TWiST
Newbie
Karma: +4/-0
 Offline
Posts: 20
|
 |
« on: March 13, 2011, 12:17:46 AM »
|
|
|
I have a 2001.5 TIP S4 and I have been interested in tuning my TCU since I first got the car but paying 450 bux for it is just a bit much I think. I have been doing googling here and there and really not coming up with anything what so ever on how to read and write to the TCU and then figuring out how to mess with it. I was hoping someone has some kind of information on this it would be super cool to take tuning 1 step further to the transmission. I know there is not much time put into auto's because the transmission is just not as tight as the manual but @ 220k miles on the engine and my daily almost 100 mile commute I can't do a 6MT swap. If I find any info out in my searching I will post it here.
Thanks!
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #1 on: March 15, 2011, 05:04:30 PM »
|
|
|
We need to know the KWP1281 or KWP2000 address of the TCU.
Then we need to figure out if the TCU supports flashing via KWP1281 or KWP2000.
Then we need to determine if the same methods used to flash ECUs work for TCUs.
Then we need to start making definition files, compare stock to tuned, etc.
|
|
|
|
|
Logged
|
|
|
|
carlossus
Sr. Member
Karma: +38/-0
Offline
Posts: 394
Leon Curpa Stg1+
|
|
« Reply #2 on: March 16, 2011, 02:00:01 AM »
|
|
|
The monoscan s/w seems to be able to connect to transmission controllers using a KKL cable. Might be worth a play.
|
|
|
|
|
Logged
|
|
|
|
|
RaraK
|
|
« Reply #3 on: March 16, 2011, 07:27:37 AM »
|
|
|
The monoscan s/w seems to be able to connect to transmission controllers using a KKL cable. Might be worth a play.
Yea i do remember seeing something like that with the MonoScan. I will try that out on my moms TIP A4 and see if theres any success Twist |
|
|
|
|
Logged
|
|
|
|
TWiST
Newbie
Karma: +4/-0
Offline
Posts: 20
|
|
« Reply #4 on: March 16, 2011, 04:35:53 PM »
|
|
|
My understanding of monoscan was that it was essentially a free version of vagcom? If we could figure out how to connect to the TCU and read and write, I may be inclined if no one else came forward to spend the 450 just so we could have a tuned file to play with and compare to a stock one. But hopefully someone with a TIP Chip could be so gracious to let us rip his TCU instead cause I can think of a million other things on my car that I could spend that 450 on.
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #5 on: March 16, 2011, 05:35:23 PM »
|
|
|
I need to find some time to make the address the NefMoto ECU flasher connects to user selectable. Because I am really hoping it uses the same standard VAG protocols for flashing as the ECU. If that is the case, then we would only need to figure out which memory addresses to read from.
|
|
|
|
|
Logged
|
|
|
|
TWiST
Newbie
Karma: +4/-0
Offline
Posts: 20
|
|
« Reply #6 on: March 16, 2011, 07:43:09 PM »
|
|
|
Ok so looks like my googling efforts may, possibly, hopefully help us in some tiny way. I found this russian forum and registered on it and got what I think, according to the chrome translator some automatic transmission files and a couple of them are Audi, I am going to attach what I found and link to the site if anyone else wants to check it out. I suggest you use google chrome as it will auto translate the site and its super smooth and easy to use that way. This is a link to the thread in question. Translator required unless you can read Russian. http://www.carhelp.info/forums/showthread.php/12216-%D0%9F%D1%80%D0%BE%D1%88%D0%B8%D0%B2%D0%BA%D0%B8-%D0%AD%D0%91%D0%A3-%D0%90%D0%9A%D0%9F%D0%9F |
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #7 on: March 21, 2011, 10:34:41 AM »
|
|
|
The next step would be to load these files into IDA to determine the memory layout.
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #8 on: May 06, 2011, 12:01:41 PM »
|
|
|
If anyone would like to test connecting to the TCU, I have a test release of the NefMoto flashing software that allows you to connect to custom addresses. Just let me know if you would like to try it out.
|
|
|
|
|
Logged
|
|
|
|
|
julex
|
|
« Reply #9 on: May 06, 2011, 06:10:09 PM »
|
|
|
I am more interested in premium features at this points, I am doing lots of research on our ECU file and flashing whole thing 20 times a day is really getting to me.
Thanks.
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #10 on: May 06, 2011, 06:28:12 PM »
|
|
|
I am more interested in premium features at this points, I am doing lots of research on our ECU file and flashing whole thing 20 times a day is really getting to me.
Hah. Message received.  Version 1.7.1.0 which isn't released yet is already tested and has full support for licensing premium features. I was waiting for a website update to actually offer the premium features though. I will get it sorted this weekend. Either the website gets updated, or I will make them available before the website update. |
|
|
|
|
Logged
|
|
|
|
|
julex
|
|
« Reply #11 on: May 06, 2011, 08:27:35 PM »
|
|
|
I am more interested in premium features at this points, I am doing lots of research on our ECU file and flashing whole thing 20 times a day is really getting to me.
Hah. Message received. Version 1.7.1.0 which isn't released yet is already tested and has full support for licensing premium features. I was waiting for a website update to actually offer the premium features though. I will get it sorted this weekend. Either the website gets updated, or I will make them available before the website update. I am working on major breakthrough for anti-lag feature for our ECU as well as no-lift-shift. I even got "RL" cable so that the licensing works ok, I hope you can give me a break on pricing albeit I suspect it will be pretty nominal anyways. Keep the AWESOME job up! |
|
|
|
|
Logged
|
|
|
|
|
gremlin
|
|
« Reply #12 on: May 07, 2011, 04:26:00 PM »
|
|
|
We need to know the KWP1281 or KWP2000 address of the TCU.
