Pages: [1] 2 3 ... 6
Author Topic: Reversing an ME7.1.1 St10F27X Audi TT 3.2  (Read 49653 times)
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« on: September 03, 2017, 01:15:07 PM »

So it is time to give a little bit back to the community.

Since i own an Audi TT 3.2 i decided some months ago to completely define the mpc and flash and not only just some parts.
As you all know there is no FR for this ecu/sw out public so i used parts of the me7.X and parts of the med9.1 FR to slowly define my project.

Attached you will find a complete map pack(genuine ols only) the mpc and flash of this ecu which fits the map pack directly and my progress till now but not the actual ida poject(for various "development" reasons).

I will right down however what you will need to import this to ida and make your own project. The file enums.txt and names.txt has my progress until today and you can use it to define lots of variables.In case anyone finds a mistake post it here so i can replace or correct it as cross referencing to both FRs could cause conflicts and misinterpretation.

The following ida import data are correct but i am sure i am missing something vital as some memory address calls are not displayed as they should.

IDA info :

import mpc file
Proc type : SGS-Thomson ST10 [st10]
Ram : 0x380000 with size 0x20000
do not split into 64kb segments
Select ST10F276
load additional binary file
-----------------------------
Enter Load segment : 0x80000
 Loading offset : 0x80000
 File offset in bytes : 0x0
 Number of bytes : 0x0
-----------------------------
Click Edit -> Segments -> Create segment
 Enter Segment name: RAM2
 Start Address: 0xF0000
 End Address: 0x10FFFF
 Base: 0x0
 Choose 16-bit segment
Click Edit -> Segments -> Set default segment register value

Dpps:

dpp0 0x23F
dpp1 and enter 0x3C
dpp2 and enter 0xE0



Future posts will include more enumerated bytes and more address names for this particular ecu.
« Last Edit: September 13, 2017, 10:58:53 AM by gt-innovation » Logged
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #1 on: September 03, 2017, 01:21:13 PM »

Here is also an official Memory layout for the st10f275 me7.1.1
Logged
turbojohan
Full Member
***

Karma: +5/-0
Offline Offline

Posts: 185


« Reply #2 on: September 03, 2017, 03:06:09 PM »

Nice work! Respect for the amount of you put into this!


Verzonden vanaf mijn iPhone met Tapatalk
Logged
aef
Hero Member
*****

Karma: +69/-46
Offline Offline

Posts: 1566


« Reply #3 on: September 04, 2017, 02:34:32 AM »

Nice work!

Have you already started your turbobuild with this car?
Logged
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #4 on: September 04, 2017, 02:43:09 AM »

Nice work!

Have you already started your turbobuild with this car?

Parts are coming in as we speak Smiley
Logged
RBPE
Sr. Member
****

Karma: +40/-5
Offline Offline

Posts: 394



« Reply #5 on: September 04, 2017, 06:26:57 PM »

Some pdf's for people that start looking into these, the def file should work in any ols I think, if I remember right I used an old CD def file and the CE file from the VW bit here with this one;

http://nefariousmotorsports.com/forum/index.php?topic=5336.0

I can't remember when I did it but generally anything in German is usually done quickly so probably duplicates/possibly wrong offsets etc - check it all as you go through it.

https://app.box.com/s/lisaln0zijixfcc2id4lnxnkb179t7uh
« Last Edit: February 01, 2018, 01:41:29 PM by RBPE » Logged
eliotroyano
Hero Member
*****

Karma: +47/-7
Offline Offline

Posts: 796


« Reply #6 on: September 04, 2017, 06:59:19 PM »

Great work as usual!!!!   Grin  Grin  Grin
Logged
RBPE
Sr. Member
****

Karma: +40/-5
Offline Offline

Posts: 394



« Reply #7 on: September 05, 2017, 10:29:08 AM »

Edited to not detract from op
« Last Edit: September 07, 2017, 12:53:23 AM by RBPE » Logged
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #8 on: September 06, 2017, 01:47:55 AM »

Some more info.

