Pages: [1] 2
Author Topic: Eeprom checksum error p0601 - death code  (Read 7573 times)
vvt18
Full Member
***

Karma: +2/-74
Offline Offline

Posts: 139


« on: February 18, 2021, 06:49:06 AM »

Hi. After i added launch and nls in my 032TL file after some starts car won't start. I received eeprom error p0601.
I made modification in eeprom like prj said in some old topics and in my file too.

1. Search for "47 F8 55 00 CC 00 CC 00" (1 match)            
2. Search forward for "E6 F4 FF DF", notice the address, save the last 4 bytes (0x69E0A -> 9E0A) (i put my file address)            
3. Change "47 F8 55 00 CC 00 CC 00" to "47 F8 55 00 EA 00 xx xx" (use the last 4 bytes loHi)            
In EEPROM change 69 C1, A5 to 8E 5A, D2. On page 01 and 02.            

I make checksum with checksum tool and it looks ok. After all of these the car crash again after some starts.
Any advice please!
Logged
bamofo
Sr. Member
****

Karma: +34/-3
Offline Offline

Posts: 420


« Reply #1 on: February 18, 2021, 07:02:12 AM »

Hi. After i added launch and nls in my 032TL file after some starts car won't start. I received eeprom error p0601.
I made modification in eeprom like prj said in some old topics and in my file too.

1. Search for "47 F8 55 00 CC 00 CC 00" (1 match)            
2. Search forward for "E6 F4 FF DF", notice the address, save the last 4 bytes (0x69E0A -> 9E0A) (i put my file address)            
3. Change "47 F8 55 00 CC 00 CC 00" to "47 F8 55 00 EA 00 xx xx" (use the last 4 bytes loHi)            
In EEPROM change 69 C1, A5 to 8E 5A, D2. On page 01 and 02.            

I make checksum with checksum tool and it looks ok. After all of these the car crash again after some starts.
Any advice please!

Please share your EEPROM file. Also what are you using to Flash your car?
Logged
vvt18
Full Member
***

Karma: +2/-74
Offline Offline

Posts: 139


« Reply #2 on: February 18, 2021, 07:26:28 AM »

I attach modified eeprom for death code and stock eeprom too.
I use galletto.
I made checksum for file with ME7.x Correction who tell me the checksum is ok after correction.
i made check sum for eeprom with eepromtool and 95040 tool.
In EEPROM change 69 C1, A5 to 8E 5A, D2. On page 01 and 02.           
In file i modified "47 F8 55 00 CC 00 CC 00' with "47 F8 55 00 EA 00 FE 7D"
Because first "E6 F4 FF DF" begin at 97DFE
Logged
BlackT
Hero Member
*****

Karma: +79/-40
Offline Offline

Posts: 1425



« Reply #3 on: February 18, 2021, 07:41:14 AM »

RSA checksum error, already covered on this forum.
Read sticky topics
Logged
vvt18
Full Member
***

Karma: +2/-74
Offline Offline

Posts: 139


« Reply #4 on: February 18, 2021, 08:16:24 AM »

RSA checksum error, already covered on this forum.
Read sticky topics

ME7.x Correction and ME7Sum told checksum is correct for RSA too!!!!


Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for ECUID table...OK
 EPK         : '39/1/ME7.5/3/X505R//24C/SP24C91/270705/'
 Part Number : '06A906032TL '
 Engine ID   : '1.8l       '
 SW Version  : '0004'
 HW Number   : '0261200000'
 SW Number   : '1037378104'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @08038 Add=0x000106FF CalcAdd=0x000106FF  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01bf98 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @95b78-95bf8
           Modulus: @16a22-16aa2
          Exponent: @16aa2 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @169fe [32 bytes]:
 1) 0x00010002-0x00013FFE
 2) 0x00014252-0x00017F4E
 3) 0x00018192-0x0001FBDC
 4) 0x00026A00-0x0002FFFC
 EncrMD5: e3 17 63 84 eb 09 0b 3b 60 68 a6 76 11 ec 35 f1
 CalcMD5: e3 17 63 84 eb 09 0b 3b 60 68 a6 76 11 ec 35 f1
  OK

Step #4: Finding CRC table(s) ..
 Searching for CRC table(s)...OK
 CRC table(s) OK

Step #5: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 Main Checksums:
 1) 0x010002-0x013FFE CalcCSM: 0013961E
 2) 0x014252-0x017F4E CalcCSM: 0025DA8D
 3) 0x018192-0x01FBDC CalcCSM: 0043C3D9
 4) 0x026A00-0x02FFFC CalcCSM: 00BF9E06
 @8ffb6 CSM: 00BF9E06 CalcCSM: 00BF9E06 OK

Step #6: ROMSYS Program Pages
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0xA19B73 CalcAdd=0xA19B73  ADD OK

Step #7: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @1fb72 [16 bytes]:
 1) 0x000000-0x00FBFF CalcChk: 48D09FE4
    0x00FC00-0x01FFFF CalcChk: 20BF54AC CalcCRC: 7FF496ED SKIPPED
 2) 0x020000-0x0FFFFF CalcChk: 2AE879F7
 @fffe0 Chk: 2AE879F7 CalcChk: 2AE879F7 OK (i)

