Pages: [1]
Author Topic: I may have something useful for the Wiki  (Read 4359 times)
J. Blazko
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3



« on: September 29, 2021, 08:47:43 PM »

Hello all,

This is my first post. First of all, thanks for making this forum what it is. Your commitment to making this community grow and helping people out is very admirable.

I'll try to make this short. I appreciate your attention.

Summary of what I have and some context:

  • I have an 03 1.8t VW Jetta, has some minor mods. KN air Filter to the MAF housing, Bronze Clutch, Forge 008 DV, N249, SAI,Brake Booster Pump delete, 3 inch downpipe to a 2.5 inch catless exhaust with magnaflow muffler. In the next days I'll delete the PCV and run a catch can.
  • It has an aftermarket "stage 2" tune in it.
  • The car feel good and pulls hard but has terrible MPG. 190 miles per tank of 94 octane gas, with moderate city driving. All maintenance is in check. Makes me think it has a bad tune. It was put in by the pre-previous owner. I don't know anything about him.

This is what I want / wanted to do:

  • Run a stock tune for a full tank to see how much of a difference I notice in the MPG and on power.
  • If possible Read the stage 2 file in the ECU to try and investigate it.
  • Create my own "Stage 1" or "1.5" bin based on that file, so that has similar power but is a bit less "turned up". Easier on the turbo and the MPG.

Summary of what I've got so far:

  • Got an FTDI, Galletto and a blue CH340 cable.
  • Got an Aliexpress bench harness and a 12v power supply.
  • Got a spare ME7.5 ECU
  • Spent hours reading this forum mostly.

My first obstacle was that nefmoto wasn't able to read the flash, I got the "Request upload may have been disabled by aftermarket engine software."

Obviously…

Went back to reading.

This is what I've accomplished so far:

  • Learned bootmode and all that.
  • Managed to IMMO off the spare ECU I got.
  • Flashed a stock 06A906032HS bin into the spare ECU (I did verify checksum)
  • Installed that ECU into the car, and it runs! Of course it has some codes, but it runs great.
  • I managed to read the stage 2 bin using galletto and boot mode. So I have the stage 2 bin file.

Worth mentioning:

Right now the car has the spare ECU installed with the stock tune, I've been running it like that for some days, haven't been able to really tell if the MPG is better, the weather is terrible and I haven't had a chance to go on a road trip. Maybe next weekend I'll be able to.

With the stock tune, the codes I have were: SAI (N112 Open circuit), N249 Open circuit, and then later evap system large leak detected came on.

That last one really caught my attention. Maybe that's why I was getting such sh*tty MPG? An EVAP leak?

I investigated and decided to delete EVAP, since where I'm at, it's not needed to pass emissions.

In that process I found out that the system was like half deleted, some weird stuff was done there. I proceeded to remove the lines, the valve, and cap off the vacuum ports. Car runs great. Now I get the EVAP N80 open ciurcuit, as expected.

We'll see if that plus the stock tune helps the MPG.

I find it crazy that I had to run a stock tune to even notice that something might be wrong with the evap system. Stage 2 tune has all that turned off.


Now this is the most interesting part!

I've been looking into the stage 2 bin, comparing it to the stock bin. And goddamn, there's a lot of stuff that was changed. It's pretty crazy. Fair amount more than what I saw in the community Stage 1 topic.

I'm using Tuner Pro and this definition map pack: http://nefariousmotorsports.com/forum/index.php?topic=4936.0

I add the stock bin and the stage 2 bin, use the "difference tool" and have noticed a lot changes.

That XDF has a large number of definitions! And still, some of the values changed in the stage2 bin are not defined there!

The map addresses do match, it looks fine. Doesn't seem to be scrambled like some aftermarket tunes do as I've read around here. They just tweaked a bunch of stuff.

