Pages: 1 ... 118 119 [120] 121 122 ... 194
Author Topic: The Volvo ME7 thread:  (Read 1759865 times)
dikidera
Full Member
***

Karma: +10/-8
Offline Offline

Posts: 152


« Reply #1785 on: November 03, 2022, 01:59:31 AM »

Prometey, did you manage to find which CAN commands dump bytes from ROM?
Logged
keichi
Full Member
***

Karma: +11/-2
Offline Offline

Posts: 100


« Reply #1786 on: November 03, 2022, 04:02:20 AM »

Checksum check is a simple:
Code:
#include "ChecksumHelper.hpp"

namespace util {

namespace {
uint32_t getValue(const std::vector<uint8_t>& data, size_t index)
{
    return ((uint32_t)data[index + 3] << 24)
            + ((uint32_t)data[index + 2] << 16)
            + ((uint32_t)data[index + 1] << 8)
            + (uint32_t)data[index];
}

void setValue(std::vector<uint8_t>& data, size_t index, uint32_t value)
{
    data[index] = static_cast<uint8_t>(value);
    data[index + 1] = static_cast<uint8_t>(value >> 8);
    data[index + 2] = static_cast<uint8_t>(value >> 16);
    data[index + 3] = static_cast<uint8_t>(value >> 24);
}

}

bool ChecksumHelper::check(const std::vector<uint8_t>& data) const
{
    uint32_t buffer_index = 0x1F810;
    uint32_t max_buffer_index = 0x1FA00;
    if (data.size() == 1024 * 1024)
        max_buffer_index = 0x1FC00;
    do {
        uint32_t start_addr = getValue(data, buffer_index);

        // Get the checksum zone end address
        uint32_t end_addr = getValue(data, buffer_index + 4);

        if (start_addr >= data.size() || end_addr >= data.size())
            break;

        uint32_t checksum = 0;
        for (uint32_t addr = start_addr; addr < end_addr; addr += 2)
            checksum += ((uint32_t)data[addr + 1] << 8) + (uint32_t)data[addr];

        uint32_t curr_checksum = getValue(data, buffer_index + 8);
        uint32_t compliment_curr_checksum = getValue(data, buffer_index + 12);

        uint32_t complchecksum = ~checksum;

        if (curr_checksum != checksum || compliment_curr_checksum != complchecksum)
            return false;

        buffer_index += 0x10;
    }
    while(buffer_index < max_buffer_index);
    return true;
}

void ChecksumHelper::update(std::vector<uint8_t>& data) const
{
    uint32_t buffer_index = 0x1F810;
    uint32_t max_buffer_index = 0x1FA00;
    if (data.size() == 1024 * 1024)
        max_buffer_index = 0x1FC00;
    do {
        uint32_t start_addr = getValue(data, buffer_index);

        // Get the checksum zone end address
        uint32_t end_addr = getValue(data, buffer_index + 4);

        if (start_addr >= data.size() || end_addr >= data.size())
            break;

        uint32_t checksum = 0;
        for (uint32_t addr = start_addr; addr < end_addr; addr += 2)
            checksum += ((uint32_t)data[addr + 1] << 8) + (uint32_t)data[addr];

        uint32_t complchecksum = ~checksum;

        setValue(data, buffer_index + 8, checksum);
        setValue(data, buffer_index + 12, complchecksum);

        buffer_index += 0x10;
    }
    while(buffer_index < max_buffer_index);
}

}


Looks like checksum calculation ranges vary even more.
In 2002 S60 T5 (20KPSC) 1MB bin checksum is calculated in the range 0x000000-0x0BFFFF so for this particular software variable max_buffer_index = 0x1FAF0.
Logged
prometey1982
Sr. Member
****

Karma: +72/-60
Offline Offline

Posts: 330



WWW
« Reply #1787 on: November 03, 2022, 04:20:50 AM »

Looks like checksum calculation ranges vary even more.
In 2002 S60 T5 (20KPSC) 1MB bin checksum is calculated in the range 0x000000-0x0BFFFF so for this particular software variable max_buffer_index = 0x1FAF0.
Yes, I caught the situation with 20KPSC software. But it still works when checksum updated twice.
Logged

Россия - Великая страна!
https://youtu.be/fup5GzIFdXk
prometey1982
Sr. Member
****

Karma: +72/-60
Offline Offline

Posts: 330



WWW
« Reply #1788 on: November 03, 2022, 04:21:23 AM »

Prometey, did you manage to find which CAN commands dump bytes from ROM?
You can dump flash with read memory by addr message.
Logged

Россия - Великая страна!
https://youtu.be/fup5GzIFdXk
prometey1982
Sr. Member
****

Karma: +72/-60
Offline Offline

Posts: 330



WWW
« Reply #1789 on: November 03, 2022, 08:18:57 AM »

Prometey, did you manage to find which CAN commands dump bytes from ROM?
By the way flash can be read by checksum calculation command. For example for TCM module 7A:
1. Start sending sleep message for 2 secs with 100 ms interval:
0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00
2. Switch TCM module to programming mode:
0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00

3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down
0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD
4. Send get checksum with next byte:
0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1
5. Read response from TCM.

