underscore
Newbie
Karma: +0/-0
 Offline
Posts: 17
|
 |
« on: February 13, 2013, 03:25:52 AM »
|
|
|
I have an rs4 8D0907551F here which was previously mapped by a tuner and I want to get a backup of the file as it has recently been rebuilt and I would like to map this car for a friend. Ecu is in the car with the instrument cluster and it starts.
I have tried nefmoto I can read the ecu info etc but when I select read flash I get the following:
12/Feb/2013 07:03:39.836: LOG: User Prompt - Title: Confirm Full Read ECU Flash Memory Message: If you are ready to read, confirm the following things:
1) You have loaded a valid memory layout for the ECU.
2) The engine is not running.
Note: Some non-standard flash memory chips may prevent reading the flash memory.
Click OK to confirm, otherwise Cancel. Result: OK
12/Feb/2013 07:03:39.837: USER: Disabling Windows sleep mode.
12/Feb/2013 07:03:39.860: USER: Reading ECU flash memory.
12/Feb/2013 07:03:39.892: LOG: Reading ECU identification option: 0x9C
12/Feb/2013 07:03:39.896: LOG: Sent message with service ID ReadECUIdentification
12/Feb/2013 07:03:39.942: LOG: Received message with service ID: ReadECUIdentificationPositiveResponse
12/Feb/2013 07:03:39.944: LOG: Read ECU identification option: 0x9C
12/Feb/2013 07:03:39.945: LOG: Successfully read ECU identification information
12/Feb/2013 07:03:39.951: USER: ECU reports programming session preconditions have been met.
12/Feb/2013 07:03:39.952: USER: Negotiating communication timings.
12/Feb/2013 07:03:39.953: LOG: Reading current communication timings.
12/Feb/2013 07:03:39.955: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:40.002: LOG: Received message with service ID: AccessTimingParametersPositiveResponse
12/Feb/2013 07:03:40.004: LOG: Set timing parameters to new values.
12/Feb/2013 07:03:40.005: LOG: Setting communication timing to defaults.
12/Feb/2013 07:03:40.059: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:40.098: LOG: Received message with service ID: AccessTimingParametersPositiveResponse
12/Feb/2013 07:03:40.099: LOG: Reading current communication timings.
12/Feb/2013 07:03:40.163: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:40.204: LOG: Received message with service ID: AccessTimingParametersPositiveResponse
12/Feb/2013 07:03:40.206: USER: Successfully changed to new communication timings.
12/Feb/2013 07:03:40.208: USER: Requesting security access.
12/Feb/2013 07:03:40.239: LOG: Sent message with service ID SecurityAccess
12/Feb/2013 07:03:40.280: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.281: LOG: Received negative response for service ID: SecurityAccess, with response code: GeneralReject
12/Feb/2013 07:03:40.284: USER: ECU reports that security access request was rejected.
12/Feb/2013 07:03:40.287: LOG: Starting ProgrammingSession diagnostic session with 124800 baud rate.
12/Feb/2013 07:03:40.288: USER: Starting diagnostic session.
12/Feb/2013 07:03:40.319: LOG: Sent message with service ID StartDiagnosticSession
12/Feb/2013 07:03:40.362: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.363: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.402: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.403: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.442: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.443: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.482: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.483: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.522: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.523: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.556: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.557: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.596: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.597: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.634: LOG: Received message with service ID: StartDiagnosticSessionPositiveResponse
12/Feb/2013 07:03:40.636: LOG: Setting communication timings to defaults.
12/Feb/2013 07:03:40.637: LOG: Set timing parameters to defaults.
12/Feb/2013 07:03:40.638: LOG: Changed diagnostic session type to: ProgrammingSession
12/Feb/2013 07:03:40.639: LOG: ECU requesting specific baud rate: 124800
12/Feb/2013 07:03:40.640: USER: Successfully started diagnostic session.
12/Feb/2013 07:03:40.641: USER: Negotiating communication timings.