First thing I noticed is that the Launch Control methods in the wiki, were not used in this bin. The maps for Soft and hard limiters explained there are not touched. They used a different method. The tune has launch control at 3500 RPM. Might be ignition cut? It sounds like loud gunshots when you hit it.

Side note: When I read the EEPROM from the ECU with the stage 2 tune to do the immo off on the spare, guess what I noticed! It has IMMO ON! But the key doesn't have the little immo chip in it. Somehow the thing was running perfectly fine, with IMMO on EEPROM and no immo chip in the key! Some crazy magic was done to that bin.

So here's what I have in mind:

Are any of you high level members interested in investigating what was done to this bin to add more info to the wiki? The Immo method, the launch control, the tables that are tweaked.. etc

I'm working on getting the name of all the maps that were changed vs the stock, potentially to what values roughly they were changed to. I'm thinking this will help a lot of people build their bins.

Once I have that, hopefully you can share some guidance on what to add to my stage 1.5 project, and what can I leave stock. Basically I want to simplify what was done there, and create a less aggressive bin I can run and daily.

I can start a new thread to start looking into the maps.

What do you think?

Cheers
« Last Edit: October 07, 2021, 03:53:26 PM by J. Blazko » Logged
stuydub
Full Member
***

Karma: +24/-12
Offline Offline

Posts: 227


« Reply #1 on: October 02, 2021, 04:15:52 AM »

A lot of files may have user tags no read markers AL NLS script and changes which are not defined in most XDFs hence when comparing it doesn't have a definition attached. Your better of comparing in a hex editor and noting the address and go from there
Logged
J. Blazko
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3



« Reply #2 on: October 06, 2021, 05:32:45 PM »

Scripts inside the bin? How does that work?

I've been doing exactly that as well, comparing the 2 hex with beyond compare. I see some blank spaces in the stock file, which are filled with FF the tuned file for example. Some are empty on the stock and have different values on the tuned. Similar to what was done with the tag.

Does someone know which or what is the method used to block reading via obd? is it part of the tag? Or is it scrambling values on other addresses? There's a bit of everything in this bin.

I have all the defined maps that were changed in the tuned bin, written down on a note. Some have descriptions, the most common ones. Some I have no idea what they are. Some of those I've googled and found something, some others, nothing at all.

I've counted 81 defined maps were changed. Undefined, I see around 20. Without counting the read tag. Not sure if its worth it to post all that.

My thoughts are that I've read so many discussions in here about how to change KFMIRL, KFMIZUFIL, KFMIZUOF, KFZW etc.... and I see lots of mixed information, lots of failed attempts resulting in bad response from the car, the info I have could help people avoid that trouble.

I guess my initial post was a bit to long, and no one is really interested in breaking down a tuned file to learn something from it.

As a side note, I've been driving with the stock map, and the mpg was slightly better, not really by much. The power is also significantly lower. Then I noticed I was running in open loop mode, because of the SAI, EVAP and N249 codes. I properly coded them out, fixed checksum, flashed, and now the DTCs are gone. I also disabled cat heating, and cold starts sound and feel great now. That was my first tune and flash. I'm happy I was successful with that. I still have to put some fresh gas in the car to see if it makes a big difference when running in closed loop, on stock fueling, timing and boost. I'll monitor the fuel trims. We'll see.


 



Logged
d3irb
Full Member
***

Karma: +131/-1
Offline Offline

Posts: 185


« Reply #3 on: October 07, 2021, 10:32:18 AM »

Quote
Scripts inside the bin?

Software patches which add or change the factory functionality. These often add new tables or change references to existing ones in such a way that standard definitions are no longer useful.

Quote
Does someone know which or what is the method used to block reading via obd?

Lots of ways to do this. Code patches to the diagnostic handlers (or just remove the RequestUpload one, like the Nef message says...), changing the seed/key constants, changing the table lookup system and altering the map layout, crappy riser board chip interceptors, so many different methods were invented over the years for these.

My big advice for you with this question and the last one is this: you need to start thinking of the binary as both code and data, not just data.

