Hi all,
Long time reader, first time poster. I am relatively new to Bosch MEs, but not to ECU reverse engineering, had some really good success with Magnetti IAWs (but that's ancient technology compared to ME, I know that, no need to tell me
).
To preempt any advice I may get from you: I read a lot, I have seen Andy's tutorials, I know how the C166/ST10 works, etc. Also have nice collection of bin images for the ECUs I study.
Anyhow, to the point, I am trying to take apart two MEs used by Fiat: ME7.3H4 (1.4 16V n/a) and ME7.9.10 (1.4 16V T). I already located the checksum blocks, that was kind of easy after reading Andy's tutorials. Next thing I looked into are DTC code words and tables. Again, the DTC table itself was too easy to find, the class table though puzzeled me, it seems it has a different form than ones mostly written about here. To the best of my study the class table is a list of byte pairs, like this for example (after reversing the actual byte order because of endian):
... 0A 33 0B 33 0C 33 ...
where the first byte in the pair is the DTC index, the second byte the actual class byte. Does this look right and make sense to you? Anybody have seen this in other ME programs? Also, some of these presumed DTC indecies in this table are repeated. I would of course check this, but I do not have means to do any real-life tests for the moment.
Attached is an example ME7.9.10 image, the DTC class table of this form starts at 0x99BCC absolute.
Any comments or suggestions are welcome
EDIT:
It seems I am quicker than you guys, I found the class table in the other one of the bins I look at. It was a bit tricky, but I've got it. To make the story short, the above guess was not right, the DTC class table is one-byte sequence per table, the same as in the post by Tony here:
http://nefariousmotorsports.com/forum/index.php?topic=567.0