Pages: 1 ... 8 9 [10] 11
Author Topic: LC/NLS  (Read 23396 times)
RBPE
Sr. Member
****

Karma: +30/-5
Offline Offline

Posts: 342



« Reply #135 on: January 19, 2020, 07:43:37 AM »

I used it and I got the script working but I would still like to find these maps. ESKONF for example could be very interresting for other things like sai or rear o2 sensor delete. ITNMXH and TNMXH are also pretty important for me to implement soft limiter launch control. Would be great if someone could help me.
Greetings  Grin

Not sure if the one I used here is the same revision as your file, but your ESKONF will be around that area;

ESKONF AUE BDE by Rick B, on Flickr
Logged
ebugauge
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 7


« Reply #136 on: January 20, 2020, 10:47:00 AM »

Thank you RBPE! Grin Can someone confirm?
ESKONF at 0x10C24
« Last Edit: January 20, 2020, 10:48:49 AM by ebugauge » Logged
RBPE
Sr. Member
****

Karma: +30/-5
Offline Offline

Posts: 342



« Reply #137 on: January 24, 2020, 08:00:48 AM »

Thank you RBPE! Grin Can someone confirm?
ESKONF at 0x10C24

Same sw rev by the look of it;

aue by Rick B, on Flickr
Logged
RBPE
Sr. Member
****

Karma: +30/-5
Offline Offline

Posts: 342



« Reply #138 on: January 24, 2020, 09:03:05 AM »

P.S. To save ME7.1.1 owners from having to mess around too much with trying to understand ESKONF, find "Marty" on here, look at his profile and go through the pages of posts he put up, somewhere in there you'll see he put up a break down of ESKONF on these!
« Last Edit: January 24, 2020, 09:22:02 AM by RBPE » Logged
Marty
Hero Member
*****

Karma: +151/-216
Offline Offline

Posts: 1511


« Reply #139 on: January 25, 2020, 05:54:39 AM »

P.S. To save ME7.1.1 owners from having to mess around too much with trying to understand ESKONF, find "Marty" on here, look at his profile and go through the pages of posts he put up, somewhere in there you'll see he put up a break down of ESKONF on these!
whos marty?
Logged

rysiektr
Newbie
*

Karma: +2/-3
Offline Offline

Posts: 24


« Reply #140 on: January 26, 2020, 03:14:20 PM »

FTOMN is 0x19E33
ITNMXH is 0x162C2
Logged
RBPE
Sr. Member
****

Karma: +30/-5
Offline Offline

Posts: 342



« Reply #141 on: January 27, 2020, 04:27:05 PM »

whos marty?

Not sure, some say he's a teen who befriended a mad scientist and travels back and forth through time so that he can give his family the best life possible whilst slacking off school like his old man, some say he even runs an ME7.1.1. car powered by something called a "flux capacitor"!

All we know is......he's called the Marty!  Wink Grin
« Last Edit: February 04, 2020, 03:10:51 PM by RBPE » Logged
armaan
Jr. Member
**

Karma: +0/-11
Offline Offline

Posts: 46



« Reply #142 on: February 01, 2020, 10:18:14 AM »

Hi all, hope you all are well.

Followed the instructions for 2Step LC in the attached document (Except for NLS, only for 2Step).
Didn't move code (Obviously the Hex addresses Setzi originally used are different from the ones I used, but I think I applied the principle correctly, especially the part for DA (calls) & used Setzi's standard example which is:

"A6 01 50 46 0A 00 F0 55 E6 FF FF FF FF FF FF FF" atleast, according to the Document.
Definitely DID NOT use Eduu's 2StepScript. Checksummed one file with MTX's ME7-2002 plugin for TunerPro RT V5 & the other with ME7Sum.

So far, ME7Sum has been working for all my Map files, but I'm not so certain it would work on this one since I had to toy around with Hex addresses which brings me to my question:

Have I implemented 2Step correctly and which checksummed file should I test flash onto my Polo GTI 9n3?