I did this quick overview of the Motronic systems and you can see info on the charged air/synchronous path tech Bosch go on about that I did in the noobs section but direct download here, should help for FI;

https://app.box.com/s/82pr4yohs0wjuylxprtqv6flkrtj2nal

I should be uploading English (quick Google translate mind you) def's for these I did for defining, however I'm having a dll problem on a new drive for Open/Libre Office docs I did and excel is pants and doesn't seem to be showing the info! So download Open/Libre Office folks, it's free and you "should" have A-Z quick English def names - let me know if not.

I'm sure these worked fine in Libre Office though if struggling;

https://app.box.com/s/epgrsj53bonhhmtl0w2y1vkc6t8bnmxb

I've managed to get into my old commercial account and get some basics, not had time to check the info but you can look into it, anything I ever upload that has "quick ref" or "quick notes etc" is generally an overview to look into;

https://app.box.com/s/9bj3mu57o0wxq4o7j2ahvtfniij2ha69

Some SSP CAN pdf's if you haven't got them too;
https://app.box.com/s/px4mea6tdt4u59wxjytq99sirvq8k65q

Let me know if there's any problems with the links as I got negative karma last time as I accidentally put up some of my commercial stuff and had to change the access so am trying to dig out my old notes - do what you want with the info I've never done a colaboration thing, it's all for educational purposes after all but please bare in mind most of this I uploaded 3-5 years ago, could be mislabled etc, not had time to go into it yet, should help with what your aiming for as in a none coding way before you start though! Helps a bit as there's no FR!  Undecided

You can start your own thread about this as this info is general and not specific to this ecu.If you pile up random data from random ecus you can only confuse and disorient the thread.
Logged
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #9 on: September 06, 2017, 08:42:34 AM »

Here is some more. Some fixed and some new in total of over 2000+ addresses defined.
Logged
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #10 on: September 12, 2017, 02:47:08 AM »

Attached again fixes and new stuff...

Since i am doing that for all the known reasons ... Customs code - turbo etc... i wrote and tested the als nls for this to a friends turbo car and here are the results..

* code is on mpc
* Variables on Flash so you can alter through obd.
* Cksum is disabled on the mpc

Logged
Nick_T
Jr. Member
**

Karma: +3/-1
Offline Offline

Posts: 42


« Reply #11 on: September 12, 2017, 08:37:28 AM »

So now there will be a total of 5 people that can tune this ecu for FI now? Cheesy Well done man, thats massive! Do you have a build thread anywhere?
Logged
prj
Hero Member
*****

Karma: +903/-420
Online Online

Posts: 5789


« Reply #12 on: September 12, 2017, 11:28:32 AM »

I like that you are working on it yourself also Smiley

I have so many requests for this stuff, and then I have development stuff like twin turbo R8 with DL800 box...
You can guess which gets priority Sad

I try to monitor this thread a little, if you get in some dead end, I can try to chime in.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #13 on: September 12, 2017, 11:39:34 AM »

I like that you are working on it yourself also Smiley

I have so many requests for this stuff, and then I have development stuff like twin turbo R8 with DL800 box...
You can guess which gets priority Sad

I try to monitor this thread a little, if you get in some dead end, I can try to chime in.

Thank you PRJ, your knowledge is what gives me motivation for such things and i understand your work load as we all have some. I will keep posting too on my further disassembly..I still have lots of things to double check and add.
Logged
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #14 on: September 12, 2017, 11:43:00 AM »

So now there will be a total of 5 people that can tune this ecu for FI now? Cheesy Well done man, thats massive! Do you have a build thread anywhere?

Thank You Nick .

No i don`t have a personal build thread but i will make one in the future.The car is from a member in this forum so he can jump in the conversation if he likes.
Logged
Pages: [1] 2 3 ... 6
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 2.851 seconds with 17 queries. (Pretty URLs adds 0s, 0q)