Pages: [1]
Author Topic: Noob needs a little advice  (Read 12263 times)
mikeyanxu
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 9


« on: February 28, 2015, 10:31:17 PM »

hello,
Just started learning on this forum. The vehicle is 2003 jetta GLI with 2.8 24V VR6 engine code BDF. My goal is to delete the SAI, EVAP, and post cat O2 sensor. I have permanently removed those parts from the car during the build and now I desperately need to pass the emission test.
ECU is ME7.1.1. I had successfully read the flash file from ECU. Now I am like facing a brick wall and can't make any progress.
Due to the lack of correct definition file, I can't open the .bin file in tunerpro.
Days worth of research showed that I can make my own xdf based on the existing fully defined .bin file and xdf file. But the file has to be very similar to mine. So, how to find such a fully defined file? And what parameters do I need to consider in order to make sure the file is similar to mine? engine size, ecu part number, software revision level, and etc?
Can anyone make me an xdf file for my ECU? I am very happy to pay for your time!
Thanks again for your time.
Logged
mikeyanxu
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 9


« Reply #1 on: February 28, 2015, 10:35:30 PM »

Another question, is there another way around only for goal to delete emission related DTC? I am not looking forward to modify performance. What other method can I use to open and edit the .bin file? I know C language. I also learned assembly language in college. It is not something I'd love to do for living but I don't mind to pick it up again.
Logged
aef
Hero Member
*****

Karma: +69/-46
Offline Offline

Posts: 1600


« Reply #2 on: March 02, 2015, 02:31:58 AM »

Uploading your file here would be a good start.

The internal bosch sw version number is what matters.
Logged
mikeyanxu
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 9


« Reply #3 on: March 02, 2015, 09:02:21 PM »

Yes sir. Please see the attached Flash file.
Thank you for your help.
Logged
aef
Hero Member
*****

Karma: +69/-46
Offline Offline

Posts: 1600


« Reply #4 on: March 03, 2015, 01:24:24 AM »

Okay,

so one way is to open this in winols demo to check out the sw version numbers.

we are talking about:
vag part number: 022906032CS or 022906032BM
bosch part number: 0261207881
software: ....368604

next step (what i do) is to check if this file is modified or original
google for "0261207881 368604" guids us to this

http://www.chiptuners.org/forums/viewtopic.php?t=5968
filename is: "022906032CS 0006.bin"

so the bosch version 368604 is the vag revision 0006 (good to know)
You will find the 0006 on the sticker of your ecucase.

a import of the "022906032CS 0006.bin"  into winols shows 100% the same as your file. so yours is original too or both are modified in the same way lol...

one cool side note from the chiptuners.org links are the two other software version number:
366145 and 366374

so what to do next?

start with google because nefs search is crap
site:nefariousmotorsports.com 366374 --> nothing
site:nefariousmotorsports.com 366145 --> nothing
site:nefariousmotorsports.com 368604 --> nothing
site:nefariousmotorsports.com BDF --> ahhhhh

okay no useful results

There is a link somewhere in the forum to a VAG DAMOS ONLY file.
within this file vomes a V6/R32 ols which should match your file

attached
« Last Edit: March 03, 2015, 01:26:47 AM by aef » Logged
mikeyanxu
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 9


« Reply #5 on: March 03, 2015, 11:21:31 PM »

Thank you so much. I loved the way you not only shine light to my question but also showed me how to get there. Just one more dumb question and I like to confirm. Will the 3.2 VR6 motor ME 7.1.1 definition file work for my 2.8 VR6 motor bin file with ME7.1.1? What factors are the key here in order to decide if the definition files are same between two flash file?
Logged
ddillenger
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #6 on: March 03, 2015, 11:29:35 PM »

Thank you so much. I loved the way you not only shine light to my question but also showed me how to get there. Just one more dumb question and I like to confirm. Will the 3.2 VR6 motor ME 7.1.1 definition file work for my 2.8 VR6 motor bin file with ME7.1.1? What factors are the key here in order to decide if the definition files are same between two flash file?

Will the addresses be the same? Very unlikely.

As for what determines which definitions are shared, very few are. Generally only between the same model year, but auto/manual variants. Shit, even a later revision of the same software will be different in most cases.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
RBPE
Sr. Member
****

Karma: +40/-5
Offline Offline

Posts: 395



« Reply #7 on: March 04, 2015, 06:25:16 AM »

Large parts of the BDF and BDE map addresses line up with that BFH file but some need offsets.

-8  -4  -2  -1  0  1  2  4  8  are the most common offsets that find them with that file (all ME7.1.1 24V/R32 seem to be very closely related) if you line it up in winOLS demo, but I have just lined it up against my BDE master file and the offset 1 has lined some areas up so those values may need to be changed by that amount.

PROKON - Codeword SLS - 181C3
« Last Edit: March 04, 2015, 06:27:19 AM by RBPE » Logged
mikeyanxu
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 9


« Reply #8 on: March 04, 2015, 11:24:23 PM »

Thank you all for the great tips. So, I just opened up both the 3.2 vr6 flash file and my 2.8 vr6 flash file side by side in winols. I tried to find the map using the search method shown in "how to find map" video: https://www.youtube.com/watch?v=0dkuoFh2foQ&feature=youtu.be
It wasn't successfule but I will try more tomorrow. Can someone please take a look and see if this method is possible to find definition file for my 2.8 bdf motor with ME7.1.1? Thank you for your precious time! I really appreciated it.
Logged
RBPE
Sr. Member
****

Karma: +40/-5
Offline Offline

Posts: 395



« Reply #9 on: March 06, 2015, 01:17:39 PM »

No files really line up with the variances in the code and neither will this one.

