Pages: [1]
Author Topic: EDC15 logger  (Read 1698 times)
nihalot
Full Member
***

Karma: +27/-1
Offline Offline

Posts: 80


« on: July 12, 2016, 10:26:14 AM »

Hello everyone
I find the me7logger rool immensely versatile. since edc15 and me7 share the same proc, what would need to be done to make such a logger for edc15.
I am willing to do tests,logs as i have a spare edc15 ecu, if anyone is willing to help.

regards
Logged

Multimap/LC/NLS on ME7/MED9/MEDC17/EDC15/EDC16/EDC17

https://www.youtube.com/user/nihal8447/

Email: edc15reverse (at) gmail (dot) com
nubcake
Sr. Member
****

Karma: +41/-1
Offline Offline

Posts: 399


« Reply #1 on: July 12, 2016, 12:42:07 PM »

Hello everyone
I find the me7logger rool immensely versatile. since edc15 and me7 share the same proc, what would need to be done to make such a logger for edc15.
I am willing to do tests,logs as i have a spare edc15 ecu, if anyone is willing to help.

regards

As far as I can tell, me7logger works at OS level, so the similarity of processors is irrelevant, unless the OS is also the same. Don't quote me on that, though - didn't do any research on the subject.
Logged
nihalot
Full Member
***

Karma: +27/-1
Offline Offline

Posts: 80


« Reply #2 on: July 12, 2016, 11:13:41 PM »

hey,

EDC15VM function description document mentions "RCOS"
EDC15C function desc. doc has the details about ReadbyMemAddress and other such functions which I presume are used by me7logger.


does anyone know if the edc15vm has this function? And if yes, how to implement it?
Logged

Multimap/LC/NLS on ME7/MED9/MEDC17/EDC15/EDC16/EDC17

https://www.youtube.com/user/nihal8447/

Email: edc15reverse (at) gmail (dot) com
jochen_145
Full Member
***

Karma: +4/-3
Offline Offline

Posts: 81


« Reply #3 on: October 28, 2017, 09:36:24 AM »

Like to reactive the question again, because EDC15 would be very nice to be logged, with ME7Logger, too instate of very slow KWP1281..

Too things I have in mind:

All Bosch related ECUs are applicated and logged with ETAS INKA..
So, application remote should be the same way for ME7 and EDC15. It is called "McMess"-functionallity AFAIK and can be found in both ECUs.

If I am not worng, ME7Logger uses the McMess functionallity of ME7, so IMO ME7Logger could log also EDC15, if the right adresses are requested ?


Maybe it is eayser to ME7Logger on EDC15 then though ?
Logged
prj
Hero Member
*****

Karma: +269/-15
Offline Offline

Posts: 3374


« Reply #4 on: October 28, 2017, 06:43:22 PM »

No one uses mcmess.

ME7Logger uses DynamicallyDefineLocalIdentifier with a ME7 specific array resize exploit to log more stuff than you are supposed to at once.
Logged
jochen_145
Full Member
***

Karma: +4/-3
Offline Offline

Posts: 81


« Reply #5 on: October 29, 2017, 06:32:51 AM »

Ok, but when I look into *.ecu file of ME7Logger, I find all RAM variables ME7Logger can log, deffined with ECU specific RAM address.
This address you will find also in a Damos or A2L for that specific ECU too.

These are the values, INKA also logs, when I use INCAs application tool. So INKA will log the same way like ME7Logger AFAIU ?!

So, if we have EDC15.map and EDC15.ecu file with the RAM adresses for EDC15 specific values, ME7Logger can log EDC15, IMO.

I don´t think Bosch got defferend protocolls to log ME7 and EDC15 for theire application system, but I don´t know jet  Huh
Logged
prj
Hero Member
*****

Karma: +269/-15
Offline Offline

Posts: 3374


« Reply #6 on: October 29, 2017, 07:30:23 AM »

Ok, but when I look into *.ecu file of ME7Logger, I find all RAM variables ME7Logger can log, deffined with ECU specific RAM address.
This address you will find also in a Damos or A2L for that specific ECU too.

These are the values, INKA also logs, when I use INCAs application tool. So INKA will log the same way like ME7Logger AFAIU ?!

So, if we have EDC15.map and EDC15.ecu file with the RAM adresses for EDC15 specific values, ME7Logger can log EDC15, IMO.

I don´t think Bosch got defferend protocolls to log ME7 and EDC15 for theire application system, but I don´t know jet  Huh

You have no idea what you are talking about.
Instead of spewing out random gibberish go and read the KWP2000 specification.

INCA can log as many parameters at once as DDLI allows, whereas with ME7Logger the amount of variables is limited by only CPU performance.
That said, ME7Logger will not log ANY EDC15 EVER, because the method used is a specific exploit only found in ME7.

If you want to log EDC15, write your own tool that will use DDLI and read the EDC15 FR for how many variables can be logged simultaneously using that method.
As for logging unlimited number of parameters, you need to reverse engineer EDC15 DDLI routine and see if it susceptible to a similar array overflow hack as ME7.
« Last Edit: October 29, 2017, 07:34:33 AM by prj » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.017 seconds with 16 queries. (Pretty URLs adds 0.001s, 0q)