Pages: [1] 2
Author Topic: problems.. corrupted bin file? "Check if flash matches".. ?  (Read 16488 times)
sn00k
Sr. Member
****

Karma: +59/-2
Offline Offline

Posts: 277


« on: November 02, 2011, 02:51:18 AM »

im currently tuning a 06A906032HN box, year 03.
using KKL ebay cable with FTDI driver tested and reccomended here.
also using MTX me7-2002 checksum plugin and tunerpro(latest build and not RT).

when i use the "Check if flash matches" button in nefmoto 1.8.0.0, and the original bin, the file matches the flashmemory.
now if i change a few bytes in the bin, and get a "checksums updated succesfully" message, when i try the "Check if flash matches" before i flash this modified bin, it sais the flash doesnt match.. so one question is.. should it match?

me7checker reported all checksums OK for the file, so i went ahead and flashed even tho it said it didnt match..

result, check engine and EPC light flashing and the throttle opening and closing in a cycle.. car starts but revs up and down..
NOW i cannot seem to connect to the ECU ever again.. not with vag-com, and not with nefmoto, so i cannot seem to restore the original flash.. and i dont really understand what is wrong.. all i can think of is the me7-2002 checksum plugin corrupting the file in some way..
that or if there is something wrong with the cable im using.. it does seem to appear a bit sporadic in the devices box in nefmoto.. as if it wasnt really ready..(same in vag-com).. but then i press refresh and its there.. and all communication seems to work.. file took 3:18 to flash.

any help/advice would be greatly appreciated.

i know i can recover the ecu using boot-mode.. but after that i want to be able to flash my new bin file to it with the changes without it going corrupt again.. =/
Logged
Gonzo
Sr. Member
****

Karma: +21/-30
Offline Offline

Posts: 483


« Reply #1 on: November 02, 2011, 09:37:25 AM »

Most likely flash didnt go thru correctly or tuned file has incorrect checksums.

Post the file here or PM ot to me and I'll check the checksums. I've had files where WinOLS and me7check both saod checksums were correct but they were not.
Logged
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #2 on: November 02, 2011, 09:48:08 AM »

.... now if i change a few bytes in the bin, ....

Could it be you changed some wrong bytes??  Just with checksums failures you should
never see the strange effects you described.
Probably you can post the changed and orig bins to be checked here.
Logged
iznogoud
Full Member
***

Karma: +13/-0
Offline Offline

Posts: 104

Learning junkie


« Reply #3 on: November 02, 2011, 11:15:04 AM »

Correct me if I am wrong, but the car should not start if there are bad checksums. OR, is some very vital checksum as bad.

Sounds like some values are corrupt and the checksums are correct for the problematic values being introduced.
Logged

Audi S4 B5 2000 6sp Cactus Green
Audi A4 B6 Avant 1.8T 2001.5 5sp Santorin Blue
sn00k
Sr. Member
****

Karma: +59/-2
Offline Offline

Posts: 277


« Reply #4 on: November 02, 2011, 01:30:59 PM »

thank you for all replies, this gives me hope =)
here are the original file..
then then 0001 file which should disable "sekundärluftpumpe" and rear O2 sensor for cat diagnosis.. also there is a bit changed for turning off the diagnosis on camshaft.. as i am using a different version of the tensioner(which gave me intermittent fault on over retarded intake camshaft).
this 0001 file flashed and the car ran great.. all DTCs i had earlier were removed.. but when i flashed it i got that flash file does not match flash memory message.. SHOULD it match??
something where spooky with this flash as the abs controller reported "an implausible message", other then that, it ran just fine.

so i proceeded to the next stage, where i wanted to try and add some more boost..
after logging AFR and making sure i was on the safe side of things.. i studied some examples and read all info available.. and came up with this 0002 file.. mainly modified kfmiop load axis, kfmirl, ldrxn, ldrxnzk, kfldhbn.. to see what happened.

i flashed this file after checking it with me7checker and all was ok..  AND here we are, the car is flashing EPC and check engine lights at me, throttle opens/closes and everything is spooked.. cannot for the world get in contact with the ecu again.. =(

any thoughts on using this cable? or if the nefmoto program should say that the file matches the memory? so i dont end up doing this allover again..

i was just about to start the fun part tweaking the life out of this old k03.. Wink
Logged
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #5 on: November 02, 2011, 02:01:14 PM »

ME7Check reports the following on both of the the two tuned images:
======================================================
Me7Check v1.11 (c) mki, 06/2004-07/2011
Checking file MIN_06A906032HN_BOX_0001.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 40/1/ME7.5/5/4019.02//24C/Dst02o/220202//
-> Contents of ECUID data table:
   - '0261207440'         (SSECUHN)         
   - '1037363908'         (SSECUSN)         
   - '06A906032HN '       (VAG part number)
   - '0002'               (VAG sw number)   
   - '1.8L R4/5VT     '   (engine id)       
-> Contents of ECUID data table:
   - 'HW_MAN004'                           


RSA signature failure found
-> Found 1 error!!!   *******************************

Probably you have used an outdated version of the checker, I added the RSA checking in August.

