907551AL 4B0907551M 4Z7907551L 4Z7907551M 8D0907551AA 8D0907551T Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: dgpb on October 12, 2014, 01:56:48 PM Nyet, and all the people that have helped. Many thanks.
I've just corrected one of my modified but uncorrected files. Checked it and was free of errors, and then compared it to the corrected one via WinOLS by someone on the forum. The result was "Identic Files" So It seems to work perfectly on 06A906032HJ Hope my post to be helpful, and again, many thanks mates ;) Ps: For the future, If ME7Check says it's OK with no errors... for sure it's OK? Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 12, 2014, 05:53:58 PM Ps: For the future, If ME7Check says it's OK with no errors... for sure it's OK? I have yet to find a case where ME7Check provably has been wrong. It gets things right where even winols does not. I have found at least one instance where winols has corrected a file incorrectly! Also *there are still known bugs in me7sum* so please make sure you test all bins before running them! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: funnix on October 12, 2014, 09:36:41 PM Sometimes i get this failure! I 've integrated me7sum and me7check in tuner pro's custom tools. What i'm doing wrong?
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Tshirt2k on October 13, 2014, 01:39:12 AM Sometimes i get this failure! I 've integrated me7sum and me7check in tuner pro's custom tools. What i'm doing wrong? What is your syntax for the tool?s I had this problem. I had to take the directory location out of the custom tool command line . Ie: c:\ecu\me7sum. As it was already in the correct directory. HTH Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: funnix on October 13, 2014, 03:35:59 AM This is my configuration:
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Tshirt2k on October 13, 2014, 09:50:20 AM I had to get rid of cmd line Params upto. Eg(C:\users\mkoehler\) for mine to work as it was already in directory.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 13, 2014, 10:59:29 AM Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: TijnCU on October 13, 2014, 02:51:30 PM Not so much bins to test it on, but on my weirdo 1024-but-actually-512kb bin it works perfectly! With this tool I feel much more able to modify files ;)
Keep up the good work! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: em.Euro.R18 on October 13, 2014, 07:42:11 PM I'm getting a Access denied when attempting to use the me7sum.exe in CMD. I've tryed using different directories and setting them to run as administrator. Still no dice. any ideas?
C:\>C:\ME7Sum-master>me7sum.exe testinput.bin testoutput.bin Access denied. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 13, 2014, 08:30:30 PM I'm getting a Access denied when attempting to use the me7sum.exe in CMD. I've tryed using different directories and setting them to run as administrator. Still no dice. any ideas? C:\>C:\ME7Sum-master>me7sum.exe testinput.bin testoutput.bin Access denied. No doubt some stupid antivirus program or something. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: em.Euro.R18 on October 14, 2014, 09:39:09 AM GOT IT!!!!! I'll see if it will work on the my daily 4 motion 1.8t passat today! Idk how anyone can stand driving a car that feels slower then a hybrid prius.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: em.Euro.R18 on October 16, 2014, 11:37:18 AM 4B0906018DQ Confirmed with me7checksum 7 checksums were corrected. Well done on this tool nyet!
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: AudiMan85 on October 16, 2014, 08:42:58 PM Just wanted to add to the great job karma. For the 1st time I had gotten a pop-up that MTX Plugin couldn't correct my file.
Ran it thru your newest ME7SUM and ME7Check and 7 Errors corrected. I attached the message pop-up that I had gotten. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: ddillenger on October 16, 2014, 10:22:43 PM Just wanted to add to the great job karma. For the 1st time I had gotten a pop-up that MTX Plugin couldn't correct my file. Ran it thru your newest ME7SUM and ME7Check and 7 Errors corrected. I attached the message pop-up that I had gotten. Be careful. That could mean you made changes outside the typical map space. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: cpp on October 18, 2014, 02:23:37 PM works perfectly on 06a906032hp !!!
Thank you so much !!!! are reaping the rewards and haunting the neighborhood !!!! up + launch control !!! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: AudiMan85 on October 20, 2014, 09:35:16 AM I had to redo or recovery windows 8.1 on my desktop. It's doing this now to every file no matter what I change. Any ideas what I did wrong? I had to reinstall tunerpro my guess is my xdf file I have pre-installed my MTX plugin and maybe I need to go back and put my license file etc back in the root folder of Tunerpro.
Good news is now ECUxPlot works now on desktop. Nothing like seeing your logs and graphs on a 40" screen in 1080p. If my video card supported it I'd have it displayed on my 60" Samsung 4K-UHD TV and really make the wife happy on movie nights!!! But my loving wife, I just gotta view these logs I been out data logging and using $20 in gas on while your home getting mad I'm out wasting gas etc lol.... this is all a bad thing if you didn't guess! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 30, 2014, 03:44:26 PM v1.0.3 released
* Detect (and properly detect) case where checksum to be corrected is within the block it belongs to. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: thelastleroy on October 30, 2014, 06:39:30 PM v1.0.3 released * Detect (and properly detect) case where checksum to be corrected is within the block it belongs to. Just a heads up: Nyet, your version 1.0.3 download page is showing error 404 (no github page here) Love the software. Keep up the good work! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 30, 2014, 06:55:02 PM Just a heads up: Nyet, your version 1.0.3 download page is showing error 404 (no github page here) Love the software. Keep up the good work! Ooops :) Should be there now. Thanks for the heads up! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: mushtafa on November 07, 2014, 01:02:40 PM Nice software! Where can I donate?
