NefMoto > Technical > Reverse Engineering > MED9.1 - Enable Boost Pressure Can Message (Additional Instruments)
Pages: [1] 2
« previous next »
Author Topic: MED9.1 - Enable Boost Pressure Can Message (Additional Instruments)  (Read 8298 times)
elias
Full Member
***

Karma: +17/-3
Offline Offline

Posts: 59
Hello rear readers,

I own a EOS with BWA Motor and installed "Additional Instruments"(PN 5C5919527B) from VW Scirocco into my car. The clock and the Oil-Temperature are working fine, but unfortunately the Boost Pressure Gauge is not. Its
basically stuck at zero and does not move. There are some "messages missing" according to VCDS.

I am trying to make it work be adding this feature into the ECU. Here is my journey so far:
1. Tried around with the Additional-Instruments on Bench with Arduino CAN-Shield. A Friend of mine gave me the tip to try to send CAN-Message 0x588 with Byte5 set to a value will to the trick. It did work.
2. Looked it up on Funktionsrahmen. It looks that this functionality is not implemented at all, and it always sends 0 on Byte5.
3. Dumped the binary with Kess from a friend and started to looking for Definition Files. Found some which were supposed to be "well documented" for Tunerpro, unfortunately it has not much tables. Found a documented binary + winols project here:  http://nefariousmotorsports.com/forum/index.php?topic=18618.0. Started with this binary as a start.
4. Started disassembly with IDA Pro using Basano Tutorials. IDA Pro turned to be out really complicated to use.
5. Switched to Ghidra as i had some previous experience with it. Unfortunately there is no tutorial for Ghidra + MED9.1.
For anyone wanting to use ghidra, use PPC(Big Endian) and set following registers and you are good to go:
assume r13 = 0x7ffff0
assume r2 = 0x5c9ff0
Memory map can be used from Basano Tutorial.

6. Started looking around for entry points for CAN-Bus Messages. Found "PMAXKBI_W" in WINOLS. Address is 005c6300. Used as entry point in Disassembly
7. Found Mot8Byte6 under 008043b1(by reference from PMAXKBI_W)
8. Found Mot7Byte5 under 008043a0 (by reading Basano tutorial and assuming that the CAN-Buffers are all nearby)
9. Found that the "boost pressure" which will be written there will be under 008028e
10. Got a spare ECU and tried to build up a Bench-Setup. Unfortunately i cannot write binary to the spare ecu due to the Immo being active. Need to buy BDM100/or KTAG to proceed further.

Questions so far:
1. Has anyone done it before?
2. Is there any tool which can read/write ram on MED9.1 using TP2.0? I have seen some basic scripts in python which can do it, however i would really appriciate if there is any tool which is capable of doing it.
3. Can someone confirm/decline my findings regarding adresses? The file which i am currently using is 1K0907115.

Greatings
Elias
Logged
cherry
Full Member
***

Karma: +24/-2
Offline Offline

Posts: 246
« Reply #1 on: October 08, 2022, 11:26:40 AM »
1K0907115 is for sure not a BWA file. Anyway in 1K0907115 the codeword to enable the message is at 1C5EFB.
Logged
cherry
Full Member
***

Karma: +24/-2
Offline Offline

Posts: 246
« Reply #2 on: October 08, 2022, 11:33:39 AM »
Why you cannot even write correct part number or upload your file? For the BWA file from other thread it should be at 1C6338...
Logged
elias
Full Member
***

Karma: +17/-3
Offline Offline

Posts: 59
« Reply #3 on: October 08, 2022, 06:27:32 PM »
Hello cherry,

Sorry for my manners. I should have posted my dumps with my first post. I am currently using the WINOLS map, which seems to be very similar to the one which i have on my spare ECU. At least the can-bus buffers seems to match between both dumps.

