I'm sharing some documents that might be useful. It describes the ME7 EEPROM structure, every KWP2000 Bosch services and the differences between C167 and ST10 (like getting the ECU into a 0x85 session)
I know this is old stuff, but I have used it recently to write an OBD2 flasher for ME7.1.1, both C167CS and ST10F275
Writing byte to eeprom page :
![](https://larochellej.com/sub-eeprom.png)
![](https://larochellej.com/sub-eeprom-example.png)
EEPROM layout document which page can be written :
![](https://larochellej.com/eeprom-write-allowed.png)
Set ST10 in 0x85 :
![](https://larochellej.com/session-85-st10.png)
Programming is done through CAN-bus. Most other services (DDLI for example) are only availaible through K-Line. If you get a 0x90 negative response code, try the service on K-Line instead