Step #8: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  0x000000-0x003FFF Chk: 0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  0x004000-0x007FFF Chk: 0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  0x000000-0x003FFF Chk: 0FA0F5CF CalcChk: 0FA0F5CF OK
 ..........
64) <1ffce>  0x0F4000-0x0F7FFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
65) <1ffde>  0x0F8000-0x0FBFFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
66) <1ffee>  0x0FC000-0x0FFFFF Chk: 1FFDE002 CalcChk: 1FFDE002 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

Step #9: Looking for rechecks ..
    <1fc6e>  0x01C000-0x01FFFF Chk: 06392ED3 CalcChk: 06392ED3 OK (recheck)

*** Found 70 checksums in G:\v25 _ 032tl.bin

*** DONE! 0 error(s) in G:\v25 _ 032tl.bin! ***
« Last Edit: February 18, 2021, 08:30:50 AM by vladvlad » Logged
stuydub
Full Member
***

Karma: +25/-12
Offline Offline

Posts: 230


« Reply #5 on: February 18, 2021, 09:29:27 AM »

your deathcode.bin is the 95040 (immo) and checksums are ok
Logged
BlackT
Hero Member
*****

Karma: +79/-40
Offline Offline

Posts: 1425



« Reply #6 on: February 18, 2021, 09:34:15 AM »

Help me God  Roll Eyes Roll Eyes you didn't read big RED letters in LC/NLS script tread?
Logged
stuydub
Full Member
***

Karma: +25/-12
Offline Offline

Posts: 230


« Reply #7 on: February 18, 2021, 09:58:36 AM »

I attach modified eeprom for death code and stock eeprom too.
I use galletto.
I made checksum for file with ME7.x Correction who tell me the checksum is ok after correction.
i made check sum for eeprom with eepromtool and 95040 tool.
In EEPROM change 69 C1, A5 to 8E 5A, D2. On page 01 and 02.           
In file i modified "47 F8 55 00 CC 00 CC 00' with "47 F8 55 00 EA 00 FE 7D"
Because first "E6 F4 FF DF" begin at 97DFE


upload correct bins
Logged
vvt18
Full Member
***

Karma: +2/-74
Offline Offline

Posts: 139


« Reply #8 on: February 18, 2021, 09:59:41 AM »

your deathcode.bin is the 95040 (immo) and checksums are ok

is not immo,,,,is death code like prj said in old topic.
i knew the checksum is correct, because is not the car don;t start.
car crash after some starts......and death code is 33 in both line 01 and 02
Logged
vvt18
Full Member
***

Karma: +2/-74
Offline Offline

Posts: 139


« Reply #9 on: February 18, 2021, 10:08:42 AM »

Help me God  Roll Eyes Roll Eyes you didn't read big RED letters in LC/NLS script tread?

I read it many times.
The function was wrote manual with calculated variables addreses from ram and rom. Launch and nls works ok.
Maybe ecu use the launch function space address or nls counter address, but.....they was free in file and i don;t see some problem with them.
Launch function starts from 0xAB540 , variables start from 0x17E50, nlscounter is 0x384FF0 (is free space in file.ecu generated with me7logger).
Logged
stuydub
Full Member
***

Karma: +25/-12
Offline Offline

Posts: 230


« Reply #10 on: February 18, 2021, 10:28:43 AM »

is not immo,,,,is death code like prj said in old topic.
i knew the checksum is correct, because is not the car don;t start.
car crash after some starts......and death code is 33 in both line 01 and 02

the file u have uploaded here is a immo.bin there is no nls script in it for one just immo data
Logged
vvt18
Full Member
***

Karma: +2/-74
Offline Offline

Posts: 139


« Reply #11 on: February 18, 2021, 10:30:41 AM »

the file u have uploaded here is a immo.bin there is no nls script in it for one just immo data


nls script write in flash file my friend not in eeprom
Logged
stuydub
Full Member
***

Karma: +25/-12
Offline Offline

Posts: 230


« Reply #12 on: February 18, 2021, 10:36:14 AM »

nls script write in flash file my friend not in eeprom

put this back to ori
Logged
vvt18
Full Member
***

Karma: +2/-74
Offline Offline

Posts: 139


« Reply #13 on: February 18, 2021, 11:44:19 AM »

Thanks for your advice but i think you don't understand!
Logged
BlackT
Hero Member
*****

Karma: +79/-40
Offline Offline

Posts: 1425



« Reply #14 on: February 18, 2021, 03:00:32 PM »

I read it many times.
The function was wrote manual with calculated variables addreses from ram and rom. Launch and nls works ok.
Maybe ecu use the launch function space address or nls counter address, but.....they was free in file and i don;t see some problem with them.
Launch function starts from 0xAB540 , variables start from 0x17E50, nlscounter is 0x384FF0 (is free space in file.ecu generated with me7logger).
Yes you did read it, that is ehy ypu put your counter to 0x384FF0
http://nefariousmotorsports.com/forum/index.php?topic=6308.15

.According to my sources, the custom NLS code is interfering with the RSA checking done by the ECU because it disturbs ram location 384FF0

Changing it to an unused (for real) location (e.g. 386000) should fix the problem, and should not require the RSA checking to be disabled entirely.  



Btw that NLS is shit, it pulltiming after shifting engine lose power and there is no any use of it
« Last Edit: February 18, 2021, 03:02:50 PM by BlackT » Logged
Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.042 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)