lefedor
Newbie
Karma: +0/-0
 Offline
Posts: 7
|
 |
« Reply #405 on: December 22, 2021, 04:06:21 PM »
|
|
|
Full readout c00000 -> c4ffff from gen5 Volvo 2-pin ecu 314-31-022.
|
|
|
|
« Last Edit: December 22, 2021, 04:08:03 PM by lefedor »
|
Logged
|
IOT hardware/software developer, ECU repair engineer, (En/Ru/De).
|
|
|
lefedor
Newbie
Karma: +0/-0
Offline
Posts: 7
|
|
« Reply #406 on: December 23, 2021, 05:01:53 AM »
|
|
|
Hey!
Did you manage to read 4Gen via CAN bus?
Can anyone have a firmware from Skoda Yeti 0br907554a?
I happen to have it. |
|
|
|
|
Logged
|
IOT hardware/software developer, ECU repair engineer, (En/Ru/De).
|
|
|
lefedor
Newbie
Karma: +0/-0
Offline
Posts: 7
|
|
« Reply #407 on: December 25, 2021, 10:40:50 AM »
|
|
|
Another Haldex controller for Volvo. Gen5.
Modern one, 07/17, CPU ins different from regular version.
|
|
|
|
« Last Edit: December 25, 2021, 12:54:34 PM by lefedor »
|
Logged
|
IOT hardware/software developer, ECU repair engineer, (En/Ru/De).
|
|
|
jeroenveer
Newbie
Karma: +0/-0
Offline
Posts: 7
|
|
« Reply #408 on: January 09, 2022, 05:07:32 AM »
|
|
|
Just saw this post and wanted to comment, in this case by doing things blind you are making things hard for yourself because all of this is already in FRF/ODX  Flashing these Gen5 modules over OBD is trivial, there is no protection whatsoever (no signatures, no encryption, nothing), and it's bog standard UDS flashing. Convert the FRF to ODX and it's all right there - seed/key is just SA2 which is in the ODX, and the OEM flash driver / loader is in the ODX as well (DRIVER). There is also a CRC32 sent over UDS but it's bog standard. If you want to do full read over OBD you could write your own custom Driver to do so as well as is done for DSG OBD read. The hard part is blindly finding maps, which I am working through but am interested in if anyone else has made progress. I am working forwards from the UDS handlers -> named RAM variables -> methods -> maps, but I know other folks are better at things like blind eyeballing calibrations instead of trying to reverse them. I have made a custom flash driver for the Gen5 that can read/write full flash in CAN BSL mode. Inserted it into the ODX with correct CRC32. It upload correctly and CRC reports OK as well, but after that it does not seem to run the code. It replies to the UDS flash upload command with a UDS reply from controller so it is still running but not the flash driver. reply is conditions not met and reboots controller after 5 seconds. Is there any other check on the flash driver that might prevent it from running? |
|
|
|
|
Logged
|
|
|
|
Norwegian1.8T
Full Member
Karma: +1/-1
Offline
Posts: 65
|
|
« Reply #409 on: January 20, 2022, 01:58:44 PM »
|
|
|
Did anyone ever get to read/write to Gen 1 haldex trough ODB?
I've read trough this thread multiple times but cant seem to get my head around it.
Some pictures and so on are missing due to broken links.
I see that @DT has done some fantastic work! What was the end resault?
|
|
|
|
|
Logged
|
|
|
|
Teitek
Newbie
Karma: +1/-0
Offline
Posts: 21
|
|
« Reply #410 on: August 29, 2022, 04:54:21 AM »
|
|
|
I have made a custom flash driver for the Gen5 that can read/write full flash in CAN BSL mode.
Inserted it into the ODX with correct CRC32. It upload correctly and CRC reports OK as well, but after that it does not seem to run the code.
It replies to the UDS flash upload command with a UDS reply from controller so it is still running but not the flash driver. reply is conditions not met and reboots controller after 5 seconds.
Is there any other check on the flash driver that might prevent it from running?
Hi Has the modified block checksum been fixed? |
|
|
|
|
Logged
|
|
|
|
DT
Full Member
Karma: +20/-1
Offline
Posts: 184
|
|
« Reply #411 on: August 30, 2022, 05:03:35 PM »
|
|
|
I see that @DT has done some fantastic work! What was the end resault?
