Pages: 1 [2] 3 4 ... 9
Author Topic: ME7Sum: Open Source Checker/Corrector for ME7  (Read 179520 times)
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #15 on: September 27, 2014, 09:07:07 AM »

I have about 10 bins and I can do all that, it's just a question of what is the most useful format for You

All I really need is ok or fail.

If you find a set that doesn't work, i'll have to hand test them anyway.

If you want to keep a complete document that describes the results for yourself, hey, thats fine too Smiley

Thanks in advance, its not going to be a fun job Smiley
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
hopsis
Full Member
***

Karma: +13/-4
Offline Offline

Posts: 174


« Reply #16 on: September 27, 2014, 11:41:01 AM »

Yeah I can do that. I've gone awol for a while. Decided to take the gf for dinner and a movie. It's 9.30PM here just now and the way things are looking, it'll probably be monday before I can sink my teeth into this.

I did some testing earlier today when at work and the program worked flawlessly. Didn't get a chance to compare against Winols as I only have the demo version on my work laptop.
Logged
hopsis
Full Member
***

Karma: +13/-4
Offline Offline

Posts: 174


« Reply #17 on: September 28, 2014, 08:08:58 AM »

I managed to find some time to test these today. I had eleven different binaries. I changed one cell in KFZW + changed the first byte to FF in all the files. ME7Sum managed to correct all but two files. The results are in the info included in the archive.

Sorry about the lack of scientific approach. I have zero previous experience in beta testing Smiley Let me know if and what You need done differently. As mentioned earlier, I have tons of free time at work. I sit at my computer all day and usually just watch Family Guy or whatever. I'll gladly put that time to a more meaningful use in the boundaries of my skills.
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #18 on: September 28, 2014, 10:42:31 AM »

Thanks! Neither of those look easy to fix right off the bat, unfortunately.

For ref:
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #19 on: September 28, 2014, 11:20:47 AM »

Thanks! Neither of those look easy to fix right off the bat, unfortunately.

I lied. You can ignore the RSA error in 4D1907558

I was wrong. DO NOT IGNORE RSA errors until ME7Sum has been fully tested, or you are willing to be a test subject.

I haven't figured it out yet RSA checking (and signing) is still very much not working. However, a failed RSA signature will not prevent a file from working, as far as i know, the ECU never checks the RSA signature.

The other image (4D0907558S) i have found a fix for; working on a new release.
« Last Edit: September 30, 2014, 03:24:46 PM by nyet » Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
ddillenger
Hero Member
*****

Karma: +637/-21
Offline Offline

Posts: 5640


« Reply #20 on: September 28, 2014, 08:58:40 PM »

I lied.

You can ignore the RSA error in 4D1907558, I haven't figured it out yet RSA checking (and signing) is still very much not working. However, a failed RSA signature will not prevent a file from working, as far as i know, the ECU never checks the RSA signature.

The other image (4D0907558S) i have found a fix for; working on a new release.

RSA checking is very much a problem on some of the 1.8t binarys.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #21 on: September 28, 2014, 09:21:28 PM »

RSA checking is very much a problem on some of the 1.8t binarys.

In that case, I'm going to need some help. The main question being: what area(s) does the RSA signature cover?

I have the rest in place (I think).
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #22 on: September 30, 2014, 03:21:18 PM »

v0.1.0 added. (see OP for link).

NEED TESTERS! Prelim RSA support is there, but for some reason, ME7Check does not like the way I correct RSA signatures.. WinOLS seems not to mind.

If you have a bin that has a RSA signature *and you know what you are doing and don't mind being stranded* I could use your help testing...

« Last Edit: October 02, 2014, 11:32:38 AM by nyet » Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #23 on: October 01, 2014, 11:14:36 PM »

v0.1.1 released.

This should fix all RSA signature problems.

ALWAYS check your bins with ME7Check.exe.. if you see any errors, DO NOT flash it to your ECU.

