BaxtR
Full Member
Karma: +17/-25
 Offline
Posts: 64
|
 |
« Reply #2160 on: February 21, 2023, 06:43:07 PM »
|
|
|
Anybody interested in working together on the Volvo ME9?
For the past 6 months, I've been compiling map packs for this ECU and have pretty much a lot of them sorted out...and still adding to the list as we go.
What I am having a hard time is sorting out the logging side of things like RAM parameters, logging tools etc. I have zero disassembly skills so is a bit hard for me. I have tried doing it myself via IDA Pro but with no prior knowledge, it's looking like another wall of text to me.
I think prometey's logger would work on the ME9 but there is no way to test as I don't have RAM parameters to test it on.
I know the knowledge is within the community but seeing the current mindset on here is "I won't share information as others don't even contribute", I figured this approach would be more ideal to some.
Everyone works in the dark unfortunately... Too many freeloaders with no contribution ;/ |
|
|
|
|
Logged
|
2007 Volvo S60R, PT6266 BB, 1700x ID Injectors, Walbro525. Halme Built manifold and exhaust #BaxtrPerformance
|
|
|
|
prj
|
|
« Reply #2161 on: February 22, 2023, 03:14:35 AM »
|
|
|
I think my logger could work with them with a few adjustments.
I checked the stack briefly and it seems to use KWP.
Probably the security is different from Ford (I already have Ford protocol working).
Also, I don't think I currently have any Volvo ME9 hex/a2l combination, and at least one will be needed to do the logging for everything else, but I think I can buy it somewhere.
I will see if I can source the data, and if so I'll probably implement it.
|
|
|
|
« Last Edit: February 22, 2023, 03:17:18 AM by prj »
|
Logged
|
|
|
|
keichi
Full Member
Karma: +10/-2
Offline
Posts: 73
|
|
« Reply #2162 on: February 23, 2023, 04:08:11 AM »
|
|
|
If you don't want to do it with ignition cut, do it with fuel cut.
There is cylinder blending target, redsol.
Override the OEM code and set it to to 5 when you want full cut on all cylinders (if you have a 5 cylinder engine, sorry I'm not much into moose).
This is totally safe, as it is the same as the hard revlimiter (except the hard revlimiter is smarter and it blends cylinder count based on target).
If you want to spool turbo, you can retard ignition + implement redsol based on distance to target RPM (can be from a map). This is at a standstill of course.
This is stuff to make car fast. Not very popular these days because NLS/LC is now mostly used to make the car create toilet farting noises, instead of trying to go faster.
Your NLS becomes literally patching this in somewhere into the OEM routine that calculates redsol (after it's set):
if (nmot_w > X && wdkba > Y && vfzg > 0 && b_kuppl) {
redsol = 5;
}
I am playing with my NLS routine. I implemented redsol as you suggested (now i retard ignition and also cut-off cylinders with redsol). Setting redsol (anything above 0) gives interesting effects - it cuts-off cylinders in some smart pattern giving rpm drop with bonus "DSG like brrrrttt" sound  I belive cars with DSG's use the same method for torque reduction. But i don't care about sounds, i want the best performance. Unfortunately setting redsol also causes closing throttle but the worst of all causes fully opening WG (0% ldtv)! It looks like redsol activates all other torque reduction functions in addition to cutting-off cylinders. After changing gear with NLS and releasing clutch throttle opens back immediately (that is acceptable) but WG remains at 0% for about 0,2-0,3s and then slowly opens back to desired level for 1,0-2,0 seconds! That means boost slowly rising back for up to 2s after gear change. Pulling ignition alone (as i did before implementing setting redsol) do not activate any interventions but is not enough for NLS. If I pull less ignition i get less overboost but too much torque and clutch is slipping. If i pull too much ignition no clutch slip but massive overboost and violent torque rush after gear change. Redsol seems like perfect supplement to pulling ignition but i can't figure out how to enable cylinders cut-off without activating WG and throttle interventions. Maybe you have some hints how to use redsol without other interventions? |
|
|
|
« Last Edit: February 23, 2023, 04:22:39 AM by keichi »
|
Logged
|
|
|
|
BaxtR
Full Member
Karma: +17/-25
Offline
Posts: 64
|
|
« Reply #2163 on: February 23, 2023, 04:19:47 AM »
|
|
|
I think my logger could work with them with a few adjustments.
I checked the stack briefly and it seems to use KWP.
Probably the security is different from Ford (I already have Ford protocol working).
Also, I don't think I currently have any Volvo ME9 hex/a2l combination, and at least one will be needed to do the logging for everything else, but I think I can buy it somewhere.
I will see if I can source the data, and if so I'll probably implement it.
Thatd be Awesome Prj. Appreciate you |
|
|
|
|
Logged
|
2007 Volvo S60R, PT6266 BB, 1700x ID Injectors, Walbro525. Halme Built manifold and exhaust #BaxtrPerformance
|
|
|
Cheekano
Full Member
Karma: +4/-1
Offline
Posts: 60
|
|
« Reply #2164 on: February 23, 2023, 06:17:36 AM »
|
|
|
I think my logger could work with them with a few adjustments.
I checked the stack briefly and it seems to use KWP.
Probably the security is different from Ford (I already have Ford protocol working).
Also, I don't think I currently have any Volvo ME9 hex/a2l combination, and at least one will be needed to do the logging for everything else, but I think I can buy it somewhere.
I will see if I can source the data, and if so I'll probably implement it.
