NefMoto

Technical => Cluster and Immobilizer => Topic started by: obdflasher on April 02, 2013, 08:26:26 PM



Title: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: obdflasher on April 02, 2013, 08:26:26 PM
Working on edc17 eeprom crc.

Looking for serious guy who has experience with crc algo's

Have much and good info.





Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: ecutuners on April 09, 2013, 05:06:17 AM
i can make all edc17 / med17 eeprom checksum

gttuning2009@yahoo.co.uk

Regards


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: obdflasher on January 17, 2014, 05:49:39 PM
Problem solved crc 16 , 32 .....


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: chli1976 on January 18, 2014, 12:56:03 AM
Problem solved crc 16 , 32 .....

Can we get more infos?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: ecufix on January 22, 2014, 06:06:09 AM
Can we get more infos? no man answer ? ;D


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: yas200979 on January 30, 2014, 01:21:03 AM
Hello
i can make all edc17 / med17 eeprom checksum
immo off med17/edc17

info@dpfoff.ru


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: ozzy_rp on September 08, 2015, 01:12:00 AM
All eeprom divided to blocks with 0x80 size
offsets:
0x00 - block id (half word)
0x02 - CS1 (half word)
0x04 - block revision ???
0x08 - data
0x7C - CS2 (word)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on September 10, 2015, 03:19:51 AM
Thanks for info.

With word you mean 16bit or 32bit ?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: ozzy_rp on September 10, 2015, 07:22:33 AM
Half word - 16 bit
Word - 32 bit

And list Block id from EDC17 eeprom:
1,8,9,A,B,C,1A,1B,1C,1D,1E,1F,2A,2B,2C
2D,2E,2F,3A,3B,3C,3D,3D,3E,3F,17,18,19
20,21,22,23,24,25,26,27,28,29,30,31,32
33,34,35,36,37,38,39,40,41,42,43,44,45
46,47,48,49,CC00


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on September 11, 2015, 02:33:34 AM
Thanks for specifying that!
For me (in programming) it is common for a word to be 16 bit ;-)


Rgs H2Deetoo


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: ozzy_rp on September 11, 2015, 02:55:20 AM
In TriCore asm another look at it :)
Size given in asm mnemonic.
Like this:
ld.hu           d15, [a12]2
extr.u          d2, d2, #0, #0x10
jne16           d15, d2, loc_8013AD6A ; Bad CRC


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: ozzy_rp on September 24, 2015, 12:28:13 PM
Next update :)


Algorithm for CS1:
data from - 0x04
leight - 0x7C
CS calculated with Tricore internal CRC32 and low half word - CS1
Inicial value - block id


unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
   const unsigned long poly = 0xEDB88320;
   unsigned long tmp1, tmp2;

   while(sz--)
   {
      tmp1 = 0;
      tmp2 = crc & poly;
      for(int i = 0; i <=31; i++ )
      tmp1 ^= ((tmp2 >> i) & 1);
      crc = *p++ ^ ((crc << 1) | tmp1) ;
   }
   return crc;
}




Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: totalfree on December 26, 2015, 07:18:59 AM
Blocks is more.
How to calculate the checksum?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: dream3R on December 27, 2015, 11:04:27 PM
Next update :)


Algorithm for CS1:
data from - 0x04
leight - 0x7C
CS calculated with Tricore internal CRC32 and low half word - CS1
Inicial value - block id


unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
   const unsigned long poly = 0xEDB88320;
   unsigned long tmp1, tmp2;

   while(sz--)
   {
      tmp1 = 0;
      tmp2 = crc & poly;
      for(int i = 0; i <=31; i++ )
      tmp1 ^= ((tmp2 >> i) & 1);
      crc = *p++ ^ ((crc << 1) | tmp1) ;
   }
   return crc;
}




Good job!


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: neuro on January 02, 2016, 11:44:19 AM
or use immoff17 https://www.youtube.com/watch?v=BLv68_2x_1g


=P


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: nano on August 05, 2016, 07:20:48 AM
If anyone have other good info about this algo please contanct me; I'm very interesting especially on CS2 algo. I can pay for it.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: absetup on October 21, 2016, 05:22:13 AM
did someone found the cs2 algo?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: absetup on November 01, 2016, 02:13:20 PM
Up


Envoyé de mon iPhone en utilisant Tapatalk


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on November 02, 2016, 06:14:01 AM
I have worked out the 32bit (CS2) checksum.
See attached document.


Best regards,
H2Deetoo


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: KMTech on November 15, 2016, 05:48:42 AM
Hello,

I've tried your solution for CS2 but it's not working. I've done all calculations on joined dump but didn't works. I've tried all combinations RefIN, RefOut, with end xor ffffffff, end xor 0, byte swap... thanks for your help


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on November 15, 2016, 08:16:46 AM
Then you're making a mistake somewhere :(

If you can get CS1 working, then CS2 should be no problem. Just change the data area and the start value as suggested in the document.
(Please note that you use correct endianess!)


Rgs H2Deetoo


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: gmgunderground on November 27, 2016, 09:35:29 AM
I'm a little bit late... Another info, CS1 is always present, but CS2 not  ;) also look for 0xCCxx

Inviato dal mio GT-I9505 utilizzando Tapatalk


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: totalfree on December 03, 2016, 06:06:36 AM
Hi.
For all.
http://canblocker.com/edc17crc.php


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: leosmut on December 05, 2016, 03:39:22 AM
Hi.
For all.
http://canblocker.com/edc17crc.php

This was posted on another forum for the members there... And if you have the same username there then you didn't even give a thanks to the original poster. Or asked him... Not nice.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: f1torrents on December 05, 2016, 07:44:57 AM
Does it work or is it your standard .bin collector?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: leosmut on December 05, 2016, 08:40:03 AM
Sure does it work and no, there is no bin collected. Why should anyone collect bins from edc17? You can not decode them without the correct flashfile from micro and they are useless.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: f1torrents on December 05, 2016, 09:14:55 AM
There is a collector for bosch RB4 and RB8 cluster and those are useless without the encryption mask from the MCU in the cluster. 


