How to turn the ecu into test mode?
Coding the ECU as test model is done in the eeprom, you have to change some data values:
in pages 1 and 2 you will find 69,C1, and A5, replace these by 8E,5A, and D2,
then update the checksums of both pages. I believe you (or other experienced users)
can manage this without more detailed instructions (and the noob's anyway shouldn't
do).
I do not know what could be changed by setting to test model besides the following:
- the data checksum results will be ignored by the ECU,
- you can start a programming session even if the ECU is locked for some time after
sending a wrong security key,
- you can download data to the flash without ciphering and compressing.
On ME7.5 images, when you have started a programming session (85) and
are requesting ecuIdentification with param 9B, the last string you get has 5 characters.
If the last character of this string shows a '*', this indicates your ECU is coded as test model. I think this is not done for ME7.1 images.
Be aware: this results from code reading and simulations, not yet tested by me on real hardware.