blundar
Newbie
Karma: +11/-1
 Offline
Posts: 22
|
 |
« on: July 01, 2010, 08:20:10 AM »
|
|
|
I have a 98 A4 1.8tqm and I've been toying with the idea of messing with the ECU in it. I bought 2 or 3 557 and 558 ECUs to have as spares.
From what I gather, these ECUs use an Intel processor and a 28F200 flash chip unlike the ME7.x stuff that I'm finding more information for. I'm going to take some pictures and try to hot-air the flash chip off one of the ECMs this weekend to read it. I have a pretty decent set of gear (SMD rework station, scope, logic analyzer, EPROM prorammers, generic FTDI USB cable, 16bit EPROM emulator) and a decent amount of reverse engineering experience (Honda/8051, Honda/66K, Honda/SH4, Ford/8061, Ford/MPPC) but not a ton of time right now (3wk old baby) so progress will probably be a little slow.
Anyone else working / interested in working on this platform? I imagine there is going to be a pretty decent amount of code analysis that is going to have to be done with IDA, etc. before it's going to be very usable. I'd love to try to find some more documentation on tables and workflow on ME3.8.x if anyone knows where to find such things so I have a better roadmap of what to look for.
Thanks!
-Dave
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #1 on: July 09, 2010, 10:44:13 PM »
|
|
|
If you need any help with getting started, just let me know.
I don't have any plans to look at ME 3.8.3 myself though.
|
|
|
|
|
Logged
|
|
|
|
|
k0mpresd
|
|
« Reply #2 on: August 05, 2010, 07:26:12 AM »
|
|
|
|
|
|
|
|
Logged
|
|
|
|
blundar
Newbie
Karma: +11/-1
Offline
Posts: 22
|
|
« Reply #3 on: August 08, 2010, 09:55:35 PM »
|
|
|
Slow progress... Found this: http://nefariousmotorsports.com/forum/index.php?topic=65.0Very helpful One chip I cannot identify... National Semiconductor SCL4402-V4 Appear to be using Intel 87C196 processor, AM29F200B FLASH chip. Flash chip WE connected to two chips on reverse. Have flash chip removed. Ordered PSOP44 adapter for EPROM programmer. going to read chip, go from there. |
|
|
|
|
Logged
|
|
|
|
blundar
Newbie
Karma: +11/-1
Offline
Posts: 22
|
|
« Reply #4 on: August 12, 2010, 09:03:53 PM »
|
|
|
Did a little more digging. the AN87C196KR is an Intel MCS96 family MCU for automotive applications http://www.datasheetcatalog.com/datasheets_pdf/8/7/C/1/87C196KR.shtmlThe Flash chip is an AM29F200B. Can't confirm but I highly suspect the chip marked B58274 is a 28 pin SRAM chip. The WE pin on the 29F200B appears to be connected to a '573 latch on Q1 along with a pin on the SRAM (Write inhibit?). D1 of the latch is connected to pin 25 of the MCU (P3.1) and LE on the '573 is connected to pin 4 on the MCU (ALE). This seems to indicate (at least preliminarily) that there are provisions for the Flash chip to be programmed in site by the MCU. |
|
|
|
« Last Edit: August 28, 2014, 11:38:25 AM by Tony@NefMoto »
|
Logged
|
|
|
|
blkbullitt
Newbie
Karma: +0/-0
Offline
Posts: 6
|
|
« Reply #5 on: August 13, 2010, 05:55:49 AM »
|
|
|
Dave,
As I mentioned when you came up a few weeks ago to pick up the 1.8t engine any help I can provide I am more than willing to. I do have a 98 1.8t ECU as well right now (as you know) and I also have a 98 2.8 V6 30v ECU in my car as well (I believe it uses Motronic 3.8.2).