Here's the full log of ME7Sum:

Code:
Attempting to open firmware file 'image.bin'

 Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for ECUID table...OK
 EPK         : '39/1/ME7.5/3/X505R//24C/SP24C91/270705/'
 Part Number : '06A906032TL '
 Engine ID   : '1.8l R4/5VT     '
 SW Version  : '0040'
 HW Number   : '0261208950'
 SW Number   : '1037378104'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @08038 Add=0x000106FF CalcAdd=0x000106FF  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01bf98 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @95b78-95bf8
           Modulus: @16a22-16aa2
          Exponent: @16aa2 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @169fe [32 bytes]:
 1) 0x00010002-0x00013FFE
 2) 0x00014252-0x00017F4E
 3) 0x00018192-0x0001FBDC
 4) 0x00026A00-0x0002FFFC
 EncrMD5: cf d7 85 02 3c 13 57 97 f2 e0 b4 72 5f 4a a4 87
 CalcMD5: d7 5e a0 ec 5b 52 27 06 0d 88 2f be b0 2d 53 6b
 ** FIXED **

Step #4: Finding CRC table(s) ..
 Searching for CRC table(s)...OK
 CRC table(s) OK

Step #5: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 Main Checksums:
 1) 0x010002-0x013FFE CalcCSM: 001398C5
 2) 0x014252-0x017F4E CalcCSM: 0026055E
 3) 0x018192-0x01FBDC CalcCSM: 00441514
 4) 0x026A00-0x02FFFC CalcCSM: 00BFEF41
 @8ffb6 CSM: 00BFE857 CalcCSM: 00BFEF41 ** FIXED **

Step #6: ROMSYS Program Pages
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0xA19B73 CalcAdd=0xA19B73  ADD OK

Step #7: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @1fb72 [16 bytes]:
 1) 0x000000-0x00FBFF CalcChk: 48D09FE4
    0x00FC00-0x01FFFF CalcChk: 20D987EB CalcCRC: CB1C2009 SKIPPED
 2) 0x020000-0x0FFFFF CalcChk: 2B10DB2A
 @fffe0 Chk: 2B08E592 CalcChk: 2B10DB2A ** FIXED **

Step #8: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK
 ..........
64) <1ffce>  0x0F4000-0x0F7FFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
65) <1ffde>  0x0F8000-0x0FBFFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
66) <1ffee>  0x0FC000-0x0FFFFF Chk: 1FFDE002 CalcChk: 1FFDE002 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

Step #9: Looking for rechecks ..
    <1fc6e>  0x01C000-0x01FFFF Chk: 062978B8 CalcChk: 062978B8 OK (recheck)

*** Found 70 checksums in image.bin

Attempting to output corrected firmware file 'out.bin'
þ Opening 'out.bin' file for writing
þ Writing to file
þ Validating size correct 1048576=1048576
þ All OK, closing file

*** DONE! 5/5 error(s) in image.bin corrected in out.bin! ***

Logged

It is indeed a difference of perception that brings about our and others reality.
armaan
Jr. Member
**

Karma: +0/-11
Offline Offline

Posts: 46



« Reply #143 on: February 01, 2020, 10:20:44 AM »

The document I used is this one: ME7.x_LC_NLS_rev003.pdf
Doesnt seem to want to upload, but I got it off this forum.

Hi all, hope you all are well.

Followed the instructions for 2Step LC in the attached document (Except for NLS, only for 2Step).
Didn't move code (Obviously the Hex addresses Setzi originally used are different from the ones I used, but I think I applied the principle correctly, especially the part for DA (calls) & used Setzi's standard example which is:

"A6 01 50 46 0A 00 F0 55 E6 FF FF FF FF FF FF FF" atleast, according to the Document.
Definitely DID NOT use Eduu's 2StepScript. Checksummed one file with MTX's ME7-2002 plugin for TunerPro RT V5 & the other with ME7Sum.

So far, ME7Sum has been working for all my Map files, but I'm not so certain it would work on this one since I had to toy around with Hex addresses which brings me to my question:

Have I implemented 2Step correctly and which checksummed file should I test flash onto my Polo GTI 9n3?

Here's the full log of ME7Sum:

Code:
Attempting to open firmware file 'image.bin'

 Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for ECUID table...OK
 EPK         : '39/1/ME7.5/3/X505R//24C/SP24C91/270705/'
 Part Number : '06A906032TL '
 Engine ID   : '1.8l R4/5VT     '
 SW Version  : '0040'
 HW Number   : '0261208950'
 SW Number   : '1037378104'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @08038 Add=0x000106FF CalcAdd=0x000106FF  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01bf98 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @95b78-95bf8
           Modulus: @16a22-16aa2
          Exponent: @16aa2 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @169fe [32 bytes]:
 1) 0x00010002-0x00013FFE
 2) 0x00014252-0x00017F4E
 3) 0x00018192-0x0001FBDC
 4) 0x00026A00-0x0002FFFC
 EncrMD5: cf d7 85 02 3c 13 57 97 f2 e0 b4 72 5f 4a a4 87
 CalcMD5: d7 5e a0 ec 5b 52 27 06 0d 88 2f be b0 2d 53 6b
 ** FIXED **

