fknbrkn
Hero Member
Karma: +186/-24
 Offline
Posts: 1455
mk4 1.8T AUM
|
 |
« Reply #105 on: September 06, 2019, 04:50:00 AM »
|
|
|
usage with explorer context menu
win+r
regedit
HKEY_CLASSES_ROOT\*\shell
make new dir name as you want ('fix cs' for example)
make new dir inside previous name it 'command'
so your final path should be \HKEY_CLASSES_ROOT\*\shell\fix cs\command
change default value at the right side to
C:\\windows\\system32\\cmd /k C:\VW\me7check\me7sum.exe "%1" "%1" & pause & C:\VW\me7check\me7check.exe "%1" & pause & pause & exit
with path changes to yours
now right click on a flash file, select 'fix cs'
|
|
|
|
« Last Edit: September 06, 2019, 04:51:48 AM by fukenbroken »
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #106 on: March 09, 2021, 01:25:54 PM »
|
|
|
Done quite a few updates today! It can now identify a few more variants/strains of routine as well as detecting and then pulling the correct DPPx register out of a given rom. This makes it quite a bit easier to set things up for correct reversing. Also added the ability to do the calculations of the multipoints now too as well as finding the xorCalcuationTable in a given rom (if it exists) and dumping its xortable too  ... Have fun Here's what dppx analysis looks like... Loaded ROM: Tool in 1Mb Mode
-[ DPPx Setup Analysis ]-----------------------------------------------------------------
>>> Scanning for Main ROM DPPx setup #1 [to extract dpp0, dpp1, dpp2, dpp3 from rom]
main rom dppX byte sequence #1 found at offset=0x64a6.
dpp0: 0x0000
dpp1: 0x0205
dpp2: 0x00e0
dpp3: 0x0003 (DPP3 is always 3, otherwise accessing CPU register area not possible)
Argh, revisited this again today. What a mess :/ I wish you had built on my code so i could merge this in more easily |
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
reactor5design
Newbie
Karma: +0/-0
Offline
Posts: 2
|
|
« Reply #107 on: October 14, 2021, 11:37:03 AM »
|
|
|
I calculated the checksums with the help of the me7sum tool and flashed it into the car, but it killed the control unit. Then I checked it with WinOLS and it detected bad checksums. Where can there be a mistake? I am attaching files ..
|
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #108 on: October 14, 2021, 08:50:58 PM »
|
|
|
Thanks for reporting this. Looks like me7sum cannot correct that bin.
It could be there are RSA checks me7sum isn't detecting.
|
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
|
BlackT
|
|
« Reply #109 on: October 14, 2021, 11:34:59 PM »
|
|
|
I work with 1ML906018A and ME7sum without any problems....
|
|
|
|
|
Logged
|
|
|
|
reactor5design
Newbie
Karma: +0/-0
Offline
Posts: 2
|
|
« Reply #110 on: October 15, 2021, 04:29:33 AM »
|
|
|
It worked for 16 edits in the software, but only in 17 it did not calculate correctly. Could it be that the _um maps have changed?
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #111 on: October 15, 2021, 09:56:54 AM »
|
|
|
There is no reason to ever change _UM maps.
Most likely with your edit you caused chain reset of ECU.
Nothing to do with checksum, everything to do with your stupidity in this case.
