ebugauge
Newbie
Karma: +0/-4
 Offline
Posts: 11
|
 |
« Reply #135 on: January 20, 2020, 10:47:00 AM »
|
|
|
Thank you RBPE!  Can someone confirm? ESKONF at 0x10C24 |
|
|
|
« Last Edit: January 20, 2020, 10:48:49 AM by ebugauge »
|
Logged
|
|
|
|
|
RBPE
|
|
« Reply #136 on: January 24, 2020, 08:00:48 AM »
|
|
|
Thank you RBPE! Can someone confirm? ESKONF at 0x10C24 Same sw rev by the look of it;  aue by Rick B, on Flickr |
|
|
|
|
Logged
|
|
|
|
|
RBPE
|
|
« Reply #137 on: January 24, 2020, 09:03:05 AM »
|
|
|
P.S. To save ME7.1.1 owners from having to mess around too much with trying to understand ESKONF, find "Marty" on here, look at his profile and go through the pages of posts he put up, somewhere in there you'll see he put up a break down of ESKONF on these!
|
|
|
|
« Last Edit: January 24, 2020, 09:22:02 AM by RBPE »
|
Logged
|
|
|
|
|
_nameless
|
|
« Reply #138 on: January 25, 2020, 05:54:39 AM »
|
|
|
P.S. To save ME7.1.1 owners from having to mess around too much with trying to understand ESKONF, find "Marty" on here, look at his profile and go through the pages of posts he put up, somewhere in there you'll see he put up a break down of ESKONF on these!
whos marty? |
|
|
|
|
Logged
|
Giving your mom a tuneup
|
|
|
rysiektr
Jr. Member
Karma: +3/-3
Offline
Posts: 47
|
|
« Reply #139 on: January 26, 2020, 03:14:20 PM »
|
|
|
FTOMN is 0x19E33
ITNMXH is 0x162C2
|
|
|
|
|
Logged
|
|
|
|
|
RBPE
|
|
« Reply #140 on: January 27, 2020, 04:27:05 PM »
|
|
|
whos marty?
Not sure, some say he's a teen who befriended a mad scientist and travels back and forth through time so that he can give his family the best life possible whilst slacking off school like his old man, some say he even runs an ME7.1.1. car powered by something called a "flux capacitor"! All we know is......he's called the Marty!  |
|
|
|
« Last Edit: February 04, 2020, 03:10:51 PM by RBPE »
|
Logged
|
|
|
|
armaan
Full Member
Karma: +6/-15
Offline
Posts: 97
|
|
« Reply #141 on: February 01, 2020, 10:18:14 AM »
|
|
|
Hi all, hope you all are well. Followed the instructions for 2Step LC in the attached document (Except for NLS, only for 2Step). Didn't move code (Obviously the Hex addresses Setzi originally used are different from the ones I used, but I think I applied the principle correctly, especially the part for DA (calls) & used Setzi's standard example which is: "A6 01 50 46 0A 00 F0 55 E6 FF FF FF FF FF FF FF" atleast, according to the Document. Definitely DID NOT use Eduu's 2StepScript. Checksummed one file with MTX's ME7-2002 plugin for TunerPro RT V5 & the other with ME7Sum. So far, ME7Sum has been working for all my Map files, but I'm not so certain it would work on this one since I had to toy around with Hex addresses which brings me to my question: Have I implemented 2Step correctly and which checksummed file should I test flash onto my Polo GTI 9n3? Here's the full log of ME7Sum: Attempting to open firmware file 'image.bin'
Step #1: Reading ROM info ..
Searching for EPK signature...OK
Searching for ECUID table...OK
EPK : '39/1/ME7.5/3/X505R//24C/SP24C91/270705/'
Part Number : '06A906032TL '
Engine ID : '1.8l R4/5VT '
SW Version : '0040'
HW Number : '0261208950'
SW Number : '1037378104'
Step #2: Reading ROMSYS ..