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: leosmut on December 05, 2016, 09:32:56 AM
There is a collector for bosch RB4 and RB8 cluster and those are useless without the encryption mask from the MCU in the cluster. 

That proves there are stupid people around :D




Title: Re:
Post by: macxxx on December 05, 2016, 11:28:37 AM
A little offtopic - what eeprom sits in a edc17 from vwpolo 1.4tdi?  Need to retrieve pin from it. P/N is 045906013E  edc17U01


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: leosmut on December 05, 2016, 02:17:44 PM
A little offtopic - what eeprom sits in a edc17 from vwpolo 1.4tdi?  Need to retrieve pin from it. P/N is 045906013E  edc17U01

Np. EDC17 has a Tricore controller with internal eeprom inside micro. Post your dump Flash+EEprom (in a new thread) and i or somebody else can calc this for your.


Title: Re:
Post by: macxxx on December 06, 2016, 01:55:57 AM
Ok i see that it wont be that easy , a friend asked me if i can do it...i see i dont have tools , i thought that there was a simple chip that i can desolder and read...


Title: Re:
Post by: gmgunderground on December 08, 2016, 04:32:03 AM
To read eeprom on TriCore you have to put ecu in boot mode, then load a CAN boot loader, initialize cpu, then you can read the eeprom portion of memory.
Or the alternative is to use a commercial product ready to go

Inviato dal mio GT-I9505 utilizzando Tapatalk


Title: Re:
Post by: macxxx on December 08, 2016, 07:09:50 AM
Thank you for your info , it's not for me..... i don't do it commercially so I will attack cluster epprom :)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: _nameless on January 01, 2017, 04:35:20 AM
i can make all edc17 / med17 eeprom checksum

gttuning2009@yahoo.co.uk

Regards
What he means is he can steal all of your work, you just need to email it to him


Title: Re:
Post by: Buzzard on January 01, 2017, 10:58:22 AM
Marty he also goes by the names        ecu-tuners.net or dpfsolutions.net or gt-tuning.net

Sent from my SM-N910F using Tapatalk


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: MarchCat on June 23, 2017, 06:14:12 AM
Hi. I need your help!
Example block :
36 00 F2 78 E2 09 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 6F 79 00 00 B1 6F 00 00 85 7C 88 7C

F2 78 - is CS1(half word) ?
36 00 - is id block ? CRC32 or CRC16 ? initial value for cs1 ? 0x00003600 or 0x36000000 ?
85 7C 88 7C - is CS ? algo is CRC32 ? with polynom 0xEDB88320 ? initial value is 0xB16F0000 or 0x0000B16F ?

My code for CRC32 (C#) :
Code:
public static UInt32 Calculate(byte[] Value, UInt32 ini)
        {
            UInt32[] CRCTable = new UInt32[256];
            for (int i = 0; i < 256; i++)
            {
                UInt32 entry = (UInt32)i;
                for (int j = 0; j < 8; j++)
                    if ((entry & 1) == 1)
                        entry = (entry >> 1) ^ 0xEDB88320;
                    else
                        entry = entry >> 1;
                CRCTable[i] = entry;
            }

            UInt32 CRCVal = ini ;
            for (int i = 0; i < Value.Length; i++)
            {
                CRCVal = (CRCVal >> 8) ^ CRCTable[(CRCVal & 0xff) ^ Value[i]];
            }
            CRCVal ^= 0xFFFFFFFF; // NOT
            UInt32 Result = CRCVal;

            return Result;
        }




Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: kuebk on June 23, 2017, 01:59:02 PM
What's the point of keeping 10 different versions of same block? Which version is used by ECU, always latest?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: ozzy_rp on July 03, 2017, 10:21:15 PM
What's the point of keeping 10 different versions of same block? Which version is used by ECU, always latest?
.
Flash has a limited number of erase-write cycles. ECU distributes writing of blocks throughout the flash.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: kolocar on September 03, 2017, 12:01:48 AM
Hi. I need your help!
Example block :
36 00 F2 78 E2 09 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 6F 79 00 00 B1 6F 00 00 85 7C 88 7C

F2 78 - is CS1(half word) ?
36 00 - is id block ? CRC32 or CRC16 ? initial value for cs1 ? 0x00003600 or 0x36000000 ?
85 7C 88 7C - is CS ? algo is CRC32 ? with polynom 0xEDB88320 ? initial value is 0xB16F0000 or 0x0000B16F ?

