|
adam-
|
 |
« Reply #15 on: August 15, 2017, 09:06:02 AM »
|
|
|
|
|
|
|
|
Logged
|
|
|
|
TrevelXP
Newbie
Karma: +0/-0
 Offline
Posts: 8
|
|
« Reply #16 on: August 18, 2017, 04:24:55 PM »
|
|
|
I did this video, Bodie released patch for public, for both VWK501MH with ROM ID: 00A4, 10A4, 92A3 and VWK503MH ROM ID: 00AE, on Graeme's web site. |
|
|
|
|
Logged
|
|
|
|
|
adam-
|
|
« Reply #17 on: August 19, 2017, 07:28:32 AM »
|
|
|
I've got it now.  I want to know HOW Bodie did it though - that interests me more. Every time I ask I get shot down though. |
|
|
|
|
Logged
|
|
|
|
|
H2Deetoo
|
|
« Reply #18 on: August 19, 2017, 08:16:56 AM »
|
|
|
Must be an assembler block stored in eeprom. Just try to disasm this block using IDA and it should be self explanatory |
|
|
|
|
Logged
|
|
|
|
nihalot
Full Member
Karma: +41/-3
Offline
Posts: 117
|
|
« Reply #19 on: August 20, 2017, 12:45:50 AM »
|
|
|
it's a 65C816 core in the micronas chip
What address is the eep mapped at though? I don't have access to a cluster to trace the micronas/eep pins
I guess Bodie read the micronas chip(physically or KWP2000) too
|
|
|
|
|
Logged
|
www.tangentmotorsport.commultimap/LC/rolling antilag for MG1/MED17/EDC17/MED9/EDC15 contact for reverse engineering services of any ECU/TCU
|
|
|
|
adam-
|
|
« Reply #20 on: August 20, 2017, 01:59:18 AM »
|
|
|
Yeah, there's an IDA module for it, but I'll need to install VS to compile it.
That's both a flash read and an EEPROM read. Not sure how that helps though.
|
|
|
|
|
Logged
|
|
|
|
nihalot
Full Member
Karma: +41/-3
Offline
Posts: 117
|
|
« Reply #21 on: August 20, 2017, 02:19:06 AM »
|
|
|
How did you read the flash? I think its incomplete as the datasheet speciefies 256KB ROM The 100PQFP Multi Chip Module also contains a 256 KB
Flash EEPROM of the AMD Am29F200AB type (bottom boot
configuration) or Am29F200AT type (top boot configuration).
These devices exhibit electrical byte program and sector
erase functions. Erase sectors are of various sizes (Fig. 5–
1). Refer to the AMD data sheet for details. |
|
|
|
|
Logged
|
www.tangentmotorsport.commultimap/LC/rolling antilag for MG1/MED17/EDC17/MED9/EDC15 contact for reverse engineering services of any ECU/TCU
|
|
|
|
adam-
|
|
« Reply #22 on: August 20, 2017, 03:56:42 AM »
|
|
|
I read that, but it only read 8k.
I'm sure the datasheet goes on to mention only 8kb? Read it with k-commander.
|
|
|
|
|
Logged
|
|
|
|
|
|
|
adam-
|
|
« Reply #24 on: August 21, 2017, 11:49:26 PM »
|
|
|
This has been posted 3 times now haha.
|
|
|
|
|
Logged
|
|
|
|
Black_A4
Full Member
Karma: +1/-1
Offline
Posts: 51
|
|
« Reply #25 on: August 22, 2017, 12:16:56 AM »
|
|
|
oh sorry for that
|
|
|
|
|
Logged
|
|
|
|
precision
Jr. Member
Karma: +0/-3
Offline
Posts: 32
|
|
« Reply #26 on: October 03, 2017, 05:27:38 AM »
|
|
|
Would this be able to be done on the 8L A3 1.8t cluster
Sent from my SM-N900 using Tapatalk
|
|
|
|
|
Logged
|
|
|
|
|
macxxx
|
|
« Reply #27 on: October 03, 2017, 12:27:30 PM »
|
|
|
No , diffrent dump
|
|
|
|
|
Logged
|
|
|
|
precision
Jr. Member
Karma: +0/-3
Offline
Posts: 32
|
|
« Reply #28 on: October 04, 2017, 12:56:41 PM »
|
|
|
No , diffrent dump
You think it would be possible to activate needle sweep on the 8L with maybe vcds long coding or something? Sent from my SM-N900 using Tapatalk |
|
|
|
|
Logged
|
|
|
|
|
macxxx
|
|
« Reply #29 on: October 04, 2017, 01:08:37 PM »
|
|
|
Not possible , only extrenal module like vfiz
|
|
|
|
|
Logged
|
|
|
|
|