Yeah, there definitely will be a demand for it. I do not have an a2l specific to Volvo bin file but I have one defined already (kp file) with most of the important maps. I will gladly share with you if that would help. The source of it are a2l from different bins which I cross-matched so the addresses are correct. So far, I've seen 3 variants of the P1 maps only. 1 for AWD, 1 for pre-2010 and one for 2011 onwards. |
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #2165 on: February 23, 2023, 09:27:49 AM »
|
|
|
Yeah, there definitely will be a demand for it. I do not have an a2l specific to Volvo bin file but I have one defined already (kp file) with most of the important maps. I will gladly share with you if that would help. The source of it are a2l from different bins which I cross-matched so the addresses are correct. So far, I've seen 3 variants of the P1 maps only. 1 for AWD, 1 for pre-2010 and one for 2011 onwards.
Nice, time for some open source ME9 maps.  |
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2166 on: February 23, 2023, 11:22:45 AM »
|
|
|
Maps are not interesting, OLS files are not interesting.
There is a hex/a2l combo somewhere in the wild, but so far no luck locating it.
Not a single hex/a2l combination = no logger. I don't do defs by hand, and at least one working combo is needed for the generator to work and generate the data for all the other files.
Reading the data from the ECU and passing security is piss easy, the hard part is getting the data.
I'm guessing no ME9 shit in leaked DHA either, right?
EDIT: Just checked and yes, DHA is useless for this, it's very limited.
Going to poke around some more about the A2L...
If I get lucky with the A2L, I'll include the ME9.0C in the next batch of ECU's I buy for development.
|
|
|
|
« Last Edit: February 23, 2023, 12:19:07 PM by prj »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #2167 on: February 23, 2023, 01:01:24 PM »
|
|
|
You need to start by...tracing the pcb to where a particular sensor goes, such as ADC. Of course this requires a datasheet of the CPU. From there it will be difficult, but not impossible to correlate memory addresses(with more work of course). Of course, with obfuscation in the way, it may be way more difficult unless you write a deobfuscator. Symbolic engines are good for this, but they may need to be adapted to p-code rather than the underlying architecture.
|
|
|
|
« Last Edit: February 23, 2023, 01:02:58 PM by dikidera »
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2168 on: February 23, 2023, 03:05:58 PM »
|
|
|
You need to start by...tracing the pcb to where a particular sensor goes, such as ADC. Of course this requires a datasheet of the CPU. From there it will be difficult, but not impossible to correlate memory addresses(with more work of course). Of course, with obfuscation in the way, it may be way more difficult unless you write a deobfuscator. Symbolic engines are good for this, but they may need to be adapted to p-code rather than the underlying architecture. Relax, you're not going to do this on any modern ECU. There's ols project for ME9 Volvo and there's hex/a2l for Ford ME9... quite openly available. I just ran the ME9 Volvo through my generator based on the Ford. Total 7809 addresses in Ford, refs were found for 4573. Out of those 4573 refs, 4058 were matched. However, because a bunch of stuff I guess is still different, the total matched was 4332 variables after the other algos ran. If it was a Volvo HEX/A2L, most likely closer to 7k vars would be found. Even with those 4058 matches, most likely all the important stuff for tuning is there. Just all the Volvo specific stuff is missing and the Ford specific stuff was obviously not detected in the Volvo bin. I used Ford PS50F200 and ran it against Volvo P020DF00. |
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #2169 on: February 23, 2023, 03:16:28 PM »
|
|
|
You don't know unless you try. I am also interested in the protections in there. I am guessing we have RTOS with multiple cores, I mean it sounds fun.
Remember, it's a bit like saying Denuvo is godlike or that PS5 will never have one dangling pointer, sorry I am writing in riddles, buut...
|
|
|
|
« Last Edit: February 23, 2023, 03:43:08 PM by dikidera »
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2170 on: February 24, 2023, 05:38:58 AM »
|
|
|
You don't know unless you try. I am also interested in the protections in there. I am guessing we have RTOS with multiple cores, I mean it sounds fun. ME9 is single core. And unlike you I know exactly what I'm talking about. https://m232.org. It took years on a very simple old ECU, on any modern one it is for all intents and purposes impossible. Remember, it's a bit like saying Denuvo is godlike or that PS5 will never have one dangling pointer, sorry I am writing in riddles, buut... You're just talking shit at this point. Anyway, with some help I managed to source the A2L, going to order an ECU next and implement the protocol for the logger. It has both $23 and $2C, but I haven't checked if $2C allows to define memory locations yet. |
|
|
|
« Last Edit: February 24, 2023, 05:42:47 AM by prj »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #2171 on: February 24, 2023, 09:10:32 AM »
|
|
|
I am not sure why you think I am talking shit. Genuinely curious. Usually these things are done by a few people, not a one man team. For myself I try and whatever happens.
If you know more, great, I also strive to know more. But to say it's impossible.... Difficult yes, taking years? Also yes. But not impossible, it's just that the time it takes to do it is a lot. A one man team could take a lot longer than years, perhaps then I could say impossible.
Seeing as you already have done it, I will root for you, you can do it.
But I would still try, it sounds fun. Maybe I just like RE.
|
|
|
|
« Last Edit: February 24, 2023, 11:05:14 AM by dikidera »
|
Logged
|
|
|
|
|
prj
|
|
« Reply #2172 on: February 24, 2023, 01:00:46 PM »
|
|
|
I don't have any clue what you are even talking about tbh.
For ME9 all the OEM data is there, I bought an ECU, and once it arrives I'll add the protocol to my logger.
|
|
|
|
|
Logged
|
|
|
|
|
|
|
prometey1982
|
|
« Reply #2174 on: February 27, 2023, 02:27:51 PM »
|
|
|
Xc90 with 2.4 t5 engine. G25-660 pulsar turbo and 1.5 bar of boost. Spool is quicker than k24. Top end performance
is much better. Will apply 5120 hack to up boost pressure to 1.7 bar.
|
|
|
|
|
Logged
|
|
|
|
|