|
|
|
|
|
Logged
|
|
|
|
xXxCryxXx
Full Member
Karma: +3/-17
Offline
Posts: 157
|
|
« Reply #112 on: October 17, 2021, 05:22:45 PM »
|
|
|
Sometimes i get the same Problem so just Double Check the Corrected file and then it should work perfect i never ever had any kind of issues with me7sum tool
Just try after correction with the me7check the file after that sum it again
|
|
|
|
|
Logged
|
|
|
|
bluelighttube
Newbie
Karma: +0/-1
Offline
Posts: 9
|
|
« Reply #113 on: January 07, 2022, 01:06:36 PM »
|
|
|
Edit: never mind i see it working
|
|
|
|
« Last Edit: January 18, 2022, 02:15:39 PM by bluelighttube »
|
Logged
|
|
|
|
Skowrix
Newbie
Karma: +0/-0
Offline
Posts: 2
|
|
« Reply #114 on: February 02, 2022, 11:22:56 AM »
|
|
|
Hello, A while ago on some AudiA4 forum I found 2 files for 8E0909518AQ - ORI and RearO2offchk. I took ORI file, and changed appropriate maps to disable rear O2 sensor (just to verify my map pack cause I have the same ECU). Then compared my changes with RearO2offchk - changes were exactly the same so I exported the file (KatOff_test) and checksumed it with me7sum (had to do it twice, after the 1st time there was still 1 error). Now ME7Check doesn't report any errors on my file (KatOff_test_chksum2) but it is different than the RearO2offchk from the forum for which me7check is also not reporting any errorrs (I see differences in 7 "sections" of the dump). Can somebody verify these files if chksums are correct? Is it possible that chksums are correct but files are different? Or maybe me7sum/check is not working with this ECU? Attaching files and full logs from me7sum in the zip file (exceeding max lenght of post). Appreciate any reply  ORI (downloaded)ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file c:\8E0909518 katoff test\ORI.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.02
-> EPK = 40/1/ME7.5/5/A505U//24I4/24I4AQ1/061106/
-> Contents of ECUID data table:
- '0261208524' (SSECUHN)
- '1037386624' (SSECUSN)
- '8E0909518AQ ' (VAG part number)
- '0020' (VAG sw number)
- '1.8L R4/5VT ' (engine id)
-> Contents of ECUID data table:
- 'HW_MAN004'
-> No errors found. File is OK. ********************* ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file c:\8E0909518 katoff test\rear02offchk.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.02
-> EPK = 40/1/ME7.5/5/A505U//24I4/24I4AQ1/061106/
-> Contents of ECUID data table:
- '0261208524' (SSECUHN)
- '1037386624' (SSECUSN)
- '8E0909518AQ ' (VAG part number)
- '0020' (VAG sw number)
- '1.8L R4/5VT ' (engine id)
-> Contents of ECUID data table:
- 'HW_MAN004'
-> No errors found. File is OK. ********************* ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file c:\8E0909518 katoff test\KatOff_test.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.02
-> EPK = 40/1/ME7.5/5/A505U//24I4/24I4AQ1/061106/
-> Contents of ECUID data table:
- '0261208524' (SSECUHN)
- '1037386624' (SSECUSN)
- '8E0909518AQ ' (VAG part number)
- '0020' (VAG sw number)
- '1.8L R4/5VT ' (engine id)
-> Contents of ECUID data table:
- 'HW_MAN004'
Page checksum failure(s) found
RSA signature failure found
Data area checksum failure(s) found
-> Found 4 errors!!! ******************************* ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file c:\8E0909518 katoff test\KatOff_test_chksum.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.02
-> EPK = 40/1/ME7.5/5/A505U//24I4/24I4AQ1/061106/
-> Contents of ECUID data table:
- '0261208524' (SSECUHN)
- '1037386624' (SSECUSN)
- '8E0909518AQ ' (VAG part number)
- '0020' (VAG sw number)
- '1.8L R4/5VT ' (engine id)
-> Contents of ECUID data table:
- 'HW_MAN004'
Data area checksum failure(s) found
-> Found 1 error!!! ******************************* ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file c:\8E0909518 katoff test\KatOff_test_chksum2.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.02
-> EPK = 40/1/ME7.5/5/A505U//24I4/24I4AQ1/061106/
-> Contents of ECUID data table:
- '0261208524' (SSECUHN)
- '1037386624' (SSECUSN)
- '8E0909518AQ ' (VAG part number)
- '0020' (VAG sw number)
- '1.8L R4/5VT ' (engine id)
-> Contents of ECUID data table:
- 'HW_MAN004'
-> No errors found. File is OK. ********************* |
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #115 on: February 03, 2022, 09:58:39 PM »
|
|
|
1) what version of me7sum? Make sure you are using the latest.
