Pages: [1] 2 3
Author Topic: Rsa Deactivation on A4 1.8T 193hp  (Read 23806 times)
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« on: February 23, 2015, 06:02:02 AM »

Hello,

Has anyone deactivated the rsa check from this file?

Even if i put the ecu in TEST mode by changing the bytes from the eeprom and also the codewrods from
flash i get the death code bytes when doing changes outside the maps area after 2 3 days.

I have corrected the checksum with 4 different tools but nothings seems to make the correct rsa key for this version...
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #1 on: February 23, 2015, 10:23:18 AM »

ME7Sum should have no problem generating the correct RSA MD5 for this file
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #2 on: February 25, 2015, 08:24:03 AM »

ME7Sum should have no problem generating the correct RSA MD5 for this file

I used winols, Cmd, Ktag, Map3d,

I did not try the me7sum but for example if i add the als nls code here in 2 days the car will through 2 x AA bytes in the second and third page inside the eeprom and car will not start..I assume this comes from the rsa cause car runs perfeclty under all cases.
Logged
k0mpresd
Hero Member
*****

Karma: +146/-54
Offline Offline

Posts: 1655


« Reply #3 on: February 25, 2015, 08:48:42 AM »

ran through ecufix.
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #4 on: February 25, 2015, 10:30:33 AM »

I used winols, Cmd, Ktag, Map3d

I did not try the me7sum but for example if i add the als nls code here in 2 days the car will through 2 x AA bytes in the second and third page inside the eeprom and car will not start..I assume this comes from the rsa cause car runs perfeclty under all cases.


the NLS code that has been floating around is bad and overwrites RAM used by the RSA code. ECUfix disables RSA completely, which, IMO, is the wrong approach.

I have no intention of doing that in ME7Sum since that is supporting bad practice and bad code.

Get the NLS fixed.
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #5 on: March 03, 2015, 07:06:30 AM »

ran through ecufix.

Thanks for that will check it out as soon as possible.
Logged
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #6 on: March 03, 2015, 07:08:49 AM »

the NLS code that has been floating around is bad and overwrites RAM used by the RSA code. ECUfix disables RSA completely, which, IMO, is the wrong approach.

I have no intention of doing that in ME7Sum since that is supporting bad practice and bad code.

Get the NLS fixed.

So where is the bug on that one? Is there something wrong with any Register in the code or the 384ff0 is a bad address for the function counter?
« Last Edit: March 03, 2015, 07:15:07 AM by gt-innovation » Logged
ddillenger
Hero Member
*****

Karma: +637/-21
Offline Offline

Posts: 5640


« Reply #7 on: March 03, 2015, 10:08:36 AM »

So where is the bug on that one? Is there something wrong with any Register in the code or the 384ff0 is a bad address for the function counter?

Yes. The ram address being used is reserved for the RSA.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #8 on: March 03, 2015, 11:45:58 AM »

Yes. The ram address being used is reserved for the RSA.

Thank you for the answer and which would be a tested address space for the rsa equiped ecus?


As for the RSA deactivation, Since i do not own the ecufix after some research i did with IDA pro in various files with rsa, a quick way to deactivate it would be to search for the following hexstring :

c1 47 fc 10 00 8d eb 98 60 db 00 xx xx xx xx (word_fd9x.x, locret_8xxxxx in most cases)

replace the xx with db 00 db 00 and the first jump is off

The xx xx xx xx bytes do also include the memory address of the next jump that you will need to disable so if you load the file in ida pro you will quickly find out the next address.However if you search for the 8b db 00 xx xx xx xx after the first jump you will most likely find the second one.

I checked this in 3 sw versions Me7.5 (polo - seat leon - audi a4 ) and found that it was the same procedure.

so assuming that ecufix disables the rsa completly that way, even if i use the same address ecu will not lock down or ?
Logged
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #9 on: March 05, 2015, 08:56:16 AM »

Maybe 385ff0? i do not see something there in this a4 bin.anyway i will test it...
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #10 on: March 05, 2015, 11:27:22 AM »

try 0x386000

Anyway  I was told there are other issues in this NLS code... I'd probably ditch it until it is fixed or you know enough to fix all the problems in it yourself.

Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #11 on: March 16, 2015, 01:03:20 PM »

try 0x386000

Anyway  I was told there are other issues in this NLS code... I'd probably ditch it until it is fixed or you know enough to fix all the problems in it yourself.



Works on one polo...Will try to the a4 aswell.
Logged
technic
Full Member
***

Karma: +17/-5
Offline Offline

Posts: 227


« Reply #12 on: March 21, 2015, 04:06:31 AM »

What NLS code are you talking about? Are you refering to this  http://www.nefariousmotorsports.com/wiki/index.php/Adding_anti-lag_launch_control_and_no-lift_shift ?

Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #13 on: March 21, 2015, 10:07:11 AM »

Don't know about that code. Was referring to Mazer's script.
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 442


« Reply #14 on: March 23, 2015, 08:35:20 AM »

What NLS code are you talking about? Are you refering to this  http://www.nefariousmotorsports.com/wiki/index.php/Adding_anti-lag_launch_control_and_no-lift_shift ?



yes but after some days happened the same again with 386000 unfortunatly...in order to inject though i wrote my own tool but maybe there is a bug on that aswell...will check it soon enough.

i also had the rsa disabled (andy`s way) but i do not think that this was the problem.... i will use the launch.exe from the forum and cross check with my tool first.
« Last Edit: March 23, 2015, 08:43:48 AM by gt-innovation » Logged
Pages: [1] 2 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.022 seconds with 16 queries. (Pretty URLs adds 0s, 0q)