Then we need to figure out if the TCU supports flashing via KWP1281 or KWP2000.
Then we need to determine if the same methods used to flash ECUs work for TCUs.
Then we need to start making definition files, compare stock to tuned, etc.
Just as idea... Maybе some texts from ini-files of flash-soft will be usefull. Compare values for ME7.1 and TCU. [ME 7.1.1 Master] AddressWord=$01 FileStartAdr=$800000 BlockCnt=3 Offset=$0000,$0000,$0000 StartAdr=$800000,$820000,$810000 StopAdr=$80FFFF,$8FFFFF,$81FFFF DelStartAdr=$800000,$820000,$810000 DelStopAdr=$80FFFF,$8FFFFF,$81FFFF CheckStartAdr=$800000,$820000,$810000 CheckStopAdr=$80FFFF,$8FFFFF,$81FFFF Format=$00,$00,$00 Code=0x68, 0x05, 0x81, 0x4A, 0x05, 0x87, 0x5F, 0xBD, 0x5D, 0xBD, 0x49, 0x4C [AL 600 / GS 19.04] AddressWord=$02 BlockCnt=4 FileStartAdr=$0000 Offset=$0000,$0000,$0000,$600000 StartAdr=$8000,$B0000,$90080,$E0080 StopAdr=$6FF7F,$DFFFF,$AFFFF,$FFFFF DelStartAdr=$8000,$B0000,$90000,$E0000 DelStopAdr=$6FFFF,$DFFFF,$AFFFF,$FFFFF CheckStartAdr=$8000,$B0000,$90080,$E0080 CheckStopAdr=$6FF7F,$DFFFF,$AFFFF,$FFFFF Format=$00,$00,$00,$00 Code=0x68, 0x06, 0x81, 0x4A, 0x05, 0x87, 0x6B, 0x5F, 0x7D, 0xD5, 0x49, 0x4C |
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #13 on: May 09, 2011, 01:09:10 PM »
|
|
|
Just as idea...
Maybе some texts from ini-files of flash-soft will be usefull.
Compare values for ME7.1 and TCU.
[ME 7.1.1 Master]
AddressWord=$01
FileStartAdr=$800000
BlockCnt=3
Offset=$0000,$0000,$0000
StartAdr=$800000,$820000,$810000
StopAdr=$80FFFF,$8FFFFF,$81FFFF
DelStartAdr=$800000,$820000,$810000
DelStopAdr=$80FFFF,$8FFFFF,$81FFFF
CheckStartAdr=$800000,$820000,$810000
CheckStopAdr=$80FFFF,$8FFFFF,$81FFFF
Format=$00,$00,$00
Code=0x68, 0x05, 0x81, 0x4A, 0x05, 0x87, 0x5F, 0xBD, 0x5D, 0xBD, 0x49, 0x4C
[AL 600 / GS 19.04]
AddressWord=$02
BlockCnt=4
FileStartAdr=$0000
Offset=$0000,$0000,$0000,$600000
StartAdr=$8000,$B0000,$90080,$E0080
StopAdr=$6FF7F,$DFFFF,$AFFFF,$FFFFF
DelStartAdr=$8000,$B0000,$90000,$E0000
DelStopAdr=$6FFFF,$DFFFF,$AFFFF,$FFFFF
CheckStartAdr=$8000,$B0000,$90080,$E0080
CheckStopAdr=$6FF7F,$DFFFF,$AFFFF,$FFFFF
Format=$00,$00,$00,$00
Code=0x68, 0x06, 0x81, 0x4A, 0x05, 0x87, 0x6B, 0x5F, 0x7D, 0xD5, 0x49, 0x4C
gremlin, what software is that ini info from? That info is very informative. I'm not sure what the "Code" entry is though. I will have to compare that to the NefMoto software. I wonder if that is the security access seed table. For instance it appears as though for flashing the ECU, they do range 0x800000-0x80FFFF, then range 0x820000-0x8FFFFF, then range 0x81FFFF-0x820000. I assume they are flashing in this order to handle changing the persistent ECU data that is backed up between sectors. The NefMoto software detects when flashing individual sectors fails an erase, and then defaults to flashing the entire chip at once to overcome the limitations of changing the persistent ECU data. The method being used here with changing the order the sectors are flashed in seems like another elegant solution. I'm a little surprised at the gaps in the TCU memory maps. The addresses also seem to indicate that the memory ranges being erased are larger than the ranges being written to. |
|
|
|
|
Logged
|
|
|
|
|
gremlin
|
|
« Reply #14 on: May 09, 2011, 04:06:55 PM »
|
|
|
gremlin, what software is that ini info from?
That info is very informative. I'm not sure what the "Code" entry is though. I will have to compare that to the NefMoto software. I wonder if that is the security access seed table. It's taken from DiaGRA software. I agree that strings concern SA seed data. See at red bytes sequence given for ME7 ECU. Then at SA table used in ME7. And then at blue bytes in TCU string... Code=0x68, 0x05, 0x81, 0x4A, 0x05, 0x87, 0x5F, 0xBD, 0x5D, 0xBD, 0x49, 0x4C Code=0x68, 0x06, 0x81, 0x4A, 0x05, 0x87, 0x6B, 0x5F, 0x7D, 0xD5, 0x49, 0x4C |
|
|
|
|
Logged
|
|
|
|
|
