Can somebody sanity check my thoughts here?
So, with the checksum DTC set, I was forced to start digging to figure out how to un-set the DTC. I didn't have an original e2p, so I took my spare ECU, flashed a working e2p and the fixed file.
I booted the ECU, cleared the DTC's, let the DTC's get set (it was on the bench), and then powered off the ECU and dumped the e2p.
Then I intentionally broke the file, flashed it back, booted the ECU, and verified the DTC was set.
Then I compared the two files. Broken on the left, no DTC on the right:
00000102: F0 C4
00000103: 3D 67
00000104: 57 20
00000105: BF CE
0000011F: B5 DF
00000902: F0 C4
00000903: 3D 67
00000904: 57 20
00000905: BF CE
0000091F: B5 DF
So I figured I could fix this - but the checksum needs to be fixed on those pages... That's why 0000011F and 0000091F were modified and presumably at the end of the page.
I remembered Setzi posted about ME7 checksums, so I found his guide here:
http://nefariousmotorsports.com/forum/index.php?topic=362.0title=Obviously the MED9 e2p is bigger, but why would they change anything? I assumed it was divided into 128 pages of 16 bytes per page.
Since I don't know what the page info table is like, I just made some assumptions.
Based on Setzi's notes, I followed:
If the checksumBit(CS) is set for a page, this page has a checksum.
Calculate the checksum as follows:
- sum up the first 14 bytes of the eeprom page in a 16bit variable.
- add the page number to the sum.
- if the checksumBit(CB) is set, subtract 1 from the sum.
- negate the sum (this is not the same as complement!).
- store the resulting value in the last two bytes of the eeprom page,
first the low-byte, then the high-byte.
Boom. A sample check of each page showed the last two bytes were correct for the above checksum routine. MED9's eeprom checksum works just like ME7.
The interesting thing is my BDM would never flash e2p files that have been modified, during my immo-off quest. It would always fail the verification.
I used the above method as a test to see if I could fix a file... and sure enough - it flashed!
Now to get this DTC unset...