Step #4: Finding CRC table(s) ..
 Searching for CRC table(s)...OK
 CRC table(s) OK

Step #5: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 Main Checksums:
 1) 0x010002-0x013FFE CalcCSM: 001398C5
 2) 0x014252-0x017F4E CalcCSM: 0026055E
 3) 0x018192-0x01FBDC CalcCSM: 00441514
 4) 0x026A00-0x02FFFC CalcCSM: 00BFEF41
 @8ffb6 CSM: 00BFE857 CalcCSM: 00BFEF41 ** FIXED **

Step #6: ROMSYS Program Pages
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0xA19B73 CalcAdd=0xA19B73  ADD OK

Step #7: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @1fb72 [16 bytes]:
 1) 0x000000-0x00FBFF CalcChk: 48D09FE4
    0x00FC00-0x01FFFF CalcChk: 20D987EB CalcCRC: CB1C2009 SKIPPED
 2) 0x020000-0x0FFFFF CalcChk: 2B10DB2A
 @fffe0 Chk: 2B08E592 CalcChk: 2B10DB2A ** FIXED **

Step #8: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK
 ..........
64) <1ffce>  0x0F4000-0x0F7FFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
65) <1ffde>  0x0F8000-0x0FBFFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
66) <1ffee>  0x0FC000-0x0FFFFF Chk: 1FFDE002 CalcChk: 1FFDE002 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

Step #9: Looking for rechecks ..
    <1fc6e>  0x01C000-0x01FFFF Chk: 062978B8 CalcChk: 062978B8 OK (recheck)

*** Found 70 checksums in image.bin

Attempting to output corrected firmware file 'out.bin'
þ Opening 'out.bin' file for writing
þ Writing to file
þ Validating size correct 1048576=1048576
þ All OK, closing file

*** DONE! 5/5 error(s) in image.bin corrected in out.bin! ***


Logged

It is indeed a difference of perception that brings about our and others reality.
armaan
Jr. Member
**

Karma: +0/-11
Offline Offline

Posts: 46



« Reply #144 on: February 02, 2020, 03:12:49 PM »

Bumpety Bump
Logged

It is indeed a difference of perception that brings about our and others reality.
rysiektr
Newbie
*

Karma: +2/-3
Offline Offline

Posts: 24


« Reply #145 on: February 05, 2020, 12:53:37 AM »

In my opinion, it's not working.
According to the instructions of LC and NLS yo need to add your conditions value like SpeedThreshold, LaunchRPM etc in around the of HEX address 17E00, not on free space in the end of file.
In your file I will use free space in location 17E40.
Logged
armaan
Jr. Member
**

Karma: +0/-11
Offline Offline

Posts: 46



« Reply #146 on: February 07, 2020, 09:47:28 AM »

In my opinion, it's not working.
According to the instructions of LC and NLS yo need to add your conditions value like SpeedThreshold, LaunchRPM etc in around the of HEX address 17E00, not on free space in the end of file.
In your file I will use free space in location 17E40.

Thanks bud, lemme have a look at it again, and will post it up on the forum again.
Logged

It is indeed a difference of perception that brings about our and others reality.
trt2020
Newbie
*

Karma: +0/-10
Offline Offline

Posts: 17


« Reply #147 on: April 02, 2020, 02:44:01 PM »

hello all !
first i introduce me like "i am noob" and i want to learn ..
i have problems with a seat leon .
i read the file from ecu .. is not a stock file from what i know.. and tried to implement via lc/nls via script .. all good
writed the file to the ecu .. car runs good .. no problems..
after that .. i writed same file to another ecu with same hw .. and the car doesnt start .. and gives me p1640 eeprom error
both car had immo off

when i load the file with winols it gave me an unseen error by me from this time ..
first pic is with error
after clicking ok .. it looks normal for me..
can anyone help me with this problem ?

the file is attached below.. thanks in advance !
Logged
sonique
Full Member
***

Karma: +12/-11
Offline Offline

Posts: 220


« Reply #148 on: April 02, 2020, 03:46:56 PM »

buy original winols and checksum plugin
« Last Edit: April 02, 2020, 04:08:59 PM by sonique » Logged
sonique
Full Member
***

Karma: +12/-11
Offline Offline

Posts: 220


« Reply #149 on: April 02, 2020, 03:50:59 PM »

checksum bad
« Last Edit: April 02, 2020, 04:08:45 PM by sonique » Logged
Pages: 1 ... 8 9 [10] 11
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.027 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)