Recent Posts

This is exactly what my differential analysis was pointing at — I called it "byte-level, not XOR" but couldn't characterize it further without the table structure. 256-byte permutation + add/shift makes perfect sense given what I was seeing.

A couple of follow-up questions if you're willing:

Is the permutation table static per TCU family (same across all firmware versions of DL381, for example), or does it vary per SW version? If it's static I should be able to recover it from a bench dump via known-plaintext.

For method 0x11 — you mentioned "same algorithm + additional compression". Is the compression layer something standard (LZ77, LZSS) or another proprietary scheme like the LZZ I found in the ZF method 0x22 blocks?

On the DL800 fake 0xAA — I've been looking at 4M0927158 (Q7/Q8 ALX520) and 8W0927158 (B9 S4/S5 AL552) which both report 0xAA. Block alignment analysis suggests those are real AES (all blocks 16-byte aligned), so I think the fake 0xAA warning doesn't apply there. Can you confirm which DL800 part numbers show the fake mark so I can make sure I'm not mixing things up?

Updated the documentation at github.com/dspl1236/vag-tcu-tools with your findings — credited to community RE on NefMoto. Let me know if you'd prefer different attribution.

Hello, what can read and write EEPROM via OBD2 in ME7.5? It's read using a standard KKL cable. But is there a cable that can write it via OBD?

I have same problem to convert my KP to XDF

Code:

Reading KP map-pack: E:\Audi A4 1.8T Quattro\Audi_A4_MAPPAK_360654.kp …
  182 records (85 scalars, 51 curves, 46 maps)
  1 categories
Generating XDF …

Traceback (most recent call last):
  File "ols_to_xdf_gui.py", line 1570, in _worker
    xdf_str, written, skipped = mod.generate_xdf(
                                ~~~~~~~~~~~~~~~~^
        records, cat_map, title=cfg['title'],
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ...<8 lines>...
        ols_meta=_meta,
        ^^^^^^^^^^^^^^^
        tool_name=f'OLS to XDF v{VERSION}')
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\Limitless\Downloads\OLS-to-XDF-Converter-Source\ols_to_xdf.py", line 2818, in generate_xdf
    xml = _build_table(rec, uid, swap_curve=swap_curve, swap_xy=swap_xy,
                       table_type=table_type,
                       helper_uid=None, y_helper_uid=None)
  File "C:\Users\Limitless\Downloads\OLS-to-XDF-Converter-Source\ols_to_xdf.py", line 2645, in _build_table
    _axis('x', x_addr, x_bits, x_count, x_units, x_factor, x_offset,
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
          col_count=x_count, decpl=x_decpl, signed=x_signed, lsb_first=_x_lsb_first),
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\Limitless\Downloads\OLS-to-XDF-Converter-Source\ols_to_xdf.py", line 1843, in _axis
    label_lines = '\n'.join(
        f'      <LABEL index="{i}" value="{label_val_fmt.format(float(i))}" />'
        for i in range(count)
    )
  File "C:\Users\Limitless\Downloads\OLS-to-XDF-Converter-Source\ols_to_xdf.py", line 1844, in <genexpr>
    f'      <LABEL index="{i}" value="{label_val_fmt.format(float(i))}" />'
                                       ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
MemoryError

I`ll attach my KP file here so if you can make it to XDF and investigate the problem. i have also tray to select manual just a couple maps to generate a smaller size of KP. Generator worked but all maps in XDF are wrong defined with any corect value

Hello
Will the 06A906032HJ map crossflash work with the 06A906032DR controller?

I see that just now.  I'll work on getting the right bin.  Sorry about that...

This is awesome!! Great work, and thank you!

Yes I have read the sticky topic, but i thought the topic starter has uploaded one.

Now here is mine.

This file is corrupt, its all FF's Whatever you used to read this file just saved garbage.

Hi,

I'm looking for xdf or damos for a 2012 Fiat Bravo 1.4 T-Jet, with the following HW/SW
HW: 0261S04244
SW: 1037391694

Hi, a few years ago i found csv defs for 551CJ, should be a good start for diff search