roman_tyk
Full Member
Karma: +0/-0
 Offline
Posts: 87
|
 |
« on: November 27, 2015, 03:08:17 AM »
|
|
|
Hi guys,
I started to work on injection my code into ECU. Beginings were quite hard, but i successfully tested few functions/instructions C167 (ME7.5 518AL) on the bench. I used some variables located at 0x387006 and 0x387004, succesfully changed it. But when i loaded ECU to the car on original software i noticed that data on those addressess are changing in some special conditions during drive, so i decided to log ram space using me7logger on driving and when ignition is on. I figured out 20 possible locations always nulled. So i exchanged my 387006/4 to new one, but with those my program (working properly on previous vars) is not changing values on those adressess.
Is it possible that new found vars are somehow protected by ori bosch software??
|
|
|
|
« Last Edit: December 09, 2015, 01:15:44 AM by roman_tyk »
|
Logged
|
|
|
|
DT
Full Member
Karma: +20/-1
Offline
Posts: 184
|
|
« Reply #1 on: November 27, 2015, 03:53:57 AM »
|
|
|
Hi guys,
I started to work on injection my code into ECU. Beginings were quite hard, but i successfully tested few functions/instructions C167 (ME7.5 518AL) on the bench. I used some variables located at 0x387006 and 0x387004, succesfully changed it. But when i loaded ECU to the car on original software i noticed that data on those addressess are changing in some special conditions during drive, so i decided to log ram space using me7logger on driving and when ignition is on. I figured out 20 possible locations always nulled. So i exchanged my 387006/4 to new one, but with those my program (working properly on previous vars) is not changing values on those adressess.
Is it possible that new found vars are somehow protected by ori bosch software??
Zero that seldom changes is not a good marker for unused bytes. You always have to check a full flash disassembly before using ram. |
|
|
|
|
Logged
|
|
|
|
roman_tyk
Full Member
Karma: +0/-0
Offline
Posts: 87
|
|
« Reply #2 on: November 27, 2015, 06:41:07 AM »
|
|
|
I know that full dissasembly is great way to determine which parts of memory can be used without any doubts.
But for example Antliag php script (shared here) uses easy search algoritm by pattern 0xFF
{
echo "Finding a good space for launch control configuration variables..\r\n";
// OLD Function $launchvars = strpos($bin,"\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF",97700)+17;
$launchvars=findHole($bin, 32, hexdec("17000"), hexdec("18000"));
// Wurde kein Platz gefunden?
if(!$launchvars)
{
echo "cannot find space for configuration variables, please input offset by argument!\n";
die();
}
}
|
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #3 on: November 27, 2015, 07:08:19 AM »
|
|
|
Yes, and it often uses already occupied RAM.
Examples:
One RS6 file it uses some of the cruise control whatnot.
Later files it uses the bits that are tasked with RSA calculations.
|
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
roman_tyk
Full Member
Karma: +0/-0
Offline
Posts: 87
|
|
« Reply #4 on: November 29, 2015, 06:36:04 AM »
|
|
|
Successfully i've found some space and used it.
btw. Is there anybody who knows why ECU on bench does not notify (me7logg) changes on pines for clutch and cruise?
I checked by shortcutting to ground those pins:
T39 cluch
T38 cruise
T57 cruise
T75 cruise
T76 cruise
|
|
|
|
|
Logged
|
|
|
|
ozzy_rp
Jr. Member
Karma: +16/-1
Offline
Posts: 49
|
|
« Reply #5 on: November 29, 2015, 06:46:12 AM »
|
|
|
Successfully i've found some space and used it.
btw. Is there anybody who knows why ECU on bench does not notify (me7logg) changes on pines for clutch and cruise?
