|
nyet
|
 |
« on: January 27, 2013, 02:54:24 AM »
|
|
|
This project is under BSD open source license. Its on the most unrestrictive freeware license possible. No warranty implied or given. It is a tool written in C for management of Bosch ME7.1 firmware dumps. It's a command line tool, as in just clicking it does nothing! You have to know how to use cmd. The latest binary releases are always available here: https://github.com/nyetwurk/ME7Sum/releases/latestThe latest version (as of 28 Oct 2024) is v1.1.3 To output corrected checksums you must specify an output file: me7sum image.bin out.binIf you omit "out.bin" it me7sum will only CHECK the file, not correct it. Note that if me7sum cannot completely detect checksum/CRC locations correctly, it will not output a file! ** Always use me7sum on a original version of your bin first to make sure it is compatible! ** ** Make sure to check all corrected bins with ME7Check.exe before flashing them! ** Source code: https://github.com/nyetwurk/ME7Sum/Readme: https://github.com/nyetwurk/ME7Sum/blob/master/README.mdKnown ECUs with problems: • Some 4.2 ME7.1.1 (e.g. 8E0910560H) • ST10 ECUs |
|
|
|
« Last Edit: October 28, 2024, 04:03:21 PM by nyet »
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
bofh
Newbie
Karma: +0/-0
 Offline
Posts: 14
|
|
« Reply #1 on: January 05, 2014, 03:53:24 PM »
|
|
|
thank you for this great tool!  btw: seems to work with ME7.5 (APX 8L0906018M). ME7Check says file is ok after running ME7Sum. 
ME7Check_linux v1.12 (c) mki, 06/2004-05/2012
Checking file test.bin (size=524288)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 42/1/ME7.5/5/4018.10//F19x6/Dst02o/101299/
-> Contents of ECUID data table:
- '0261206797' (SSECUHN)
- '1037354094' (SSECUSN)
- '8L0906018M ' (VAG part number)
- '0002' (VAG sw number)
- '1.8L R4/5VT ' (engine id)
-> Contents of ECUID data table:
- 'HW_MAN004'
-> No errors found. File is OK. *********************
|
|
|
|
|
Logged
|
|
|
|
|
AARDQ
|
|
« Reply #2 on: September 24, 2014, 10:50:19 PM »
|
|
|
4Z907551R with modified KFZW. ME7Check results at the bottom. This is OK, as common lore would have it? Epic tool! I've been dreading the day when my ancient laptop with MTX Tunerpro plugin dies. c:\me7checktest>me7sum me711testA.bin me711testcorr.bin
ME7Tool (v0.0.6) [ Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information
Written by 360trev and nyet [BSD License Open Source].
Attempting to open firmware file 'me711testA.bin'
Step #1: Reading ROMSYS ..
Startup section: word[0x00008000]+word[0x0000FFFE]
@8038 Add=0x00004AEB CalcAdd=0x00004AEB ADD OK
Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
@803c Add=0x0099D9E5 CalcAdd=0x0099D4E0 ** FIXED **
All param page: word[0x00010000]+word[0x0001FFFE]
@1e182 Add=0x971D CalcAdd=0x971D ADD OK
Step #2: Reading Main Data Checksums ..
Searching for main data CRC pre block...missing
Searching for main data checksum blocks...OK
Searching for main data CRC offsets...missing
Searching for main data checksum offsets...OK
1) Adr: 0x010002-0x013FFE CalcCSM: 00129311
2) Adr: 0x014382-0x017F4E CalcCSM: 0029DE60
3) Adr: 0x018192-0x01FBDC CalcCSM: 004795AD
4) Adr: 0x026A00-0x02FFFC CalcCSM: 00A6913D
@abee6 CSM: 00A68D2B CalcCSM: 00A6913D ** FIXED **
Step #3: Reading Main Program Checksums ..
Searching for main program checksum..OK
ROM Checksum Block Offset Table @27f90 [16 bytes]:
1) Adr: 0x000000-0x00FBFF
0x00FC00-0x01FFFF SKIPPED CalcChk: 0x23DDE12D CalcCRC: 0x585F363E
2) Adr: 0x020000-0x0FFFFF
@fffe0 Chksum: 0xA58D3F15 CalcChk: 0xA58D491F ** FIXED! **
Step #4: Reading Multipoint Checksum Blocks ..