My code for CRC32 (C#) :
Code:
public static UInt32 Calculate(byte[] Value, UInt32 ini)
        {
            UInt32[] CRCTable = new UInt32[256];
            for (int i = 0; i < 256; i++)
            {
                UInt32 entry = (UInt32)i;
                for (int j = 0; j < 8; j++)
                    if ((entry & 1) == 1)
                        entry = (entry >> 1) ^ 0xEDB88320;
                    else
                        entry = entry >> 1;
                CRCTable[i] = entry;
            }

            UInt32 CRCVal = ini ;
            for (int i = 0; i < Value.Length; i++)
            {
                CRCVal = (CRCVal >> 8) ^ CRCTable[(CRCVal & 0xff) ^ Value[i]];
            }
            CRCVal ^= 0xFFFFFFFF; // NOT
            UInt32 Result = CRCVal;

            return Result;
        }



Maybe  first calc crc32 (08-7B)then  half word(cs1),but i don't know how calc it,so who can offer more useful advice please?thx BR Kolo


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Ionut on September 21, 2017, 02:01:17 PM
Hi all, i`ve tried every possible combination and nothing seems to work....
For example this block
Code:
08 00 EB 04 94 53 00 00 FF B8 71 E0 EA 30 D0 E4 B1 8E 05 E4 35 AF 3E F2 8E 6A 09 9C A7 EF 80 E7 FC AE AE 56 AA 80 01 00 57 41 55 5A 5A 5A 38 54 37 42 41 30 39 37 36 36 31 48 EF E0 24 BA 6C 05 30 02 B6 6C 7D 43 97 A4 F9 B1 EF BF F7 74 FB 67 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C1 4E 00 00 56 8D F6 1C
Tried with CRC32 with poly 0xEDB88320, initial value 0xC14E0000, bytes from 8 to 7F (119 bytes) and result is D7A854D and it should be 56 8D F6 1C.
With initial value just first 2 bytes (0xC14E), result is F219CCDD, with fist 2 bytes reversed, result is AA79A104 and with initial value 0x4EC10000 (each 2 bytes reversed) result is 418F9500

Here is the C# code used for CRC32:
Code:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace FwpCrc
{
    class CRC32
    {
        uint[] table;

        public uint ComputeChecksum(byte[] bytes, uint initialValue) {
            uint crc = initialValue;
        //  uint crc = 0xffffffff;
            for(int i = 0; i < bytes.Length; ++i) {
                byte index = (byte)(((crc) & 0xff) ^ bytes[i]);
                crc = (uint)((crc >> 8) ^ table[index]);
            }
            return ~crc;
        }

        public CRC32() {
            uint poly = 0xEDB88320;
            table = new uint[256];
            uint temp = 0;
            for(uint i = 0; i < table.Length; ++i) {
                temp = i;
                for(int j = 8; j > 0; --j) {
                    if((temp & 1) == 1) {
                        temp = (uint)((temp >> 1) ^ poly);
                    }else {
                        temp >>= 1;
                    }
                }
                table[i] = temp;
            }
        }
    }
}
I`m doing something wrong?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: IamwhoIam on September 22, 2017, 03:08:56 AM
Buy WinOLS and Tricore checksum plugin, and then eeprom checksums won't be a problem anymore at all, apart from 1793 Bosch MEDC17.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Ionut on September 22, 2017, 03:53:22 AM
I want to learn how to do it, not buy something that already exists!


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: cherry on September 22, 2017, 04:02:23 AM
Buy WinOLS and Tricore checksum plugin, and then eeprom checksums won't be a problem anymore at all, apart from 1793 Bosch MEDC17.

Really, did they fix VAG EDC17 eeprom checksum? I think it´s wrong and miss something ;)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on September 23, 2017, 02:56:08 PM
Not all blocks have a valid 32 bit checksum.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Ionut on October 25, 2017, 02:35:35 AM
With help of a great man, succeeded to build correct checksum on EDC17 EEPROM. Informations posted here are correct, my approach was not :)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: jcsbanks on October 26, 2017, 09:20:21 AM
I wrote back an EEPROM I had just read from MEVD17.2 (TC1797), but I added some data in dataflash bank 1 which was not being used at the time. It read back correctly in boot mode, then when the ECU was powered up normally it wiped the new data.

I will try it in dataflash bank 0.

I did not package the data with a block ID or checksums.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: abedc17 on March 06, 2018, 05:45:09 AM
Next update :)


Algorithm for CS1:
data from - 0x04
leight - 0x7C
CS calculated with Tricore internal CRC32 and low half word - CS1
Inicial value - block id


unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
   const unsigned long poly = 0xEDB88320;
   unsigned long tmp1, tmp2;

   while(sz--)
   {
      tmp1 = 0;
      tmp2 = crc & poly;
      for(int i = 0; i <=31; i++ )
      tmp1 ^= ((tmp2 >> i) & 1);
      crc = *p++ ^ ((crc << 1) | tmp1) ;
   }
   return crc;
}





great job thankss
i converted this script to c# but i don't know how it works
can any one give an exemple to run this function ?

Example block (exemple of kolocar membre ;) ) :

36 00 F2 78 E2 09 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 6F 79 00 00 B1 6F 00 00 85 7C 88 7C

CS1 = F2 78
ID = 36 00
 what is the initial value for cs1
there are 3 varialbes in the crc_buffer function (crc, p, sz) ... wich one is initial value ?

please help


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on March 08, 2018, 01:02:03 AM
crc seems to be the initial value if you just look at the code.
p is the buffer with data
and sz is the size


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on March 08, 2018, 03:28:25 AM
check this:

CS1=2D81 -> OK

INIT = 00000009
LENGTH = 0000001F
DATA: 5D33AED29D521DB5173E61E41A896771D36CE10790AA89A6947F586FAA8001004C46563341323447304533303835353830328BC262C72A96C3A4F6D9BF3C7FA7BAFDF5E9F53724F7541B1B8D0B0000000000000000000000000000000000000000000000000000000000000000000000


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on March 08, 2018, 07:06:09 AM
Sorry I used wrong example. Here is the data for your example record:

INIT = 00000036
LENGTH = 0000001F
DATA: E20900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006F790000B16F0000857C887C
CS1=78F2 -> OK


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: abedc17 on March 08, 2018, 12:37:41 PM
thank you very much .. it's work now ( in 32 bits)
i'm going to search for cs2 now  8)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on March 08, 2018, 12:54:56 PM
CS2 is documented by me several postings ago.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: morfej on July 05, 2018, 06:05:53 AM
What about TC1793 that doesn't seems to use CS2. Blocks still looks to be same size, but no block ID is used.

