FRF to Bin to FRF SIMOS18

Pages: 1 [2]

« previous next »

Author

Topic: FRF to Bin to FRF SIMOS18 (Read 11953 times)

vt1111

Jr. Member

Karma: +0/-0
Offline

Offline

Posts: 27

	Re: FRF to Bin to FRF SIMOS18 « Reply #15 on: July 20, 2021, 08:34:11 AM »

I tired to delete all old files and use the complete new pull. But same result as in my last image


	Logged

d3irb

Full Member

Karma: +134/-1
Offline

Offline

Posts: 195

	Re: FRF to Bin to FRF SIMOS18 « Reply #16 on: July 20, 2021, 09:14:11 AM »

Not quite the same error this time... please pull again. I tried to use a feature which only works in some Python versions. Should be good to go now.


	Logged

vt1111

Jr. Member

Karma: +0/-0
Offline

Offline

Posts: 27

	Re: FRF to Bin to FRF SIMOS18 « Reply #17 on: July 21, 2021, 03:16:46 AM »

Hi,

thanks for your help. Now the Output is that:

VCP still says the old ECU number.


« Last Edit: July 21, 2021, 05:02:18 AM by vt1111 »	Logged

d3irb

Full Member

Karma: +134/-1
Offline

Offline

Posts: 195

	Re: FRF to Bin to FRF SIMOS18 « Reply #18 on: July 21, 2021, 09:44:53 AM »

This looks like better output, although I would prefer logs (there should be a flash.log and a few other generated logfiles for this purpose).

Please DM me and we can try to figure out what's going on for you. Does VCP show you the Hardware Number (H13 / X13) ?


	Logged

vt1111

Jr. Member

Karma: +0/-0
Offline

Offline

Posts: 27

	Re: FRF to Bin to FRF SIMOS18 « Reply #19 on: July 22, 2021, 03:51:41 AM »

Hi!

Sent. X13 as ECU Variant is shown. H13 I can't see but i attached the Image from VCP in the DM.


	Logged

michelhadid

Jr. Member

Karma: +10/-2
Offline

Offline

Posts: 41

	Re: FRF to Bin to FRF SIMOS18 « Reply #20 on: July 22, 2021, 06:54:00 PM »

Quote from: d3irb on July 14, 2021, 04:46:00 PM

Exactly! Now you get it, I think! Sorry, it is quite complex really.

Hopefully I get to this tomorrow or so my time.

You could however repeat this process every time you write a modfied/tuned file, right? Flash all 5 blocks of patched 8V software and then just flash all of the blocks for the original frf on the car with a modified CAL sector/block (remap)? Or am i missing something and it would trigger an IMMO brick?


	Logged

d3irb

Full Member

Karma: +134/-1
Offline

Offline

Posts: 195

	Re: FRF to Bin to FRF SIMOS18 « Reply #21 on: July 23, 2021, 01:15:55 AM »

Quote from: vt1111 on July 22, 2021, 03:51:41 AM

Hi!

Sent. X13 as ECU Variant is shown. H13 I can't see but i attached the Image from VCP in the DM.

If X13 is shown the in-memory patch is working and the car is now in a fake Sample Mode CBOOT. So, you should be able to flash a patched set of blocks now. There is an issue I just thought of though with not having a patched CBOOT to flash (don't worry, you can always go back to stock!). Read along:

Quote

This would work, except for something I just thought of which prevents it. Without flashing a patched CBOOT first, this actually won't work, unfortunately. Here's why:

Your car is now loading an ASW which loads up a fake Sample Mode CBOOT in RAM. This fake Sample Mode CBOOT will accept _any_ block, and will mark it as Valid in the ECU memory. But, the next block that's flashed actually has to be a CBOOT with the Sample Mode patch applied, in order to flash a custom CAL. Here's why:

When the ECU writes CBOOT, it actually does it by downloading the data into the CAL block and then copying it into the CBOOT area if it passes all checks. Next, it instantly and immediately reboots into the new CBOOT.

This means that the ASW-based CBOOT patcher will be instantly removed across this reboot - and the now-running CBOOT will not accept patched blocks, unless it is in Sample Mode.

And, when I wasn't thinking right before, I had thought "well, just write CAL first, it will be marked as valid and the rebooted CBOOT won't care" - but this isn't true, because flashing a new CBOOT erases CAL, inherently, because the CAL area is where the temporary CBOOT is written.

So in short - vt1111, you need a patched-into-Sample Mode CBOOT to flash over the top. Right now, your ECU was patched successfully, and it is in fake Sample Mode each time it boots up (that's the X13 identifier you see). Right now, it will write unsigned blocks. But, unfortunately, the unsigned blocks you write need to be a full-time patched CBOOT, for the reasons listed above.


	Logged

vt1111

Jr. Member

Karma: +0/-0
Offline

Offline

Posts: 27

	Re: FRF to Bin to FRF SIMOS18 « Reply #22 on: July 23, 2021, 02:07:49 AM »

So it is currently not possible to flash any software but only if it is 8V.... where you have a patch, right?


	Logged

d3irb

Full Member

Karma: +134/-1
Offline

Offline

Posts: 195

	Re: FRF to Bin to FRF SIMOS18 « Reply #23 on: July 26, 2021, 12:07:11 PM »

8V is nothing to do with it - CBOOT and ASW versions are independent of brand and product and are shared across all product lines, which is convenient as for USDM MQB cars there is actually a shared CBOOT and ASW (I0 CBOOT and S50 ASW) which has a calibration for almost all models: GTI/A3 2.0 5G 259L__0002, R/S3 8V 259K__0003, Golf/Sportwagen/A3 1.8 8V 264K__0003, and TT-S 8S 259C__0004 all have an I0 S50 calibration for USDM.

