Post your tool here. I haven't disassembled the code yet, but is it only one ram address accessed by that code? Are used registers free? Everything push:ed and pop:ed correctly?

I have this problem only on RSA binaries so that is why i assumed it was the rsa algo that was conflicting with something on the code...

As i have seen on other posts there are a some users that had the same problem but i did not checked the code myself instead i wrote a gui tool to make things faster for the implementation.

As for the emulator i would like some info so i can set one up by myself either with keil or anyother sw/hw combination.

No need to convince someone here about anything since all of you are kind enough to provide a lot of usefull information which made our life easier...Further more since my contribution was not much i am willing to change that somehow if i have the time in the future.

My frist step is to share the tool i developed for that code:

Simple Gui wrote in visual studio with c#. It still needs your me7info .ecu output but you need to type the addresses by hand since i was too lazy to make a parser for it. Nothing is needed to run(no php), just .net which i am sure everyone has.

I am also working in a better version that locates ftomn and other addresses and can fix eeprom errors and checksum on the 95040 but it is still based on the initial code that is published here.

The bitmask table that will be needed :

40001.0     mask:0001   -> 00h
40001.1     mask:0002   -> 10h
40001.2     mask:0004   -> 20h
40001.3     mask:0008   -> 30h
40001.4     mask:0010   -> 40h
40001.5     mask:0020   -> 50h
40001.6     mask:0040   -> 60h
40001.7     mask:0080   -> 70h
40001.8     mask:0100   -> 80h
40001.9     mask:0200   -> 90h
40001.10     mask:0400  -> A0h
40001.11     mask:0800  -> B0h
40001.12     mask:1000  -> C0h
40001.13     mask:2000  -> D0h
40001.14     mask:4000  -> E0h
40001.15     mask:8000  -> F0h


To locate Ftomn on 1.8T i search for a0a0a08080(05) in hex

nls counter 0x384ff0 for non rsa ecus.

Well if that is the case then Rsa occupies both 384ff0 and 386000 ? Maybe Setzi or someone else can enlgihten us on this..

Talking this thread from death I will try to ask here. I am curious about this too. I have same problem with a similar A4 ME7.5. 8E0909518AR RSA ECU. I have been doing tests and looking for an answer. I have mixed results bricked at once or after several on-off cycles. Then may I ask which will be the way to solve this problem, different RSA RAM address or RSA totally disable?

Yes

Ok attached

I have send NLS rpm limit to a higher value than actual car rpm limit in order to deactivate it. LC function works but in few hours or during the second day it bricks again.