2) show the output of me7sum or its impossible to guess whats going on.
|
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
|
nyet
|
|
« Reply #116 on: February 03, 2022, 10:00:49 PM »
|
|
|
Sometimes i get the same Problem so just Double Check the Corrected file and then it should work perfect i never ever had any kind of issues with me7sum tool
Just try after correction with the me7check the file after that sum it again
1) what version of ME7Sum 2) please show the *output of me7sum* or I can never fix the issues you're seeing. |
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
Skowrix
Newbie
Karma: +0/-0
Offline
Posts: 2
|
|
« Reply #117 on: February 03, 2022, 10:56:31 PM »
|
|
|
1) what version of me7sum? Make sure you are using the latest.
2) show the output of me7sum or its impossible to guess whats going on.
Hi Nyet, as mentioned in my post full output was attached in the zip file because I couldn't put it to the post due to char limit. However here it is: 1st correctionME7Sum (v1.1.1) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].
Attempting to open firmware file 'c:\8E0909518 katoff test\KatOff_test.bin'
Step #1: Reading ROM info ..
Searching for EPK signature...OK
Searching for ECUID table...OK
EPK : '40/1/ME7.5/5/A505U//24I4/24I4AQ1/061106/'
Part Number : '8E0909518AQ '
SW Version : '0020'
HW Number : '0261208524'
SW Number : '1037386624'
Step #2: Reading ROMSYS ..
Startup section: word[0x008000]+word[0x00FFFE]
@08038 Add=0x00010EEB CalcAdd=0x00010EEB ADD OK
All param page: word[0x010000]+word[0x01FFFE]
@01e512 Add=0x00971D CalcAdd=0x00971D ADD OK
Step #3: Finding CRC table(s) ..
Searching for CRC table(s)...OK
CRC table(s) OK
Step #4: Reading Main Data CRC/Checksums ..
Searching for main data CRC pre block...missing
Searching for main data CRC/csum blocks...OK
Searching for main data CRC offsets...missing
Searching for main data checksum offsets...OK
Main Checksums:
1) 0x010002-0x013FFE CalcCSM: 00147945
2) 0x014252-0x017F4E CalcCSM: 0030B56F
3) 0x018192-0x01FBDC CalcCSM: 004FC931
4) 0x026A00-0x02FFFC CalcCSM: 00896C5D
@9ffea CSM: 00896BA6 CalcCSM: 00896C5D ** FIXED **
Step #5: ROMSYS Program Pages
Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
@00803c Add=0x8F138D CalcAdd=0x8F138D ADD OK
Step #6: Reading RSA signatures ..
Searching for RSA offset #0...OK
Searching for RSA offset #1...OK
Signature: @a599a-a5a1a
Modulus: @16962-169e2
Exponent: @169e2 = 3
Searching for MD5 ranges...OK
MD5 Block Offset Table @1693e [32 bytes]:
1) 0x00010002-0x00013FFE
2) 0x00014252-0x00017F4E
3) 0x00018192-0x0001FBDC
4) 0x00026A00-0x0002FFFC
EncrMD5: a5 57 36 55 f5 83 1e 67 80 46 ed 25 90 73 a7 e6
CalcMD5: 3e 65 8b 0f fd fb 32 b8 bc 02 db 5c 86 9a f4 5a
** FIXED **
Step #7: Reading Main Program Checksums ..
Searching for main program checksum..OK
ROM Checksum Block Offset Table @2bbd6 [16 bytes]:
1) 0x000000-0x00FBFF CalcChk: 4705D818
0x00FC00-0x01FFFF CalcChk: 27351EAB CalcCRC: 6FF76DEC SKIPPED
2) 0x020000-0x0FFFFF CalcChk: AA65AD7B
@fffe0 Chk: AA67FE25 CalcChk: AA65AD7B ** FIXED **
Step #8: Reading Multipoint Checksum Blocks ..
