By the way flash can be read by checksum calculation command. For example for TCM module 7A:
1. Start sending sleep message for 2 secs with 100 ms interval:
0xFFFFE 0xFF 0x86 0x00 0x00 0x00 0x00 0x00 0x00
2. Switch TCM module to programming mode:
0xFFFFE 0x7A 0xC0 0x00 0x00 0x00 0x00 0x00 0x00

3. Send start add for checksum: AABBCCDD - addr from 0xF0000 down
0xFFFFE 0x7A 0x9C 0xAA 0xBB 0xCC 0xDD
4. Send get checksum with next byte:
0xFFFFE 0x7A 0xB4 0xAA 0xBB 0xCC 0xDD+1
5. Read response from TCM.

6. After all flash is read send CAN reset message.
0xFFFFE 0xFF 0xC8 0x00 0x00 0x00 0x00 0x00 0x00

Looks like this approach can also be used for ECM module read.

ECM 0x7A
TCM 0x6E
CEM 0x40/0x50

Thanks, its just as you said. However adding 1 to address does not fetch correct data, I have to set checksum address to the new byte location and then issue get checksum again. Slower but at least it works.

diki@raspberrypi:~ $ cansend can0 000FFFFE#7A9C00000080 <- rom address 00000080
diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000081 <- fetches first byte from that address
diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000082 <- does NOT fetch next byte correctly, it's mutated
diki@raspberrypi:~ $ cansend can0 000FFFFE#7A9C00000081 <- set checksum pointer to next byte
diki@raspberrypi:~ $ cansend can0 000FFFFE#7AB400000082 <- correct data retrieved.

All in all, I would call this a success, thank you for the invaluable information.

might be something to think about... you dont have a method to state your can speed for datalogging


good work!

 

Also may think of incorporating the checksum tool on flash. This is how my .bin flasher works

Curious. Is it the CEM that verifies the code or the ECM? Why not just patch out the checksum code?

Free The Moose testing

Flashing works

Reading does not work, always stops at same time and tells the file is corrupt.

Logging not tested yet, need to make xml file but then i will put the car on my dyno and test the logging.