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: AARDQ on November 09, 2014, 12:58:51 PM Sometimes i get this failure! I 've integrated me7sum and me7check in tuner pro's custom tools. What i'm doing wrong? No spaces in path names allowed, e.g. Tunerpro Files won't work. The prog thinks 'Files' is the name of the bin, and, of course, it isn't. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: SB_GLI on November 10, 2014, 02:48:34 PM Spaces should work fine as long as you put quotes around the file names. Although it is wise advice, especially when dealing with open source / free software that uses file IO, to make sure your folders don't have spaces in them.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: slappynuts on May 14, 2015, 06:52:27 PM I am having issues trying to run a bigger MAF on this ecu B0906018P. ME7 sum says it corrected everything and it is good, but ME7check says it fails.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on May 14, 2015, 07:00:50 PM Please don't make me download those files, cut and paste the output you are seeing.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: slappynuts on May 15, 2015, 03:39:13 PM Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved. C:\WINDOWS\system32>cd.. C:\Windows>cd.. C:\>me7\me7sum me7\bigmafstockatwgood.bin me7\bigmafstockatwgood_fix.bin ME7Tool (v1.0.3) [Management tool for Bosch ME7.x firmwares] Inspiration from Andy Whittaker's tools and information. Written by 360trev and nyet [BSD License Open Source]. Attempting to open firmware file 'me7\bigmafstockatwgood.bin' Step #1: Reading ROM info .. Searching for EPK signature...OK Searching for ECUID table...OK EPK : '42/1/ME7.5/3/4012.00//F22id/Dst06g/250899/' Part Number : '4B0906018P ' Engine ID : '1.8L R4/5VT ' SW Version : '0006' HW Number : '0261206537' SW Number : '1037352750' Step #2: Reading ROMSYS .. Startup section: word[0x008000]+word[0x00FFFE] @008038 Add=0x007CD1 CalcAdd=0x007CD1 ADD OK Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0x7FFFF @00803c Add=0x3972A5 CalcAdd=0x3972A5 ADD OK All param page: word[0x010000]+word[0x01FFFE] @01b560 Add=0x00971D CalcAdd=0x00971D ADD OK Step #3: Reading RSA signatures .. Searching for RSA offset #0...missing Searching for RSA offset #1...missing Step #4: Finding CRC table(s) .. Searching for CRC table(s)...OK CRC table(s) OK Step #5: Reading Main Data Checksums .. Searching for main data CRC pre block...missing Searching for main data CRC/csum blocks...missing Falling back to default 512k CRC blocks...OK Searching for main data CRC offsets...OK Searching for main data checksum offsets...missing Main CRCs: 1) 0x010000-0x013FFF @70000 CRC: AB605C52 CalcCRC: E2FDA8ED ** FIXED ** 2) 0x014300-0x017F67 @70006 CRC: 534DE7C2 CalcCRC: 534DE7C2 CRC OK 3) 0x018191-0x01FBFF @7000c CRC: A323DCA6 CalcCRC: A323DCA6 CRC OK Step #6: Reading Main Program Checksums .. Searching for main program checksum..OK ROM Checksum Block Offset Table @1dfec [16 bytes]: 1) 0x000000-0x00FBFF CalcChk: 47EF557E 0x00FC00-0x01FFFF CalcChk: 2CEDD2F0 CalcCRC: 668F1A38 SKIPPED 2) 0x020000-0x07FFFF <7ffe0> Chk: D81EDC5F CalcChk: D81F6097 ** FIXED ** Step #7: Reading Multipoint Checksum Blocks .. Searching for multipoint block descriptor #1...OK 1) <14224> 0x024000-0x02658D Chk: 0AFD060F CalcChk: 0AFD060F OK 2) <14234> 0x014000-0x014243 Chk: 005CAABC CalcChk: 005CAABC OK (i) 3) <14244> 0xFFFFFFFF-0xFFFFFFFF END Multipoint #1: [2 blocks x <16> = 32 bytes] Searching for multipoint block descriptor #2...OK 1) <1fc00> 0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK 2) <1fc10> 0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK 3) <1fc20> 0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK 4) <1fc30> 0x004000-0x007FFF Chk: 0F4716B3 CalcChk: 0F4716B3 OK Multipoint #2: [34 blocks x <16> = 544 bytes] *** Found 41 checksums in me7\bigmafstockatwgood.bin Attempting to output corrected firmware file 'me7\bigmafstockatwgood_fix.bin' ├╛ Opening 'me7\bigmafstockatwgood_fix.bin' file for writing ├╛ Writing to file ├╛ Validating size correct 524288=524288 ├╛ All OK, closing file *** DONE! 5/5 error(s) in me7\bigmafstockatwgood.bin corrected in me7\bigmafstoc katwgood_fix.bin! *** C:\> me7check v1.12 (c) mki, 06/2004-05/2012 Checking file C:\me7\bigmafstockatw_fix.bin (size=524288) Reading Version Strings... -> Bootrom Version = 05.12 -> EPK = 42/1/ME7.5/3/4012.00//F22id/Dst06g/250899/ -> Contents of ECUID data table: - '0261206537' (SSECUHN) - '1037352750' (SSECUSN) - '4B0906018P ' (VAG part number) - '0006' (VAG sw number) - '1.8L R4/5VT ' (engine id) -> Contents of ECUID data table: - 'HW_MAN004' Romsys checksum failure(s) found -> Found 1 error!!! ******************************* Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on May 15, 2015, 04:20:29 PM That doesn't look good :(
try running the _fix file back through ME7Sum.. I will take a look time permitting. Thanks for reporting the issue.. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: slappynuts on May 17, 2015, 08:54:00 AM Oh it worked! TY sir! Kicking myself for not thinking of that. ::)
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on May 17, 2015, 11:37:16 AM Oh it worked! TY sir! Kicking myself for not thinking of that. ::) No worries, it is a known bug I haven't figured out how to fix yet :( Thanks for providing an image I can use to test further! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: TLS4 on June 23, 2015, 09:43:38 AM No worries, it is a known bug I haven't figured out how to fix yet :( I get the same problem, I have to run ME7Sum twice to fix all checksums.Thanks for providing an image I can use to test further! The bins are more or less stock 8D0907551K and Q. Just a couple of codewords changed (CW_CAR_R_0___A = 0 on first try and the a few more). If you need test files I can post one of these. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on June 23, 2015, 10:09:45 AM I get the same problem, I have to run ME7Sum twice to fix all checksums. The bins are more or less stock 8D0907551K and Q. Just a couple of codewords changed (CW_CAR_R_0___A = 0 on first try and the a few more). If you need test files I can post one of these. Please do, thanks! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: TLS4 on June 24, 2015, 03:15:35 PM Please do, thanks! Here is a K-bin and a Q-bin and corresponding output from me7check and me7sum Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: redtop on September 16, 2015, 01:30:12 AM Hi!
I'm working with ME7.3.1 in Fiat/Alfa Romeo/Lancia and trying to sort out what happend with the ME7Sum development. As I understand it when reading old threads, the functionality of calculating the checksum for the Ferrari ME7.3h4 made by 360Trev was never implemented in Nyet's ME7Sum software? Still there's another ME7Sum by 360Trev on Github that is intended for the Ferrari ECU: https://github.com/360trev/ME7Sum ? Have I got this right? And is there anyplace I can get hold of 360Trev's software compiled for Windows? Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on September 16, 2015, 10:01:25 AM Hi! I'm working with ME7.3.1 in Fiat/Alfa Romeo/Lancia and trying to sort out what happend with the ME7Sum development. As I understand it when reading old threads, the functionality of calculating the checksum for the Ferrari ME7.3h4 made by 360Trev was never implemented in Nyet's ME7Sum software? Still there's another ME7Sum by 360Trev on Github that is intended for the Ferrari ECU: https://github.com/360trev/ME7Sum ? Have I got this right? And is there anyplace I can get hold of 360Trev's software compiled for Windows? That software was never completed and 1) does not compute all the checksums 2) does not automatically locate checksum locations. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: redtop on September 16, 2015, 10:54:10 PM That software was never completed and 1) does not compute all the checksums 2) does not automatically locate checksum locations. Thank you for the clairification! I guess I'll have to find another tool for checksums on the Alfa ECUs. :'( Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Awaken on November 25, 2016, 06:26:19 PM Hello, is MD5 hash failure same as RSA failure?