Quote
Undefined, I see around 20

Are some of these checksums?

Quote
My thoughts are that I've read so many discussions in here about how to change KFMIRL, KFMIZUFIL, KFMIZUOF, KFZW etc.... and I see lots of mixed information, lots of failed attempts resulting in bad response from the car, the info I have could help people avoid that trouble.

This is discussed at length in this forum and on the wiki. If you find the current information confusing, read the diagrams in the FR and fix up the documentation. Stealing a professional tuner's changes is pointless. They're just people too and are often either the people posting in those threads or even more incompetent. You risk getting led astray by garbage in garbage out by trying to infer what random tunes are doing even more than you do by reading the forum.

Quote
I guess my initial post was a bit to long, and no one is really interested in breaking down a tuned file to learn something from it.

These ECUs are ancient and have been reverse engineered to death. The information is all out there. The FR defines the factory control strategies exhaustively. For most people, there's not much to learn from a commercial tune.

That's why the advice is posted everywhere on this forum over and over: start from scratch, read the wiki, learn the control strategy, and make a tune.
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #4 on: October 07, 2021, 10:57:38 AM »

Are any of you high level members interested in investigating what was done to this bin to add more info to the wiki? The Immo method, the launch control, the tables that are tweaked.. etc

Not really. To mirror dirb's post: all of these ancient bins are of limited use. They were hacked together by people who did not have the resources and information readily available today, such that today, anyone smart enough to figure out what these old hacks do could most certainly do a better job themselves and work from first principles.
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
prj
Hero Member
*****

Karma: +903/-420
Offline Offline

Posts: 5789


« Reply #5 on: October 07, 2021, 11:25:01 AM »

MIZUFIL/MIZUOF, wish that shit would be deleted entirely, as there is never a reason to change these maps.
If someone changed them they don't know what they are doing.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
J. Blazko
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3



« Reply #6 on: October 07, 2021, 03:52:28 PM »

Wow, thanks for the replies.

d3irb

Are some of these checksums?

I'm not sure. How do the checksums look in these bins?

Here are some of the undefined maps I've seen:

C7000 to C708D, are empty on stock, but on tuned they have something.
A7000 to A70FF, are empty on stock, but  on tuned they have something.

A1CCC to A1CCF changed, not defined.
90B4E to 90B51 changed, not defined.
90B54 to 90B57 changed, not defined.
90B5A to 90B5D changed, not defined.
8FC3C to 8FC3E changed, not defined.
1F18C to 1F1FE all FF on tuned. Empty on stock

There are about 12 more that I haven't written down. Not sure if I should even focus on that...

FF000 to FF07F, Read tag
FF130 to FF17F, Read tag

I'm just curious about the undefined maps and if there could be script values in those addresses, trying to understand if those blank spaces in the stock bin were used for something. But I don't care that much about it at this point after what you all just said. I might as well not even look at that tune bin moving forward

I added the stock tune in case you want to check out the addresses I'm talking about and maybe see if they look like checksum/script/anti read method to you.

You risk getting led astray by garbage in garbage out by trying to infer what random tunes are doing even more than you do by reading the forum.

I get your point. I actually followed the info here and on the wiki for the sai/n249/n80 delete and the cat heating disable, and the car is idling better than it did with the tune. The tune didn't touch FKHABMN, CLATEVE, and had CWKONABG set to 1, which if I'm not wrong means cat is still installed. I zeroed all that out and it feels better. First clue that the tune isn't great lol... I was a bit overwhelmed and maybe impressed by the amount of changed maps when I fist opened it.

nyet

They were hacked together by people who did not have the resources and information readily available today, such that today, anyone smart enough to figure out what these old hacks do could most certainly do a better job themselves and work from first principles.

The tag in the tune says 2012, I totally get your point. Seems like a lot has been learned since then.

