Pages: 1 2 [3]
Author Topic: R32 ME7.1.1 OLS300 Simulator  (Read 18533 times)
Rittersport
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 13


« Reply #30 on: April 27, 2017, 06:39:32 AM »

Yes, but very very rarely.

1. Search for "47 F8 55 00 CC 00 CC 00" (1 match)
2. Search forward for "E6 F4 FF DF", notice the address, save the last 4 bytes (0x69E0A -> 9E0A)
3. Change "47 F8 55 00 CC 00 CC 00" to "47 F8 55 00 EA 00 0A 9E" (use the last 4 bytes loHi)

In EEPROM change 69 C1, A5 to 8E 5A, D2. On page 01 and 02.

This approach works on pretty much everything. Technically if WinOLS is correcting checksums you can only do the EEPROM.
The first patch is to check checksum when ECU is powering up (IGNITION ON). The EEPROM mod is to disable checksums while ECU is running, which is the really important part.
Maybe a silly question. Will this work on Volvo ME7 ? They have the same problem.. when changing on the Fly with OLS 300 ECU dies.. (8bit values can be modified without ecu fuckup but 16 bit values can't)
I have searced for the Hex values in the Volvo files and not found the 47 F8 55 00 CC 00 CC 00. But E6 F4 FF DF can be found in numerous places.
Logged
vwaudiguy
Hero Member
*****

Karma: +47/-35
Offline Offline

Posts: 1965



« Reply #31 on: December 06, 2017, 09:44:52 AM »

I'm going to say if you aren't finding hex string "47 F8 55 00 CC 00 CC 00" in your binary, then there is another string of hex for your particular ecu. I'm positive there's a way to do it, but unfortunately, I don't know how. Time to get cozy with IDA.
Logged

"If you have a chinese turbo, that you are worried is going to blow up when you floor it, then LOL."
pizzaschnitzer
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 17


« Reply #32 on: March 28, 2018, 03:46:52 AM »

Yes, but very very rarely.

1. Search for "47 F8 55 00 CC 00 CC 00" (1 match)
2. Search forward for "E6 F4 FF DF", notice the address, save the last 4 bytes (0x69E0A -> 9E0A)
3. Change "47 F8 55 00 CC 00 CC 00" to "47 F8 55 00 EA 00 0A 9E" (use the last 4 bytes loHi)

In EEPROM change 69 C1, A5 to 8E 5A, D2. On page 01 and 02.

This approach works on pretty much everything. Technically if WinOLS is correcting checksums you can only do the EEPROM.
The first patch is to check checksum when ECU is powering up (IGNITION ON). The EEPROM mod is to disable checksums while ECU is running, which is the really important part.

This thread is the same problem i have on 2.7t ecu 4z7907551N, but i already tried the checksumfree mod on my emulator ecu (roadrunner) the car starts once, now i have the eeprom-error code in it. i think i need to reflash the mpc. can you give me a litte slap on my ass how to come clear with it?
i want to use tunerpro/roadrunner and neet to endian the file for using it with tunerpro, but it would be okay if its working like that.
thankyou! PS: your info about 550cc injectors works perfectly. i tuned them now on LTFT +0,8/-0,8 left/right bank. the car runs like stock and has beatiful idle. THANKALOT!
Logged
prj
Hero Member
*****

Karma: +284/-27
Offline Offline

Posts: 3488


« Reply #33 on: March 28, 2018, 06:05:27 AM »

Your ECU does not have a flashable mpc. It only has ROM OTP.
To fix the additional problem with this checksum on this ECU search for "9A ?? ?? ?? DA ?? ?? ?? 49 81 3D 19" (question marks are wildcards).
Replace with "CC 00 CC 00 CC 00 CC 00 CC 00 CC 00".

The code should clear on next ignition and car should start.
Logged
Pages: 1 2 [3]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.021 seconds with 16 queries. (Pretty URLs adds 0s, 0q)