Searching for multipoint block descriptor #1...missing
Searching for multipoint block descriptor #2...OK
1) <1fbde> 0x000000-0x003FFF Chk: 0E59D5C8 Boot: (whitelisted) OK
2) <1fbee> 0x004000-0x007FFF Chk: 1077FB35 Boot: (whitelisted) OK
3) <1fbfe> 0x000000-0x003FFF Chk: 0E59D5C8 CalcChk: 0E59D5C8 OK
..........
64) <1ffce> 0x0F4000-0x0F7FFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
65) <1ffde> 0x0F8000-0x0FBFFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
66) <1ffee> 0x0FC000-0x0FFFFF Chk: 1FFDE002 CalcChk: 1FFDE002 OK
Multipoint #2: [66 blocks x <16> = 1056 bytes]
Step #9: Looking for rechecks ..
*** Found 70 checksums in c:\8E0909518 katoff test\KatOff_test.bin
Attempting to output corrected firmware file 'c:\8E0909518 katoff test\KatOff_te
st_chksum.bin'
├ż Opening 'c:\8E0909518 katoff test\KatOff_test_chksum.bin' file for writing
├ż Writing to file
├ż Validating size correct 1048576=1048576
├ż All OK, closing file
*** DONE! 7/7 error(s) in c:\8E0909518 katoff test\KatOff_test.bin corrected in
c:\8E0909518 katoff test\KatOff_test_chksum.bin! *** ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file c:\8E0909518 katoff test\KatOff_test_chksum.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.02
-> EPK = 40/1/ME7.5/5/A505U//24I4/24I4AQ1/061106/
-> Contents of ECUID data table:
- '0261208524' (SSECUHN)
- '1037386624' (SSECUSN)
- '8E0909518AQ ' (VAG part number)
- '0020' (VAG sw number)
- '1.8L R4/5VT ' (engine id)
-> Contents of ECUID data table:
- 'HW_MAN004'
Data area checksum failure(s) found
-> Found 1 error!!! ******************************* ME7Sum (v1.1.1) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].
Attempting to open firmware file 'c:\8E0909518 katoff test\KatOff_test_chksum.bi
n'
Step #1: Reading ROM info ..
Searching for EPK signature...OK
Searching for ECUID table...OK
EPK : '40/1/ME7.5/5/A505U//24I4/24I4AQ1/061106/'
Part Number : '8E0909518AQ '
SW Version : '0020'
HW Number : '0261208524'
SW Number : '1037386624'
Step #2: Reading ROMSYS ..
Startup section: word[0x008000]+word[0x00FFFE]
@08038 Add=0x00010EEB CalcAdd=0x00010EEB ADD OK
All param page: word[0x010000]+word[0x01FFFE]
@01e512 Add=0x00971D CalcAdd=0x00971D ADD OK
Step #3: Finding CRC table(s) ..
Searching for CRC table(s)...OK
CRC table(s) OK
Step #4: Reading Main Data CRC/Checksums ..
Searching for main data CRC pre block...missing
Searching for main data CRC/csum blocks...OK
Searching for main data CRC offsets...missing
Searching for main data checksum offsets...OK
Main Checksums:
1) 0x010002-0x013FFE CalcCSM: 00147945
2) 0x014252-0x017F4E CalcCSM: 0030C118
3) 0x018192-0x01FBDC CalcCSM: 004FD4DA
4) 0x026A00-0x02FFFC CalcCSM: 00897806
@9ffea CSM: 00896C5D CalcCSM: 00897806 ** FIXED **
Step #5: ROMSYS Program Pages
Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
@00803c Add=0x8F138D CalcAdd=0x8F138D ADD OK
Step #6: Reading RSA signatures ..