Hope this thread is still alive and hopefully I can get some info. I have a problem with a file for a 2002 S3 BAM 8N0906018BP. I use TunerPro with the MTX plugin. I have made only one simple change to the ori file, as a proof of concept and I get this when I run ME7Check: ME7Check v1.12 (c) mki, 06/2004-05/2012 Checking file C:\Users\Ceco\Desktop\Audi S3 225HP 8N0906018BP 0261208054 366474_modified.ori (size=1048576) Reading Version Strings... -> Bootrom Version = 05.12 -> EPK = 40/1/ME7.5/5/4018.20//24B/Dst02o/290702// -> Contents of ECUID data table: - '0261208054' (SSECUHN) - '1037366474' (SSECUSN) - '8N0906018BP ' (VAG part number) - '0002' (VAG sw number) - '1.8L R4/5VT ' (engine id) -> Contents of ECUID data table: - 'HW_MAN004' RSA signature failure found -> Found 1 error!!! ******************************* However! When I run ME7Sum on the same file, I get what I can identify as a md5 hash error, and not the RSA: ME7Tool (v1.0.3) [Management tool for Bosch ME7.x firmwares] Inspiration from Andy Whittaker's tools and information. Written by 360trev and nyet [BSD License Open Source]. Attempting to open firmware file 'asd.ori' Step #1: Reading ROM info .. Searching for EPK signature...OK Searching for ECUID table...OK EPK : '40/1/ME7.5/5/4018.20//24B/Dst02o/290702//' Part Number : '8N0906018BP ' Engine ID : '1.8L R4/5VT ' SW Version : '0002' HW Number : '0261208054' SW Number : '1037366474' Step #2: Reading ROMSYS .. Startup section: word[0x008000]+word[0x00FFFE] @008038 Add=0x00CD15 CalcAdd=0x00CD15 ADD OK Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF @00803c Add=0xA0B46E CalcAdd=0xA0B46E ADD OK All param page: word[0x010000]+word[0x01FFFE] @01bf7a Add=0x00971D CalcAdd=0x00971D ADD OK Step #3: Reading RSA signatures .. Searching for RSA offset #0...OK Searching for RSA offset #1...OK Signature: @8ec6a-8ecea Modulus: @167c2-16842 Exponent: @16842 = 3 Searching for MD5 ranges...OK MD5 Block Offset Table @1679e [32 bytes]: 1) 0x00010002-0x00013FFE 2) 0x00014252-0x00017F4E 3) 0x00018192-0x0001FBDC 4) 0x00026A00-0x0002FFFC EncrMD5: b6 87 d5 35 c6 9b 50 b3 d5 c5 1d eb 9a 73 2b 58 CalcMD5: a1 6b 4d e4 20 39 c5 92 ac c2 ba 43 a9 70 9c c2 ** NOT OK ** Step #4: Finding CRC table(s) .. Searching for CRC table(s)...OK CRC table(s) OK Step #5: Reading Main Data Checksums .. Searching for main data CRC pre block...missing Searching for main data CRC/csum blocks...OK Searching for main data CRC offsets...missing Searching for main data checksum offsets...OK Main Checksums: 1) 0x010002-0x013FFE CalcCSM: 001327A6 2) 0x014252-0x017F4E CalcCSM: 00286183 3) 0x018192-0x01FBDC CalcCSM: 00452742 4) 0x026A00-0x02FFFC CalcCSM: 00C338F7 @8f4b0 CSM: 00C338F7 CalcCSM: 00C338F7 Main data checksum OK Step #6: Reading Main Program Checksums .. Searching for main program checksum..OK ROM Checksum Block Offset Table @1fb92 [16 bytes]: 1) 0x000000-0x00FBFF CalcChk: 48D10B05 0x00FC00-0x01FFFF CalcChk: 2198346D CalcCRC: 2E660DB7 SKIPPED 2) 0x020000-0x0FFFFF <fffe0> Chk: 425F5982 CalcChk: 425F5982 OK (i) Step #7: Reading Multipoint Checksum Blocks .. Searching for multipoint block descriptor #1...missing Searching for multipoint block descriptor #2...OK 1) <1fbde> 0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK 2) <1fbee> 0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK 3) <1fbfe> 0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK 4) <1fc0e> 0x004000-0x007FFF Chk: 0F4716B3 CalcChk: 0F4716B3 OK Multipoint #2: [66 blocks x <16> = 1056 bytes] *** Found 70 checksums in asd.ori *** WARNING! 1/1 uncorrected error(s) in asd.ori! *** I have attached the binary. Thanks in advance and sorry if I failed to find an answer to this, but I am pretty sure I read the whole forum already... :) Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on November 25, 2016, 07:26:46 PM yes
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Awaken on November 26, 2016, 02:37:51 AM Is there a way for Me7Sum to correct this, or is it something it cannot do yet? I read that some RSA support was added.
Thank you! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on November 26, 2016, 02:50:18 AM Does it not work?
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Awaken on November 26, 2016, 06:40:14 AM Unfortunately not, unless I use it wrong. I do ME7Sum.exe {filename}.bin. The output I just posted 2 posts ago is from ME7Sum, not ME7Check and the output is following (just pasting the problematic areas):
Step #3: Reading RSA signatures .. Searching for RSA offset #0...OK Searching for RSA offset #1...OK Signature: @8ec6a-8ecea Modulus: @167c2-16842 Exponent: @16842 = 3 Searching for MD5 ranges...OK MD5 Block Offset Table @1679e [32 bytes]: 1) 0x00010002-0x00013FFE 2) 0x00014252-0x00017F4E 3) 0x00018192-0x0001FBDC 4) 0x00026A00-0x0002FFFC EncrMD5: b6 87 d5 35 c6 9b 50 b3 d5 c5 1d eb 9a 73 2b 58 CalcMD5: a1 6b 4d e4 20 39 c5 92 ac c2 ba 43 a9 70 9c c2 ** NOT OK ** *** Found 70 checksums in asd.ori *** WARNING! 1/1 uncorrected error(s) in asd.ori! *** I am attaching the bin in question again. For the function call I had renamed it to asd.bin since it does not accept spaces in file names. Does it matter if I used the MTX plugin prior to using ME7Sum? Because MTX seems to fix the checksums, just not the RSA. Thank you for your replies, I appreciate it! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Awaken on November 26, 2016, 11:48:20 AM Actually, I was using it wrong, I was missing the out file. It worked perfectly now.
Still this might turn useful to somebody: don't forget to give an out file name to the command. Me7Sum.exe in_file.bin out_file.bin Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on November 26, 2016, 11:49:26 AM Me7Sum.exe in_file.bin out_file.bin yea, it is in the first post. Literally. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Awaken on November 26, 2016, 12:50:44 PM :) Sorry about that, too much information in one piece, some things are bound to slip thru.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Colt45 on May 19, 2017, 04:35:40 PM Hi, I tested this file with an 07K ECU (2.5L NA 5cyl from mkV a-platform cars), ME7.1.1, early one that is C167 and not ST10.
I don't intend to use this one for anything so it's not critical ME7Sum supports it, but I thought the data point might be helpful for greater support, I don't know. I pulled the file off an eBay ECU, maybe someone was in it before, maybe not (case was a bit mangled) can attach the files if any interest. ############ $ ./me7check.exe ../ori/07k/07K906032_0261208870_377692.bin ============================================================================== me7check v1.12 (c) mki, 06/2004-05/2012 Checking file ../ori/07k/07K906032_0261208870_377692.bin (size=1048576) Reading Version Strings... -> Bootrom Version = embedded in CPU, asume 06.02/06.05 -> EPK = 45/1/ME7.1.1/120/C1103B//24M/A4A05M50/110705/ -> Contents of ECUID data table: - '0261208870' (SSECUHN) - '1037377692' (SSECUSN) - '07K906032 ' (VAG part number) - '7826' (VAG sw number) - 'R5 AT ' (engine id) -> Contents of ECUID data table: - 'HW_MAN004' -> No errors found. File is OK. ********************* ############# $ ./me7sum.exe ../ori/07k/07K906032_0261208870_377692.bin fixed.bin ME7Tool (v1.0.3) [Management tool for Bosch ME7.x firmwares] Inspiration from Andy Whittaker's tools and information. Written by 360trev and nyet [BSD License Open Source]. Attempting to open firmware file '../ori/07k/07K906032_0261208870_377692.bin' Step #1: Reading ROM info .. Searching for EPK signature...OK Searching for ECUID table...0 matches, missing Step #1: ERROR! Skipping ROM info.. UNDEFINED Step #2: Reading ROMSYS .. Startup section: word[0x008000]+word[0x00FFFE] @008038 Add=0x00AFB7 CalcAdd=0x00AFB7 ADD OK Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF @00803c Add=0x74A1A1 CalcAdd=0x74A1A1 ADD OK All param page: word[0x010000]+word[0x01FFFE] @01e814 Add=0x00971D CalcAdd=0x00971D ADD OK Step #3: Reading RSA signatures .. Searching for RSA offset #0...OK Searching for RSA offset #1...OK Signature: @c8d10-c8d90 Modulus: @16830-168b0 Exponent: @168b0 = 3 Searching for MD5 ranges...OK MD5 Block Offset Table @1680c [32 bytes]: 1) 0x00010002-0x00013FFE 2) 0x00014502-0x00017EFE 3) 0x00018192-0x0001FBDC 4) 0x00026A00-0x0002FFFC EncrMD5: 17 c4 3f 60 e4 c3 21 e0 8d 7e 31 45 07 18 ae 35 CalcMD5: 17 c4 3f 60 e4 c3 21 e0 8d 7e 31 45 07 18 ae 35 OK Step #4: Finding CRC table(s) .. Searching for CRC table(s)...missing Searching for CRC table(s) using fallback...