Post the bin here and/or email me directly.
« Last Edit: October 04, 2014, 04:56:15 PM by nyet » Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #24 on: October 04, 2014, 04:57:09 PM »

v1.0.0 released. See OP for download link

First feature complete (but probably still buggy) version.

Added -s option to dump ecu info only.
« Last Edit: October 13, 2014, 01:44:08 PM by nyet » Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
ddillenger
Hero Member
*****

Karma: +637/-21
Offline Offline

Posts: 5640


« Reply #25 on: October 04, 2014, 06:48:22 PM »

You are a beast nye. Congrats!

Every binary I tested it on seemed to work. Sorry I don' have that many cars here Tongue
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
AudiMan85
Full Member
***

Karma: +21/-7
Offline Offline

Posts: 215



WWW
« Reply #26 on: October 04, 2014, 10:03:03 PM »

Sweet job. Will this do .bins for the 518AK?
Logged

"Ride like I got a horse stable under my hood" ~ The Game - Too Much
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #27 on: October 04, 2014, 10:06:53 PM »

Maybe. I don't have a car to try it out on.

ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file '8E0909518AK.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '40/1/ME7.5/5/4012.31//24H/Dst04o/010903//'
 Part Number : '8E0909518AK'
 Engine ID   : '1.8L R4/5VT'
 SW Version  : '0004'
 HW Number   : '0261208230'
 SW Number   : '1037369307'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x010D43 CalcAdd=0x010D43  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0x921CB5 CalcAdd=0x921CB5  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01e50c Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @a595c-a59dc
           Modulus: @16962-169e2
          Exponent: @169e2 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @1693e [32 bytes]:
 1) Adr: 0x00010002-0x00013FFE
 2) Adr: 0x00014252-0x00017F4E
 3) Adr: 0x00018192-0x0001FBDC
 4) Adr: 0x00026A00-0x0002FFFC
 EncrMD5: b0 1c d5 90 b6 8e ed f5 0a bc e0 32 69 6f f8 21
 CalcMD5: b0 1c d5 90 b6 8e ed f5 0a bc e0 32 69 6f f8 21
  OK

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 1) Adr: 0x010002-0x013FFE CalcCSM: 0014741B
 2) Adr: 0x014252-0x017F4E CalcCSM: 002E7CC4
 3) Adr: 0x018192-0x01FBDC CalcCSM: 004DBFB7
 4) Adr: 0x026A00-0x02FFFC CalcCSM: 00878190
 @9ffee CSM: 00878190 CalcCSM: 00878190  Main data checksum OK

Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @2bbca [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x2626C9D7 CalcCRC: 0x8EAFE566
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0xAD05A414 CalcChk: 0xAD05A414  Main program checksum OK

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0E59D5C8 Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x1077FB35 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0E59D5C8 CalcChk: 0x0E59D5C8 OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x1077FB35 CalcChk: 0x1077FB35 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 70 checksums in 8E0909518AK.bin

*** DONE! 0/0 error(s) corrected in 8E0909518AK.bin! ***
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
AudiMan85
Full Member
***

Karma: +21/-7
Offline Offline

Posts: 215



WWW
« Reply #28 on: October 04, 2014, 10:29:04 PM »

I can test on a friends car if someone can for sure tell me how to boot mode that ecu. Same chip and pin as ours? I have never looked at the ecu but can take some 16mp pics if anyone needs to see the PCB.

Lmk my friend wants me to make him file anyways, I have found enough info so far as xdf's. I know I told him that MTX wants a different checksum tool for his ecu and he didn't wanna pay for me to have the plug-in. So his SOL right now.
Logged

"Ride like I got a horse stable under my hood" ~ The Game - Too Much
SB_GLI
Hero Member
*****

Karma: +115/-10
Offline Offline

Posts: 1022


« Reply #29 on: October 05, 2014, 08:12:56 AM »

Wow!  It works! This is great news!  The MTX plugin never worked on this file.  Thanks for this Nye!

