Besides these couple maps I have defined most of the important maps for this file.
Some tuners seem to change them and I would like to know what maps they actually are.

I´ve gone thru most of the definition files for other 1.8T ECUs but none of them seem to have definitions for these.

If someone could take a look:

Offset 169C8h - 16AA2h (just after KFMIOP & NMAXOG)
Offset 1FC46h - 1FC7Dh
Offset 1FFF6h - 1FFFDh

Binary as attachment.

Hi,

At 169C8 is NMXDKPU.
At 169CA is TNMXH.
At 169CC is TFMIZU.
At 169CE is TNSC.

At 1FC46 you will find the checksum for the flash data area between 810000 and 813FFF.
At 1FFF6 is the checksum stored for 8FC000 - 8FFFFF.

Tom

At first sight, IDA shows that subroutine 8958FC is invited.

The subroutine uses RAM variables FA00, F9EA, F9EE, 3826FC, 3826FF, 382750, 384E1E, 384E1F and bit 3 and 9 of FD94.

I don't have a list of the RAM-variables for this ECU.

Has anyone an idea?

Tom

Didn't know the R in RSA stands for 'riddle' 

16A22h - 16AA2h is RSA signature?
So the signature is always the same for all files that came from the same maker (e.g VAG in this case)?
Some original files for other ME7.5 ECUs have identical data at 16A22h - 16AA2h while some do not, so I guess it is.

Thanks