Startup section: word[0x008000]+word[0x00FFFE]
@08038 Add=0x000106FF CalcAdd=0x000106FF ADD OK
All param page: word[0x010000]+word[0x01FFFE]
@01bf98 Add=0x00971D CalcAdd=0x00971D ADD OK
Step #3: Reading RSA signatures ..
Searching for RSA offset #0...OK
Searching for RSA offset #1...OK
Signature: @95b78-95bf8
Modulus: @16a22-16aa2
Exponent: @16aa2 = 3
Searching for MD5 ranges...OK
MD5 Block Offset Table @169fe [32 bytes]:
1) 0x00010002-0x00013FFE
2) 0x00014252-0x00017F4E
3) 0x00018192-0x0001FBDC
4) 0x00026A00-0x0002FFFC
EncrMD5: cf d7 85 02 3c 13 57 97 f2 e0 b4 72 5f 4a a4 87
CalcMD5: d7 5e a0 ec 5b 52 27 06 0d 88 2f be b0 2d 53 6b
** FIXED **
Step #4: Finding CRC table(s) ..
Searching for CRC table(s)...OK
CRC table(s) OK
Step #5: Reading Main Data Checksums ..
Searching for main data CRC pre block...missing
Searching for main data CRC/csum blocks...OK
Searching for main data CRC offsets...missing
Searching for main data checksum offsets...OK
Main Checksums:
1) 0x010002-0x013FFE CalcCSM: 001398C5
2) 0x014252-0x017F4E CalcCSM: 0026055E
3) 0x018192-0x01FBDC CalcCSM: 00441514
4) 0x026A00-0x02FFFC CalcCSM: 00BFEF41
@8ffb6 CSM: 00BFE857 CalcCSM: 00BFEF41 ** FIXED **
Step #6: ROMSYS Program Pages
Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
@00803c Add=0xA19B73 CalcAdd=0xA19B73 ADD OK
Step #7: Reading Main Program Checksums ..
Searching for main program checksum..OK
ROM Checksum Block Offset Table @1fb72 [16 bytes]:
1) 0x000000-0x00FBFF CalcChk: 48D09FE4
0x00FC00-0x01FFFF CalcChk: 20D987EB CalcCRC: CB1C2009 SKIPPED
2) 0x020000-0x0FFFFF CalcChk: 2B10DB2A
@fffe0 Chk: 2B08E592 CalcChk: 2B10DB2A ** FIXED **
Step #8: Reading Multipoint Checksum Blocks ..
Searching for multipoint block descriptor #1...missing
Searching for multipoint block descriptor #2...OK
1) <1fbde> 0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK
2) <1fbee> 0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK
3) <1fbfe> 0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK
..........
64) <1ffce> 0x0F4000-0x0F7FFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
65) <1ffde> 0x0F8000-0x0FBFFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
66) <1ffee> 0x0FC000-0x0FFFFF Chk: 1FFDE002 CalcChk: 1FFDE002 OK
Multipoint #2: [66 blocks x <16> = 1056 bytes]
Step #9: Looking for rechecks ..
<1fc6e> 0x01C000-0x01FFFF Chk: 062978B8 CalcChk: 062978B8 OK (recheck)
*** Found 70 checksums in image.bin
Attempting to output corrected firmware file 'out.bin'
þ Opening 'out.bin' file for writing
þ Writing to file
þ Validating size correct 1048576=1048576
þ All OK, closing file
*** DONE! 5/5 error(s) in image.bin corrected in out.bin! *** |
|
|
|
|
Logged
|
It is indeed a difference of perception that brings about our and others reality.
