DISASSEMBLERS please read. New Platform
Jul 2, 2009 | 01:34 AM
#1
Thread Starter
Evolved Member
iTrader: (17)
Joined: Jun 2005
Posts: 3,419
Likes: 14
From: Chico, CA (NOR-CAL)
DISASSEMBLERS please read. New Platform
Hello, some of you know me, some dont. anyways, I picked up an Audi S4 (B5), which is the 2.7l V6 twin turbo. Anyways, they have no open source type of flashing programs or anything. I know we have some smart people here and am wondering if anyone thinks they can help out. I have an extra S4 ECU that I can contribute to this cause. Also, a LOT of people in the S4 community would to donate money if we could get some where with this project.
Last edited by Evo_Jay; Jul 4, 2009 at 08:27 PM.
Jul 2, 2009 | 01:54 AM
#2
Evolved Member
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
If you use generic memory model as specified in EcuFlash 1.42 release notes you should be able to view the ROM, without flashing support.
Jul 2, 2009 | 02:21 AM
#5
Evolved Member
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
It should be
<memmodel>Generic1024K</memmodel>
but I have not tried it, I have asked Colby to provide complete set of keywords, but I have no reply yet
<memmodel>Generic1024K</memmodel>
but I have not tried it, I have asked Colby to provide complete set of keywords, but I have no reply yet
# 2009-06-27: Version 1.42 released
* -- EcuFlash Related Changes --
* support for flashing H8/539FA processor (e.g. Evo 6.5) via new H8539FA memory model
* add many generic memory models to allow support for arbitrary ROMs from ECUs that EcuFlash has no flashing support for. these are named Generic1K, Generic2K, ... up to Generic2048K, including all powers of 2, plus many other common sizes.
* fix programming voltage warning errors in Subaru HC16 kernels
* actively pull up OBD pin 9 when communicating with HC16 Subarus to avoid reflash mode initialization problems on some EDM models
* add some retries to kernel reads, instead of failing
* allow unique ID data in Subaru CAN ROM protected area to be different without requiring this area to be reflashed (which is not allowed). this allows ROMs of the same version to be shared amongst users without refusal-to-flash errors.
* fixed error that limited data type to 4 bytes in size (doubles and bloblists can be bigger)
* fixed bug in Subaru K-line reflashing that did not initialize the parity mode of the vehicle interface, causing errors if the interface had previously been used with odd or even parity
* -- J2534 DLL Related Changes --
* (no changes other than new firmware payload)
* -- Firmware Related Changes --
* fix bug which can cause CAN receive buffer overruns during large ISO15765 transfers
* fix bug where resting voltage of adjustable power supply can be low enough to trigger undervoltage protection of voltage multiplexer IC
* increase maximum allowable ISO9141 baud rate to be 125000 baud
* -- EcuFlash Related Changes --
* support for flashing H8/539FA processor (e.g. Evo 6.5) via new H8539FA memory model
* add many generic memory models to allow support for arbitrary ROMs from ECUs that EcuFlash has no flashing support for. these are named Generic1K, Generic2K, ... up to Generic2048K, including all powers of 2, plus many other common sizes.
* fix programming voltage warning errors in Subaru HC16 kernels
* actively pull up OBD pin 9 when communicating with HC16 Subarus to avoid reflash mode initialization problems on some EDM models
* add some retries to kernel reads, instead of failing
* allow unique ID data in Subaru CAN ROM protected area to be different without requiring this area to be reflashed (which is not allowed). this allows ROMs of the same version to be shared amongst users without refusal-to-flash errors.
* fixed error that limited data type to 4 bytes in size (doubles and bloblists can be bigger)
* fixed bug in Subaru K-line reflashing that did not initialize the parity mode of the vehicle interface, causing errors if the interface had previously been used with odd or even parity
* -- J2534 DLL Related Changes --
* (no changes other than new firmware payload)
* -- Firmware Related Changes --
* fix bug which can cause CAN receive buffer overruns during large ISO15765 transfers
* fix bug where resting voltage of adjustable power supply can be low enough to trigger undervoltage protection of voltage multiplexer IC
* increase maximum allowable ISO9141 baud rate to be 125000 baud
Last edited by acamus; Jul 2, 2009 at 02:24 AM.