Emulated eeprom is 192Kb in size.

At place where normally CS2 is, only something similar to CS1.




Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: vwphun on July 09, 2018, 01:11:52 AM
Very interesting topic, thank you "ozzy_rp and H2Deetoo" ;D. CS1 and CS2 are clear now. And what about crypted immo data block 0x08 0x09 0x0A? How are crypted CS, PIN, MAC in eeprom with data from flash OTP sector? VIN is visible in RAW data.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on July 09, 2018, 10:39:21 PM
it is a simple XOR


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: vwphun on July 10, 2018, 03:31:44 AM
Thank you for confirmation. Can you give me a hint? I try some combination on known immodata (Block id 0x08) offset 0x08 - 0x1D (PIN, CS, MAC location?) from begin of block (EDC17cp14), but without success. Is crypt key located in flash arrea 0x17F00-0x17F7F? Thank you for your patience  ;)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: kuebk on July 10, 2018, 03:45:07 AM
Crypt key is located in OTP area but it's hashed multiple times to get final value for XOR.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: vwphun on July 10, 2018, 04:22:53 AM
Thank you for answer. Do you have an example? Algo is the same for every EDC17 family?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on July 10, 2018, 07:19:23 AM
You can deduct the XOR with known values.
It is calculated from unique ID from EDC17 from OTP area, so the XOR result is unique for each EDC.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: vwphun on July 10, 2018, 09:47:13 AM
Thank you. I know, that operands and XOR result is differnt for each ecu, but algo (adresses) same for family (f. e. EDC17CP14)? Unique ID is present twice consecutively (2 x 20bytes)? It!s needed dissasembled code of mcu for algo, or is simple and can get result with some combination (with known data as PIN, CS, MAC? How is organisation and order of immodata - 1) CS 6bytes, 2) PIN 2bytes, 3) MAC 4bytes? In attached img selected data are right?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: kuebk on January 03, 2019, 07:03:09 AM
Figured out myself what I was doing wrong, nevermind.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: carservice on March 07, 2019, 10:13:08 PM
HI
 crypted CS, PIN, MAC algorithm ,You succeeded in the calculation?I did a lot of research, but it didn't work out.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: carservice on March 08, 2019, 11:02:29 PM
(http://)
You can deduct the XOR with known values.
It is calculated from unique ID from EDC17 from OTP area, so the XOR result is unique for each EDC.
I found the immo data in EEPROM and the encrypted bytes in the OTP area, but failed to compute.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: sandor1987 on December 22, 2019, 05:13:34 AM
somebody found out how to calculate cs pin mac etc?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Matrosek on April 17, 2020, 05:05:32 AM
Hi all, i`ve tried every possible combination and nothing seems to work....
For example this block
Code:
08 00 EB 04 94 53 00 00 FF B8 71 E0 EA 30 D0 E4 B1 8E 05 E4 35 AF 3E F2 8E 6A 09 9C A7 EF 80 E7 FC AE AE 56 AA 80 01 00 57 41 55 5A 5A 5A 38 54 37 42 41 30 39 37 36 36 31 48 EF E0 24 BA 6C 05 30 02 B6 6C 7D 43 97 A4 F9 B1 EF BF F7 74 FB 67 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C1 4E 00 00 56 8D F6 1C
Tried with CRC32 with poly 0xEDB88320, initial value 0xC14E0000, bytes from 8 to 7F (119 bytes) and result is D7A854D and it should be 56 8D F6 1C.
With initial value just first 2 bytes (0xC14E), result is F219CCDD, with fist 2 bytes reversed, result is AA79A104 and with initial value 0x4EC10000 (each 2 bytes reversed) result is 418F9500

Here is the C# code used for CRC32:
Code:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace FwpCrc
{
    class CRC32
    {
        uint[] table;

        public uint ComputeChecksum(byte[] bytes, uint initialValue) {
            uint crc = initialValue;
        //  uint crc = 0xffffffff;
            for(int i = 0; i < bytes.Length; ++i) {
                byte index = (byte)(((crc) & 0xff) ^ bytes[i]);
                crc = (uint)((crc >> 8) ^ table[index]);
            }
            return ~crc;
        }

        public CRC32() {
            uint poly = 0xEDB88320;
            table = new uint[256];
            uint temp = 0;
            for(uint i = 0; i < table.Length; ++i) {
                temp = i;
                for(int j = 8; j > 0; --j) {
                    if((temp & 1) == 1) {
                        temp = (uint)((temp >> 1) ^ poly);
                    }else {
                        temp >>= 1;
                    }
                }
                table[i] = temp;
            }
        }
    }
}
I`m doing something wrong?

