Hi,
I'm currently working on switching from Ols to TunerPro with an eeprom emulator to live tune.
In order to, I have to find a way to manage Checksums:
First way, finding the algorithm of calculation and implement it in a .dll plugin for TunerPro
Or second, disable checksum.

For the first solution I have identified the checksum zone and associated checksum addresses. I try all the calculation method in TunerPro (sum, complement 1, complement 2) and others in HxD and none of them fit the one calculated with Ols.
I have hearded that EDC15 checksum are is calculated with bit shifting and factors but no more precise information ?

For the second solution I have the Irom disassemble in IDA Pro, if there is a way to completely disable checksum of the flash, that might be easier ?

I will post zone addresses and associated checksum addresses.

Attached my ori file

Waiting to hearing from you guys.

Thanks in advance

Thanks for the answer.
So I have to find a way to disable it.
I've read that their are different things to change.
If I understand well, some values control the checksum at the start of the motor and others while the motor is running.

I've try this on my file:
1. Search for "47 F8 55 00 CC 00 CC 00" (1 match)
2. Search forward for "E6 F4 FF DF", notice the address, save the last 4 bytes (0x69E0A -> 9E0A)
3. Change "47 F8 55 00 CC 00 CC 00" to "47 F8 55 00 EA 00 0A 9E" (use the last 4 bytes loHi)

but "47 F8 55 00 CC 00 CC 00" doesn't exist in my file.

Will I have to modify the irom to disable it. Or it can be done in the flash directly?

I have the irom disassemble in IDA. I've looked at it sometime ago in order to modify it for multimap purpose. For this, we have to patch a specific checksum in this part of the code (0x10000-0x13FFF range).
But is the checksums I need to patch are in the irom or in the Flash (and their I will have to disasemble the Flash ?)
Thanks for the help

You'r right I'm sorry I messed up on the adresses.

0x00000 -> 0x08000 is the internal Rom
08001 -> 7FFFE is the external flash
if I understand well

I got the Interal Rom from someone who read it with minimon.

I will read more about C167 datasheet and will be back with news hopefully

Thanks

I've now a partially disassembled file.
0 -> 8000 IROM
and flash loaded at 80000

I've also disassembled a edc15p file, found the checksum function and the 4 jumps that have to be modified (easy with all the information on forums).

In edc15c2 here are the zones of checksums i've found (with some testing):

08000-0FFFF
10000-13FFF
14000-5FFFF
60000-60FFF
61000-6BCFF
70000-70FFF
71000-7BCFF
 
From what I've seen, previous checksums doesn't feed next ones like on edc15p. Am I right ?

I've found one checksum function in the Irom but is it the only one ? (it's only called 2 times in the flash that what bother me)