Hi Nefmoto,

I want to dig into the C167/AM29F400BB powered SMG (Alfa Selespeed derivate) transmission contro unit and started by unsoldering the flash and reading its content.

Unfortunately the flash content looks pretty weird, so I can't "read" it correctly, like the adress or data lines are shifted somehow when compared to ME7 or MS43.


Read from the flash chip:


Corrected read I was sent:



The flash content itself is correct, I loaded it into my emulator and the TCU works fine with that.

Maybe someone else had to deal with something like that in the past already and can help me with that.

Thanks for the hint prj, I measured through the data lines that connect the AM29F400BB flash chip to the C167 CPU and found out that they shuffled the connections.

On the left you find the normal setup for this combination, all the AD# lines from the CPU match up the DQ# on the flash chip. But on the right there is the shuffled layout from SMG2 TCU.



So with this information and some python code that a friend quickly hacked together, we are atleast able to convert raw flash content to valid code and data. Back and forth. You will find the converter attached to this post.

You need to install Python 3 and "numPy" module. Then you can simply drag&drop the binary onto it and it will convert it. It has a basic detection of whether its a CPU read, or a flash read based on the first byte being 0xFA (CPU read) or not (flash read).