12/Feb/2013 07:03:40.642: LOG: Reading current communication timings.
12/Feb/2013 07:03:40.693: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:40.696: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 0 of 9 bytes.
12/Feb/2013 07:03:40.697: LOG: Expected: 07 83 02 32 28 6E 14 0A 72
12/Feb/2013 07:03:40.698: LOG: Read: F0 F0 81 99 94 FF 8A 85 F9
12/Feb/2013 07:03:40.699: LOG: Clearing remaining expected echo bytes.
12/Feb/2013 07:03:42.704: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:42.705: LOG: Flushing 9 bytes from receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:42.706: LOG: Message received no replies.
12/Feb/2013 07:03:42.707: LOG: Resending message. Send attempts: 2
12/Feb/2013 07:03:42.757: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:42.760: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 0 of 9 bytes.
12/Feb/2013 07:03:42.761: LOG: Expected: 07 83 02 32 28 6E 14 0A 72
12/Feb/2013 07:03:42.762: LOG: Read: F0 F0 81 99 94 FF 8A 85 F9
12/Feb/2013 07:03:42.763: LOG: Clearing remaining expected echo bytes.
12/Feb/2013 07:03:44.768: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:44.769: LOG: Flushing 9 bytes from receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:44.770: LOG: Message received no replies.
12/Feb/2013 07:03:44.771: LOG: Resending message. Send attempts: 3
12/Feb/2013 07:03:44.821: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:44.824: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 0 of 9 bytes.
12/Feb/2013 07:03:44.825: LOG: Expected: 07 83 02 32 28 6E 14 0A 72
12/Feb/2013 07:03:44.826: LOG: Read: F0 F0 81 99 94 FF 8A 85 F9
12/Feb/2013 07:03:44.827: LOG: Clearing remaining expected echo bytes.
12/Feb/2013 07:03:46.832: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:46.833: LOG: Flushing 9 bytes from receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:46.834: LOG: Message received no replies.
12/Feb/2013 07:03:46.835: LOG: Failed to send message 3 times, message send failed.
12/Feb/2013 07:03:46.836: LOG: Did not receive any replies to message.
12/Feb/2013 07:03:46.842: USER: Reading ECU flash memory failed.
12/Feb/2013 07:03:47.347: LOG: Sent message with service ID TesterPresent
12/Feb/2013 07:03:47.350: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 0 of 4 bytes.
12/Feb/2013 07:03:47.351: LOG: Expected: 02 3E 01 41
12/Feb/2013 07:03:47.352: LOG: Read: 81 BF C0 C0
12/Feb/2013 07:03:47.353: LOG: Clearing remaining expected echo bytes.
12/Feb/2013 07:03:47.608: LOG: User Prompt - Title: Reading ECU Flash Memory Complete Message: Reading ECU flash memory failed. Result: OK
12/Feb/2013 07:03:47.610: USER: 100% complete.
I have soldered a switch on the ecu for boot mode and I can confirm that it does get into boot mode as when it is held for 5-10 seconds when ignition is switched on nefmoto can no longer get a read on it but galletto says boot mode inactive.
What else can I try to read the file off it? I don't dabble too much into euro ecus so don't stock much equipment for them really.
Could it be the previous tuner has done somethiing (more than likely) so that flash cannot be read? nothing has been soldered/desolder on the ecu.
|
|
|
|
|
Logged
|
|
|
|
|
aef
|
|
« Reply #1 on: February 13, 2013, 03:59:55 AM »
|
|
|
Have you tried it with pulled dash- and radiofuse?
Tried it on the bench with less voltage?
Please try argdubs 94050 tool to see if bootmode is working.
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2 on: February 13, 2013, 04:01:00 AM »
|
|
|
Boot mode has to be done on bench, forget it in the car, you will never get through the cluster.
