Zac
Jr. Member
Karma: +14/-0
 Offline
Posts: 47
|
 |
« on: December 16, 2011, 02:42:17 PM »
|
|
|
I want to read the internal ROM from the C167. 0x0 to 0x7FFF? I got Minimon working and read the attached bin. Does this match what others have pulled?
Also attached are screenshots of how I setup Minimon. Using ebay blue kkl cable. ECU is on the bench in boot mode.
Edit: The C167 IROM file I attached in this post read out wrong. Leave the configuration settings alone, it'll figure them out. Meaning the 2nd screenshot is wrong!
|
|
|
|
« Last Edit: December 19, 2011, 06:59:25 PM by Zac »
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #1 on: December 16, 2011, 02:50:56 PM »
|
|
|
Here is what I read out of the primary C167.
|
|
|
|
|
Logged
|
|
|
|
Zac
Jr. Member
Karma: +14/-0
Offline
Posts: 47
|
|
« Reply #2 on: December 16, 2011, 03:24:30 PM »
|
|
|
Thanks Tony! Odd, your internal rom bin matches up very closely with the first 32k of the HS flash. But it doesn't seem to match the first 32k of the 002 M-Box flash?  I'm not good enough yet to figure this out by myself. Disasm makes sense when looking at your internal c167 rom, there are lots of handlers jumping to the 0x820000 area. (Assuming flash starts @ 0x800000) The data I read out doesn't make as much sense...lots of jumps to the 0xFA0000 area?? |
|
|
|
« Last Edit: December 16, 2011, 03:28:15 PM by Zac »
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #3 on: December 16, 2011, 03:35:34 PM »
|
|
|
The internal ROM and Flash are completely separate and don't match at all. Andy Whittaker has incorrect info posted on his site if that is what you are referencing.
|
|
|
|
|
Logged
|
|
|
|
Zac
Jr. Member
Karma: +14/-0
Offline
Posts: 47
|
|
« Reply #4 on: December 16, 2011, 04:34:48 PM »
|
|
|
Any idea if it's different between ME 7.1 & 7.5? I'm working with the 06A906032HS ECU which is ME7.5 (VW 02 1.8T AWP NA)
Screenshot - Your internal c167 rom matches up really well with the start of the 06A906032HS flash oddly enough?
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #5 on: December 16, 2011, 04:42:18 PM »
|
|
|
I know there are two different versions of the ME7.1 internal ROM. Setzi62 knows more about how many versions there are than I do.
The start of flash memory is similar to the internal ROM, but it isn't guaranteed to be the same, and they aren't memory mapped to the same memory or anything.
|
|
|
|
|
Logged
|
|
|
|
Zac
Jr. Member
Karma: +14/-0
Offline
Posts: 47
|
|
« Reply #6 on: December 16, 2011, 05:04:31 PM »
|
|
|
Thanks, I've still got a lot to learn. I'll keep messing around with Minimon. I'm getting a bad read or have my settings wrong. Every other byte is matching up to the first 32k of the flash. Then every next byte is a dupe of the previous one.
|
|
|
|
|
Logged
|
|
|
|
|
gremlin
|
|
« Reply #7 on: December 16, 2011, 06:29:54 PM »
|
|
|
I know there are two different versions of the ME7.1 internal ROM. Setzi62 knows more about how many versions there are than I do. ME7.1/7.5 ECUs have 3 versions of IROMs content with 16-bit add CSMs: $5CF6 (ECUs with 512k flash) $6DE5 and $DCA0 (ECUs with 1M flash) |
|
|
|
|
Logged
|
|
|
|
Zac
Jr. Member
Karma: +14/-0
Offline
Posts: 47
|
|
« Reply #8 on: December 16, 2011, 07:10:22 PM »
|
|
|
Will the internal rom data I pull from this HS match the flash's first 32k?
|
|
|
|
« Last Edit: December 16, 2011, 07:13:27 PM by Zac »
|
Logged
|
|
|
|
|
gremlin
|
|
« Reply #9 on: December 16, 2011, 07:34:40 PM »
|
|
|
Will the internal rom data I pull from this HS match the flash's first 32k?
No. It will be different. |
|
|
|
|
Logged
|
|
|
|
setzi62
Full Member
Karma: +142/-0
Offline
Posts: 249
|
|
« Reply #10 on: December 17, 2011, 08:03:42 AM »
|
|
|
The internal rom you pulled from the HS ecu is not correctly read.
In the file only the odd bytes are contained (doubled), e.g.:
00000000: fafa7070 fafa0404 fafa1818 fafa0c0c ..pp............
Check your settings/program.
There are two main families of bootroms, 05.XX and 06.XX used in ME7.1/ME7.5.
Normally the first 32kB of the flash for a ME7.5 are matching the bootrom, but it is
not necessary.
|
|
|
|
|
Logged
|
|
|
|
Zac
Jr. Member
Karma: +14/-0
Offline
Posts: 47
|
|
« Reply #11 on: December 17, 2011, 12:13:53 PM »
|
|
|
Thanks! Back to the bench...
Eventually I want to find the code behind the alternate rpm limiter NMAXOG that was posted here for the stock launch control feature. Specifically the part where it compares TNMXH (gets set to 6800 seconds) to the elapsed time and patch the code to make the comparison always < or nop out the jump that turns off the alt rpm limit so the feature stays on all the time instead of returning the RPM limit to NMAX which is now the launch RPM [+DNMAXH]
Figured it'd be a good starting idea since I'm pretty new to the process and completely new to this processor.
|
|
|
|
|
Logged
|
|
|
|
|
gremlin
|
|
« Reply #12 on: December 17, 2011, 04:10:24 PM »
|
|
|
Check your settings/program.
It's happen because register config in C167 for external ROM bus in minimon was set wrong. |
|
|
|
|
Logged
|
|
|
|
Zac
Jr. Member
Karma: +14/-0
Offline
Posts: 47
|
|
« Reply #13 on: December 18, 2011, 09:55:58 PM »
|
|
|
Got it to read correctly by leaving the Configure dialog alone instead of trying to define registers and memory myself. It's happen because register config in C167 for external ROM bus in minimon was set wrong.
BUSCON address(es)? |
|
|
|
|
Logged
|
|
|
|
janne
Full Member
Karma: +2/-0
Offline
Posts: 50
|
|
« Reply #14 on: December 19, 2011, 10:06:39 AM »
|
|
|
What tool you use to read prosessor data?
|
|
|
|
|
Logged
|
|
|
|
|
