Pages: [1]
Author Topic: The McMESS protocol in ME7  (Read 32912 times)
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« on: July 11, 2011, 02:09:47 AM »

Here are the notes I have compiled for the McMESS protocol as I found it implemented
in ME7.  I collected this just for completeness, I believe that nobody could make something
really useful with this braindead protocol.
Logged
rkam
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 55


« Reply #1 on: July 15, 2011, 02:45:41 AM »

Very good information!

I have been curious about MCMESS for a while.
Reference to it is also found in Volvo M4.4, and I wonder if this protocol could be the one that can read and possibly write directly to CPU ports. In the communication code parts of M4.4 there are direct MOV P1, P2, P3 ... commands.

I'm quite sure that I can now waste a lot of time exploring this stuff based on your document :-)

Volvo is using 9-bit 187500bps to diagnose M1.8. Transparent blue KKL interfaces can handle this and also some PCMCIA-RS232 cards for laptop.
« Last Edit: July 15, 2011, 02:52:42 AM by rkam » Logged
passuff
Jr. Member
**

Karma: +3/-9
Offline Offline

Posts: 48


« Reply #2 on: July 15, 2011, 03:27:35 AM »

Any clue what kind of software tool to use for setup a McMess communication . Tried a lot of serial toolkits/analyzer but no one was able to do proper communication due to reasons like:
-no customize baud rate
-no puls init
-no proper scripting(if receive xyz send xyz)
-no 9bit
any helpful suggestion are welcome Wink
Logged
rkam
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 55


« Reply #3 on: July 15, 2011, 08:13:13 AM »

Probably only high-end tool(s) like INCA.

http://en.wikipedia.org/wiki/INCA_(software)
http://www.bosch-motorsport.de/content/downloads/Documentation/Archiv/08_Data_Logging_Systems/KIC_2.pdf

I'll probably try to make something in VB that can make the connection, but it will probably never do anything useful.
Logged
passuff
Jr. Member
**

Karma: +3/-9
Offline Offline

Posts: 48


« Reply #4 on: July 18, 2011, 10:35:39 AM »

Inca  works only if you have seed, a2l and hex for your ecu ( beside the KIC 2 Interface).. It's not for reverse engineering Wink

I think it could be the right way to use atmega with level changer like this one (is on my bench) but his source (kwp1281 /kwp2000) is not opened for everyone. so you have to write your own one Wink

http://66.196.80.202/babelfish/translate_url_content?lp=de_en&url=http%3A%2F%2Fwww.blafusel.de%2Fobd%2Fwbhdiagpro_bt_b.html&.intl=de
Logged
Tony@NefMoto
Administrator
Hero Member
*****

Karma: +132/-4
Offline Offline

Posts: 1389


2001.5 Audi S4 Stage 3


« Reply #5 on: August 29, 2011, 11:48:47 PM »

Thanks for sharing the info.

I found the code for the 17 predefined values that you can read and write a long time ago when I was disassembling code. I never found out what communication system was calling into them though. Good to know it is part of McMESS.

Did you end up using any part of the McMESS protocol in the ME7 Logger you wrote?
Logged

Remember you have to log in if you want to see the file attachments!
Info or questions, please add to the wiki: http://www.nefariousmotorsports.com/wiki
Follow NefMoto developments on Twitter: http://twitter.com/nefmoto
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #6 on: September 07, 2011, 01:59:19 AM »

I didn't use the McMESS protocol for logging, it is so braindead ...
Good luck to everybody trying to make some use of this protocol.
Logged
Neuss
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 8


« Reply #7 on: August 20, 2020, 10:09:57 AM »

Code:
with a normal fastinit pulse and an "A0" request messsage:
   a) fast init pulse 25ms low / 25ms high, send 82 10 F1 A0 A5 <cks> (10400baud,8N1)
        -> receive 03 E0 A5 0D cks (10400baud,8N1) => connected with normal speed (10400bd)

What do the <cks> symbols mean?
Logged
woj
Hero Member
*****

Karma: +43/-3
Offline Offline

Posts: 500


« Reply #8 on: August 21, 2020, 04:37:39 AM »

Code:
with a normal fastinit pulse and an "A0" request messsage:
   a) fast init pulse 25ms low / 25ms high, send 82 10 F1 A0 A5 <cks> (10400baud,8N1)
        -> receive 03 E0 A5 0D cks (10400baud,8N1) => connected with normal speed (10400bd)

What do the <cks> symbols mean?

Checksum most likely...
Logged
Neuss
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 8


« Reply #9 on: August 21, 2020, 06:12:14 AM »

Checksum most likely...
I think so too. How to calculate it?
Logged
nyet
Administrator
Hero Member
*****

Karma: +607/-168
Offline Offline

Posts: 12268


WWW
« Reply #10 on: August 21, 2020, 10:36:32 AM »

http://files.s4wiki.com/docs/kwp2000_recommended_guidlines.pdf

should be there somewhere.

but there are a ton of mcmess documents avail on the internet
Logged

ME7.1 tuning guide
ECUx Plot
ME7Sum checksum
Trim heatmap tool

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
totti
Full Member
***

Karma: +15/-29
Offline Offline

Posts: 227


« Reply #11 on: October 18, 2020, 03:51:35 PM »

Hi,

Is it possible with McMESS to change CWMDAPP and LDRAPP with running engine? I would like to log my N75 valve characteristic without reflash the ecu.
Logged
360trev
Full Member
***

Karma: +68/-2
Offline Offline

Posts: 235


« Reply #12 on: November 12, 2020, 08:08:57 PM »

Hi,

Is it possible with McMESS to change CWMDAPP and LDRAPP with running engine? I would like to log my N75 valve characteristic without reflash the ecu.

Your going to need to do some work. The McMess allows reading and writing to ram variables defined in its table. So you'd need to relocate any variables you wish to change at runtime from rom map section first.

How? You'd need to search and patched the code which references those ROM map area locations to relocate them to RAM and then initialized them to default values early on at boot before they are referenced. After that its relatively straight forward to accomplish what you want to do after adding them into the VSV table and its default values table. The number of entries in the tables also would need updating but yes it could be made to work as long as you have the available ram.

Logged
kruftindustries
Full Member
***

Karma: +1/-1
Offline Offline

Posts: 50



« Reply #13 on: April 19, 2021, 11:26:11 PM »

Is this how "quicktune" works in commercial software? One I've seen seems to update specific memory addresses and update checksums but the car has to be off.
« Last Edit: April 19, 2021, 11:28:14 PM by kruftindustries » Logged
denux44
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 1


« Reply #14 on: September 10, 2022, 07:50:20 PM »

This software is compatible with the J1939 communication protocol.HuhHuhHuh?
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.026 seconds with 17 queries. (Pretty URLs adds 0s, 0q)