Hi all, I used code from post #39 and CRC from post #38, but I get wrong CRCsum. What I'm doing wrong?
My code:
Code:
using System;
using System.IO;
using System.Text;

namespace TricoreCRC32Calculator
{
    public class Program
    {
        public static void Main(string[] args)
        {
            while (true)
            {
                Console.WriteLine("\nCRC-Calculator...");
                Console.Write("File name: ");
                TricoreCRC32 CRC = new TricoreCRC32(Console.ReadLine());
                Console.WriteLine(CRC);
                uint initValue = 0x00000036;
                uint result = CRC.ComputeChecksum(initValue);
                Console.WriteLine("{0:X}", result);
                Console.Write("Continue or exit: ");
                if (Console.ReadLine() == "exit") break;
            }
        }
    }

    public class TricoreCRC32
    {
        private byte[] block = new byte[124];
        private uint[] table = new uint[256];


        private async void ReadBlock(string nameFile)
        {
            try
            {
                await new FileStream(nameFile, FileMode.Open).ReadAsync(block, 0, block.Length);
            }
            catch (FileNotFoundException)
            {
                Console.WriteLine("Not found file!");
            }
            catch (IOException)
            {
                Console.WriteLine("Another error!");
            }
        }

        public TricoreCRC32(string nameFile)
        {
            ReadBlock(nameFile);
        }

        public override string ToString()
        {
            StringBuilder block = new StringBuilder();
            for (int i = 0; i < 124; i++)
            {
                block.AppendFormat("{0:X}", this.block[i]);
                block.Append(' ');
            }
            return "Block: " + block;
        }

        public uint ComputeChecksum(uint initialValue)
        {
            CreateTable();
            uint crc = initialValue;
            //  uint crc = 0xffffffff;
            for (int i = 0; i < block.Length; ++i)
            {
                byte index = (byte)(((crc) & 0xff) ^ block[i]);
                crc = (uint)((crc >> 8) ^ table[index]);
            }
            return ~crc;
        }

        public uint[] CreateTable()
        {
            table = new uint[256];
            uint poly = 0xEDB88320;
            uint temp;
            for (uint i = 0; i < table.Length; ++i)
            {
                temp = i;
                for (int j = 8; j > 0; --j)
                {
                    if ((temp & 1) == 1)
                    {
                        temp = (uint)((temp >> 1) ^ poly);
                    }
                    else
                    {
                        temp >>= 1;
                    }
                }
                table[i] = temp;
            }
            return table;
        }
    }
}

Right CRC is F2 78, but I get 42 0D 0B 00. Block file in attachments.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: lgmautoeletronica on November 24, 2020, 12:31:07 PM
hello boys .my name and leandro i'm new to the forum, but study a little about the vw line and create some solutions for my daily use. i create scripts for the original upa only, i was trying to enter the forum to participate and i was very interested about the subject of edc17 and med17. someone could help create this algorithm in pascal. if you can I thank you and agree price.
my email lgmchaveiro@gmail.com

if i can and personally agree i can send some images of my scripts

 whatsapp 55 54 991062864
 thanks


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: danyguit2000 on December 02, 2020, 09:32:52 AM
Next update :)


Algorithm for CS1:
data from - 0x04
leight - 0x7C
CS calculated with Tricore internal CRC32 and low half word - CS1
Inicial value - block id


unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
   const unsigned long poly = 0xEDB88320;
   unsigned long tmp1, tmp2;

   while(sz--)
   {
      tmp1 = 0;
      tmp2 = crc & poly;
      for(int i = 0; i <=31; i++ )
      tmp1 ^= ((tmp2 >> i) & 1);
      crc = *p++ ^ ((crc << 1) | tmp1) ;
   }
   return crc;
}




This code returns double word (64bit) CRC !
If anyone wants to see where this code comes from look at this document, refer to page 5 and 6
In other words it is not applicable to the thread.
https://www.infineon.com/dgdl/ap3208510_tc1766_mchk.pdf?fileId=db3a304412b407950112b409ca48035c (https://www.infineon.com/dgdl/ap3208510_tc1766_mchk.pdf?fileId=db3a304412b407950112b409ca48035c)
There is some correct, but also misleading information about the eeprom CS.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: arenasaa on August 03, 2021, 01:02:05 AM
What about TC1793 that doesn't seems to use CS2. Blocks still looks to be same size, but no block ID is used.

Emulated eeprom is 192Kb in size.

At place where normally CS2 is, only something similar to CS1.




who knows what is the init value and the data area in this case?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: lgmautoeletronica on September 13, 2021, 12:40:46 PM
simple crc16, does not have 2 crc


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: lgmautoeletronica on September 13, 2021, 12:46:54 PM
It's really ; complicated for me to decipher the data , from med17 and edc 17 . to crc 2 words ok I type in pascal delphi , but decypting is very difficult , it is not a simple xor , or it can be you but I really tired looking , unfortunately I don't know how to reverse engineering, but I really like to study and create my applications, who knows someone with a good heart can clear my head more.
 
 


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Auto-elect on January 03, 2022, 11:37:34 AM
Hello Friends
For those who managed to calculate CRC 1 and 2, please tell me where is the problem? ..
I translated the code from  H2Deetoo:
Code:
unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
   const unsigned long poly = 0xEDB88320;
   unsigned long tmp1, tmp2;

   while(sz--)
   {
      tmp1 = 0;
      tmp2 = crc & poly;
      for(int i = 0; i <=31; i++ )
      tmp1 ^= ((tmp2 >> i) & 1);
      crc = *p++ ^ ((crc << 1) | tmp1) ;
   }
   return crc;
}


 To pascal here is my code:

Code:
function CRC32T(Initial: LongWord; Data:array of byte; DataSize: LongWord): LongWord;
const poly=$EDB88320;
var j:integer;
tmp1,tmp2,crc,i:longword;
BEGIN
crc:=initial;
i:=0;
while i<=DataSize-1 do begin
tmp1:=0;
tmp2:=crc and poly;
for j:=0 to 31 do tmp1:=tmp1 xor ((tmp2 shr j) and 1);
crc:=Data[i] xor ((crc shl 1) or tmp1);
i:=i+1;
end;
CRC32T:=crc;
END;

my function seems to work perfectly .. I have checked it with the results of the site crccalc.com
the result is 100/100 identical, of course when I choose 0xFFFFFFFF as initial value, and the result is xored with 0xFFFFFFFF.
This allows me to be sure that there is no error in the implementation of the code.