Well, really soon it's time to forget about other Gen1 products like Blue, Agent(  ) Orange, HPA Touchmotion or similar. There will be a new superior product available.  |
|
|
|
|
Logged
|
|
|
|
Norwegian1.8T
Full Member
Karma: +1/-1
Offline
Posts: 65
|
|
« Reply #412 on: August 31, 2022, 03:16:41 AM »
|
|
|
Well, really soon it's time to forget about other Gen1 products like Blue, Agent( ) Orange, HPA Touchmotion or similar. There will be a new superior product available. Wow! That sounds awsome! Let me know if there is anyhting you need help with, testing, developing etc  |
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #413 on: August 31, 2022, 04:35:14 AM »
|
|
|
IIRC there is a checksum on at least the calibration in Gen5 and if you get that wrong, you have a brick in a reset loop...
|
|
|
|
|
Logged
|
|
|
|
d3irb
Full Member
Karma: +131/-1
Offline
Posts: 186
|
|
« Reply #414 on: August 31, 2022, 08:03:55 AM »
|
|
|
IIRC there is a checksum on at least the calibration in Gen5 and if you get that wrong, you have a brick in a reset loop...
Second this, there's a checksum on each block and it will brick if you get it wrong on the flashed ones, it is quite annoying actually. This is probably the issue with your driver block also. |
|
|
|
|
Logged
|
|
|
|
crazypete
Newbie
Karma: +0/-0
Offline
Posts: 3
|
|
« Reply #415 on: October 11, 2022, 07:16:30 AM »
|
|
|
Hello guys,
I just wanted to ask if there is any progress made in terms of 1 Gen Haldex.
The last update in this topic was from DT who said he is working on something great, but they it died completely.
Would love to hear some feedback. Thank you.
|
|
|
|
|
Logged
|
|
|
|
wachu
Newbie
Karma: +0/-1
Offline
Posts: 18
|
|
« Reply #416 on: October 11, 2022, 11:40:38 AM »
|
|
|
most likely they will not share their knowledge because as stated before they want to commercialise it, which i totally understand but it still makes me sad as there are no other alternatives. there was a openhaldex initiative but it was abandoned some time ago. it seems like unitedmotorsport is still the only option, however they charge 600$ for it and you have to ship the controller to them.
i am pretty sure even if some folks from this forum will finally release their product they will be charging similar price which for me is astronomical to be honest (i am from Poland so for 600$ you buy a whole car, not a reflash service which will be barely perceptible xD)
|
|
|
|
|
Logged
|
|
|
|
|
Sandstorm3k
|
|
« Reply #417 on: October 11, 2022, 12:56:37 PM »
|
|
|
Hello guys,
I just wanted to ask if there is any progress made in terms of 1 Gen Haldex.
The last update in this topic was from DT who said he is working on something great, but they it died completely.
Would love to hear some feedback. Thank you.
Openhaldex looks cool |
|
|
|
|
Logged
|
|
|
|
d3irb
Full Member
Karma: +131/-1
Offline
Posts: 186
|
|
« Reply #418 on: September 03, 2023, 12:30:25 PM »
|
|
|
Forgot to bump this thread with progress, don't worry, we didn't go commercial just yet  : Haldex Gen5 flashing is available in https://github.com/bri3d/VW_Flash , including checksums. Thanks to ConnorHowell for taking it across the finish line. This hasn't been extensively tested besides to tamper with some obvious values (module identifier etc.) in the app software to confirm that changes are taking and some random bytes in Calibration to confirm it doesn't brick. It's probably worth having a miniwiggler on hand in case of issues still. I certainly wouldn't recommend all of the mind virus commercial tuners out there steal this for customer cars yet. Full flash dumps and miniwiggler pinouts have already been posted by others in this thread. The next step is to reverse the firmware to find maps. There are a lot of obvious maps by shape in the calibration area, so there are options. One solution would be to work by guess-and-check by editing obvious maps and datalogging. Alternatively, someone who likes C167 (aka, not me, I hate it a lot) could go in through disassembly of the UDS localIdentifier routines, name RAM variables, and work backwards (ie - old school control module reversing the real way). |
|
|
|
|
Logged
|
|
|
|
|
terminator
|
|
« Reply #419 on: September 04, 2023, 04:54:21 AM »
|
|
|
DTCs can also be useful for naming subroutines.
|
|
|
|
|
Logged
|
|
|
|
|