On the dump-from-winols.bin i can find A5 in 1C5EFB, however no References. On 1C6338 i can find a refence to the function which writes the boost. I suppose that i need to write a 1 to the address to enable this function
.
However i still do not understand correctly how its working
According to the "pseudocode" of ghidra the change in the dumpfile will be executed "after" the memory variable has been written. I suppose that it might have something to do with multiple runs of this function, when something else happens which will trigger the code above.

Code:
.....
  if ((uVar2 & 0x20) != 0) {
    uVar2 = read_volatile_2(DAT_007fd6ec);
    if (uVar2 < 0xff00) {
      uVar7 = (undefined)((uint)uVar2 >> 8);
    }
    else {
      uVar7 = 0xfe;
    }
    write_volatile_1(DAT_008028e5,uVar7);
    uVar2 = read_volatile_2(DAT_007fd6ea);
    if (uVar2 < 0xff00) {
      uVar7 = (undefined)((uint)uVar2 >> 8);
    }
    else {
      uVar7 = 0xfe;
    }
    write_volatile_1(DAT_008028e4,uVar7);
    uVar2 = read_volatile_2(DAT_007fd902);
    iVar13 = (uint)uVar2 * 0x485 + 0x8000;
    local_4 = (ushort)((uint)iVar13 >> 0x10);
    if (local_4 < 0x59) {
      cVar9 = (char)((uint)iVar13 >> 0x10) + -0x5a;
    }
    else {
      cVar9 = -2;
    }
    write_volatile_1(BOOST_PRESSURE_MEMORY_008028e,cVar9);
    uVar11 = read_volatile_2(DAT_007fd6b8);
    uVar2 = read_volatile_2(DAT_007fcdba);
    if ((uVar11 < uVar2) && (uVar2 = read_volatile_2(DAT_007fcdbc), uVar2 != uVar11)) {
      uVar7 = 0;
    }
    else {
      uVar7 = 1;
    }
    write_volatile_1(DAT_007fe9f0,uVar7);
  }
  if ((BOOST_ENABLED_FLASH_1C6338 & 1) == 0) {
    return;
  }

Many thanks for providing the adress. I will give it a try and hope it will work.

So my plan is for now:
1. Change the address
2. Adjust the Checksums with MED9Tool
3. Flash it to the ECU
Logged
prj
Hero Member
*****

Karma: +915/-427
Offline Offline

Posts: 5840
« Reply #4 on: October 09, 2022, 12:32:32 AM »
My logger will read RAM.
Write no, but you can read all you want.
www.vehical.net
Logged
PM's will not be answered, so don't even try.
Log your car properly.
sonique
Sr. Member
****

Karma: +24/-12
Offline Offline

Posts: 283
« Reply #5 on: October 09, 2022, 05:17:21 AM »
CWLDANZ  Codeword for Boost Gauge
just need correct bit enable
Logged
elias
Full Member
***

Karma: +17/-3
Offline Offline

Posts: 59
« Reply #6 on: October 09, 2022, 02:17:13 PM »
Hello everyone,

I made a lot of progress today:
1. Realized that i can make IMMO-Off on the spare ECU with an EEPROM reader + KESS. Did exactly that. Wanted to have a Backup-ECU if something goes wrong while flashing it into the car.
2. Dumped original ECU(which is in the car), patched the address(0x1C6338), corrected checksums using WINOLS and flashed it back.

Result:
Kind of working, but not without problems:
Before the flash, the gauge was not doing anything.
Currently it does go to 2 bar as soon as you idle the car. As soon as you start driving, it starts moving to 3 bar. It does respond to throttle, but always moves between 2 and 3 bars. I suspect that the gauge is expecting the data in different format.


My plan changed to:
1. I will try to tinker around with my ArduinoCan-Shield and try to find the values which will set the gauge to different values (1 bar, 2 bar, 3 bar).
2. I will monitor the values which the ECU is sending out. I assume that it will send the boost pressure in decimal settings(seen it in Funktionsrahmen).