Now the problem is in the choice of the initial value and the data area.
here is an example:
0x4000      01 00 30 30 00 00 00 00  00 00 00 00 00 00 00 00 
0x4010      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4020      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4030      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4040      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4050      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4060      00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x4070      00 00 00 00 00 00 00 00  2B 00 00 00 C9 B0 BF B2

CRC1 = 3030
CRC2= C9 B0 BF B2

CRC1 Calculation :(From the H2Deetoo document)
Initial value: 00 00 00 01 ; data area from 0x4004 to 0x407F (It seemed strange to me that the crc2 will be included in the data area);
the function return :A1 45 D9 88 which is not correct..
I even wrote an algorithm to permute all the possible cases of the data area..!!
same thing for the choice of the initial value, I made all the permutations you can imagine :D :D

Same thing for CRC2


A charitable soul could tell me where I messed up.??




Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on January 12, 2022, 11:49:20 PM
This block doesn't conform to the standard CRC1/CRC2 checksums as described here!
ADDR=000000 BLOCKID=0001,
CS1=3030 -> ERROR, should be 00003071,
CS2=B2BFB0C9 -> ERROR, should be BB1DB377

Maybe this block was modified?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on January 12, 2022, 11:56:33 PM
Block 0001h normally holds some dates Bosch numbers, so your block really looks handcrafted.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Auto-elect on January 13, 2022, 07:16:52 AM
Thank you very much H2Deetoo for all the information posted,
I managed to get the crc1 and crc2 algo to work properly.
for the example I put yes..c was not an original.

my pascal translation is also correct .. it was necessary to read the data in 32bit swaped. :D..



Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: reproteq on February 12, 2022, 12:03:16 PM
Hi alls i am newbie in this forum
I need a litle help for finish mi tool

(https://ibb.co/WF3HNCk)
https://ibb.co/WF3HNCk (https://ibb.co/WF3HNCk)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: reproteq on February 13, 2022, 11:29:48 AM
i am using this algo

https://pastebin.com/bb6E6iX7


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: reproteq on February 13, 2022, 11:40:10 AM
https://ibb.co/5npwGGr

also i think in finish this soft i maked , but now not functions and not algos for finish this project if anyone want colaborate.
thanks friends


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: reproteq on February 13, 2022, 11:53:35 AM
I am making these softwares, if someone wants to collaborate, a little help would not hurt

ecudecoder for vag
https://ibb.co/5npwGGr
Click image for larger version.

Name:   ecudecriptor-reproteq..jpg
Views:   0
Size:   8.3 KB
ID:   868190

percent built so far 20%



medc17 cks calc and immooff
https://ibb.co/r6MxVBy
Click image for larger version.

Name:   ckscalculator.jpg
Views:   0
Size:   9.2 KB
ID:   868191

percent built so far 98%


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: sandor1987 on March 20, 2022, 01:37:51 PM
I am making these softwares, if someone wants to collaborate, a little help would not hurt

ecudecoder for vag
https://ibb.co/5npwGGr
Click image for larger version.

Name:   ecudecriptor-reproteq..jpg
Views:   0
Size:   8.3 KB
ID:   868190

percent built so far 20%



medc17 cks calc and immooff
https://ibb.co/r6MxVBy
Click image for larger version.

Name:   ckscalculator.jpg
Views:   0
Size:   9.2 KB
ID:   868191

percent built so far 98%

looks really great!!!


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: prj on March 21, 2022, 07:05:09 AM
Collaboration is done on github, not posting screenshots of random UI things.
This is not the place on the forum to sell your shit. There's a "For Sale" subsection.


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: stranger on June 09, 2022, 03:00:47 AM
Hi. I'am trying calculate CS1 but get wrong CS each time. Maybe someone will tell me what I'm doing wrong.

Example block (from previous posts) :

36 00 F2 78 E2 09 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 6F 79 00 00 B1 6F 00 00 85 7C 88 7C

Original C code:
Code:
unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
   const unsigned long poly = 0xEDB88320;
   unsigned long tmp1, tmp2;

   while(sz--)
   {
      tmp1 = 0;
      tmp2 = crc & poly;
      for(int i = 0; i <=31; i++ )
      tmp1 ^= ((tmp2 >> i) & 1);
      crc = *p++ ^ ((crc << 1) | tmp1) ;
   }
   return crc;
}

Pascal code from Auto-elect (post 70). He claiming that function works. As I can see this Pascal code is identical to C code except for one difference: in While loop i C we counting from last element to first, in pascal - from first to last.
Code:
function CRC32T(Initial: LongWord; Data:array of byte; DataSize: LongWord): LongWord;
const poly=$EDB88320;
var j:integer;
tmp1,tmp2,crc,i:longword;
BEGIN
crc:=initial;
i:=0;
while i<=DataSize-1 do begin
tmp1:=0;
tmp2:=crc and poly;
for j:=0 to 31 do tmp1:=tmp1 xor ((tmp2 shr j) and 1);
crc:=Data[i] xor ((crc shl 1) or tmp1);
i:=i+1;
end;
CRC32T:=crc;
END;

Question regarding input parameters: 1) Initial - understood; 2) Data -> data to checksum (byte array) - understood; 3) DataSize - ? Size of what? of byte array? In this case we don't need this parameter, we can calculate it inside function.