*** WARNING: ASM detect failed, fell back (found 0) in ../ori/07k/07K906032_0261208870_377692.bin OK Step #4: ERROR! Couldn't find CRC table(s) Step #5: Reading Main Data Checksums .. Searching for main data CRC pre block...missing Searching for main data CRC/csum blocks...OK Searching for main data CRC offsets...missing Searching for main data checksum offsets...OK Main Checksums: 1) 0x010002-0x013FFE CalcCSM: 0013FFA9 2) 0x014502-0x017EFE CalcCSM: 002B08FC 3) 0x018192-0x01FBDC CalcCSM: 004A8ADD 4) 0x026A00-0x02FFFC CalcCSM: 00AA0926 @c9556 CSM: 00AA0926 CalcCSM: 00AA0926 Main data checksum OK Step #6: Reading Main Program Checksums .. Searching for main program checksum..OK ROM Checksum Block Offset Table @294f8 [16 bytes]: 1) 0x000000-0x00FBFF CalcChk: 4672F6E7 0x00FC00-0x01FFFF CalcChk: 24A071FC CalcCRC: 46DB0B62 SKIPPED 2) 0x020000-0x0FFFFF <fffe0> Chk: 16C1A373 CalcChk: 16C1A373 OK (i) Step #7: Reading Multipoint Checksum Blocks .. Searching for multipoint block descriptor #1...missing Searching for multipoint block descriptor #2...OK 1) <1fbde> 0x000000-0x003FFF Chk: 0E59D5C8 Boot: (whitelisted) OK 2) <1fbee> 0x004000-0x007FFF Chk: 1077FB35 Boot: (whitelisted) OK 3) <1fbfe> 0x000000-0x003FFF Chk: 10942779 CalcChk: 10942779 OK 4) <1fc0e> 0x004000-0x007FFF Chk: 0E83C050 CalcChk: 0E83C050 OK Multipoint #2: [66 blocks x <16> = 1056 bytes] *** Found 70 checksums in ../ori/07k/07K906032_0261208870_377692.bin *** ABORTING! 2 uncorrectable error(s) in ../ori/07k/07K906032_0261208870_377692.bin! *** Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on July 22, 2017, 12:17:58 PM v1.0.5 is released; hopefully making it so you don't have to re-run me7sum several times on the same file
http://nyetwurk.github.io/ME7Sum/downloads/me7sum-v1.0.5.zip Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on July 24, 2017, 11:34:08 PM can attach the files if any interest. Go for it. No guarantees I can make it work but I can try Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Arti on January 03, 2018, 12:46:26 AM Hi,
me7.5 file 1mb from winols (checksum calculated with winols 2.24) and after using ME7sum I get Step #3: Reading RSA signatures .. Searching for RSA offset #0...missing Searching for RSA offset #1...missing Searching for main data checksum offsets...missing RSA offset finally program write *** Found 71 checksums in v1.bin *** DONE! 0/0 error(s) in v1.bin corrected in v1corr.bin! *** but v1corr.bin file doesn't exist Just to be sure: everything is ok file is not created because input file is 100% ok? (checksum in the file)? "Missing..." is not an error? Arti Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on January 03, 2018, 01:26:53 PM RSA not found is fine, it means there's no RSA to correct.
As to your other issue, it looks like an actual bug. Thanks for reporting it! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 24, 2018, 12:12:00 AM @ nyet
I've been doing some more work on the checksumming code recently as part of my recent bit of time to explore again. After some more time analyzing the main rom checksums (byte-summing) I noted we inherited the use of 'hardcoded locations' to identify where it is. This isn't really the best approach. Also we always assume there are only 2 sections (since for most roms this is the case, however its not always so, i've found some with 3). This means with these updates for instance it ME7Sum can work to checksum Alfa's too :) So I'm using the needle/mask approach to identify the rom sum function itself... #define SKIP 0x00 #define XXXX 0x00 #define YYYY 0x00 #define MASK 0xff // // this is the needle (masked) for the Main Checksum function to extract Start Address and End Address then extract the segment offset function and the hi/lo words directly out of the code.. // const unsigned char needle_2[] = { 0xF6, 0x8E, XXXX, XXXX, // mov var_x, zeros 0xF6, 0x8E, XXXX, XXXX, // mov var_x, zeros 0xF7, 0x8E, XXXX, XXXX, // movb var_x, zeros 0xD7, 0x50, XXXX, XXXX, // extp #XXXXh, #2 <--- * this is the segment offset 0xF2, XXXX, YYYY, YYYY, // mov rX, var_y <--- * this is the offset to the [checksum_1_hi] word (start address for main rom) 0xF2, XXXX, YYYY, YYYY, // mov rX, var_y <--- * this is the offset to the [checksum_1_lo] word (start address for main rom) 0xF6, YYYY, XXXX, XXXX, // mov var_x, rY 0xF6, YYYY, XXXX, XXXX, // mov var_x, rY 0xE1, 0x18, // movb r14, #1 0xF7, YYYY, XXXX, XXXX, // movb var_x, rY 0xD7, 0x50, XXXX, XXXX, // extp #XXXXh, #2 <--- * this is the segment offset (typically 0x206 or 0x207) 0xF2, XXXX, YYYY, YYYY, // mov rX, var_y <--- * this is the offset to the [checksum_2_hi] word (end address for main rom) 0xF2, XXXX, YYYY, YYYY, // mov rX, var_y <--- * this is the offset to the [checksum_2_lo] word (end address for main rom) 0xF6, YYYY, XXXX, XXXX, // mov var_x, rY 0xF6, YYYY, XXXX, XXXX, // mov var_x, rY 0xDB, 0x00 // rets }; const unsigned char mask_2[] = { MASK, MASK, SKIP, SKIP, // mov var_x, zeros MASK, MASK, SKIP, SKIP, // mov var_x, zeros MASK, MASK, SKIP, SKIP, // movb var_x, zeros MASK, MASK, SKIP, SKIP, // extp #206h, #2 // memory offset selection MASK, SKIP, SKIP, SKIP, // mov rX, var_y // ***checksum1_hi*** MASK, SKIP, SKIP, SKIP, // mov rX, var_y // ***checksum1_lo*** MASK, SKIP, SKIP, SKIP, // mov var_x, rY // to ram address1_hi MASK, SKIP, SKIP, SKIP, // mov var_x, rY // to ram address1_lo MASK, MASK, // movb r14, #1 // set boolean on MASK, SKIP, SKIP, SKIP, // movb var_x, rY // actually set variable MASK, MASK, SKIP, SKIP, // extp #206h, #2 // memory offset selection MASK, SKIP, SKIP, SKIP, // mov rX, var_y // ***checksum2_hi*** MASK, SKIP, SKIP, SKIP, // mov rX, var_y // ***checksum2_lo*** MASK, SKIP, SKIP, SKIP, // mov var_x, rY // to ram address2_hi MASK, SKIP, SKIP, SKIP, // mov var_x, rY // to ram address2_lo MASK, MASK // rets }; (pm me and I can send you the code which does this). And this is what the output looks like... Opening '0261206715_SW127735611_VER_10A0Xw00_ME731_9_613_3_Alfa.bin' file Succeded loading file. >>> Scanning for Main ROM Checksum sub-routine #1 [to extract Start/End regions] main checksum byte sequence #1 found at offset=0x6f7ec. Main Region Block #1: lo:0x1d054 hi:0x1d056 (seg: 0x207 phy:0x81d054) : 0x800000 lo:0x1d058 hi:0x1d05a (seg: 0x207 phy:0x81d058) : 0x80fe6d sum=4bcae83a ~sum=b43517c5 : acc_sum=0 Main Region Block #2: lo:0x1d05c hi:0x1d05e (seg: 0x207 phy:0x81d05c) : 0x820000 lo:0x1d060 hi:0x1d062 (seg: 0x207 phy:0x81d060) : 0x837fff sum=63b0207e ~sum=9c4fdf81 : acc_sum=4bcae83a Main Region Block #3: lo:0x1d064 hi:0x1d066 (seg: 0x207 phy:0x81d064) : 0x840000 lo:0x1d068 hi:0x1d06a (seg: 0x207 phy:0x81d068) : 0x87ffff sum=c350f52 ~sum=f3caf0ad : acc_sum=af7b08b8 Final Main ROM Checksum calculation: 0xbbb0180a (after 3 rounds) Final Main ROM Checksum calculation: ~0x444fe7f5 Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 24, 2018, 12:17:09 AM And you can also use the same needle/mask approach to identify the location where these main rom checksums should end up going...