0x00 = 0 bar
0x7F(decimal 127) = 1,27 bar
0xFE(decimal 254) = 2,54 bar
3. Write some function in ASM which will do the mapping

I researched the code, and it seems that it is calculated here:
Code:
004fac44:

    uVar2 = read_volatile_2(BOOST_VARIABLE_7fd902);
    iVar13 = (uint)uVar2 * 0x485 + 0x8000;
    local_4 = (ushort)((uint)iVar13 >> 0x10);
    if (local_4 < 0x59) {
      cVar9 = (char)((uint)iVar13 >> 0x10) + -0x5a;
    }
    else {
      cVar9 = 0xFE;
    }
    write_volatile_1(BOOST_VARIABLE_00802E2,cVar9);
Logged
elias
Full Member
***

Karma: +17/-3
Offline Offline

Posts: 59
« Reply #7 on: October 10, 2022, 03:59:39 PM »
Okey, i got some progress today.

1. I have installed my arduino with can-bus shield into the car
2. Created the Mapping table for the gauge by trying out different values(see boost-gauge-table.png)
3. Realized that probably the output of the ECU Function needs to be divided by 2 to output the right value for the gauges.
4. Tried to program it (see screenshots for full code):
4.1 Basically replaced the "if" with NOP(ori r0,r0,0) codes as i consider its not needed anymore. What it basically was doing, is putting a maximal value, if the value was to high. As it should not happen if you divide by 2, i removed it. Also i needed space for my code.
4.2 Basically used rlwinm which will byteshift right by 1 bit. This is basically the divide by 2.
5. Will flash it tomorow and test it. Hopefully it will work.

Questions:
1. Unfortunately i assume that the "Pseudocode Generator" of Ghidra is buggy, or i do not understand why its showing me different results for the "addi r5,r6,0x5a" code. The bytecode is same, so in my opinion it should return the same result. But on the original code, it shows me " + -0x5A" and on patched code, it shows me "0x5A". I dont know exactly what happens, because the ADDI function should result in the same "pseudocode"..Can someone please explain if its a bug in ghidra?
2. Can someone please review my code and tell me if its okey to do it this way?


Many thanks in Advance,
Elias
Logged
fknbrkn
Hero Member
*****

Karma: +177/-18
Offline Offline

Posts: 1402


mk4 1.8T AUM
« Reply #8 on: October 11, 2022, 12:58:06 AM »
Just log can byte with arduino
FR shows same conversion formula as pvdkds so its just an absolute pressure
Logged
elias
Full Member
***

Karma: +17/-3
Offline Offline

Posts: 59
« Reply #9 on: October 11, 2022, 02:34:17 AM »
I did already a logging with Arduino.


The FR shows that MED9.1 will send the data according to following formula:
<bar><mot7byte5>
1 Bar = 100
1.5 Bar = 150
2 Bar = 200

So basically, the gauge will display correct value if you send following:
<bar><mot7byte5>
1 Bar = 50
1.5 Bar = 75
2 Bar = 100

By that i deduce that i need to divide the output of the ecu function by 2 , to achieve the result which is needed to make the gauges work correctly.
Logged
fknbrkn
Hero Member
*****

Karma: +177/-18
Offline Offline

Posts: 1402


mk4 1.8T AUM
« Reply #10 on: October 11, 2022, 03:02:40 AM »
You have to subtract atmosperic pressure to get boost from absolute pressure

Then do some math or map() with arduino to calibrate gauge

Idk why you make this things so complex
Logged
cherry
Full Member
***

Karma: +24/-2
Offline Offline

Posts: 246
« Reply #11 on: October 11, 2022, 06:09:07 AM »
Never heard that there are such problems after retrofit, i do not expect VW change factor in newer MED9.1 ecu. Btw. 1 bar on this intrument is atmospheric pressure, so it should show 1 bar at engine off.