Anyway, I added an automated patcher. It is incredibly naive and just patches a hex string, which I am not particularly proud of as it is generally a horrible practice (vs. writing a disassembler and doing it right). However, amazingly, I automated the FRF/ODX extraction process and tested my patcher on every single CBOOT sample I have for all Simos MQB ECUs, and the naive hex patching actually seems to be OK on all known CBOOTs.

So the new process is:

* Flash 8V0906259H__0001 with patch.bin, as you have done. Double check this by looking - Hardware Number should now read X13 (as yours did).

* `python3 VW_Flash.py --action flash_frf --frf yourcar.frf --patch-cboot` . This will apply the FRF to your car but with a patched CBOOT, which will allow unsigned code and CAL blocks for your boxcode going forward.

* Extract the FRF/ODX for your boxcode. FD_4 will be the CAL. To flash a new CAL in the future, you can do `python3 VW_Flash.py --action flash_cal --infile FD_4 --block CAL` to flash a new CAL with whatever changes you want. flash_cal has also been updated to correct both the CRC32 and ECM3->ECM2 summation checksums.

* You can also flash new ASW patches using `python3 VW_Flash.py --action flash_bin --infile FD_1 --block ASW1` for example. Be aware that doing this without having very well-tested patches or ready access to bench/boot tooling (Raspberry Pi with 5V level shifters and CAN hat to use my open-source stuff, or commercial tools), is rather hazardous and can easily result in a brick.

I tested this whole process on my bench ECU using the latest VW_Flash `master` branch and `FL_5G0906259___0009.frf`, I didn't have ___0010 handy. Everything worked great.

The most dangerous part of this process is that you _must_ make sure that the FRF you flash is for the correct vehicle. If the IMO_idxTun0X_C_VW table does not contain a match for the adapted PClass in the ImoDat, the ECU will happily flash the file, boot up, and not find a PClass. Then you will get stuck in "IMMO brick" which requires bench tools to restore.


	Logged

prj

Hero Member

Karma: +1072/-480
Offline

Offline

Posts: 6035

	Re: FRF to Bin to FRF SIMOS18 « Reply #24 on: July 27, 2021, 12:53:00 AM »

Quote from: d3irb on July 26, 2021, 12:07:11 PM

The most dangerous part of this process is that you _must_ make sure that the FRF you flash is for the correct vehicle. If the IMO_idxTun0X_C_VW table does not contain a match for the adapted PClass in the ImoDat, the ECU will happily flash the file, boot up, and not find a PClass. Then you will get stuck in "IMMO brick" which requires bench tools to restore.

Here is some code to get the file number and version from any S18.1 ECU:

Code:

            // Check for S18.1
            if (ArrayMatches(0x200000, ASCIIEncoding.ASCII.GetBytes("CASC8"), bin)) {
                info.EcuType = VagEcuType.SIMOS18_1;
                info.FileNum = ASCIIEncoding.ASCII.GetString(bin.Skip(0x200060).Take(12).ToArray()).TrimEnd((Char)0).Trim();
                info.FileVer = ASCIIEncoding.ASCII.GetString(bin.Skip(0x200080).Take(4).ToArray()).TrimEnd((Char)0).Trim();
            }

You can adapt this code, and then when flashing make sure that the file number in the ECU (queried with 22 F1 87) matches what you are trying to flash. If they do not match, throw an error and do not continue.
Allow overriding this by specifying a special command line switch.

This way it is possible to flash a newer or older version, but not a different file number. This guarantees that you never run into immobilizer problems.


	Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches

d3irb

Full Member

Karma: +134/-1
Offline

Offline

Posts: 195

	Re: FRF to Bin to FRF SIMOS18 « Reply #25 on: July 27, 2021, 06:18:05 AM »

Quote from: prj on July 27, 2021, 12:53:00 AM

https://github.com/bri3d/VW_Flash/blob/master/VW_Flash.py#L384 - thanks, but it's been in there for many months now - when using flash_cal to update a calibration, there's no chance for an easy mistake.

Users really only need to watch out when they're flashing initially - and this is in no small part my own fault because I encourage USDM users to cross-flash to specific versions in https://github.com/bri3d/VW_Flash#getting-started to avoid the endless hunt for definition files. Unfortunately, this means any warning added to the "full flash" handler would probably be zombie-accepted anyway.

I think I'll manually generate a table of calibration names with known matching idxTun tables in a bit, and match using a CSV. For now, people should just pay attention to what they're flashing when they're not using flash_cal


« Last Edit: July 27, 2021, 06:20:03 AM by d3irb »	Logged

vt1111

Jr. Member

Karma: +0/-0
Offline

Offline

Posts: 27

	Re: FRF to Bin to FRF SIMOS18 « Reply #26 on: August 02, 2021, 12:57:05 AM »

Very nice! Thanks for your adaption. I will try in next days and will get back to you.


	Logged

keine ahnung

Newbie

Karma: +0/-0
Offline

Offline

Posts: 2

	Re: FRF to Bin to FRF SIMOS18 « Reply #27 on: November 25, 2022, 04:05:39 AM »

Hello

3. Flash FL_5G0906259___0010 Block 1-4

How can i do that?

After flashing the frf for the car, I didn`t see the X13 and my cal block is overwritten.

Thank you.

Best regards
keine Ahnung


	Logged

Pages: 1 [2]

« previous next »

Jump to:

Navigation

Personal Tools

November 26, 2024, 12:03:22 AM

Welcome, Guest. Please login or register.
Did you miss your activation email?

Navigation

Personal Tools

Search