>>> Scanning for Main ROM Checksum sub-routine #2 [to extract stored checksums and locations in ROM] main checksum byte sequence #2 block found at offset=0x6f894. Stored Main ROM Block Checksum: lo:0x7ffe0 hi:0x7ffe2 (seg: 0x21f phy:0x87ffe0) : 0xbbb0180a Stored Main ROM Block ~Checksum: lo:0x7ffe4 hi:0x7ffe6 (seg: 0x21f phy:0x87ffe4) : 0x444fe7f5 MAIN STORED ROM CHECKSUM: bbb0180a ? bbb0180a : OK! ~CHECKSUM: 444fe7f5 ? 444fe7f5 : OK! Here's the needle I use for this ... // // this is the needle (masked) for the Main Checksum function to extract the stored checksum Hi & Lo Words // const unsigned char needle_3[] = { 0xF2, 0xF4, XXXX, XXXX, // mov r4, var_Y 0xF2, 0xF5, XXXX, XXXX, // mov r5, var_Y 0xD7, 0x50, 0x1f, 0x02, // extp #21fh, #2 <--- * this is the segment offset (should be 0x21f - LAST SEGMENT IN 512Kbyte ROM) 0x22, 0xF4, XXXX, XXXX, // sub r4, var_Y <--- * this is offset to the [EndFirmware_hi] word (stored checksum) 0x32, 0xF5, XXXX, XXXX, // subc r5, var_Y <--- * this is offset to the [EndFirmware_lo] word (stored checksum) 0x3D, XXXX, // jmpr cc_NZ, offset_XXXX 0xE6, 0xF4, XXXX, XXXX, // mov r4, #XXXXh 0xE6, 0xF5, XXXX, XXXX, // mov r5, #XXXXh 0xDC, 0x45, // extp r5, #1 0xA9, 0x64, // movb r13, [r4] 0x77, 0xF6, 0x08, 0x00, // orb r13, #8 0xE6, 0xF4, XXXX, XXXX, // mov r4, #XXXXh 0xE6, 0xF5, XXXX, XXXX, // mov r5, #XXXXh 0xDC, 0x45, // extp r5, #1 0xB9, 0x64, // mov [r4], r13 0x0D, 0x0E // jmpr cc_UC, +0xE }; const unsigned char mask_3[] = { MASK, MASK, SKIP, SKIP, // mov r4, var_Y MASK, MASK, SKIP, SKIP, // mov r5, var_Y MASK, MASK, MASK, MASK, // extp #21fh, #2 <--- * this is the segment offset (should be 0x21f - LAST SEGMENT IN 512Kbyte ROM) MASK, MASK, SKIP, SKIP, // sub r4, var_Y <--- * this is offset to the [EndFirmware_hi] word (stored checksum) MASK, MASK, SKIP, SKIP, // subc r5, var_Y <--- * this is offset to the [EndFirmware_lo] word (stored checksum) MASK, SKIP, // jmpr cc_NZ, offset_XX MASK, MASK, SKIP, SKIP, // mov r4, #XXXXh MASK, MASK, SKIP, SKIP, // mov r5, #XXXXh MASK, MASK, // extp r5, #1 MASK, MASK, // movb r13, [r4] MASK, MASK, MASK, MASK, // orb r13, #8 MASK, MASK, SKIP, SKIP, // mov r4, #XXXXh MASK, MASK, SKIP, SKIP, // mov r5, #XXXXh MASK, MASK, // extp r5, #1 MASK, MASK, // mov [r4], r13 MASK, MASK // jmpr cc_UC, +0xE }; Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 24, 2018, 07:45:37 AM And ofcourse you can also do this for the multipoint checksum blocks too.. tried it on a 1mb (rather than 512kbyte) file I downloaded from the ecu dump section on here for file 06A906032DS 0261207080 360930.
It reveals 66 multipoint checksums on a 1mb file that need correcting. I noted my code match for finding end of rom failed to find end of 1mb file.. I need to investigate that now... but it did find ALL of the multipoints with my new code.. Opening '06A906032DS 0261207080 360930' file Succeded loading file. >>> Scanning for Main ROM Checksum sub-routine #1 [to extract Start/End regions] main checksum byte sequence #1 found at offset=0x880b8. Main Region Block #1: lo:0x1dfc0 hi:0x1dfc2 (seg: 0x207 phy:0x81dfc0) : 0x800000 lo:0x1dfc4 hi:0x1dfc6 (seg: 0x207 phy:0x81dfc4) : 0x80fbff sum=48cf9ca6 ~sum=b7306359 : acc_sum=0 Main Region Block #2: lo:0x1dfc8 hi:0x1dfca (seg: 0x207 phy:0x81dfc8) : 0x820000 lo:0x1dfcc hi:0x1dfce (seg: 0x207 phy:0x81dfcc) : 0x8fffff sum=4851122c ~sum=b7aeedd3 : acc_sum=48cf9ca6 Final Main ROM Checksum calculation: 0x9120aed2 (after 2 rounds) Final Main ROM Checksum calculation: ~0x6edf512d >>> Scanning for Main ROM Checksum sub-routine #2 [to extract stored checksums and locations in ROM] No match found main checksum byte sequence #2 not found Giving up. >>> Scanning for Multipoint Checksum sub-routine #1 [to extract stored checksum list location in ROM] Multipoint byte sequence #1 block found at offset=0x8b854. Blk #01: lo:0x1fbde (seg: 0x207 phy:0x81fbde) : Start: 0x00000000 lo:0x1fbe2 (seg: 0x207 phy:0x81fbe2) : End: 0x00003fff lo:0x1fbe6 (seg: 0x207 phy:0x81fbe6) : CRC32: 0x0fa0f5cf lo:0x1fbea (seg: 0x207 phy:0x81fbea) : ~CRC32 0xf05f0a30 Bootblock #1 ram/rom offset: 0x00000000 len=0x3fff Blk #02: lo:0x1fbee (seg: 0x207 phy:0x81fbee) : Start: 0x00004000 lo:0x1fbf2 (seg: 0x207 phy:0x81fbf2) : End: 0x00007fff lo:0x1fbf6 (seg: 0x207 phy:0x81fbf6) : CRC32: 0x0f4716b3 lo:0x1fbfa (seg: 0x207 phy:0x81fbfa) : ~CRC32 0xf0b8e94c Bootblock #2 ram/rom offset: 0x00004000 len=0x3fff ... cut ... cut ... (message too big!) Blk #64: lo:0x1ffce (seg: 0x207 phy:0x81ffce) : Start: 0x008f4000 lo:0x1ffd2 (seg: 0x207 phy:0x81ffd2) : End: 0x008f7fff lo:0x1ffd6 (seg: 0x207 phy:0x81ffd6) : CRC32: 0x1fffe000 lo:0x1ffda (seg: 0x207 phy:0x81ffda) : ~CRC32 0xe0001fff rom offset: 0x000f4000 len=0x3fff Blk #65: lo:0x1ffde (seg: 0x207 phy:0x81ffde) : Start: 0x008f8000 lo:0x1ffe2 (seg: 0x207 phy:0x81ffe2) : End: 0x008fbfff lo:0x1ffe6 (seg: 0x207 phy:0x81ffe6) : CRC32: 0x1fffe000 lo:0x1ffea (seg: 0x207 phy:0x81ffea) : ~CRC32 0xe0001fff rom offset: 0x000f8000 len=0x3fff Blk #66: lo:0x1ffee (seg: 0x207 phy:0x81ffee) : Start: 0x008fc000 lo:0x1fff2 (seg: 0x207 phy:0x81fff2) : End: 0x008fffff lo:0x1fff6 (seg: 0x207 phy:0x81fff6) : CRC32: 0x1ffde002 lo:0x1fffa (seg: 0x207 phy:0x81fffa) : ~CRC32 0xe0021ffd rom offset: 0x000fc000 len=0x3fff Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on August 24, 2018, 08:31:22 AM This is FANTASTIC... i'd prefer a (working) pull request over a patch though :)
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 24, 2018, 08:31:55 AM Fixed the missing detection of multipoint, it was I need to correct the mask on the segment !