Pulling fuses, forget it, won't work.
|
|
|
|
|
Logged
|
|
|
|
underscore
Newbie
Karma: +0/-0
Offline
Posts: 17
|
|
« Reply #3 on: February 13, 2013, 04:06:23 AM »
|
|
|
Damn it, I'll see if I can get a hold of the ecu harness to make a bench rig. I have the powersource already PS-9KX 13.8 volt regulated supply.
So is it because the tuner has applied some form of encryption that I cannot get read using nefmoto?
I just checked and I am unable to get it into bootmode on the car as nefmoto does not connect in "boot mode"
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #4 on: February 13, 2013, 05:31:05 AM »
|
|
|
The problem is not the ECU, it's the cluster. Forget boot moding anything with Euro immo cluster in car.
|
|
|
|
|
Logged
|
|
|
|
|
aef
|
|
« Reply #5 on: February 13, 2013, 05:42:44 AM »
|
|
|
Nefmoto wont work because of the NOREAD tag?
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #6 on: February 13, 2013, 05:45:45 AM »
|
|
|
Nefmoto wont work because of the NOREAD tag?
No, because seed key was changed it seems. |
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #7 on: February 13, 2013, 08:16:15 AM »
|
|
|
NOREAD only keeps you from opening the file with winOLS.
If you want to open the file once you get it, just load it into a hex editor, search for any instances of NOREAD in ascii, and FF them out. Then, open with winOLS.
|
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
|
aef
|
|
« Reply #8 on: February 13, 2013, 12:29:00 PM »
|
|
|
NOREAD keeps MPPS from pulling the file thatswhy i thought nefmoto flasher behaves this way.
Back to topic
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #9 on: February 13, 2013, 12:29:50 PM »
|
|
|
NOREAD keeps MPPS from pulling the file thatswhy i thought nefmoto flasher behaves this way.
Back to topic
It does not keep it from pulling the file, just keeps you from saving it. Open process memory and search for NOREAD. If that no longer works, it is possible to hook the cable driver ... |
|
|
|
|
Logged
|
|
|
|
|
aef
|
|
« Reply #10 on: February 13, 2013, 12:36:51 PM »
|
|
|
Right, i remember to bypass this and copy the image from the memory somehow.
And there is the noread hack mpps.exe
But Nefmoto Software didnt care about noread tag, right?
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #11 on: February 13, 2013, 12:49:23 PM »
|
|
|
Right, i remember to bypass this and copy the image from the memory somehow.
And there is the noread hack mpps.exe
But Nefmoto Software didnt care about noread tag, right?
I don't think nefmoto cares. But in this case seed key was changed. |
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #12 on: February 13, 2013, 01:03:08 PM »
|
|
|
Nefmoto doesn't care one bit about noread. I have read files from ecu's and been unable to open them with winOLS, had to change the NOREAD tag.
|
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
underscore
Newbie
Karma: +0/-0
Offline
Posts: 17
|
|
« Reply #13 on: February 15, 2013, 05:38:14 PM »
|
|
|
Got it to read using a spare harness on the bench in boot mode.
So now I have a backup of the original can I just flash a stock file and be able to flash over obd with the ecu in the car? or will I have to remove the immobiliser as well? I did a search but this wasn't as clear.
|
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #14 on: February 15, 2013, 05:48:28 PM »
|
|
|
If you want to flash on the bench, you will need to disable immobilizer. PRJ has repeatedly said that flashing earlier cars via obd doesn't work so well, so I would assume you can't flash via OBD (at least reliably). Make a backup of the eeprom, then disable the immobilizer, flash your file, and finally flash the original eeprom data back to the ecu, thus preserving your immobilizer functions. (I'd wait until the tune was dialed in first, that way you don't have to disable the immo before every write).
On another note, I'd love it if you could get me the .bin from your cluster. The software required to do so is in a sticky entitled "Bench flash s4 gauges with vag com" or something similar in the immobilizer/cluster section. If you get a chance, post it (and the matching eeprom) in the cluster dumps section!
|
|
|
|
« Last Edit: February 15, 2013, 05:49:59 PM by ddillenger »
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
|