Searching for RSA offset #0...OK
Searching for RSA offset #1...OK
Signature: @a599a-a5a1a
Modulus: @16962-169e2
Exponent: @169e2 = 3
Searching for MD5 ranges...OK
MD5 Block Offset Table @1693e [32 bytes]:
1) 0x00010002-0x00013FFE
2) 0x00014252-0x00017F4E
3) 0x00018192-0x0001FBDC
4) 0x00026A00-0x0002FFFC
EncrMD5: dd c3 ae 00 a1 5f 58 d8 60 fb 79 7b 54 c9 ec db
CalcMD5: dd c3 ae 00 a1 5f 58 d8 60 fb 79 7b 54 c9 ec db
OK
Step #7: Reading Main Program Checksums ..
Searching for main program checksum..OK
ROM Checksum Block Offset Table @2bbd6 [16 bytes]:
1) 0x000000-0x00FBFF CalcChk: 4705D818
0x00FC00-0x01FFFF CalcChk: 27351EAB CalcCRC: 22112CB0 SKIPPED
2) 0x020000-0x0FFFFF CalcChk: AA65AD7B
@fffe0 Chk: AA65AD7B CalcChk: AA65AD7B OK (i)
Step #8: Reading Multipoint Checksum Blocks ..
Searching for multipoint block descriptor #1...missing
Searching for multipoint block descriptor #2...OK
1) <1fbde> 0x000000-0x003FFF Chk: 0E59D5C8 Boot: (whitelisted) OK
2) <1fbee> 0x004000-0x007FFF Chk: 1077FB35 Boot: (whitelisted) OK
3) <1fbfe> 0x000000-0x003FFF Chk: 0E59D5C8 CalcChk: 0E59D5C8 OK
..........
64) <1ffce> 0x0F4000-0x0F7FFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
65) <1ffde> 0x0F8000-0x0FBFFF Chk: 1FFFE000 CalcChk: 1FFFE000 OK
66) <1ffee> 0x0FC000-0x0FFFFF Chk: 1FFDE002 CalcChk: 1FFDE002 OK
Multipoint #2: [66 blocks x <16> = 1056 bytes]
Step #9: Looking for rechecks ..
*** Found 70 checksums in c:\8E0909518 katoff test\KatOff_test_chksum.bin
Attempting to output corrected firmware file 'c:\8E0909518 katoff test\KatOff_te
st_chksum2.bin'
├ż Opening 'c:\8E0909518 katoff test\KatOff_test_chksum2.bin' file for writing
├ż Writing to file
├ż Validating size correct 1048576=1048576
├ż All OK, closing file
*** DONE! 1/1 error(s) in c:\8E0909518 katoff test\KatOff_test_chksum.bin correc
ted in c:\8E0909518 katoff test\KatOff_test_chksum2.bin! *** ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file c:\8E0909518 katoff test\KatOff_test_chksum2.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.02
-> EPK = 40/1/ME7.5/5/A505U//24I4/24I4AQ1/061106/
-> Contents of ECUID data table:
- '0261208524' (SSECUHN)
- '1037386624' (SSECUSN)
- '8E0909518AQ ' (VAG part number)
- '0020' (VAG sw number)
- '1.8L R4/5VT ' (engine id)
-> Contents of ECUID data table:
- 'HW_MAN004'
-> No errors found. File is OK. ********************* |
|
|
|
« Last Edit: February 03, 2022, 10:58:40 PM by Skowrix »
|
Logged
|
|
|
|
marcjero
Full Member
Karma: +4/-1
Offline
Posts: 60
|
|
« Reply #118 on: May 31, 2023, 06:45:11 AM »
|
|
|
Hi,
I need to calculate checksum for a Smart ECU (MEG 1.1). I tried the lastest version of ME7Sum but it doesn't find anything useful in the bin file.
What do you think ? Is it doable or not to make it work ?
I know absolutely nothing about the checksums that are used in these ECUs.
|
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #119 on: May 31, 2023, 11:35:20 AM »
|
|
|
Hi,
I need to calculate checksum for a Smart ECU (MEG 1.1). I tried the lastest version of ME7Sum but it doesn't find anything useful in the bin file.
What do you think ? Is it doable or not to make it work ?
I know absolutely nothing about the checksums that are used in these ECUs.
Sadly, a completely different ECU in almost every way that matters. |
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
|