const unsigned char mask_3[] = { MASK, MASK, SKIP, SKIP, // mov r4, var_Y MASK, MASK, SKIP, SKIP, // mov r5, var_Y MASK, MASK, SKIP, SKIP, // extp #XXXXh, #2 <--- * this is the segment offset (should be 0x21f in 512kb & 0x23f in 1024kb ROM) Just change 3rd line for SKIP SKIP on last 2 entries... and it works for both 512kbyte and 1024kbyte roms... Opening '06A906032DS 0261207080 360930' file Succeded loading file. >>> Scanning for Main ROM Checksum sub-routine #1 [to extract Start/End regions] main checksum byte sequence #1 found at offset=0x880b8. Main Region Block #1: lo:0x1dfc0 hi:0x1dfc2 (seg: 0x207 phy:0x81dfc0) : 0x800000 lo:0x1dfc4 hi:0x1dfc6 (seg: 0x207 phy:0x81dfc4) : 0x80fbff sum=48cf9ca6 ~sum=b7306359 : acc_sum=0 Main Region Block #2: lo:0x1dfc8 hi:0x1dfca (seg: 0x207 phy:0x81dfc8) : 0x820000 lo:0x1dfcc hi:0x1dfce (seg: 0x207 phy:0x81dfcc) : 0x8fffff sum=4851122c ~sum=b7aeedd3 : acc_sum=48cf9ca6 Final Main ROM Checksum calculation: 0x9120aed2 (after 2 rounds) Final Main ROM Checksum calculation: ~0x6edf512d >>> Scanning for Main ROM Checksum sub-routine #2 [to extract stored checksums and locations in ROM] main checksum byte sequence #2 block found at offset=0x88160. Stored Main ROM Block Checksum: lo:0xfffe0 hi:0xfffe2 (seg: 0x23f phy:0x8fffe0) : 0x9120aed2 Stored Main ROM Block ~Checksum: lo:0xfffe4 hi:0xfffe6 (seg: 0x23f phy:0x8fffe4) : 0x6edf512d MAIN STORED ROM CHECKSUM: 9120aed2 ? 9120aed2 : OK! ~CHECKSUM: 6edf512d ? 6edf512d : OK! >>> Scanning for Multipoint Checksum sub-routine #1 [to extract stored checksum list location in ROM] Multipoint byte sequence #1 block found at offset=0x8b854. Blk #01: lo:0x1fbde (seg: 0x207 phy:0x81fbde) : Start: 0x00000000 lo:0x1fbe2 (seg: 0x207 phy:0x81fbe2) : End: 0x00003fff lo:0x1fbe6 (seg: 0x207 phy:0x81fbe6) : CRC32: 0x0fa0f5cf lo:0x1fbea (seg: 0x207 phy:0x81fbea) : ~CRC32 0xf05f0a30 Bootblock #1 ram/rom offset: 0x00000000 len=0x3fff Blk #02: lo:0x1fbee (seg: 0x207 phy:0x81fbee) : Start: 0x00004000 lo:0x1fbf2 (seg: 0x207 phy:0x81fbf2) : End: 0x00007fff lo:0x1fbf6 (seg: 0x207 phy:0x81fbf6) : CRC32: 0x0f4716b3 lo:0x1fbfa (seg: 0x207 phy:0x81fbfa) : ~CRC32 0xf0b8e94c Bootblock #2 ram/rom offset: 0x00004000 len=0x3fff Blk #03: lo:0x1fbfe (seg: 0x207 phy:0x81fbfe) : Start: 0x00800000 lo:0x1fc02 (seg: 0x207 phy:0x81fc02) : End: 0x00803fff lo:0x1fc06 (seg: 0x207 phy:0x81fc06) : CRC32: 0x0fa0f5cf lo:0x1fc0a (seg: 0x207 phy:0x81fc0a) : ~CRC32 0xf05f0a30 rom offset: 0x00000000 len=0x3fff ... cut ... cut ... Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 24, 2018, 08:33:56 AM This is FANTASTIC... i'd prefer a (working) pull request over a patch though :) Just going out to dinner now but I will come back to you... I'm going to need to work out how to do it on the old ME7sum (your version) since this is completely new code. Shouldn't be too hard though... Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 29, 2018, 01:36:04 AM @ Nyet... Haven't been sleeping. Noticed that there are a few more variants of the checksum routines I could support so I've now got it working with Volvo roms too which took a little bit more effort since they don't use the same rombase addressing so I had to work out a way to do it without using hardcoded rombase addresses!!
Here's a sample output on a Volvo ROM I downloaded from here.. Ý Opening 'VOLVO S60R_AUT 2.5L B5254T4 300HP NoCarPartNo 0261208289 30684626A.bin' file Succeded loading file. Loaded ROM: Tool in 1Mb Mode >>> Scanning for Main ROM Checksum sub-routine #1 [to extract Start/End regions] main checksum byte sequence #1 found at offset=0xe3040. Main Region Block #1: lo:0x2c882 hi:0x2c884 (seg: 0xb phy:0x2c882) : 0xc000 lo:0x2c886 hi:0x2c888 (seg: 0xb phy:0x2c886) : 0xdfff sum=41c6b73 ~sum=fbe3948c : acc_sum=0 Main Region Block #2: lo:0x2c88a hi:0x2c88c (seg: 0xb phy:0x2c88a) : 0x10b00 lo:0x2c88e hi:0x2c890 (seg: 0xb phy:0x2c88e) : 0x1f7ff sum=1ba41a95 ~sum=e45be56a : acc_sum=41c6b73 Main Region Block #3: lo:0x2c892 hi:0x2c894 (seg: 0xb phy:0x2c892) : 0x1fc00 lo:0x2c896 hi:0x2c898 (seg: 0xb phy:0x2c896) : 0xfffef sum=facf8c86 ~sum=5307379 : acc_sum=1fc08608 Final Main ROM Checksum calculation: 0x1a90128e (after 3 rounds) Final Main ROM Checksum calculation: ~0xe56fed71 >>> Scanning for Main ROM Checksum sub-routine #2 variant #A [to extract stored checksums and locations in ROM] No match found main checksum byte sequence #2 not found Trying different variant. >>> Scanning for Main ROM Checksum sub-routine #2 variant #B [to extract stored checksums and locations in ROM] main checksum byte sequence #2 variant #B block found at offset=0xe30ce. Stored Main ROM Block Checksum: lo:0xffff0 hi:0xffff2 (seg: 0x3f phy:0xffff0) : 0x1a90128e Stored Main ROM Block ~Checksum: lo:0xffff4 hi:0xffff6 (seg: 0x3f phy:0xffff4) : 0xe56fed71 MAIN STORED ROM CHECKSUM: 1a90128e ? 1a90128e : OK! ~CHECKSUM: e56fed71 ? e56fed71 : OK! Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: DT on August 29, 2018, 02:48:28 PM Nice, this needle mask routine could be very useful for finding other routines between different files too.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 29, 2018, 02:59:52 PM Nice, this needle mask routine could be very useful for finding other routines between different files too. That's exactly the way I'm using it. My latest ME7Sum tool is now working across multiple different (normally incompatible) checksummed rom's including both 512kbyte and 1024kbyte. Each with different rom base addresses, etc. Totally different locations, numbers of multipoint sums and numbers of entries. I now extract EVERYTHING directly out of the machine code include number of entries in the tables. Check out the latest log output on a Volvo rom (originally unsupported) but also working on Ferrari, Alfa, VAG, etc... Pretty much everything that's built with Siemens C167 that I've tried so far... Opening 'VOLVO S60R_AUT 2.5L B5254T4 300HP NoCarPartNo 0261208289 30684626A.bin' file Succeded loading file. Loaded ROM: Tool in 1Mb Mode >>> Scanning for Main ROM Checksum sub-routine #1 [to extract number of entries in table] main checksum byte sequence #1 found at offset=0xe307c. Found #3 Regional Block Entries in table >>> Scanning for Main ROM Checksum sub-routine #2 [to extract Start/End regions] main checksum byte sequence #1 found at offset=0xe3040. Main Region Block #1: lo:0x2c882 hi:0x2c884 (seg: 0xb phy:0x2c882) : 0xc000 lo:0x2c886 hi:0x2c888 (seg: 0xb phy:0x2c886) : 