I checked by shortcutting to ground those pins:
T39 cluch
T38 cruise
T57 cruise
T75 cruise
T76 cruise
You need shortcut to "Positive connection 2 (15), in dash panel wiring harness (A104)" |
|
|
|
|
Logged
|
|
|
|
roman_tyk
Full Member
Karma: +0/-0
Offline
Posts: 87
|
|
« Reply #6 on: November 29, 2015, 07:48:18 AM »
|
|
|
thanks. Working perfectly.  |
|
|
|
« Last Edit: November 29, 2015, 07:50:56 AM by roman_tyk »
|
Logged
|
|
|
|
roman_tyk
Full Member
Karma: +0/-0
Offline
Posts: 87
|
|
« Reply #7 on: November 30, 2015, 08:49:41 AM »
|
|
|
Has anyone ecu definition with B_epcl flag? me7logger didn't find it on many ECUs
i've only read on forum that should be the same address as B_mil flag but bit 1 instead of bit 0.
;B_mil , {} , 0x00FD2A, 2, 0x0001,
;B_epcl , {} , 0x00FD2A, 2, 0x0002,
I checked in the car, and when b_mil is ON also b_epcl is ON on dashboard but 1 bit is zero.
|
|
|
|
« Last Edit: November 30, 2015, 09:57:04 AM by roman_tyk »
|
Logged
|
|
|
|
roman_tyk
Full Member
Karma: +0/-0
Offline
Posts: 87
|
|
« Reply #8 on: December 04, 2015, 01:53:24 AM »
|
|
|
Guys, i am looking for any information about me7.5 startup / init procedure especially conditions which have to be meet to start engine.
I've already tried view those:
- evz_austot
- b_bevab
- b_evabu
..but not sufficient.
i want to find some variable responsible for blocking startup engine.
|
|
|
|
|
Logged
|
|
|
|
|
gt-innovation
|
|
« Reply #9 on: December 04, 2015, 04:43:19 AM »
|
|
|
In which sw version you need this? post some more info and i might find one for you...
|
|
|
|
|
Logged
|
|
|
|
roman_tyk
Full Member
Karma: +0/-0
Offline
Posts: 87
|
|
« Reply #10 on: December 04, 2015, 05:32:30 AM »
|
|
|
In which sw version you need this? post some more info and i might find one for you...
8E0909518AQ |
|
|
|
|
Logged
|
|
|
|
|
gt-innovation
|
|
« Reply #11 on: December 08, 2015, 07:21:58 AM »
|
|
|
go for word_FD44.10 (fd44.10)
0x0625aa
|
|
|
|
|
Logged
|
|
|
|
roman_tyk
Full Member
Karma: +0/-0
Offline
Posts: 87
|
|
« Reply #12 on: December 08, 2015, 02:50:17 PM »
|
|
|
go for word_FD44.10 (fd44.10)
0x0625aa
at this addres i have setting of 9bit =>> bset word_FD44.9 ; =============== S U B R O U T I N E ==================================== Seg0x218@860000:25AA Seg0x218@860000:25AA Seg0x218@860000:25AA sub_8625AA: ; CODE XREF: sub_8623B6+144P Seg0x218@860000:25AA ; sub_8623B6+1D2P ... Seg0x218@860000:25AA 9F 22 bset word_FD44.9 Seg0x218@860000:25AC DB 00 rets Seg0x218@860000:25AC ; End of function sub_8625AA Seg0x218@860000:25AC Seg0x218@860000:25AE Seg0x218@860000:25AE ; =============== S U B R O U T I N E ======================================= |
|
|
|
|
Logged
|
|
|
|
roman_tyk
Full Member
Karma: +0/-0
Offline
Posts: 87
|
|
« Reply #13 on: December 08, 2015, 02:53:20 PM »
|
|
|
both are zero on bench (9 & 10):
gt-innovation , {} , 0x00FD44, 2, 0x0400, {}
gt-innovation2 , {} , 0x00FD44, 2, 0x0200, {}
|
|
|
|
|
Logged
|
|
|
|
|
gt-innovation
|
|
« Reply #14 on: December 09, 2015, 05:48:31 AM »
|
|
|
bset word_FD44.10 did not work for you?
|
|
|
|
|
Logged
|
|
|
|
|