BEFORE:

ME7Sum:
Code:
C:\Users\Steve>Z:\me7sum\me7sum.exe "Z:\ECU Files\Jetta\checksumtest.bin"
ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'Z:\ECU Files\Jetta\checksumtest.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '42/1/ME7.5/120/4013.00//24D/Dst03o/051202/'
 Part Number : '06A906032PL'
 Engine ID   : '1.8L R4/5VT'
 SW Version  : '0003'
 HW Number   : '0261208188'
 SW Number   : '1037367517'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x007DEB CalcAdd=0x007DEB  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0x99BB9F CalcAdd=0x99BB9F  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01be66 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @9cf30-9cfb0
           Modulus: @169d6-16a56
          Exponent: @16a56 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @169b2 [32 bytes]:
 1) Adr: 0x00010002-0x00013FFE
 2) Adr: 0x00014252-0x00017F4E
 3) Adr: 0x00018192-0x0001FBDC
 4) Adr: 0x00026A00-0x0002FFFC
 EncrMD5: 4f 35 b2 d2 c8 13 c1 02 1f 16 8f e7 af 08 83 a6
 CalcMD5: 59 e5 99 70 f3 e1 b2 b7 96 83 3c 75 31 82 04 52
 ** NOT OK **

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 1) Adr: 0x010002-0x013FFE CalcCSM: 0013E994
 2) Adr: 0x014252-0x017F4E CalcCSM: 002D6462
 3) Adr: 0x018192-0x01FBDC CalcCSM: 004C1261
 4) Adr: 0x026A00-0x02FFFC CalcCSM: 00BCA7DB
 @9d776 CSM: 00BCA80F CalcCSM: 00BCA7DB ** NOT OK **

Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @27f0e [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x25890F63 CalcCRC: 0x214758FB
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0x05017844 CalcChk: 0x05017844  Main program checksum OK

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF CalcChk: 0x0FA0F5CF OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 CalcChk: 0x0F4716B3 OK
10) <1fc6e>  Adr: 0x01C000-0x01FFFF Chk: 0x06C1FA64 CalcChk: 0x06C1F03A ** NOT O
K **
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 70 checksums in Z:\ECU Files\Jetta\checksumtest.bin

*** WARNING! 3/3 uncorrected error(s) in Z:\ECU Files\Jetta\checksumtest.bin! **
*

ME7Check:
Code:
==============================================================================
ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file \\DESKTOP\ECU Tuning\ECU Files\Jetta\checksumtest.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 05.12
-> EPK = 42/1/ME7.5/120/4013.00//24D/Dst03o/051202/
-> Contents of ECUID data table:
   - '0261208188'         (SSECUHN)        
   - '1037367517'         (SSECUSN)        
   - '06A906032PL '       (VAG part number)
   - '0003'               (VAG sw number)  
   - '1.8L R4/5VT     '   (engine id)      
-> Contents of ECUID data table:
   - 'HW_MAN004'                            


Page checksum failure(s) found
RSA signature failure found
Data area checksum failure(s) found
-> Found 3 errors!!!   *******************************

Correction:

Code:
C:\Users\Steve>Z:\me7sum\me7sum.exe "Z:\ECU Files\Jetta\checksumtest.bin" "Z:\EC
U Files\Jetta\checksumtest.bin"
ME7Tool (v1.0.0) [Management tool for Bosch ME7.x firmwares]
Inspiration from Andy Whittaker's tools and information.
Written by 360trev and nyet [BSD License Open Source].