0xdfff sum=41c6b73 ~sum=fbe3948c : acc_sum=0 Main Region Block #2: lo:0x2c88a hi:0x2c88c (seg: 0xb phy:0x2c88a) : 0x10b00 lo:0x2c88e hi:0x2c890 (seg: 0xb phy:0x2c88e) : 0x1f7ff sum=1ba41a95 ~sum=e45be56a : acc_sum=41c6b73 Main Region Block #3: lo:0x2c892 hi:0x2c894 (seg: 0xb phy:0x2c892) : 0x1fc00 lo:0x2c896 hi:0x2c898 (seg: 0xb phy:0x2c896) : 0xfffef sum=facf8c86 ~sum=5307379 : acc_sum=1fc08608 Final Main ROM Checksum calculation: 0x1a90128e (after 3 rounds) Final Main ROM Checksum calculation: ~0xe56fed71 >>> Scanning for Main ROM Checksum sub-routine #3 variant #A [to extract stored checksums and locations in ROM] No match found main checksum byte sequence #3 variant #A not found Trying different variant. >>> Scanning for Main ROM Checksum sub-routine #3 variant #B [to extract stored checksums and locations in ROM] main checksum byte sequence #3 variant #B block found at offset=0xe30ce. Stored Main ROM Block Checksum: lo:0xffff0 hi:0xffff2 (seg: 0x3f phy:0xffff0) : 0x1a90128e Stored Main ROM Block ~Checksum: lo:0xffff4 hi:0xffff6 (seg: 0x3f phy:0xffff4) : 0xe56fed71 MAIN STORED ROM CHECKSUM: 0x1a90128e ? 0x1a90128e : OK! ~CHECKSUM: 0xe56fed71 ? 0xe56fed71 : OK! >>> Scanning for Multipoint Checksum sub-routine #1 [to extract number entries in stored checksum list in ROM] Multipoint byte sequence #1 block found at offset=0xe151e. Found #64 Multipoint Entries in table >>> Scanning for Multipoint Checksum sub-routine #2 [to extract address of stored checksum list location in ROM] Multipoint byte sequence #2 block found at offset=0xe17a0. Blk #01: lo:0x1f800 (seg: 0x7 phy:0x1f800) : Start: 0x00000000 lo:0x1f804 (seg: 0x7 phy:0x1f804) : End: 0x000001ff lo:0x1f808 (seg: 0x7 phy:0x1f808) : CRC32: 0x00407600 lo:0x1f80c (seg: 0x7 phy:0x1f80c) : ~CRC32 0xffbf89ff Blk #02: lo:0x1f810 (seg: 0x7 phy:0x1f810) : Start: 0x00000000 lo:0x1f814 (seg: 0x7 phy:0x1f814) : End: 0x000001ff lo:0x1f818 (seg: 0x7 phy:0x1f818) : CRC32: 0x00407600 lo:0x1f81c (seg: 0x7 phy:0x1f81c) : ~CRC32 0xffbf89ff Blk #03: lo:0x1f820 (seg: 0x7 phy:0x1f820) : Start: 0x00008000 lo:0x1f824 (seg: 0x7 phy:0x1f824) : End: 0x0000bfff lo:0x1f828 (seg: 0x7 phy:0x1f828) : CRC32: 0x0ec1a3cb lo:0x1f82c (seg: 0x7 phy:0x1f82c) : ~CRC32 0xf13e5c34 ... cut .... cut ...... cut .... cut ...... cut .... cut ...... cut .... cut ... Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 29, 2018, 03:59:42 PM Its pretty much still a work in progress (the new code will be retrofitted into latest Nyet ME7sum soon). If you want to try it out (or look at the source-code) here's a google drive share to it...
https://drive.google.com/open?id=1ajZYirUtiD7XBqXVrtv2flcoGsroUxZm (https://drive.google.com/open?id=1ajZYirUtiD7XBqXVrtv2flcoGsroUxZm) Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on August 29, 2018, 04:06:31 PM Please, do not do it this way. Github exists for a reason, and posting source code in dropbox or gdrive is pure insanity.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on August 29, 2018, 04:07:23 PM You should already be making these changes, incrementally, under source control, based on an upstream repository.
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 29, 2018, 08:32:57 PM nyet, your absolutely right, it actually is already under github, just didn't yet check latest version upsteam. Done now.
Here it is here; https://github.com/360trev/ME7RomTool_Ferrari (https://github.com/360trev/ME7RomTool_Ferrari) Its not the same tool as me7sum as its going to do more than sum. I think we need to make a option to build the summing code as a shared library to be used by other kinds of tools in the future. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on August 30, 2018, 08:52:22 AM Thanks, looking over it now. Merging is not going to be easy :/
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on August 30, 2018, 10:41:55 PM Thanks, looking over it now. Merging is not going to be easy :/ I'd recommend just taking the sections of code which deal with the needles and substitue the hard coded assumed addresses. Really this is the biggest difference between original and the new approach. Every address is discovered from probing the machine code itself and pulling out the necessary information. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: 360trev on September 03, 2018, 03:53:55 PM Done quite a few updates today!
It can now identify a few more variants/strains of routine as well as detecting and then pulling the correct DPPx register out of a given rom. This makes it quite a bit easier to set things up for correct reversing. Also added the ability to do the calculations of the multipoints now too as well as finding the xorCalcuationTable in a given rom (if it exists) and dumping its xortable too ;)... Have fun ;) Here's what dppx analysis looks like... Loaded ROM: Tool in 1Mb Mode -[ DPPx Setup Analysis ]----------------------------------------------------------------- >>> Scanning for Main ROM DPPx setup #1 [to extract dpp0, dpp1, dpp2, dpp3 from rom] main rom dppX byte sequence #1 found at offset=0x64a6. dpp0: 0x0000 dpp1: 0x0205 dpp2: 0x00e0 dpp3: 0x0003 (DPP3 is always 3, otherwise accessing CPU register area not possible) Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: JKaunisto on June 16, 2019, 12:27:01 PM Hi! New to this forum and ecu flashing, and now it hapeened. I'm facing a need for an answer.
So i started with babysteps, and was going to only delete the rear 02 sensors from my ecu. After fiquring out how to use Tunerpro, Nefmoto etc. i had the .bin file from my 4Z7907551N ecu. Used in Tunerpro the "R" box .xdf, and apparently succesfully modified the .bin. So here it comes: when i pulled program from my ecu, i ran it through ME7Check. Result "OK". So after tweaking the file, i ran it through ME7Check again. Well, well, RSA signature error (from what i've understood, this is normal), but also checkusm errors etc. Total of 4 errors, including the RSA. So i ran the new file through me7sum. Found 7 bad checksums, corrected 7/7, everything ok. After this pulled it again through ME7Check, still moaning about the 4 errors (3 if you drop the RSA away). So basically, what is normal, when i should be worried, and please help me to understand the basics of this. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on June 16, 2019, 02:43:24 PM This is why it is pointless to modify tuned ecus. You have no idea what the person was trying to do.