|
|
|
armaan
Full Member
Karma: +6/-15
Offline
Posts: 97
|
|
« Reply #142 on: February 01, 2020, 10:20:44 AM »
|
|
|
The document I used is this one: ME7.x_LC_NLS_rev003.pdf Doesnt seem to want to upload, but I got it off this forum. Hi all, hope you all are well. Followed the instructions for 2Step LC in the attached document (Except for NLS, only for 2Step). Didn't move code (Obviously the Hex addresses Setzi originally used are different from the ones I used, but I think I applied the principle correctly, especially the part for DA (calls) & used Setzi's standard example which is: "A6 01 50 46 0A 00 F0 55 E6 FF FF FF FF FF FF FF" atleast, according to the Document. Definitely DID NOT use Eduu's 2StepScript. Checksummed one file with MTX's ME7-2002 plugin for TunerPro RT V5 & the other with ME7Sum. So far, ME7Sum has been working for all my Map files, but I'm not so certain it would work on this one since I had to toy around with Hex addresses which brings me to my question: Have I implemented 2Step correctly and which checksummed file should I test flash onto my Polo GTI 9n3? Here's the full log of ME7Sum: Attempting to open firmware file 'image.bin'
Step #1: Reading ROM info ..
Searching for EPK signature...OK
Searching for ECUID table...OK
EPK : '39/1/ME7.5/3/X505R//24C/SP24C91/270705/'
Part Number : '06A906032TL '
Engine ID : '1.8l R4/5VT '
SW Version : '0040'
HW Number : '0261208950'
SW Number : '1037378104'
Step #2: Reading ROMSYS ..
Startup section: word[0x008000]+word[0x00FFFE]
@08038 Add=0x000106FF CalcAdd=0x000106FF ADD OK
All param page: word[0x010000]+word[0x01FFFE]
@01bf98 Add=0x00971D CalcAdd=0x00971D ADD OK
Step #3: Reading RSA signatures ..
Searching for RSA offset #0...OK
Searching for RSA offset #1...OK
Signature: @95b78-95bf8
Modulus: @16a22-16aa2
Exponent: @16aa2 = 3
Searching for MD5 ranges...OK
MD5 Block Offset Table @169fe [32 bytes]:
1) 0x00010002-0x00013FFE
2) 0x00014252-0x00017F4E
3) 0x00018192-0x0001FBDC
4) 0x00026A00-0x0002FFFC
EncrMD5: cf d7 85 02 3c 13 57 97 f2 e0 b4 72 5f 4a a4 87
CalcMD5: d7 5e a0 ec 5b 52 27 06 0d 88 2f be b0 2d 53 6b
** FIXED **
Step #4: Finding CRC table(s) ..
Searching for CRC table(s)...OK
CRC table(s) OK
Step #5: Reading Main Data Checksums ..
Searching for main data CRC pre block...missing
Searching for main data CRC/csum blocks...OK
Searching for main data CRC offsets...missing
Searching for main data checksum offsets...OK
Main Checksums:
1) 0x010002-0x013FFE CalcCSM: 001398C5
2) 0x014252-0x017F4E CalcCSM: 0026055E
3) 0x018192-0x01FBDC CalcCSM: 00441514
4) 0x026A00-0x02FFFC CalcCSM: 00BFEF41
@8ffb6 CSM: 00BFE857 CalcCSM: 00BFEF41 ** FIXED **
Step #6: ROMSYS Program Pages
Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
@00803c Add=0xA19B73 CalcAdd=0xA19B73 ADD OK
Step #7: Reading Main Program Checksums ..
Searching for main program checksum..OK
ROM Checksum Block Offset Table @1fb72 [16 bytes]:
1) 0x000000-0x00FBFF CalcChk: 48D09FE4
0x00FC00-0x01FFFF CalcChk: 20D987EB CalcCRC: CB1C2009 SKIPPED
2) 0x020000-0x0FFFFF CalcChk: 2B10DB2A
@fffe0 Chk: 2B08E592 CalcChk: 2B10DB2A ** FIXED **
Step #8: Reading Multipoint Checksum Blocks ..