Attempting to open firmware file 'Z:\ECU Files\Jetta\checksumtest.bin'

Step #1: Reading ROM info ..
 Searching for EPK signature...OK
 Searching for P/N...OK
 EPK         : '42/1/ME7.5/120/4013.00//24D/Dst03o/051202/'
 Part Number : '06A906032PL'
 Engine ID   : '1.8L R4/5VT'
 SW Version  : '0003'
 HW Number   : '0261208188'
 SW Number   : '1037367517'

Step #2: Reading ROMSYS ..
 Startup section: word[0x008000]+word[0x00FFFE]
 @008038 Add=0x007DEB CalcAdd=0x007DEB  ADD OK
 Program pages: 8k page first+last in 0x0000-0xFFFF and 0x20000-0xFFFFF
 @00803c Add=0x99BB9F CalcAdd=0x99BB9F  ADD OK
 All param page: word[0x010000]+word[0x01FFFE]
 @01be66 Add=0x00971D CalcAdd=0x00971D  ADD OK

Step #3: Reading RSA signatures ..
 Searching for RSA offset #0...OK
 Searching for RSA offset #1...OK
         Signature: @9cf30-9cfb0
           Modulus: @169d6-16a56
          Exponent: @16a56 = 3
 Searching for MD5 ranges...OK
 MD5 Block Offset Table @169b2 [32 bytes]:
 1) Adr: 0x00010002-0x00013FFE
 2) Adr: 0x00014252-0x00017F4E
 3) Adr: 0x00018192-0x0001FBDC
 4) Adr: 0x00026A00-0x0002FFFC
 EncrMD5: 4f 35 b2 d2 c8 13 c1 02 1f 16 8f e7 af 08 83 a6
 CalcMD5: 59 e5 99 70 f3 e1 b2 b7 96 83 3c 75 31 82 04 52
 ** FIXED **

Step #4: Reading Main Data Checksums ..
 Searching for main data CRC pre block...missing
 Searching for main data CRC/csum blocks...OK
 Searching for main data CRC offsets...missing
 Searching for main data checksum offsets...OK
 1) Adr: 0x010002-0x013FFE CalcCSM: 0013E994
 2) Adr: 0x014252-0x017F4E CalcCSM: 002D6852
 3) Adr: 0x018192-0x01FBDC CalcCSM: 004C1651
 4) Adr: 0x026A00-0x02FFFC CalcCSM: 00BCABCB
 @9d776 CSM: 00BCA80F CalcCSM: 00BCABCB ** FIXED **

Step #5: Reading Main Program Checksums ..
 Searching for main program checksum..OK
 ROM Checksum Block Offset Table @27f0e [16 bytes]:
 1) Adr: 0x000000-0x00FBFF
         0x00FC00-0x01FFFF SKIPPED CalcChk: 0x25883F28 CalcCRC: 0x948996F1
 2) Adr: 0x020000-0x0FFFFF
 @fffe0 Chk: 0x05017844 CalcChk: 0x04FFC6F4 ** FIXED **

Step #6: Reading Multipoint Checksum Blocks ..
 Searching for multipoint block descriptor #1...missing
 Searching for multipoint block descriptor #2...OK
 1) <1fbde>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF Boot: (whitelisted) OK
 2) <1fbee>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 Boot: (whitelisted) OK
 3) <1fbfe>  Adr: 0x000000-0x003FFF Chk: 0x0FA0F5CF CalcChk: 0x0FA0F5CF OK
 4) <1fc0e>  Adr: 0x004000-0x007FFF Chk: 0x0F4716B3 CalcChk: 0x0F4716B3 OK
 Multipoint #2: [66 blocks x <16> = 1056 bytes]

*** Found 70 checksums in Z:\ECU Files\Jetta\checksumtest.bin

Attempting to output corrected firmware file 'Z:\ECU Files\Jetta\checksumtest.bi
n'
├╛ Opening 'Z:\ECU Files\Jetta\checksumtest.bin' file for writing
├╛ Writing to file
├╛ Validating size correct 1048576=1048576
├╛ All OK, closing file

*** DONE! 6/6 error(s) corrected in Z:\ECU Files\Jetta\checksumtest.bin! ***
Logged
Pages: 1 [2] 3 4 ... 9
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.164 seconds with 18 queries. (Pretty URLs adds 0.001s, 0q)