It is a full def file though so you will have to learn how to pick out the maps  - there should be about 4 lambda maps in the definition file - these always seem to line up with the R32/V6 4motion/VR6 24V files.

As said earlier - try the offsets from -8 to 8 and scroll up and down the ecu, some maps should line up.
Logged
mikeyanxu
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 9


« Reply #10 on: March 06, 2015, 09:59:29 PM »

Hello, thank you for being so helpful. I spen some time in winols demo tonight. I started trying to find the lambda maps from this 3.2 vr6 ols file. However, when I tried to search CDHSH, CDHSHE,CDLATV, CDLASH, CDLSH, and CDLSHV (ccording to S4wiki), I found nothing. Does it mean that this 3.2 vr6 .ols file doesn't contain any map about the lambda control?

No files really line up with the variances in the code and neither will this one.

It is a full def file though so you will have to learn how to pick out the maps  - there should be about 4 lambda maps in the definition file - these always seem to line up with the R32/V6 4motion/VR6 24V files.

As said earlier - try the offsets from -8 to 8 and scroll up and down the ecu, some maps should line up.
Logged
RBPE
Sr. Member
****

Karma: +40/-5
Offline Offline

Posts: 395



« Reply #11 on: March 07, 2015, 07:52:03 AM »

Sorry, I didn't mean to post lambda, was doing three things at once and playing with those maps on another ecu at the time!  Huh 

I actually meant the 14x14 maps in the R32 ecu which are usually the easiest to find and together on these ecu's (should be GGHFM for the MAF corrections if I remember right).

Try this;

Ctrl + 2 to line the maps up. Go to the BFH file and go to GGHFM (I think it is) and in there are some 14x14 maps. Right click one of them with your mouse and go to "view in hexdump" and it will flash where the point is in the binary code.
Usually with these maps as they are so large, they can be easily found by winols and as such, should be able to find them in the other ecu and the buttons will light up with the offset for those maps. If they look right then transfer the map details (button second from bottom on the connecting join), just transfer structure instead of values (I have seen some things switched off and on with that VR6 24V/R32 file compared with oem bins) at which point it should say "x axis values are not the same, same ones found at offset x" and you can make notes of the offsets and see if they are correct and see what lines up.

I will have a look at this ecu with the R32 one and pick out some bits and take a couple of screenshots if it makes it easier? I have spent a couple of minutes on it and -4 came up and 0 offset too for a few maps. Will find out when I get on that computer and post some up next time.
Logged
mikeyanxu
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 9


« Reply #12 on: March 07, 2015, 10:31:35 AM »

Thank you so so much sir. Let me try and play with it. Your time is precious so I will only ask for the screen shots if I can't figure it out. Thanks again. I am sure I will have more questions. Smiley

Sorry, I didn't mean to post lambda, was doing three things at once and playing with those maps on another ecu at the time!  Huh 

I actually meant the 14x14 maps in the R32 ecu which are usually the easiest to find and together on these ecu's (should be GGHFM for the MAF corrections if I remember right).

Try this;

Ctrl + 2 to line the maps up. Go to the BFH file and go to GGHFM (I think it is) and in there are some 14x14 maps. Right click one of them with your mouse and go to "view in hexdump" and it will flash where the point is in the binary code.
Usually with these maps as they are so large, they can be easily found by winols and as such, should be able to find them in the other ecu and the buttons will light up with the offset for those maps. If they look right then transfer the map details (button second from bottom on the connecting join), just transfer structure instead of values (I have seen some things switched off and on with that VR6 24V/R32 file compared with oem bins) at which point it should say "x axis values are not the same, same ones found at offset x" and you can make notes of the offsets and see if they are correct and see what lines up.

I will have a look at this ecu with the R32 one and pick out some bits and take a couple of screenshots if it makes it easier? I have spent a couple of minutes on it and -4 came up and 0 offset too for a few maps. Will find out when I get on that computer and post some up next time.
Logged
RBPE
Sr. Member
****

Karma: +40/-5
Offline Offline

Posts: 395



« Reply #13 on: March 08, 2015, 06:48:06 AM »

Here you go - easy one to do first.

Open the two files and connect them (ctrl+2)
Scroll down the R32 file till you come to ignition coil closing time - ZUESZ in blue -in that there is a map I've also highlighted in blue, right click "view in hexdump" which it will in yellow on the R32 file - the 5A5A bit - winols will then pick up this map with the offset -FA and you can then line it up.
The bit I have highlighted in red at the bottom is where you can add the map structure, I would leave the values alone on any reference file and just do the axis data and then have a look to see if it looks okay.

You can now do a couple more in that area as can be seen where the maps are defined in blue - have a play!
« Last Edit: March 12, 2015, 12:05:44 PM by RBPE » Logged
Tiros
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3


« Reply #14 on: October 23, 2016, 10:31:26 AM »

Can someone please extract and post the binary from the attached 3.2 VR6 flash file?
I need to load the binary into IDA. I only have winols demo, I tried to extract with hex edit but it doesn't look quite right and me7 check reports errors.
Nevermind...they are checksum errors. It doesn't affect my disassembly.
« Last Edit: October 25, 2016, 04:24:50 AM by Tiros » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.023 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)