Searching for multipoint block descriptor #1...SKIPPED
Searching for multipoint block descriptor #2...OK
Multipoint #1: [64 blocks x <16> = 1024 bytes]
*** Found 69 checksums in me711testA.bin
Attempting to output corrected firmware file 'me711testcorr.bin'
├╛ Opening 'me711testcorr.bin' file for writing
├╛ Writing to file
├╛ Validating size correct 1048576=1048576
├╛ All OK, closing file
*** DONE! 6/6 errors corrected in me711testA.bin! ***
c:\me7checktest>me7check me711testcorr.bin
==============================================================================
me7check v1.12 (c) mki, 06/2004-05/2012
Checking file me711testcorr.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.02
-> EPK = 43/1/ME7.1.1/5/6011.02//A25an/Dst5A/150502/
-> Contents of ECUID data table:
- '??????????' (SSECUHN)
- '??????????' (SSECUSN)
- '4Z7907551R ' (VAG part number)
- ' ' (VAG sw number)
- 'U25AN34.hex LEV' (engine id)
-> Contents of ECUID data table:
- 'HW_MAN004'
Warning: the bootrom copy in flash contains modified code
RSA signature failure found
-> Found 1 error!!! *******************************
|
|
|
|
« Last Edit: July 24, 2021, 10:47:16 AM by nyet »
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #3 on: September 24, 2014, 11:09:32 PM »
|
|
|
Yea the RSA error is as expected - I have no idea how that is done still.
Also, there is one multipoint checksum area not checked yet for ME7.1.1 - 0x0 - 0x3fff ... hopefully not too many people modify that area.
I'm currently trying to figure that one out too.
|
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
hopsis
Full Member
Karma: +13/-4
Offline
Posts: 174
|
|
« Reply #4 on: September 25, 2014, 02:44:08 AM »
|
|
|
Some problems with ME7.1 also.
C:\Users\Käyttäjä\Desktop\tunettamiset\temp\new me7 check>me7check testi.bin
==============================================================================
me7check v1.12 (c) mki, 06/2004-05/2012
Checking file testi.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = embedded in CPU, asume 05.12/05.32
-> EPK = 42/1/ME7.1/5/8000.07//X22fc/Dstt2g/100699/
-> Contents of ECUID data table:
- '0261206373' (SSECUHN)
- '1037352378' (SSECUSN)
- '4D0907559D ' (VAG part number)
- '0002' (VAG sw number)
- '4.2L V8/5V ' (engine id)
WARNING: flash should be 512kB of size, but the file is 1MB !!
-> trying to analyze only the first 512kB of the file
Page checksum failure(s) found
Data area checksum failure(s) found
-> Found 2 errors!!! *******************************
C:\Users\Käyttäjä\Desktop\tunettamiset\temp\new me7 check>me7sum testi.bin
ME7Tool (v0.0.7) [ Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information
Written by 360trev and nyet [BSD License Open Source].
Attempting to open firmware file 'testi.bin'
Step #1: Reading ROMSYS ..
Startup section: word[0x00008000]+word[0x0000FFFE]
@8038 Add=0x00005DCB CalcAdd=0x00005DCB ADD OK
Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
@803c Add=0x00B80C1B CalcAdd=0x00380C9B ** NOT OK **
All param page: word[0x00010000]+word[0x0001FFFE]
@1b12a Add=0x971D CalcAdd=0x971D ADD OK
Step #2: Reading Main Data Checksums ..
Searching for main data CRC pre block...missing
Searching for main data checksum blocks...FAIL
Searching for main data CRC offsets...OK
Step #2: ERROR! Skipping main data checksums ... UNDEFINED
Step #3: Reading Main Program Checksums ..
Searching for main program checksum..OK
Step #3: ERROR! Skipping Main Program Checksums.. UNDEFINED
Step #4: Reading Multipoint Checksum Blocks ..
Searching for multipoint block descriptor #1...OK
Multipoint #0: [2 blocks x <16> = 32 bytes]
Searching for multipoint block descriptor #2...OK
5) <1fc60> Adr: 0x010000-0x013FFF Chk: 0x09E1B29B CalcChk: 0x09E25A84 ** NOT O
K **
Multipoint #1: [32 blocks x <16> = 512 bytes]
*** Found 37 checksums in testi.bin
*** ABORTING! 2 uncorrectable error(s) in testi.bin! ***
|
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #5 on: September 25, 2014, 09:05:51 AM »
|
|
|
Some problems with ME7.1 also.
- '4D0907559D ' (VAG part number)
- '0002' (VAG sw number)
- '4.2L V8/5V ' (engine id)
Can you post the original bin for this file? Thanks! |
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
|
ddillenger
|
|
« Reply #6 on: September 25, 2014, 09:19:06 AM »
|
|
|
Here you are.
|
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
|
nyet
|
|
« Reply #7 on: September 25, 2014, 03:37:20 PM »
|
|
|
ME7Check somewhat complains on that file:
ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file D.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = embedded in CPU, asume 05.12/05.32
-> EPK = 42/1/ME7.1/5/8000.07//X22fc/Dstt2g/100699/
-> Contents of ECUID data table:
- '0261206373' (SSECUHN)
- '1037352378' (SSECUSN)
- '4D0907559D ' (VAG part number)
- '0002' (VAG sw number)
- '4.2L V8/5V ' (engine id)
WARNING: flash should be 512kB of size, but the file is 1MB !!
