Pages: 1 [2] 3
Author Topic: 3B0 920 949/MK4 Needle Sweep  (Read 19838 times)
adam-
Hero Member
*****

Karma: +122/-33
Offline Offline

Posts: 2177


« Reply #15 on: August 15, 2017, 09:06:02 AM »

https://4donline.ihs.com/images/VipMasterIC/IC/MCNS/MCNSS00288/MCNSS00288-1.pdf?hkey=EF798316E3902B6ED9A73243A3159BB0

If you can help explain this, I'd love to hear it!
Logged
TrevelXP
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 8


« Reply #16 on: August 18, 2017, 04:24:55 PM »

https://www.youtube.com/watch?v=2bPcrHnFDW4

I now have it stage round, but it doesn't return.


I did this video, Bodie released patch for public, for both VWK501MH with ROM ID: 00A4, 10A4, 92A3 and VWK503MH ROM ID: 00AE, on Graeme's web site.
Logged
adam-
Hero Member
*****

Karma: +122/-33
Offline Offline

Posts: 2177


« Reply #17 on: August 19, 2017, 07:28:32 AM »

I've got it now. Smiley

I want to know HOW Bodie did it though - that interests me more.  Every time I ask I get shot down though.
Logged
H2Deetoo
Sr. Member
****

Karma: +26/-1
Offline Offline

Posts: 255


« Reply #18 on: August 19, 2017, 08:16:56 AM »

Must be an assembler block stored in eeprom.
Just try to disasm this block using IDA and it should be self explanatory Smiley
Logged
nihalot
Full Member
***

Karma: +40/-3
Offline Offline

Posts: 116


« Reply #19 on: August 20, 2017, 12:45:50 AM »

it's a 65C816 core in the micronas chip

What address is the eep mapped at though? I don't have access to a cluster to trace the micronas/eep pins

I guess Bodie read the micronas chip(physically or KWP2000) too
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
adam-
Hero Member
*****

Karma: +122/-33
Offline Offline

Posts: 2177


« Reply #20 on: August 20, 2017, 01:59:18 AM »

Yeah, there's an IDA module for it, but I'll need to install VS to compile it.

That's both a flash read and an EEPROM read.  Not sure how that helps though.
Logged
nihalot
Full Member
***

Karma: +40/-3
Offline Offline

Posts: 116


« Reply #21 on: August 20, 2017, 02:19:06 AM »

How did you read the flash? I think its incomplete as the datasheet speciefies 256KB ROM

Quote
The 100PQFP Multi Chip Module also contains a 256 KB
Flash EEPROM of the AMD Am29F200AB type (bottom boot
configuration) or Am29F200AT type (top boot configuration).
These devices exhibit electrical byte program and sector
erase functions. Erase sectors are of various sizes (Fig. 5–
1). Refer to the AMD data sheet for details.
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
adam-
Hero Member
*****

Karma: +122/-33
Offline Offline

Posts: 2177


« Reply #22 on: August 20, 2017, 03:56:42 AM »

I read that, but it only read 8k.

I'm sure the datasheet goes on to mention only 8kb?  Read it with k-commander.
Logged
Black_A4
Full Member
***

Karma: +1/-1
Offline Offline

Posts: 51


« Reply #23 on: August 21, 2017, 11:48:25 PM »

Hey guys, check this out:

http://www.users.on.net/~graeme86/sweep501/sweep501.html

will check today if my cluster has the right rom number and if yes i will try it and report back.
Logged
adam-
Hero Member
*****

Karma: +122/-33
Offline Offline

Posts: 2177


« Reply #24 on: August 21, 2017, 11:49:26 PM »

This has been posted 3 times now haha.
Logged
Black_A4
Full Member
***

Karma: +1/-1
Offline Offline

Posts: 51


« Reply #25 on: August 22, 2017, 12:16:56 AM »

oh sorry for that
Logged
precision
Jr. Member
**

Karma: +0/-3
Offline Offline

Posts: 32



« Reply #26 on: October 03, 2017, 05:27:38 AM »

Would this be able to be done on the 8L A3 1.8t cluster

Sent from my SM-N900 using Tapatalk

Logged
macxxx
Sr. Member
****

Karma: +29/-1
Offline Offline

Posts: 498


« Reply #27 on: October 03, 2017, 12:27:30 PM »

No , diffrent dump
Logged
precision
Jr. Member
**

Karma: +0/-3
Offline Offline

Posts: 32



« Reply #28 on: October 04, 2017, 12:56:41 PM »

No , diffrent dump
You think it would be possible to activate needle sweep on the 8L with maybe vcds long coding or something?


Sent from my SM-N900 using Tapatalk

Logged
macxxx
Sr. Member
****

Karma: +29/-1
Offline Offline

Posts: 498


« Reply #29 on: October 04, 2017, 01:08:37 PM »

Not possible , only extrenal module like vfiz
Logged
Pages: 1 [2] 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.022 seconds with 18 queries. (Pretty URLs adds 0s, 0q)