6. After all flash is read send CAN reset message.
0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00

Looks like this approach can also be used for ECM module read.
« Last Edit: November 03, 2022, 08:21:31 AM by prometey1982 » Logged

Россия - Великая страна!
https://youtu.be/fup5GzIFdXk
t6
Full Member
***

Karma: +0/-5
Offline Offline

Posts: 56


« Reply #1790 on: November 03, 2022, 09:21:04 AM »


heres what i have used for 03-04 autos in a euro file

Hi,
I tried this soft but the engine does not start. S60R 2003, original: QGHJ
Logged
luki743
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 18


« Reply #1791 on: November 03, 2022, 09:32:52 AM »

By the way flash can be read by checksum calculation command. For example for TCM module 7A:
1. Start sending sleep message for 2 secs with 100 ms interval:
0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00
2. Switch TCM module to programming mode:
0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00

3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down
0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD
4. Send get checksum with next byte:
0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1
5. Read response from TCM.

6. After all flash is read send CAN reset message.
0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00

Looks like this approach can also be used for ECM module read.

ECM 0x7A
TCM 0x6E
CEM 0x40/0x50
Logged
rlinewiz
Jr. Member
**

Karma: +16/-1
Offline Offline

Posts: 44


« Reply #1792 on: November 03, 2022, 09:45:36 AM »


I usually flash a 50GPHJ in an 05 auto car.  This Will cross flash no problem. As long as you are sure the bin is a auto

thats good to know, and will save me a ton of work. now I just have to track down a 50GPHJ AUT AWD US bin..  unless an EU bin will work? I remember reading they're tuned back a wee bit
« Last Edit: November 03, 2022, 10:01:59 AM by rlinewiz » Logged

2005 S60R M66-Swapped // Self-tuned @ 22psi
[[forever coding for the OpenMoose project]]
dikidera
Full Member
***

Karma: +10/-8
Offline Offline

Posts: 152


« Reply #1793 on: November 03, 2022, 10:24:34 AM »

By the way flash can be read by checksum calculation command. For example for TCM module 7A:
1. Start sending sleep message for 2 secs with 100 ms interval:
0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00
2. Switch TCM module to programming mode:
0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00

3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down
0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD
4. Send get checksum with next byte:
0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1
5. Read response from TCM.

6. After all flash is read send CAN reset message.
0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00

Looks like this approach can also be used for ECM module read.

Thanks, its just as you said. However adding 1 to address does not fetch correct data, I have to set checksum address to the new byte location and then issue get checksum again. Slower but at least it works.

diki@raspberrypi:~ $ cansend can0 000FFFFE#7A9C00000080 <- rom address 00000080
diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000081 <- fetches first byte from that address
diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000082 <- does NOT fetch next byte correctly, it's mutated
diki@raspberrypi:~ $ cansend can0 000FFFFE#7A9C00000081 <- set checksum pointer to next byte
diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000082 <- correct data retrieved.

All in all, I would call this a success, thank you for the invaluable information.
« Last Edit: November 03, 2022, 10:32:00 AM by dikidera » Logged
s60rawr
Full Member
***

Karma: +22/-1162
Offline Offline

Posts: 191



WWW
« Reply #1794 on: November 03, 2022, 06:02:13 PM »

Delete this. its old and irrelevant
« Last Edit: November 10, 2022, 12:15:35 PM by s60rawr » Logged


There is a free flash suite in progres

http://www.openmoose.net/blog/?page=renatus

#1 Nefmoto -Karma Sponge!
SparkyR
Full Member
***

Karma: +19/-21
Offline Offline

Posts: 84



« Reply #1795 on: November 03, 2022, 07:23:44 PM »

might be something to think about... you dont have a method to state your can speed for datalogging


good work!

 
« Last Edit: November 03, 2022, 07:27:28 PM by SparkyR » Logged

2005 S60R m66, Xona Rotor 7864, turbosmart 45mm wastegate, 1300cc injectors
s60rawr
Full Member
***

Karma: +22/-1162
Offline Offline

Posts: 191



WWW
« Reply #1796 on: November 03, 2022, 07:57:32 PM »

might be something to think about... you dont have a method to state your can speed for datalogging


good work!

 


that may have been an oversight....
the fuction is there lol...
oopsssss
Logged


There is a free flash suite in progres

http://www.openmoose.net/blog/?page=renatus

#1 Nefmoto -Karma Sponge!
SparkyR
Full Member
***

Karma: +19/-21
Offline Offline

Posts: 84



« Reply #1797 on: November 03, 2022, 08:51:40 PM »

Also may think of incorporating the checksum tool on flash. This is how my .bin flasher works
Logged

2005 S60R m66, Xona Rotor 7864, turbosmart 45mm wastegate, 1300cc injectors
s60rawr
Full Member
***

Karma: +22/-1162
Offline Offline

Posts: 191



WWW
« Reply #1798 on: November 03, 2022, 09:43:00 PM »

ya the other tool I have does that too
but it has the vlic lock stuff
it's on the list!
I have it running on my computer and it refreshes the folder every so often
but yes
thanks for testing
Logged


There is a free flash suite in progres

http://www.openmoose.net/blog/?page=renatus

#1 Nefmoto -Karma Sponge!
dikidera
Full Member
***

Karma: +10/-8
Offline Offline

Posts: 152


« Reply #1799 on: November 04, 2022, 12:12:28 AM »

Also may think of incorporating the checksum tool on flash. This is how my .bin flasher works
Curious. Is it the CEM that verifies the code or the ECM? Why not just patch out the checksum code?
Logged
Pages: 1 ... 118 119 [120] 121 122 ... 194
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.022 seconds with 15 queries. (Pretty URLs adds 0s, 0q)