I'm not sure if the checksum failure alone is causing the problems you see, I would have doubted
this.  But the RSA signature appears in damos files with the name "tuningschutz",  i.e. tuning protection, so probably the behaviour you see is intended and all you have to do is fix the
checksums.
Logged
sn00k
Sr. Member
****

Karma: +59/-2
Offline Offline

Posts: 277


« Reply #6 on: November 02, 2011, 03:10:21 PM »

there we go, something is definitely wrong with the checksum correction plugin, and i was using an older version of the checker, as you said.

awesome setzi, now we know what is causing these spooks, lots of thanks! =)
Logged
Gonzo
Sr. Member
****

Karma: +21/-30
Offline Offline

Posts: 483


« Reply #7 on: November 02, 2011, 07:34:35 PM »

Having the RSA checksum wrong has never caused any issues for me.
Logged
sn00k
Sr. Member
****

Karma: +59/-2
Offline Offline

Posts: 277


« Reply #8 on: November 03, 2011, 02:55:07 AM »

=========================================
ME7Check v1.11 (c) mki, 06/2004-07/2011
Checking file Golf 1.8t 180bhp AUQ 06A906032HN 0261207440 363908.bin (size=104876)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 40/1/ME7.5/5/4019.02//24C/Dst02o/220202//
-> Contents of ECUID data table:
   - '0261207440'         (SSECUHN)
   - '1037363908'         (SSECUSN)
   - '06A906032HN '       (VAG part number)
   - '0002'               (VAG sw number)
   - '1.8L R4/5VT     '   (engine id)
-> Contents of ECUID data table:
   - 'HW_MAN004'


Page checksum failure(s) found
RSA signature failure found
Overall checksum failure found
-> Found 3 errors!!!   *******************************
=========================================

this is what i get when changing ONE bit in a known working original file for this ecu.. and letting the me7-2002 checksum plugin calculate and save the file.. surely something is wrong with the checksum calculation..

Gonzo: any thought on what could be causing this behavior besides the cheksums?

no known issues like these with the ebay KKL cables using FTDI d2xx drivers?
Logged
sn00k
Sr. Member
****

Karma: +59/-2
Offline Offline

Posts: 277


« Reply #9 on: November 03, 2011, 04:35:20 PM »

so.. i know why i cannot get in contact with the ecu now.. the ecu keeps shutting down and rebooting.. over and over.. and this is why it flaps the throttle and flashes EPC and check-engine lights at me.. it boots up, shuts down, boots up, shuts down and so on in a neverending cycle.

Salvatore at MTX-electronics, who have developed the checksum plugin, have confirmed that the RSA signature/checksums are being incorrectly calculated by the plugin for this file, and he is looking into it right now... progress..! =)
Logged
Gonzo
Sr. Member
****

Karma: +21/-30
Offline Offline

Posts: 483


« Reply #10 on: November 03, 2011, 04:46:17 PM »

Weird.

I have tested files with wrong RSA checksum and worked perfectly. Oh well...
Logged
carlossus
Sr. Member
****

Karma: +38/-0
Offline Offline

Posts: 394

Leon Curpa Stg1+


« Reply #11 on: November 04, 2011, 01:13:01 AM »

so.. i know why i cannot get in contact with the ecu now.. the ecu keeps shutting down and rebooting.. over and over.. and this is why it flaps the throttle and flashes EPC and check-engine lights at me.. it boots up, shuts down, boots up, shuts down and so on in a neverending cycle.

Salvatore at MTX-electronics, who have developed the checksum plugin, have confirmed that the RSA signature/checksums are being incorrectly calculated by the plugin for this file, and he is looking into it right now... progress..! =)

Keep us updated, this is interesting for me.
Logged
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #12 on: November 04, 2011, 10:28:07 AM »

The image _0002 crashes with stack overflow after about 0.5 seconds!

In both modified images, _0001 and _0002 there is a modification in the code area,
so it is just luck that the image _0001 did not crash.

Here is the relevant diff from orig to 0001 and from 0001 to 0002:
At 83'F8EC there is a change:
< 0003f8e0: d4a942f4 80328d29 9a092750 9a0e0de0  ..B..2.)..'P....
---
> 0003f8e0: d4a942f4 80328d29 9a092750 0a0e0de0  ..B..2.)..'P....

< 0003f8e0: d4a942f4 80328d29 9a092750 0a0e0de0  ..B..2.)..'P....
---
> 0003f8e0: d4a942f4 80328d29 9a092750 ec0e0de0  ..B..2.)..'P....

This changed an instruction "JMP somewhere"  to a "PUSH PSW; JMP somewhere else",
the result is clear  Grin
Logged
Gonzo
Sr. Member
****

Karma: +21/-30
Offline Offline

Posts: 483


« Reply #13 on: November 04, 2011, 05:37:32 PM »

Old cracked versions of WinOLS will do this. It will do random edits on the code.
I think its related to the checksum module that messes up.

Try using Tunerpro?
Logged
sn00k
Sr. Member
****

Karma: +59/-2
Offline Offline

Posts: 277


« Reply #14 on: November 05, 2011, 02:10:17 AM »

gonzo: i AM using tunerpro latest build with the MTX checksum plugin.. but the plugin apparently misses something in the calculation.

setzi: i dont think this is something i could have done in tunerpro while i set the disable bit for the camshaft diagnosis?
this is caused by the checksum plugin altering the code somewhere it shouldnt if i understand you correctly..?
Logged
Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.035 seconds with 16 queries. (Pretty URLs adds 0.001s, 0q)