dikidera
Full Member
 
Karma: +10/-8
Offline
Posts: 152
|
 |
« Reply #1785 on: November 03, 2022, 01:59:31 AM »
|
|
|
Prometey, did you manage to find which CAN commands dump bytes from ROM?
|
|
|
|
|
Logged
|
|
|
|
keichi
Full Member
 
Karma: +11/-2
Offline
Posts: 100
|
 |
« Reply #1786 on: November 03, 2022, 04:02:20 AM »
|
|
|
Checksum check is a simple: #include "ChecksumHelper.hpp"
namespace util {
namespace { uint32_t getValue(const std::vector<uint8_t>& data, size_t index) { return ((uint32_t)data[index + 3] << 24) + ((uint32_t)data[index + 2] << 16) + ((uint32_t)data[index + 1] << 8) + (uint32_t)data[index]; }
void setValue(std::vector<uint8_t>& data, size_t index, uint32_t value) { data[index] = static_cast<uint8_t>(value); data[index + 1] = static_cast<uint8_t>(value >> 8); data[index + 2] = static_cast<uint8_t>(value >> 16); data[index + 3] = static_cast<uint8_t>(value >> 24); }
}
bool ChecksumHelper::check(const std::vector<uint8_t>& data) const { uint32_t buffer_index = 0x1F810; uint32_t max_buffer_index = 0x1FA00; if (data.size() == 1024 * 1024) max_buffer_index = 0x1FC00; do { uint32_t start_addr = getValue(data, buffer_index);
// Get the checksum zone end address uint32_t end_addr = getValue(data, buffer_index + 4);
if (start_addr >= data.size() || end_addr >= data.size()) break;
uint32_t checksum = 0; for (uint32_t addr = start_addr; addr < end_addr; addr += 2) checksum += ((uint32_t)data[addr + 1] << 8) + (uint32_t)data[addr];
uint32_t curr_checksum = getValue(data, buffer_index + 8); uint32_t compliment_curr_checksum = getValue(data, buffer_index + 12);
uint32_t complchecksum = ~checksum;
if (curr_checksum != checksum || compliment_curr_checksum != complchecksum) return false;
buffer_index += 0x10; } while(buffer_index < max_buffer_index); return true; }
void ChecksumHelper::update(std::vector<uint8_t>& data) const { uint32_t buffer_index = 0x1F810; uint32_t max_buffer_index = 0x1FA00; if (data.size() == 1024 * 1024) max_buffer_index = 0x1FC00; do { uint32_t start_addr = getValue(data, buffer_index);
// Get the checksum zone end address uint32_t end_addr = getValue(data, buffer_index + 4);
if (start_addr >= data.size() || end_addr >= data.size()) break;
uint32_t checksum = 0; for (uint32_t addr = start_addr; addr < end_addr; addr += 2) checksum += ((uint32_t)data[addr + 1] << 8) + (uint32_t)data[addr];
uint32_t complchecksum = ~checksum;
setValue(data, buffer_index + 8, checksum); setValue(data, buffer_index + 12, complchecksum);
buffer_index += 0x10; } while(buffer_index < max_buffer_index); }
}
Looks like checksum calculation ranges vary even more. In 2002 S60 T5 (20KPSC) 1MB bin checksum is calculated in the range 0x000000-0x0BFFFF so for this particular software variable max_buffer_index = 0x1FAF0.
|
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
 |
« Reply #1787 on: November 03, 2022, 04:20:50 AM »
|
|
|
Looks like checksum calculation ranges vary even more. In 2002 S60 T5 (20KPSC) 1MB bin checksum is calculated in the range 0x000000-0x0BFFFF so for this particular software variable max_buffer_index = 0x1FAF0.
Yes, I caught the situation with 20KPSC software. But it still works when checksum updated twice.
|
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
 |
« Reply #1788 on: November 03, 2022, 04:21:23 AM »
|
|
|
Prometey, did you manage to find which CAN commands dump bytes from ROM?
You can dump flash with read memory by addr message.
|
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
 |
« Reply #1789 on: November 03, 2022, 08:18:57 AM »
|
|
|
Prometey, did you manage to find which CAN commands dump bytes from ROM?
By the way flash can be read by checksum calculation command. For example for TCM module 7A: 1. Start sending sleep message for 2 secs with 100 ms interval: 0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00 2. Switch TCM module to programming mode: 0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00 3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down 0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD 4. Send get checksum with next byte: 0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1 5. Read response from TCM. 6. After all flash is read send CAN reset message. 0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00 Looks like this approach can also be used for ECM module read.
|
|
|
|
« Last Edit: November 03, 2022, 08:21:31 AM by prometey1982 »
|
Logged
|
|
|
|
t6
Full Member
 