Maybe the intrument is broken, did you check values with VCDS? Did you make output test, does the pointer work correct? Are there any coding options in the instrument?
« Last Edit: October 11, 2022, 06:16:05 AM by cherry » Logged
elias
Full Member
***

Karma: +17/-3
Offline Offline

Posts: 59
« Reply #12 on: October 11, 2022, 10:54:21 AM »
Quote from: cherry on October 11, 2022, 06:09:07 AM
Never heard that there are such problems after retrofit, i do not expect VW change factor in newer MED9.1 ecu. Btw. 1 bar on this intrument is atmospheric pressure, so it should show 1 bar at engine off.

Maybe the intrument is broken, did you check values with VCDS? Did you make output test, does the pointer work correct? Are there any coding options in the instrument?

I think its related to the fact that this gauges were never sold with the MED9.1 motors. They appeared on the VW Beetle Facelift and VW Scirocco Facelift. Both were produced long after the MED9.1 was canceled.

Nevertheless, i am 100% sure that the gauges are working correctly, as the oil-gauge is working fine and i can drive the boost-gauge with my arduino. I suppose they just changed the mapping to allow higher boost values. The original values from FR are limited to 2,55 bar(0xFF) , and the gauge can drive up to 3 bar. So it makes sense, that they just divided the value by 2 to make it work.

Regarding pointers: they are working fine.
Regarding Coding-Options: I checked but there are no related coding options in this gauges.

I did the changes however they havent change any visible value. I suppose that i havent found the correct can-bus buffer on this firmware.

Question:
Does someone know the adresses of the Canbus-Buffer on the  firmware?
I know that the one for MOT8-Message Can Buffer is starting at 008043ac. I am searching for the MOT7-Message Can-Buffer so i can modify the value before it will be sended out. I assumed that it would be at 008043a0, however this was not the case...
« Last Edit: October 11, 2022, 10:56:21 AM by elias » Logged
sonique
Sr. Member
****

Karma: +24/-12
Offline Offline

Posts: 283
« Reply #13 on: October 11, 2022, 11:09:21 AM »
i think u are wrong
1K8907115L
 sold until 2018
this binary enable boost gauge 
Logged
elias
Full Member
***

Karma: +17/-3
Offline Offline

Posts: 59
« Reply #14 on: October 12, 2022, 05:33:49 PM »
Quote from: sonique on October 11, 2022, 11:09:21 AM
i think u are wrong
1K8907115L
 sold until 2018
this binary enable boost gauge 

many thanks, learned something new. I was thinking that the ECU was dropped after the Golf 6R...

1. I got a binary(1K8907115L) from http://nefariousmotorsports.com/forum/index.php?topic=14741.0
2. Loaded in Ghidra and wanted to compare the code
3. Oh boy - nothing is same between my binary and 1K8907115L. Cannot find any common adresses etc. Also do not have any Damos for that file. I stopped it here as i really doubt that i can "copy" it over from that file.
4. I really doubt that its a good idea to flash this file onto my car, as its designed for the 280PS CDL Engine and i have only 200PS BWA Engine.
5. My plan would be first of all to do some base-research...i need to find the adresses of the canbuffers on my binary to move forward with this project. Idea is still to "reprogram" the code which is writing the can-message.


Questions so far:
1. Does anyone adapted the 1K8907115L Binary for BWA motor? Maybe someone did already, however its very unlikely that someone done it.
2. Does anyone know where the can-buffers are located on my binary?
Logged
Pages: [1] 2
  Print  
« previous next »
 
Jump to:  

Navigation
Personal Tools
  • April 27, 2024, 08:16:50 AM
  • Welcome, Guest. Please login or register.
    Did you miss your activation email?

    Login with username, password and session length
Search
 
Advanced Search
About Disclaimer
All Rights Reserved 2010 Nefarious Motosports
Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.025 seconds with 17 queries. (Pretty URLs adds 0s, 0q)