|
tao13
|
 |
« on: January 02, 2025, 05:43:51 AM »
|
|
|
I tried some asm modification in my file and wrote in my ecu. Some of them works but when i tried to make a modification to keep a value in eeprom the ecu was blocked.
I can write eeprom and flash in bootmode but it not start/boot , after power on it looks like remaining in the boot mode.
I can read too the flash and eeprom in bootmode and they are exactly like i wrote.
Some advice please?
|
|
|
|
« Last Edit: January 02, 2025, 05:51:30 AM by tao13 »
|
Logged
|
|
|
|
Dande
Full Member
Karma: +2/-0
 Offline
Posts: 51
|
|
« Reply #1 on: January 02, 2025, 02:15:50 PM »
|
|
|
What ECU are you trying this on?
|
|
|
|
« Last Edit: January 02, 2025, 02:22:28 PM by Dande »
|
Logged
|
|
|
|
|
tao13
|
|
« Reply #2 on: January 02, 2025, 03:04:40 PM »
|
|
|
sorry
it is a me7.5 from 1.8t 20v BAM engine with Bootrom Version = 05.12
|
|
|
|
« Last Edit: January 03, 2025, 12:52:05 AM by tao13 »
|
Logged
|
|
|
|
|
tao13
|
|
« Reply #3 on: January 04, 2025, 05:24:29 AM »
|
|
|
Nobody?
I tried with mpps and galleto write in bootmode eeprom and flash too with stock files. As i wrote i can read them in bootmode after wrote and they are identicaly with what i wrote.
Ecu not respond to vcds and me7logger.
Looks like it remaining in boot mode because the current of it is the same like i put it in bootmode = 15-16mA.
I will try it to my car , but if not respond on bench to vcds, i think i will try for nothing.
|
|
|
|
|
Logged
|
|
|
|
|
tao13
|
|
« Reply #4 on: Yesterday at 04:56:25 AM »
|
|
|
prj , nyet , fknbrkn , _namekess , blazius , some ideea?
|
|
|
|
|
Logged
|
|
|
|
|
gremlin
|
|
« Reply #5 on: Yesterday at 05:32:09 AM »
|
|
|
Need to see what was changed in the asm patches.
For example, maybe some MCU port pins are broken after a bad reconfiguration.
|
|
|
|
|
Logged
|
|
|
|
|
tao13
|
|
« Reply #6 on: Yesterday at 06:38:33 AM »
|
|
|
I try to learm, so the code is not important. I went to make a simple test to write in eeprom (2870FA) value 2 or 3.
First i called my subrotine from where a launch code was called 0x9DD54 (where was this movb rl4, byte_380990 but i put in my last line of my code) and the code is this:
sub_8AAFEC:
extp #0E1h, #1
mov r4 , word_3870FA
cmp r4 , #5
jmpr cc_ULE , loc_8AAFF8
mov r4, #2
jmpr cc_UC, loc_8AAFFC
loc_8AAFF8:
mov r4, #3
jmpr cc_UC, loc_8AAFFC
loc_8AAFFC:
extp #0E1h, #1
mov word_3870FA , r4
extp #0E1h, #1 ; 'ß'
movbz r14, word_3870FA
calls 82h, sub_825F18
movb rl4, byte_380990
rets
After i tried to call from here 0x78FCC(like stuydub made in his code but i found the right subroutine for my ecu and where the code was calls 82h, sub_825CC0) and i replace last 2 lines from upstairs because only with rets.
After i put the second modification on ecu , ecu not start , like i said it looks like it remaing in boot mode.
I attached my stock file here.
Thanks in advance
|
|
|
|
« Last Edit: Yesterday at 06:42:39 AM by tao13 »
|
Logged
|
|
|
|
|
IamwhoIam
|
|
« Reply #7 on: Yesterday at 09:21:21 AM »
|
|
|
I don't think anyone is going to want to help you without seeing what exactly you have flashed in your ECU.
|
|
|
|
|
Logged
|
I have no logs because I have a boost gauge (makes things easier)
|
|
|
|
tao13
|
|
« Reply #8 on: Yesterday at 01:04:25 PM »
|
|
|
modified file atached
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #9 on: Yesterday at 03:05:21 PM »
|
|
|
The ECU can't "remain in boot" on these.
It goes into bootstrap mode only if a certain combination of pins has certain values.
If it goes into bootmode every time without shorting pin 24 to ground it means you probably damaged something on the board physically. Nothing to do with the code in the ECU.
However you said something about EEPROM, if you call the actual EEPROM write or checksum function (not writing the mirror) in a tight loop you will kill the eeprom chip.
|
|
|
|
|
Logged
|
|
|
|
Geomeo
Full Member
Karma: +11/-7
 Online
Posts: 158
|
|
« Reply #10 on: Yesterday at 07:20:48 PM »
|
|
|
A visual representation of what I think happened to your ECU.......
|
|
|
|
|
Logged
|
|
|
|
|
tao13
|
|
« Reply #11 on: Today at 12:49:36 AM »
|
|
|
Thanks PRJ!
I will try these days after i buy a new eeprom to resolder a new one, even if i read and write it on boot mode and it looks ok.
Ecu had a wire solder on it from a long time and it was with case on it , so a shortcut was impossible to happen.
I said it looks like remaining in bootmode because i saw the same current (amperage) on the power supply like when i put it in bootmode , aproximatly 0.16mA withpout any cable connected to it.
I can write and read in bootmode, so the processor it make its job to make bypass.
I will change the eeprom and i will inform you.
PS:
geomeo.....
|
|
|
|
« Last Edit: Today at 01:27:33 AM by tao13 »
|
Logged
|
|
|
|
|
tao13
|
|
« Reply #12 on: Today at 01:01:52 AM »
|
|
|
geomeo.....the attached picture looks better than monkey ........it is my actual ecu on the car with dual flash from 5 years ago.
The broken ecu is the test ecu on beanch and i want to learn asm for c167...all of us was a monkey in the past.
|
|
|
|
|
Logged
|
|
|
|
|