Karma: +0/-5
Offline
Posts: 56
|
 |
« Reply #1790 on: November 03, 2022, 09:21:04 AM »
|
|
|
heres what i have used for 03-04 autos in a euro file
Hi, I tried this soft but the engine does not start. S60R 2003, original: QGHJ
|
|
|
|
|
Logged
|
|
|
|
luki743
Newbie
Karma: +2/-0
Offline
Posts: 18
|
 |
« Reply #1791 on: November 03, 2022, 09:32:52 AM »
|
|
|
By the way flash can be read by checksum calculation command. For example for TCM module 7A: 1. Start sending sleep message for 2 secs with 100 ms interval: 0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00 2. Switch TCM module to programming mode: 0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00
3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down 0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD 4. Send get checksum with next byte: 0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1 5. Read response from TCM.
6. After all flash is read send CAN reset message. 0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00
Looks like this approach can also be used for ECM module read.
ECM 0x7A TCM 0x6E CEM 0x40/0x50
|
|
|
|
|
Logged
|
|
|
|
rlinewiz
Jr. Member

Karma: +16/-1
Offline
Posts: 44
|
 |
« Reply #1792 on: November 03, 2022, 09:45:36 AM »
|
|
|
I usually flash a 50GPHJ in an 05 auto car. This Will cross flash no problem. As long as you are sure the bin is a auto
thats good to know, and will save me a ton of work. now I just have to track down a 50GPHJ AUT AWD US bin.. unless an EU bin will work? I remember reading they're tuned back a wee bit
|
|
|
|
« Last Edit: November 03, 2022, 10:01:59 AM by rlinewiz »
|
Logged
|
2005 S60R M66-Swapped // Self-tuned @ 22psi [[forever coding for the OpenMoose project]]
|
|
|
dikidera
Full Member
 
Karma: +10/-8
Offline
Posts: 152
|
 |
« Reply #1793 on: November 03, 2022, 10:24:34 AM »
|
|
|
By the way flash can be read by checksum calculation command. For example for TCM module 7A: 1. Start sending sleep message for 2 secs with 100 ms interval: 0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00 2. Switch TCM module to programming mode: 0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00
3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down 0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD 4. Send get checksum with next byte: 0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1 5. Read response from TCM.
6. After all flash is read send CAN reset message. 0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00
Looks like this approach can also be used for ECM module read.
Thanks, its just as you said. However adding 1 to address does not fetch correct data, I have to set checksum address to the new byte location and then issue get checksum again. Slower but at least it works. diki@raspberrypi:~ $ cansend can0 000FFFFE#7A9C00000080 <- rom address 00000080 diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000081 <- fetches first byte from that address diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000082 <- does NOT fetch next byte correctly, it's mutated diki@raspberrypi:~ $ cansend can0 000FFFFE#7A9C00000081 <- set checksum pointer to next byte diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000082 <- correct data retrieved. All in all, I would call this a success, thank you for the invaluable information.
|
|
|
|
« Last Edit: November 03, 2022, 10:32:00 AM by dikidera »
|
Logged
|
|
|
|
|
s60rawr
|
 |
« Reply #1794 on: November 03, 2022, 06:02:13 PM »
|
|
|
Delete this. its old and irrelevant
|
|
|
|
« Last Edit: November 10, 2022, 12:15:35 PM by s60rawr »
|
Logged
|
There is a free flash suite in progres
http://www.openmoose.net/blog/?page=renatus #1 Nefmoto -Karma Sponge!
|
|
|
SparkyR
Full Member
 
Karma: +19/-21
Offline
Posts: 84
|
 |
« Reply #1795 on: November 03, 2022, 07:23:44 PM »
|
|
|
might be something to think about... you dont have a method to state your can speed for datalogging
good work!
|
|
|
|
« Last Edit: November 03, 2022, 07:27:28 PM by SparkyR »
|
Logged
|
2005 S60R m66, Xona Rotor 7864, turbosmart 45mm wastegate, 1300cc injectors
|
|
|
|
s60rawr
|
 |
« Reply #1796 on: November 03, 2022, 07:57:32 PM »
|
|
|
might be something to think about... you dont have a method to state your can speed for datalogging
good work!
that may have been an oversight.... the fuction is there lol... oopsssss
|
|
|
|
|
Logged
|
There is a free flash suite in progres
http://www.openmoose.net/blog/?page=renatus #1 Nefmoto -Karma Sponge!
|
|
|
SparkyR
Full Member
 
Karma: +19/-21
Offline
Posts: 84
|
 |
« Reply #1797 on: November 03, 2022, 08:51:40 PM »
|
|
|
Also may think of incorporating the checksum tool on flash. This is how my .bin flasher works
|
|
|
|
|
Logged
|
2005 S60R m66, Xona Rotor 7864, turbosmart 45mm wastegate, 1300cc injectors
|
|
|
|
s60rawr
|
 |
« Reply #1798 on: November 03, 2022, 09:43:00 PM »
|
|
|
ya the other tool I have does that too but it has the vlic lock stuff it's on the list! I have it running on my computer and it refreshes the folder every so often but yes thanks for testing
|
|
|
|
|
Logged
|
There is a free flash suite in progres
http://www.openmoose.net/blog/?page=renatus #1 Nefmoto -Karma Sponge!
|
|
|
dikidera
Full Member
 
Karma: +10/-8
Offline
Posts: 152
|
 |
« Reply #1799 on: November 04, 2022, 12:12:28 AM »
|
|
|
Also may think of incorporating the checksum tool on flash. This is how my .bin flasher works
Curious. Is it the CEM that verifies the code or the ECM? Why not just patch out the checksum code?
|
|
|
|
|
Logged
|
|
|
|
|