-> trying to analyze only the first 512kB of the file
-> No errors found. File is OK. *********************
|
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
|
ddillenger
|
|
« Reply #8 on: September 25, 2014, 03:57:02 PM »
|
|
|
That is just how those files are. From the factory they are just doubled up on 29F800BB flash chips-lol.
|
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
hopsis
Full Member
Karma: +13/-4
Offline
Posts: 174
|
|
« Reply #9 on: September 25, 2014, 10:04:08 PM »
|
|
|
Yep. I have more of those ME7.1 bins, mostly from 40V 4.2 A6/S6 engines that produce the same results with ME7sum. Personally it's not that big a deal anymore and I don't know if anybody else even works with V8 ME7.1 cars.
DD is correct about the file being doubled up. I have one 4D0907558D ecu with the 29F400BB and the first 512k is practically identical to the 1024k 4D0907559D. I even tried flashing a 1024k file to the 512k chip with Galletto. Works like a charm, Galletto expectedly throws an error at 50% but the good stuff is already in the ecu at that point.
|
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #10 on: September 26, 2014, 09:38:07 AM »
|
|
|
Thanks for your patience guys! I have a new test version coming pretty soon that should address some of the issues reported.
I am still unclear on how the RSA stuff works, and there are a bunch of ME7.5 files that still don't work right, but I am making good headway.
|
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
hopsis
Full Member
Karma: +13/-4
Offline
Posts: 174
|
|
« Reply #11 on: September 26, 2014, 11:21:34 PM »
|
|
|
Had a quick test with a few bins before leaving for work, seems to work better with the previously mentioned 40V V8 ME7.1 binarys. I hope it's a slow day at work, I'll put this to stress test with everything I have and cross-compare with Winols corrections of the same files. If that is something that would be useful, I can do the grunt work for You, I have more free time than skills. What could go wrong with that combo? |
|
|
|
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #12 on: September 26, 2014, 11:23:52 PM »
|
|
|
Had a quick test with a few bins before leaving for work, seems to work better with the previously mentioned 40V V8 ME7.1 binarys. I hope it's a slow day at work, I'll put this to stress test with everything I have and cross-compare with Winols corrections of the same files. If that is something that would be useful, I can do the grunt work for You, I have more free time than skills. What could go wrong with that combo? YES! That is EXACTLY what I need! Thank you! |
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
hopsis
Full Member
Karma: +13/-4
Offline
Posts: 174
|
|
« Reply #13 on: September 27, 2014, 01:37:08 AM »
|
|
|
Cool, about time I can give something back. Do You have any preference or a specific method that You want me to use? I have all the binarys in a folder with me7check and me7sum. I'm thinking of doing 1 minor change to a random map I can find in all the bins, say KFZW. I can then run me7check against the originals and me7sum/winols corrected files but that seems like a lot of data for You to sift through.
If I run:
ME7Check for original
ME7Check for modified
ME7Sum for modified
Winols for modified
ME7Check for ME7Sum corrected
ME7Check for Winols corrected
I end up with 4 binarys in total (ORI, MOD, WINOLS, ME7SUM) and a load of logs. I have about 10 bins and I can do all that, it's just a question of what is the most useful format for You. Is there any way to get any log from Winols when it does its checksum corrections? I'm thinking propably not. If there is, please let me know how and I'll add that info too.
|
|
|
|
« Last Edit: September 27, 2014, 01:38:54 AM by hopsis »
|
Logged
|
|
|
|
|
nyet
|
|
« Reply #14 on: September 27, 2014, 09:05:06 AM »
|
|
|
Yea, this is definitely what I need.
The only problem is, it is the more obscure checksum/crc blocks that might need testing (ROMSYS, bootblock) (meaning changes in odd places in the bin)... but they are also places people are very very unlikely to ever have to change... so i don't even know if that is relevant?
But I think that can easily be solved; just also change the first byte in the file (yea, it will probably result in a bad bin, so dont run it!) but it would be fine for testing the checksum.
As far as getting winols to tell you where things changed... nope. it doesn't do that. They really don't want you knowing how checksums work.
They also go out of the way to hide checksum value areas from the hex view, and from the diffing tool (but that makes sense, when tuning, you don't really want to be told those are differences).
The only foolproof way is to use a binary diffing tool. There are several out there for windows, but I have not found one i like best yet.
|
|
|
|
|
Logged
|
ME7.1 tuning guideECUx PlotME7Sum checksumTrim heatmap toolPlease do not ask me for tunes. I'm here to help people make their own. Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
|
|
|
|
