Hey all,
Following Nyet's advice from a previous post: (Thanks a lot btw @Nyet),
I have done the following steps to add LC/NLS to my Polo GTI 9n3. ECU: 06A906032TL 0040.
SpeedThreshold: 0x17EA0
LaunchRPM: 0x17EA2
IgnitionCutDuration: 0x17EA4
RPMThreshold: 0x17EA6
AccPedalThreshold: 0x17EA8
FTOMN 0x1A4DC
AB600 (This is where antilag function is) (becomes 8A 00 B6 when implementing the 'DA' part)
17E00 in my case is occupied, so using 17EA0 instead (being used for condition variables)
0x380BA2 (Taken from .ecu file, used for placing NLS counter)
0x00FD4E (b_kuppl hex address)
0x1000 (bitmask for b_kuppl, b_brems should have the same address but -2 for the bitmask, so 0x400, according to the document)
Used HxD editor
Final antilag function used (customized according to my ECU using ME7WIZZARD):
9A 27 13 C0 F2 F4 00 9C D7 00 81 00 F2 F9 A0 7E
40 49 9D 0B F2 F4 9E F8 D7 00 81 00 F2 F9 A2 7E
40 49 FD 03 F7 8E C5 8B 0D 2F 9A 27 29 C0 8A 27
22 A0 F2 F4 9E F8 D7 00 81 00 F2 F9 A6 7E 40 49
FD 1A C2 F4 BD 89 D7 00 81 00 C2 F9 A8 7E 40 49
FD 12 D7 00 38 00 F2 F4 A2 0B D7 00 81 00 F2 F9
A4 7E 40 49 9D 11 F7 8E C5 8B 08 41 D7 00 38 00
F7 F8 A2 0B 0D 09 D7 00 38 00 F6 8F A2 0B 0D 04
D7 00 38 00 F6 8E A2 0B F3 F8 9F 89 DB 00 FF FF
After that I used ME7Sum to update the checksums and this is the read out:
ME7Sum (v1.0.5) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].
Attempting to open firmware file 'image.bin'
Step #1: Reading ROM info ..
Searching for EPK signature...OK
Searching for ECUID table...OK
EPK : '39/1/ME7.5/3/X505R//24C/SP24C91/270705/'
Part Number : '06A906032TL '
Engine ID : '1.8l R4/5VT '
SW Version : '0040'
HW Number : '0261208950'
SW Number : '1037378104'
Step #2: Reading ROMSYS ..
Startup section: word[0x008000]+word[0x00FFFE]
@08038 Add=0x000106FF CalcAdd=0x000106FF ADD OK
All param page: word[0x010000]+word[0x01FFFE]
@01bf98 Add=0x00971D CalcAdd=0x00971D ADD OK
Step #3: Reading RSA signatures ..
Searching for RSA offset #0...OK
Searching for RSA offset #1...OK
Signature: @95b78-95bf8
Modulus: @16a22-16aa2
Exponent: @16aa2 = 3
Searching for MD5 ranges...OK
MD5 Block Offset Table @169fe [32 bytes]:
1) 0x00010002-0x00013FFE
2) 0x00014252-0x00017F4E
3) 0x00018192-0x0001FBDC
4) 0x00026A00-0x0002FFFC
EncrMD5: 65 80 59 89 5b ca 09 2e 68 41 74 da d3 af f3 35
CalcMD5: 2a 34 7f 6f ef 34 63 c1 ed 77 8d d6 9b 44 a1 ce
** FIXED **
Step #4: Finding CRC table(s) ..
Searching for CRC table(s)...OK
CRC table(s) OK
Step #5: Reading Main Data Checksums ..
Searching for main data CRC pre block...missing
Searching for main data CRC/csum blocks...OK
Searching for main data CRC offsets...missing
Searching for main data checksum offsets...OK
Main Checksums:
1) 0x010002-0x013FFE CalcCSM: 0013974C
2) 0x014252-0x017F4E CalcCSM: 0025F546
3) 0x018192-0x01FBDC CalcCSM: 00440623
4) 0x026A00-0x02FFFC CalcCSM: 00BFE050
@8ffb6 CSM: 00BFD16A CalcCSM: 00BFE050 ** FIXED **
Step #6: ROMSYS Program Pages
Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
@00803c Add=0xA19B73 CalcAdd=0xA19B73 ADD OK
Step #7: Reading Main Program Checksums ..
Searching for main program checksum..OK
ROM Checksum Block Offset Table @1fb72 [16 bytes]:
1) 0x000000-0x00FBFF CalcChk: 48D09FE4
0x00FC00-0x01FFFF CalcChk: 20D0C1BA CalcCRC: 08DD67B1 SKIPPED
2) 0x020000-0x0FFFFF CalcChk: 2AE38CDE
@fffe0 Chk: 2B11B637 CalcChk: 2AE38CDE ** FIXED **
Step #8: Reading Multipoint Checksum Blocks ..
Searching for multipoint block descriptor #1...missing
Searching for multipoint block descriptor #2...OK
1) <1fbde> 0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK
2) <1fbee> 0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK
3) <1fbfe> 0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK
..........
64) <1ffce> 0x0F4000-0x0F7FFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
65) <1ffde> 0x0F8000-0x0FBFFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
66) <1ffee> 0x0FC000-0x0FFFFF Chk: 1FFDE002 CalcChk: 1FFDE002 OK
Multipoint #2: [66 blocks x <16> = 1056 bytes]
Step #9: Looking for rechecks ..
<1fc6e> 0x01C000-0x01FFFF Chk: 062978B8 CalcChk: 062978B8 OK (recheck)
*** Found 70 checksums in image.bin
Attempting to output corrected firmware file 'out.bin'
├╛ Opening 'out.bin' file for writing
├╛ Writing to file
├╛ Validating size correct 1048576=1048576
├╛ All OK, closing file
*** DONE! 8/8 error(s) in image.bin corrected in out.bin! ***
Attached is my LC/NLS file & .ecu file.
Please let me know if the checksum is done correctly, and if I have implemented LC/NLS correctly.
Thanks in advance.