My code in Visual Basic:
Code:
Public Function GetCRC32_eeprom(Data As Byte(), CRC_initial As UInteger) As String

        Dim crc As UInteger = CRC_initial
        Dim poly As UInteger = &HEDB88320UI
        Dim tmp1 As UInteger
        Dim tmp2 As UInteger
        Dim size As Integer = Data.Length - 1

        While size >= 0

            tmp1 = 0
            tmp2 = crc And poly

            For i = 0 To 31
                tmp1 = tmp1 Xor ((tmp2 >> i) And 1)
            Next

            crc = Data(size) Xor ((crc << 1) Or tmp1)

            size = size - 1
        End While

        Return Hex(crc)

    End Function

With example block i can't get xx xx F2 78 checksum. Tried swap data (2bytes and 4 bytes).

Please give me hint what I am doing wrong.



Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: SergeyIgnatov on July 13, 2022, 11:52:43 AM
everything is written in detail, read all the pages carefully


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on July 17, 2022, 12:35:13 AM
For your example block you have these parameters for the CS16:

Initval = 0036h (first 2 bytes of the record indicating a recordid)
Data to include in this checksum starts at the 4th byte.
In the original C code this data array is handled as 32bit DWORDS so the first DWORD used in the checksum is 000009E2h.
The size of the data block to checksum is indicated in DWORDS, so in this case the size is 124 bytes, which is 31 DWORDS.

The CS16 will be 78F2h which looks just fine.


Rgs H2Deetoo


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: reproteq on September 02, 2022, 09:06:50 AM
Collaboration is done on github, not posting screenshots of random UI things.
This is not the place on the forum to sell your shit. There's a "For Sale" subsection.

I don't sell ideas, I think that knowledge should be free, otherwise you wouldn't be reading this because you wouldn't even have learned to read, because someone taught you and surely you didn't pay for it.
the only thing that I think has to be sold is the work, the development of something specific for someone, as Linus Torvals said, software like sex is better for free.
here I leave you some example of what he told you, you can also visit my github and you will see how my repositories and source code is free

I have tried a thousand ways to get the crc32 cs1 cs2 manually with websites like

 crccalc.com

I would like someone to explain or help me in the  where you can see perfectly and manually how I calculate crc.
Thank you







Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Herleybob on November 19, 2022, 10:06:55 PM
Incase anyone out there is working on a TC1762.

This only has one 16-bit checksum, its the sum of the previous 0x7E bytes.

(https://img1.wsimg.com/isteam/ip/6f491266-8b92-4278-818d-631155bc327b/Capture.JPG)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: bluelighttube on December 26, 2022, 04:24:45 PM
Not all blocks have a valid 32 bit checksum.
So some blocks have an invalid 32 bit (cs2) checksum but a valid cs1 (with the invalid cs2). So whats the deal with these? A cs2 correction automatically requires a cs1 correction given its within the check range of cs1. Is it safe to correct these?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on December 31, 2022, 09:18:07 AM
I would personally not touch checksums which are invalid (in an unmodified dump)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Davidik on January 15, 2023, 06:40:16 AM
I read everything several times and tried many combinations. can someone tell me what I'm doing wrong ???


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on January 15, 2023, 06:51:38 AM
If I look at your screenshot the CRC has the last 2 bytes set to 0000. I think that the chance is small this would be true for a CRC, so I think for this ecu there is not CRC used in record 003E.
Same would be true for the previous record 003D where it is all 00000000.

Here is some 003E record which does have a valid CRC:

00011600  3E 00 99 A1 A1 0B 00 00 00 00 00 00 00 00 00 00  >.™¡¡...........
00011610  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00011620  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00011630  3D 00 0E 00 FF FF 00 00 AC B7 B8 C0 FF 0F FF 0F  =...ÿÿ..¬·¸Àÿ.ÿ.
00011640  FF 0F FF 0F 00 00 00 00 00 00 00 00 00 00 00 00  ÿ.ÿ.............
00011650  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00011660  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00011670  00 00 00 00 00 00 00 00 3F 00 00 00 0D 4A AB 78  ........?....J«x



Rgs H2Deetoo


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Davidik on January 15, 2023, 06:51:56 AM
can't get the original checksum


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Davidik on January 15, 2023, 07:26:21 AM
37 00 0D B0 A3 83 00 00 BB BB 87 FC 02 78 07 47 14 06 98 81 01 00 24 60 28 00 08 00 00 40 26 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 2F A5 2A E5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 B1 0F 27 E0 B1 0F 27 00 00 00 00 00 00 00 00 00 00 00 00


I took another correct part and just can't get the correct value


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Davidik on January 15, 2023, 07:31:39 AM
i get crc 02252E97


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on January 15, 2023, 10:35:34 AM
Ah I get it ... I thought you already had it working just not that record, but I guess you cannot get any CRC to match using that editor tool function?

You have to understand that a CRC32 algorithm can have several different parameters, mainly the polynome, bit reflection (reversed) and final xoring.
And in this case Endianess is important because this algo is DWORD based.


Regards,
H2Deetoo


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: bluelighttube on January 16, 2023, 09:59:16 AM
If I look at your screenshot the CRC has the last 2 bytes set to 0000. I think that the chance is small this would be true for a CRC, so I think for this ecu there is not CRC used in record 003E.
Same would be true for the previous record 003D where it is all 00000000.

Here is some 003E record which does have a valid CRC:

00011600  3E 00 99 A1 A1 0B 00 00 00 00 00 00 00 00 00 00  >.™¡¡...........
00011610  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00011620  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00011630  3D 00 0E 00 FF FF 00 00 AC B7 B8 C0 FF 0F FF 0F  =...ÿÿ..¬·¸Àÿ.ÿ.
00011640  FF 0F FF 0F 00 00 00 00 00 00 00 00 00 00 00 00  ÿ.ÿ.............
00011650  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00011660  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00011670  00 00 00 00 00 00 00 00 3F 00 00 00 0D 4A AB 78  ........?....J«x



Rgs H2Deetoo

I've validated with the genuine Winols eeprom checksum plugin and there is an additional 16bit checksum on blocks that do not have checksum2. I have tried several combinations of byte ranges/initial values/(word/dword) cs ranges and can't figure this one out.