Searching for multipoint block descriptor #1...missing
Searching for multipoint block descriptor #2...OK
1) <1fbde> 0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK
2) <1fbee> 0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK
3) <1fbfe> 0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK
..........
64) <1ffce> 0x0F4000-0x0F7FFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
65) <1ffde> 0x0F8000-0x0FBFFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
66) <1ffee> 0x0FC000-0x0FFFFF Chk: 1FFDE002 CalcChk: 1FFDE002 OK
Multipoint #2: [66 blocks x <16> = 1056 bytes]
Step #9: Looking for rechecks ..
<1fc6e> 0x01C000-0x01FFFF Chk: 062978B8 CalcChk: 062978B8 OK (recheck)
*** Found 70 checksums in image.bin
Attempting to output corrected firmware file 'out.bin'
þ Opening 'out.bin' file for writing
þ Writing to file
þ Validating size correct 1048576=1048576
þ All OK, closing file
*** DONE! 5/5 error(s) in image.bin corrected in out.bin! *** |
|
|
|
|
Logged
|
It is indeed a difference of perception that brings about our and others reality.
|
|
|
armaan
Full Member
Karma: +6/-15
Offline
Posts: 97
|
|
« Reply #143 on: February 02, 2020, 03:12:49 PM »
|
|
|
Bumpety Bump
|
|
|
|
|
Logged
|
It is indeed a difference of perception that brings about our and others reality.
|
|
|
rysiektr
Jr. Member
Karma: +3/-3
Offline
Posts: 47
|
|
« Reply #144 on: February 05, 2020, 12:53:37 AM »
|
|
|
In my opinion, it's not working.
According to the instructions of LC and NLS yo need to add your conditions value like SpeedThreshold, LaunchRPM etc in around the of HEX address 17E00, not on free space in the end of file.
In your file I will use free space in location 17E40.
|
|
|
|
|
Logged
|
|
|
|
armaan
Full Member
Karma: +6/-15
Offline
Posts: 97
|
|
« Reply #145 on: February 07, 2020, 09:47:28 AM »
|
|
|
In my opinion, it's not working.
According to the instructions of LC and NLS yo need to add your conditions value like SpeedThreshold, LaunchRPM etc in around the of HEX address 17E00, not on free space in the end of file.
In your file I will use free space in location 17E40.
Thanks bud, lemme have a look at it again, and will post it up on the forum again. |
|
|
|
|
Logged
|
It is indeed a difference of perception that brings about our and others reality.
|
|
|
trt2020
Newbie
Karma: +0/-10
Offline
Posts: 18
|
 |
« Reply #146 on: April 02, 2020, 02:44:01 PM »
|
|
|
hello all !
first i introduce me like "i am noob" and i want to learn ..
i have problems with a seat leon .
i read the file from ecu .. is not a stock file from what i know.. and tried to implement via lc/nls via script .. all good
writed the file to the ecu .. car runs good .. no problems..
after that .. i writed same file to another ecu with same hw .. and the car doesnt start .. and gives me p1640 eeprom error
both car had immo off
when i load the file with winols it gave me an unseen error by me from this time ..
first pic is with error
after clicking ok .. it looks normal for me..
can anyone help me with this problem ?
the file is attached below.. thanks in advance !
|
|
|
|
|
Logged
|
|
|
|
|
sonique
|
|
« Reply #147 on: April 02, 2020, 03:46:56 PM »
|
|
|
buy original winols and checksum plugin
|
|
|
|
« Last Edit: April 02, 2020, 04:08:59 PM by sonique »
|
Logged
|
|
|
|
|
sonique
|
|
« Reply #148 on: April 02, 2020, 03:50:59 PM »
|
|
|
checksum bad
|
|
|
|
« Last Edit: April 02, 2020, 04:08:45 PM by sonique »
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #149 on: April 02, 2020, 05:06:06 PM »
|
|
|
ditch the LS garbage unless you are willing to do it yourself, by hand.
How many fucking times do i have to say it
|
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
|