Drew
|
|
|
|
|
Logged
|
2002 Audi S4 Avant 6MT
|
|
|
|
pvl
|
|
« Reply #6 on: December 18, 2010, 03:16:09 AM »
|
|
|
@ k0mpresd : Could you tell us forumpeeps what boxnumber (bosch/vag) this csv-file originates of ? That would be really nice  Thanks, Pascal |
|
|
|
|
Logged
|
|
|
|
|
pvl
|
|
« Reply #7 on: January 04, 2011, 05:21:27 PM »
|
|
|
The CSV-file from k0mpresd comes from a M3.8.2 box
I will dig into it later on, to find the exact boxnumber.
If anyone has a damos- or asap-file from a m3.8.3 box, i would be very gratefull to
have a look to that and see the differences with the .2 box.
Thanks,
PvL
|
|
|
|
|
Logged
|
|
|
|
A4Nick
Newbie
Karma: +1/-0
Offline
Posts: 13
|
|
« Reply #8 on: January 17, 2011, 03:47:32 AM »
|
|
|
This is incredible lol. So you're cracking everything to tune the stock eprom chip correct? correct me if im wrong. Isn't it possible to buy a programmable eprom and solder that in place and begin tuning? will a special program be needed or what?
|
|
|
|
« Last Edit: April 18, 2011, 03:57:08 PM by Tony@NefMoto »
|
Logged
|
|
|
|
|
elRey
|
|
« Reply #9 on: January 18, 2011, 07:57:50 PM »
|
|
|
From ecuconnections: ... All 5.92 ecus have 29f200 inside and are flashable. MPPS and SPI. However, you need to give 12V to pin 43 in order for these interfaces to be able to write.
Or, unsolder and solder. ME 5.9.2 is closely related to ME3.8.3. They are saying it's writable with 12v on pin 43 via MPPS or SPI. However, you CANNOT read the flash in any case and Galletto doesn't work at all. |
|
|
|
|
Logged
|
|
|
|
|
pvl
|
|
« Reply #10 on: January 19, 2011, 02:38:28 AM »
|
|
|
"They are saying it's writable with 12v on pin 43 via MPPS "
True.
Just tested this, on a M3.8.3 AQ-box on the workbench.
3.07 minutes flat flashingtime with MPPS and a benchflashcable.
Does someone have a damosfile of M3.8.3 or 5.9.2 ? or any
info abouth these ecu's ?
Thanks,
PvL
|
|
|
|
|
Logged
|
|
|
|
|
elRey
|
|
« Reply #11 on: January 19, 2011, 11:55:13 AM »
|
|
|
Is that (12v to pin 43) equivalent to boot mode (ground to pin whatever) on the other ECUs?
|
|
|
|
|
Logged
|
|
|
|
|
pvl
|
|
« Reply #12 on: January 19, 2011, 12:44:03 PM »
|
|
|
I think so. Ecu stays closed. No opening up. Straightforward programming like obd-programming.
Hope this helps.
PvL
|
|
|
|
|
Logged
|
|
|
|
|
elRey
|
|
« Reply #13 on: January 19, 2011, 12:53:54 PM »
|
|
|
So, I curious as to why one is not able to read the eprom in boot mode. Is the processor the same as the me7 boxes?
|
|
|
|
|
Logged
|
|
|
|
|
pvl
|
|
« Reply #14 on: January 19, 2011, 02:44:02 PM »
|
|
|
"Ecu stays closed" = no bootmode.
Secondly, we have a FLASHrom inside. No eprom.
And i think there are limitations to the capabilities
of this specific hardware-setup, therefore the read
is (yet) not possible.
The processor is a intel processor, so no ME7.x kinda
siemens comparable thing.
Try to download some original files, and winols will tell
you the processor, if it's known @ evc-germany and
they programmed the recognition in win-ols.
I'm already happy that i don't have to solder and socket
stuff with these. Now onto a definitionfile for M3.8.3/M5.92
to get going. A Damos or A2L file will be most interesting.
Cheers,
PvL
|
|
|
|
|
Logged
|
|
|
|
|