Thanks for reading my posts!

prj

Another legend replying here

MIZUFIL/MIZUOF, wish that shit would be deleted entirely, as there is never a reason to change these maps.
If someone changed them they don't know what they are doing.

haha sounds like you would puke if you see this bin then lol

They changed those tables entirely all to FF in the tune

KFMIZUFIL - Allowed indicated torque to torque limit before filter - all to FF
KFMIZUOF - Max permitted indicated set torque for torque limitation - all to FF

I guess they were trying to avoid level 1 torque intervention, which is a crappy thing to do based on the info.
Some other maps are also changed to all FF, like these:

KFVPDKLD - Max pressure ratio (throttle plate) for Idra Diag - all to FF
KFLDHBN - LDP altitud limitation, all to FF
KFDLULS - Delta pressure for overboost protection-  all to FF

Exactly what the wiki says no to do. lol

I'm glad I made this post and got your replies, I get it now. This tune is garbage. Not even remotely close to deserve any attention from anyone here. I'll make my stage 1 file entirely with the help of the wiki and the this forum.

I'll also delete the name of the tuner from my original post, just to keep this neutral.

Cheers
« Last Edit: October 07, 2021, 03:59:04 PM by J. Blazko » Logged
gyroplane
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 4


« Reply #7 on: November 03, 2021, 08:00:43 PM »

Scripts inside the bin? How does that work?

I've been doing exactly that as well, comparing the 2 hex with beyond compare. I see some blank spaces in the stock file, which are filled with FF the tuned file for example. Some are empty on the stock and have different values on the tuned. Similar to what was done with the tag.

Does someone know which or what is the method used to block reading via obd? is it part of the tag? Or is it scrambling values on other addresses? There's a bit of everything in this bin.

I have all the defined maps that were changed in the tuned bin, written down on a note. Some have descriptions, the most common ones. Some I have no idea what they are. Some of those I've googled and found something, some others, nothing at all.

I've counted 81 defined maps were changed. Undefined, I see around 20. Without counting the read tag. Not sure if its worth it to post all that.

My thoughts are that I've read so many discussions in here about how to change KFMIRL, KFMIZUFIL, KFMIZUOF, KFZW etc.... and I see lots of mixed information, lots of failed attempts resulting in bad response from the car, the info I have could help people avoid that trouble.

I guess my initial post was a bit to long, and no one is really interested in breaking down a tuned file to learn something from it.

As a side note, I've been driving with the stock map, and the mpg was slightly better, not really by much. The power is also significantly lower. Then I noticed I was running in open loop mode, because of the SAI, EVAP and N249 codes. I properly coded them out, fixed checksum, flashed, and now the DTCs are gone. I also disabled cat heating, and cold starts sound and feel great now. That was my first tune and flash. I'm happy I was successful with that. I still have to put some fresh gas in the car to see if it makes a big difference when running in closed loop, on stock fueling, timing and boost. I'll monitor the fuel trims. We'll see.

I am just trying to confirm or adapt my own understanding of the open/closed loop definition and purpose. Every synopsis, Function Sheet, or Fuel Strategy document I have ever studied about ME7, ME9 etc. places paramount importance on a catalyst being present in order for there to be a known control point from which to gauge and adjust for lambda. So my question is what loop are you attempting to close if you have no measurable chemical change able to take place between your o2 sensors? Isn't it essentially the same exact gas your wide band picked up? As far as coding stuff out or deleting components from what I have seen in a Damos for my car finally, its really like the butterfly effect. I obviously have no real understanding as to the depth and complexity of the system in its entirety. I have an idea, I know its vast. But I also think most tuners butcher the system and have little to no finesse. They get the immediate results the consumer wants and then have no answers for when a far removed component in the system starts acting up or fails because they didn't know it depended on something they changed to function. That's where I am at at least. My overall point is that these systems were built around catalytic converters and closed loop operation. How can you have one without the other?




Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.025 seconds with 17 queries. (Pretty URLs adds 0s, 0q)