Pages: [1] 2
Author Topic: Disassembling my edc15p  (Read 19531 times)
john9357
Full Member
***

Karma: +10/-1
Offline Offline

Posts: 54


« on: September 21, 2013, 03:50:02 PM »

Hello, I introduce myself, my name is jonathan. I am passionate chiptuning and I am also moderator in chiptuners.fr where i work a lot.
I'm a french who does not speak English so excuse me in advance for my bad English. (Google traduction!!)
I am currently working on a TDI edc15p but I do not have as much knowledge as some here.
I would disassemble the program in my ecu to learn more.
I have not managed to connect the C167 with MINIMON and Galetto or kkl.
I connected directly the C167 with a ftdi on rx and tx pins and I used flashit to extract the file. (Minimon logs on but doesn't work to download irom).
With FLASHit I can also read flash. Reading the irom gives me the same file with or without the flash.

Here is some information that I found in my ecu :
The C167 operates at 16mhz (has checked the oscilloscope).
The pin / ae is connected to 5v so the presence of a irom.
The connections between the flash and the C167:

Code:
29f400 <-> c167
A0 <-> A1
A1 <-> A2
A2 <-> A3
A3 <-> A4
A4 <-> A5
A5 <-> A6
A6 <-> A7
A7 <-> A8
A8 <-> A9
A9 <-> A10
A10 <-> A11
A11 <-> A12
A12 <-> A13
A13 <-> A14
A14 <-> A15
A15 <-> A16
A16 <-> A17
A17 <-> A18

Q0 <-> AD0
Q1 <-> AD1
Q2 <-> AD2
Q3 <-> AD3
Q4 <-> AD4
Q5 <-> AD5
Q6 <-> AD6
Q7 <-> AD7
Q8 <-> AD8
Q9 <-> AD9
Q10 <-> AD10
Q11 <-> AD11
Q12 <-> AD12
Q13 <-> AD13
Q14 <-> AD14
Q15 <-> AD15

/WE <-> /CS4
/OE <-> /CS0
vss <-> /CE
vdd <-> /BYTE

How to know the address of the external ram, and the address of the flash?
which chip on the pcb is the ram?
I give you the file in the internal rom and the external rom my ecu.

Thank you in advance for your help.
Logged
john9357
Full Member
***

Karma: +10/-1
Offline Offline

Posts: 54


« Reply #1 on: September 21, 2013, 04:05:18 PM »

When I disassemble the internal rom in my EDC15 and in a me7, I realize that the structure is totally different.
At the init of the EDC15 dpp0=0 dpp1=1 dpp2=2 dpp3=3, different from me7.
Logged
john9357
Full Member
***

Karma: +10/-1
Offline Offline

Posts: 54


« Reply #2 on: November 24, 2013, 03:43:51 PM »

for information, I've written a driver for minimon to erase and write the 29F400 in boot mode in my edc15p+
http://www.youtube.com/watch?v=RL79P5YnF5s
Logged
mtx-electronics
Full Member
***

Karma: +11/-1
Offline Offline

Posts: 66


WWW
« Reply #3 on: November 25, 2013, 11:23:20 AM »

Nice work, keep on going Smiley A few years ago I worked on this ecu to extract the checksum algos and a few months ago in collaboration with Dilemma while he was working on the EDC15Suite software I put toghether a small opensource program for checksum calculation so that he could add it to is application. You might find this code usefull for your current adventure. I'll attach it here for reference.

Some notes:

- The VAG 4.1 checksum is not compatible with all files, Dilemma has made some fixes that are included in the EDC15Suite source;
- The VAG 4.1-2002 checksum is working fine;
- The code is a ASM to C convertion and can be optimized but I had little time to work on it and probably will won't update it any time soon.
Logged
john9357
Full Member
***

Karma: +10/-1
Offline Offline

Posts: 54


« Reply #4 on: November 25, 2013, 03:37:12 PM »

Thank you verry.
I build a new version:
-bug solved
-read an write at 0x80000 (not write at 80000 and read at 100000)
-no configuration for ADDRSEL3 and BUSCON3 (just BUSCON0=04AD and SYSCON=E404)

« Last Edit: November 25, 2013, 03:39:05 PM by john9357 » Logged
dream3R
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 1194


« Reply #5 on: December 09, 2013, 02:53:48 AM »

Pretty cool!

I take it you've got this figured out then, or do you want me to see if I can find the settings?
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
dragon187
Full Member
***

Karma: +13/-15
Offline Offline

Posts: 106


« Reply #6 on: March 26, 2017, 11:11:07 AM »

Where can I get this minimon?
Thanks
Logged
nihalot
Full Member
***

Karma: +41/-3
Offline Offline

Posts: 117


« Reply #7 on: March 26, 2017, 10:00:56 PM »

Where can I get this minimon?
Thanks

http://www.infineon.com/cms/en/product/microcontroller/legacy-products-c500-c166-xc166-audo1-family/c166/xc166-development-tools-software-and-kits/software-downloads/channel.html?channel=ff80808112ab681d0112ab6b50fe07c9
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MG1/MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
badger
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3


« Reply #8 on: March 28, 2017, 08:54:13 AM »

Hello!

I'm looking into reverse engineering the EDC15P for a few reasons.

- Disable reading through OBD by disabling the 'download allowed' return that the ECU sends before transmitting the data.
- Multimap Switching (understand there is a way already however, I don't have $$$ to buy the code so I'm learning how it's done)

I've managed to download my EEPROM dump (IRAM etc...) using MiniMon and managed to finally get it to load in IDA Pro.

Issues I'm having is how to link the documentation and maps contained within :/
Logged
prj
Hero Member
*****

Karma: +1072/-483
Offline Offline

Posts: 6039


« Reply #9 on: March 28, 2017, 09:10:25 AM »

- Disable reading through OBD by disabling the 'download allowed' return that the ECU sends before transmitting the data.
There is a ROM function to download, good luck disabling that lol.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
badger
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3


« Reply #10 on: March 28, 2017, 11:16:05 AM »

There is a ROM function to download, good luck disabling that lol.

So maybe this method won't work?

When using a ECU Programming tool (MPPS etc...) I'm trying to understand the process the ECU goes through to allow the EEPROM read. I've read the Functionscreiben for the EDC15+ and it talks about download access and data access.
Logged
prj
Hero Member
*****

Karma: +1072/-483
Offline Offline

Posts: 6039


« Reply #11 on: March 29, 2017, 12:15:38 AM »

Already told you, this functionality on EDC15 is present in the processor ROM.
Unless you want to change the processor, as the ROM is OTP.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
naach_
Full Member
***

Karma: +3/-2
Offline Offline

Posts: 55


« Reply #12 on: March 30, 2017, 04:05:31 AM »

Very interested in this topic, I'm trying to figure out how to make a codeblock change by time, let's say a "trial version". Good post guys
Logged

nihalot
Full Member
***

Karma: +41/-3
Offline Offline

Posts: 117


« Reply #13 on: March 30, 2017, 05:23:37 AM »

Very interested in this topic, I'm trying to figure out how to make a codeblock change by time, let's say a "trial version". Good post guys

Have done the trial version but for a different purpose... automatic codeblock change after warmup time(15minutes)
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MG1/MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
naach_
Full Member
***

Karma: +3/-2
Offline Offline

Posts: 55


« Reply #14 on: March 30, 2017, 08:27:21 AM »

Have done the trial version but for a different purpose... automatic codeblock change after warmup time(15minutes)
There would be some post where you explain the way to get ideas?
Logged

Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.025 seconds with 17 queries. (Pretty URLs adds 0s, 0q)