Pages: [1] 2 3 ... 9
Author Topic: ME 3.8.3  (Read 157648 times)
blundar
Newbie
*

Karma: +11/-1
Offline Offline

Posts: 22


« on: July 01, 2010, 08:20:10 AM »

I have a 98 A4 1.8tqm and I've been toying with the idea of messing with the ECU in it.  I bought 2 or 3 557 and 558 ECUs to have as spares.

From what I gather, these ECUs use an Intel processor and a 28F200 flash chip unlike the ME7.x stuff that I'm finding more information for.  I'm going to take some pictures and try to hot-air the flash chip off one of the ECMs this weekend to read it.  I have a pretty decent set of gear (SMD rework station, scope, logic analyzer, EPROM prorammers, generic FTDI USB cable, 16bit EPROM emulator) and a decent amount of reverse engineering experience (Honda/8051, Honda/66K, Honda/SH4, Ford/8061, Ford/MPPC)  but not a ton of time right now (3wk old baby) so progress will probably be a little slow.

Anyone else working / interested in working on this platform?  I imagine there is going to be a pretty decent amount of code analysis that is going to have to be done with IDA, etc. before it's going to be very usable.  I'd love to try to find some more documentation on tables and workflow on ME3.8.x if anyone knows where to find such things so I have a better roadmap of what to look for.

Thanks!
-Dave
Logged
Tony@NefMoto
Administrator
Hero Member
*****

Karma: +130/-4
Offline Offline

Posts: 1389


2001.5 Audi S4 Stage 3


« Reply #1 on: July 09, 2010, 10:44:13 PM »

If you need any help with getting started, just let me know.

I don't have any plans to look at ME 3.8.3 myself though.
Logged

Remember you have to log in if you want to see the file attachments!
Info or questions, please add to the wiki: http://www.nefariousmotorsports.com/wiki
Follow NefMoto developments on Twitter: http://twitter.com/nefmoto
k0mpresd
Hero Member
*****

Karma: +146/-54
Offline Offline

Posts: 1655


« Reply #2 on: August 05, 2010, 07:26:12 AM »

eh?  Smiley http://mycarbl0ws.com/me38.csv
Logged
blundar
Newbie
*

Karma: +11/-1
Offline Offline

Posts: 22


« Reply #3 on: August 08, 2010, 09:55:35 PM »

Slow progress...

Found this: http://nefariousmotorsports.com/forum/index.php?topic=65.0
Very helpful

One chip I cannot identify...  National Semiconductor SCL4402-V4

Appear to be using Intel 87C196 processor, AM29F200B FLASH chip.

Flash chip WE connected to two chips on reverse.

Have flash chip removed.  Ordered PSOP44 adapter for EPROM programmer.  going to read chip, go from there.
Logged
blundar
Newbie
*

Karma: +11/-1
Offline Offline

Posts: 22


« Reply #4 on: August 12, 2010, 09:03:53 PM »

Did a little more digging.

the AN87C196KR is an Intel MCS96 family MCU for automotive applications
http://www.datasheetcatalog.com/datasheets_pdf/8/7/C/1/87C196KR.shtml

The Flash chip is an AM29F200B.

Can't confirm but I highly suspect the chip marked B58274 is a 28 pin SRAM chip.

The WE pin on the 29F200B appears to be connected to a '573 latch on Q1 along with a pin on the SRAM (Write inhibit?).  D1 of the latch is connected to pin 25 of the MCU (P3.1)  and LE on the '573 is connected to pin 4 on the MCU (ALE).  This seems to indicate (at least preliminarily) that there are provisions for the Flash chip to be programmed in site by the MCU.
« Last Edit: August 28, 2014, 11:38:25 AM by Tony@NefMoto » Logged
blkbullitt
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 6


« Reply #5 on: August 13, 2010, 05:55:49 AM »

Dave,

As I mentioned when you came up a few weeks ago to pick up the 1.8t engine any help I can provide I am more than willing to. I do have a 98 1.8t ECU as well right now (as you know) and I also have a 98 2.8 V6 30v ECU in my car as well (I believe it uses Motronic 3.8.2).

Drew
Logged

2002 Audi S4 Avant 6MT
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #6 on: December 18, 2010, 03:16:09 AM »

@ k0mpresd :

Could you tell us forumpeeps what boxnumber (bosch/vag) this csv-file originates of ?

That would be really nice Smiley

Thanks,

Pascal

Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #7 on: January 04, 2011, 05:21:27 PM »

The CSV-file from k0mpresd comes from a M3.8.2 box
I will dig into it later on, to find the exact boxnumber.

If anyone has a damos- or asap-file from a m3.8.3 box, i would be very gratefull to
have a look to that and see the differences with the .2 box.

Thanks,

PvL
Logged
A4Nick
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 13


« Reply #8 on: January 17, 2011, 03:47:32 AM »

This is incredible lol. So you're cracking everything to tune the stock eprom chip correct? correct me if im wrong. Isn't it possible to buy a programmable eprom and solder that in place and begin tuning? will a special program be needed or what?
« Last Edit: April 18, 2011, 03:57:08 PM by Tony@NefMoto » Logged
elRey
Hero Member
*****

Karma: +31/-1
Offline Offline

Posts: 565


« Reply #9 on: January 18, 2011, 07:57:50 PM »


From ecuconnections:
Quote
... All 5.92 ecus have 29f200 inside and are flashable. MPPS and SPI. However, you need to give 12V to pin 43 in order for these interfaces to be able to write.

Or, unsolder and solder.

ME 5.9.2 is closely related to ME3.8.3.

They are saying it's writable with 12v on pin 43 via MPPS or SPI. However, you CANNOT read the flash in any case and Galletto doesn't work at all.

Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #10 on: January 19, 2011, 02:38:28 AM »

"They are saying it's writable with 12v on pin 43 via MPPS "

True.

Just tested this, on a M3.8.3 AQ-box on the workbench.
3.07 minutes flat flashingtime with MPPS and a benchflashcable.

Does someone have a damosfile of M3.8.3 or 5.9.2 ? or any
info abouth these ecu's ?

Thanks,

PvL
Logged
elRey
Hero Member
*****

Karma: +31/-1
Offline Offline

Posts: 565


« Reply #11 on: January 19, 2011, 11:55:13 AM »

Is that (12v to pin 43) equivalent to boot mode (ground to pin whatever) on the other ECUs?

Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #12 on: January 19, 2011, 12:44:03 PM »

I think so. Ecu stays closed. No opening up. Straightforward programming like obd-programming.

Hope this helps.

PvL
Logged
elRey
Hero Member
*****

Karma: +31/-1
Offline Offline

Posts: 565


« Reply #13 on: January 19, 2011, 12:53:54 PM »

So, I curious as to why one is not able to read the eprom in boot mode. Is the processor the same as the me7 boxes?
Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #14 on: January 19, 2011, 02:44:02 PM »

"Ecu stays closed" = no bootmode.

Secondly, we have a FLASHrom inside. No eprom.

And i think there are limitations to the capabilities
of this specific hardware-setup, therefore the read
is (yet) not possible.

The processor is a intel processor, so no ME7.x kinda
siemens comparable thing.

Try to download some original files, and winols will tell
you the processor, if it's known @ evc-germany and
they programmed the recognition in win-ols.

I'm already happy that i don't have to solder and socket
stuff with these. Now onto a definitionfile for M3.8.3/M5.92
to get going. A Damos or A2L file will be most interesting.

Cheers,

PvL
Logged
Pages: [1] 2 3 ... 9
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.024 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)