Jul 2, 2009 | 02:38 AM
#7
Evolved Member
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
You have to create a ROM XML
something like
then you have to create tables and scalings...
something like
Code:
<rom>
<romid>
<xmlid>8D0907551F</xmlid>
<internalidaddress>???</internalidaddress>
<internalidhex>8D0907551F</internalidhex>
<make>AUDI</make>
<market>USDM</market>
<model>S</model>
<submodel>S</submodel>
<transmission>Manual</transmission>
<year>2006?</year>
<flashmethod>???</flashmethod>
<memmodel>Generic1024K</memmodel>
</romid>
</rom>
Trending Topics
Jul 2, 2009 | 02:55 AM
#8
Evolved Member
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
But basically you are looking after something like
http://cgi.ebay.de/EOBD2-OBDII-OBD-E...30176002r37862
http://www.remaps.de/kabel
if you want to flash.
http://cgi.ebay.de/EOBD2-OBDII-OBD-E...30176002r37862
http://www.remaps.de/kabel
if you want to flash.
Jul 2, 2009 | 03:29 AM
#9
Thread Starter
Evolved Member
iTrader: (17)
Joined: Jun 2005
Posts: 3,419
Likes: 14
From: Chico, CA (NOR-CAL)
You have to create a ROM XML
something like
then you have to create tables and scalings...
something like
Code:
<rom>
<romid>
<xmlid>8D0907551F</xmlid>
<internalidaddress>???</internalidaddress>
<internalidhex>8D0907551F</internalidhex>
<make>AUDI</make>
<market>USDM</market>
<model>S</model>
<submodel>S</submodel>
<transmission>Manual</transmission>
<year>2006?</year>
<flashmethod>???</flashmethod>
<memmodel>Generic1024K</memmodel>
</romid>
</rom>
Got any ideas on what to put int he bold areas?
Also, any ideas on scalings and tables?? thx
Also, the link i post in my first post has some info, i just dont know how to use it
Jul 2, 2009 | 03:36 AM
#11
Evolved Member
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
http://74.125.79.132/translate_c?hl=...m9UZWpQE4LGAXQ
You have bought german car, do not blame me for it
Jul 2, 2009 | 03:40 AM
#12
Evolved Member
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Jul 2, 2009 | 03:41 AM
#13
Thread Starter
Evolved Member
iTrader: (17)
Joined: Jun 2005
Posts: 3,419
Likes: 14
From: Chico, CA (NOR-CAL)
I started a XML, but Im gonna need some help. I mean i i know how to add a table here and there and how to add scaling, but starting from scratch is a lil over my head.
Jul 2, 2009 | 04:10 AM
#15
Evolved Member
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Attached xml can open one of files at http://nyet.org/cars/files/
namely
http://nyet.org/cars/files/8D0907551F.bin
I do not know at what location is the ROMID but you can load it to ECUFlash.
Rename it to XML and store in romdata ecuflash directory.
this should get you started.
Either use MapHunter to find maps or use WinOLS for brute hex search or read processor manual and use IDA to find them.
Once you have maps test them on car - create scalings.
An example for brute hex search on above file would be
namely
http://nyet.org/cars/files/8D0907551F.bin
I do not know at what location is the ROMID but you can load it to ECUFlash.
Rename it to XML and store in romdata ecuflash directory.
this should get you started.
Either use MapHunter to find maps or use WinOLS for brute hex search or read processor manual and use IDA to find them.
Once you have maps test them on car - create scalings.
An example for brute hex search on above file would be
Code:
<scaling name="myScaling" units="units" toexpr="x" frexpr="x" format="%.0f" min="0" max="255" inc="1" storagetype="uint8" endian="big"/> <table name="newTable" address="11c6e" type="3D" level="1" scaling="myScaling"> <table name="X" address="0" type="X Axis" elements="20" scaling="myScaling"/> <table name="Y" address="0" type="Y Axis" elements="10" scaling="myScaling"/> </table>
Last edited by acamus; Jul 2, 2009 at 04:54 AM.