Revert to stock, start from there. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: fknbrkn on September 06, 2019, 04:50:00 AM usage with explorer context menu
win+r regedit HKEY_CLASSES_ROOT\*\shell make new dir name as you want ('fix cs' for example) make new dir inside previous name it 'command' so your final path should be \HKEY_CLASSES_ROOT\*\shell\fix cs\command change default value at the right side to C:\\windows\\system32\\cmd /k C:\VW\me7check\me7sum.exe "%1" "%1" & pause & C:\VW\me7check\me7check.exe "%1" & pause & pause & exit with path changes to yours now right click on a flash file, select 'fix cs' Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on March 09, 2021, 01:25:54 PM Done quite a few updates today! It can now identify a few more variants/strains of routine as well as detecting and then pulling the correct DPPx register out of a given rom. This makes it quite a bit easier to set things up for correct reversing. Also added the ability to do the calculations of the multipoints now too as well as finding the xorCalcuationTable in a given rom (if it exists) and dumping its xortable too ;)... Have fun ;) Here's what dppx analysis looks like... Loaded ROM: Tool in 1Mb Mode -[ DPPx Setup Analysis ]----------------------------------------------------------------- >>> Scanning for Main ROM DPPx setup #1 [to extract dpp0, dpp1, dpp2, dpp3 from rom] main rom dppX byte sequence #1 found at offset=0x64a6. dpp0: 0x0000 dpp1: 0x0205 dpp2: 0x00e0 dpp3: 0x0003 (DPP3 is always 3, otherwise accessing CPU register area not possible) Argh, revisited this again today. What a mess :/ I wish you had built on my code so i could merge this in more easily Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: reactor5design on October 14, 2021, 11:37:03 AM I calculated the checksums with the help of the me7sum tool and flashed it into the car, but it killed the control unit. Then I checked it with WinOLS and it detected bad checksums. Where can there be a mistake? I am attaching files ..
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on October 14, 2021, 08:50:58 PM Thanks for reporting this. Looks like me7sum cannot correct that bin.
It could be there are RSA checks me7sum isn't detecting. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: BlackT on October 14, 2021, 11:34:59 PM I work with 1ML906018A and ME7sum without any problems....
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: reactor5design on October 15, 2021, 04:29:33 AM It worked for 16 edits in the software, but only in 17 it did not calculate correctly. Could it be that the _um maps have changed?
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: prj on October 15, 2021, 09:56:54 AM There is no reason to ever change _UM maps.
Most likely with your edit you caused chain reset of ECU. Nothing to do with checksum, everything to do with your stupidity in this case. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: xXxCryxXx on October 17, 2021, 05:22:45 PM Sometimes i get the same Problem so just Double Check the Corrected file and then it should work perfect i never ever had any kind of issues with me7sum tool
Just try after correction with the me7check the file after that sum it again Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: bluelighttube on January 07, 2022, 01:06:36 PM Edit: never mind i see it working
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Skowrix on February 02, 2022, 11:22:56 AM Hello,
A while ago on some AudiA4 forum I found 2 files for 8E0909518AQ - ORI and RearO2offchk. I took ORI file, and changed appropriate maps to disable rear O2 sensor (just to verify my map pack cause I have the same ECU). Then compared my changes with RearO2offchk - changes were exactly the same so I exported the file (KatOff_test) and checksumed it with me7sum (had to do it twice, after the 1st time there was still 1 error). Now ME7Check doesn't report any errors on my file (KatOff_test_chksum2) but it is different than the RearO2offchk from the forum for which me7check is also not reporting any errorrs (I see differences in 7 "sections" of the dump). Can somebody verify these files if chksums are correct? Is it possible that chksums are correct but files are different? Or maybe me7sum/check is not working with this ECU? Attaching files and full logs from me7sum in the zip file (exceeding max lenght of post). Appreciate any reply :) ORI (downloaded) Code: ME7Check v1.12 (c) mki, 06/2004-05/2012 rear02offchk (downloaded) Code: ME7Check v1.12 (c) mki, 06/2004-05/2012 KatOff_test (modified by me from ORI) Code: ME7Check v1.12 (c) mki, 06/2004-05/2012 KatOff_test check after correction 1 Code: ME7Check v1.12 (c) mki, 06/2004-05/2012 KatOff_test check after correction 2 Code: ME7Check v1.12 (c) mki, 06/2004-05/2012 Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on February 03, 2022, 09:58:39 PM 1) what version of me7sum? Make sure you are using the latest.
2) show the output of me7sum or its impossible to guess whats going on. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on February 03, 2022, 10:00:49 PM Sometimes i get the same Problem so just Double Check the Corrected file and then it should work perfect i never ever had any kind of issues with me7sum tool Just try after correction with the me7check the file after that sum it again 1) what version of ME7Sum 2) please show the *output of me7sum* or I can never fix the issues you're seeing. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: Skowrix on February 03, 2022, 10:56:31 PM 1) what version of me7sum? Make sure you are using the latest. 2) show the output of me7sum or its impossible to guess whats going on. Hi Nyet, as mentioned in my post full output was attached in the zip file because I couldn't put it to the post due to char limit. However here it is: 1st correction Code: ME7Sum (v1.1.1) [Management tool for Bosch ME7.x firmwares] check after 1st correction Code: ME7Check v1.12 (c) mki, 06/2004-05/2012 2nd correction Code: ME7Sum (v1.1.1) [Management tool for Bosch ME7.x firmwares] check after 2nd correction Code: ME7Check v1.12 (c) mki, 06/2004-05/2012 Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: marcjero on May 31, 2023, 06:45:11 AM Hi,
I need to calculate checksum for a Smart ECU (MEG 1.1). I tried the lastest version of ME7Sum but it doesn't find anything useful in the bin file. What do you think ? Is it doable or not to make it work ? I know absolutely nothing about the checksums that are used in these ECUs. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on May 31, 2023, 11:35:20 AM Hi, I need to calculate checksum for a Smart ECU (MEG 1.1). I tried the lastest version of ME7Sum but it doesn't find anything useful in the bin file. What do you think ? Is it doable or not to make it work ? I know absolutely nothing about the checksums that are used in these ECUs. Sadly, a completely different ECU in almost every way that matters. Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: dspl1236 on March 25, 2024, 10:38:45 AM I have an old Stage 3 ecu from almost 10 yrs ago from a build I did and backed the ecu up 10yrs ago too. ECU got water damaged, got a replacement one. I have a few times tried to flash it onto a new ecu with but never seems to work. Just cranks. I tossed in a 440cc ecu tune to get the car back on the road for now.
When I run the me7check, its fine. When I run me7sum, it errors out. Maybe thats fine? Just thinking maybe an immo version mismatch in the ecu? Code: Z:\Archive\Software\ECU tuning\ME7>me7check 630HN.bin Code: Z:\Archive\Software\ECU tuning\ME7>me7sum 630HN.bin Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on March 25, 2024, 11:50:02 AM v0.0.5? Seriously?
Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: nyet on March 25, 2024, 11:51:36 AM Code: ME7Sum (v1.1.2-4-ge503) [Management tool for Bosch ME7.x firmwares] Title: Re: ME7Sum: Open Source Checker/Corrector for ME7 Post by: dspl1236 on March 25, 2024, 01:04:39 PM My apologies, I made sure to use the latest download, but was working in the wrong directory. I know 0.0.5 was a while ago when I was archiving. :-[
file looks fine Must be an immo mismatch and or injector related. Code: D:\Downloads\me7sum>me7sum 630HN.bin |