Hi there,

I want to implement NLS and LC on my S4 B5 G Box.
I am an IT guy but I am not familiar with Hex, Assambler and stuff like that, this is not my special field.
First I thought, I easily use the php Script, but my gut instinct says it would turn out of shit!
Also I am interested how this function works itself, so I try to build this it into my .bin file manually with setzi/sn00kis document:
https://www.docdroid.net/vffm/me7x-lc-nls-rev003.pdf#page=2

First I created a .ecu file from my .bin File.
Then I searched for some empty space after the main code, this part is clear for me, setzi used 8E800 (8:E800h:) but in my .bin file there is still main code.
So I scrolled a bit more down and found empty Code (FF FF...) at 91400 (9:1400h:).

See first Screenshot

Now I searched empty space for the "condition"-variables, setzi and sn00k searched them above in the file on 17E00.
In my .bin File is space from 171E0 to 17F40, so I use 17E00, too.

See second Screenshot

The "condition"-variables are "SpeedThreshold, LaunchRPM, IgnitionCutDuration, RPMThreshold and AccPedalThreshold" or am I wrong ?
  But why are we now placing this conditions above in the file and not after the main code like the rest ?

So let's go to the next step, I search the following adresses in my .ecu file


And I found every of them but not "B_brems".
At 0x00FD56 I only got the following:


 "B_brems" should be at 0x0040 but there it is not.
  So the question is, is it important that this condition is in the .ecu file or is this just for information ?
And if it is important, can I copy it from another .ecu (maybe M-Box)  file into the right column with 0x00FD56 bitmask 0x0040 ?

The next step is, find an empty adress in RAM for the NLS-counter.
In my .ecu file the last Address is 0x383F32, setzi used 0x384FF0, so I will use it, too.

Until now, I think I got all Adresses I need.

So the next step is completly confusing for me.
I go to the end of the file and search upwards for "D7 40 06 02 03 F8" now I am here, see Screenshot:

See third Screenshot

So I have to replace the first F3 in the row "8:E100h" with DA and the following three fields where the new functionis implementet with in my case 91400 (?).
But I don't know how to write this in the three fields, in the example sn00k wrote:

  Why is it now written 8A 00 9C and not 8A 9C 00 ?
How do I have to write the 91400 for my file in this three fields ? Maybe 89 00 14 ?


Next I have to set the conditions in 17E00, I also use setzis example "A6 01 50 46 0A 00 F0 55 E6 FF FF FF FF FF FF FF".
And in the End I have to change FTOMN to zero.
The XDF for the new conditions I will adjust later.

Im try to undestand this function since hours, I hope somebody can answer my questions.

thanks in Advance !

Hi Fukenbroken,

thanks for your reply!

I take a look at this Excel.

Are you shure that B_brems = b_br ? I am not.
In the "Funktionsrahmen" documentation are different descriptions as you can see in the attachments.
I am german, so I have the luck, that I can understand what there is written.
In my optionen, B_Brems means "Breakes are activated" and B_BR means "Breakingtestswitch(?) is activated"

So you mean, for routine I should use 0xB1234 insted of 0x384FF0 ?