Side note- I am able to accurately calculate CS1 and CS2. This "new" checksum that winols is correcting- I have no idea.



Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Davidik on March 12, 2023, 04:11:04 AM
Code:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace ConsoleApp1
{
    class Program
    {

        static void Main(string[] args)
        {
            const UInt32 poly= 0xEDB88320;
            UInt32[] Data = {0x000009E2, 0x00000000, 0x00000000, 0x00000000,
                             0x00000000, 0x00000000, 0x00000000, 0x00000000,
                             0x00000000, 0x00000000, 0x00000000, 0x00000000,
                             0x00000000, 0x00000000, 0x00000000, 0x00000000,
                             0x00000000, 0x00000000, 0x00000000, 0x00000000,
                             0x00000000, 0x00000000, 0x00000000, 0x00000000,
                             0x00000000, 0x00000000, 0x00000000, 0x00000000,
                             0x0000796F, 0x00006FB1, 0x7C887C85};
            UInt32 ini = 0x00000036;
            UInt32 tmp1, tmp2;
            UInt32 crc = ini;
            int i = 0;
            Console.WriteLine(Data[0]);           
            while ( i <= Data.Length-1)
            {
                tmp1 = 0;
                tmp2 = crc & poly;

                for (int j = 0; j < 31; j++)
                {
                    tmp1 ^= ((tmp2 >> j) & 1);
                }

                crc = Data[i] ^ ((crc << 1) | tmp1);

                i = i + 1;
           
            }
           
            Console.WriteLine(crc.ToString("X2"));
            Console.ReadLine();

           
        }
   }
}

Friends can tell me where I'm making a mistake
Result : 984D7A99

INIT = 00000036
LENGTH = 0000001F
DATA: E20900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006F790000B16F0000857C887C
CS1=78F2 -> OK
Report to moderator    Logged


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: H2Deetoo on March 13, 2023, 01:58:43 AM
ADDR=000000 BLOCKID=0036, CS1=78F2 -> OK, CS2=7C887C85 -> OK

Looks to be just fine :)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: STON75 on March 23, 2023, 06:20:32 AM
I'm also interested in creating an algorithm for calculating the Checksum on MEDC17, maybe you need to ask ChatGPT to understand a little better how to calculate it.  ;D


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: boxsport on June 28, 2023, 04:52:25 PM
Hello guys.

Could anyone help me out calculating the checksums on the eeprom file for a ME17.9.21.1 from Kia?
I need to change VIN in this ECU, but i dont know how to calculate checksums.

I´m attaching Original file and modified file but the checksums need to be corrected

Any help?

Thanks


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: terminator on June 29, 2023, 02:57:58 PM
welcome


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Team dz on November 30, 2023, 12:41:51 PM


Thank you i am solved all crc !



Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: doot47 on December 03, 2023, 10:33:37 AM

Thank you i am solved all crc !



Great job my friend
can you send me your solution ...


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: doot47 on December 06, 2023, 12:19:29 PM
You can deduct the XOR with known values.
It is calculated from unique ID from EDC17 from OTP area, so the XOR result is unique for each EDC.
Hi,
how to calculate or extraction unique id from edc17 ?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Team dz on December 07, 2023, 04:36:31 PM
GO TO STRING  FLACH  ADRSS:17F00

Slect :16 bit

This is id part otp


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Team dz on December 08, 2023, 05:27:15 AM
ALGO  SIMPLE CRC  IS:B382....OK


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Team dz on December 09, 2023, 03:23:58 PM
All I know is that you take 16 bytes from that string and perform an operation xor


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: Team dz on December 09, 2023, 03:26:49 PM
ALGO  SIMPLE CRC  Xor


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: doot47 on December 13, 2023, 01:25:40 PM

thank you friend  :) :) :)


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: beginner on March 06, 2024, 07:48:29 PM
does any one have a working c# for this algo ?


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: deutsch1988 on April 22, 2024, 12:03:16 PM
Hello.
And i am interessing abouth here. Will up this theme!


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: deutsch1988 on April 23, 2024, 12:13:59 PM
6 days i am trying to fix this , buth CR1 dont work. here pascal code, what its wrong?


Code:

[codefunction CRC32T(Initial: LongWord; Data: array of Byte; DataSize: LongWord): LongWord;
const
 poly = $EDB88320;
var
 j: Integer;
 tmp1, tmp2, crc, i: LongWord;
begin
 crc := Initial;
 i := 0;
 while i < DataSize do
 begin
   tmp1 := 0;
   tmp2 := crc xor Data[i];
   for j := 0 to 7 do
   begin
     if tmp2 and 1 = 1 then
       tmp1 := tmp1 xor poly;
     tmp2 := tmp2 shr 1;
   end;
   crc := (crc shr 8) xor tmp1;
   Inc(i);
 end;
 Result := not crc;
end;


Title: Re: MED 17 , EDC 17 EEPROM CHECKSUM
Post by: deutsch1988 on April 23, 2024, 02:54:25 PM
Problem fixed CS1.
Special Thanks to Anton from group. he have writed code in Visual Studio, and i have converted this code to Pascal!
SPECIAL THANKS ANTON!!!
Great mann.helped very very goood!!!


after finish program i will share the direct basic exe file, just put datas and get CS1 and CS2 or automatic edit CS on file with cheking!