# Reading/Writing ECU files



## chaveezy (Jan 31, 2010)

What is the suggested method of retrieving a file from the ECU, and then writing a file ONTO the ECU? 

My Mika Fuel Tune is going to be updated, but since they are in Finland, they just said send them the file and they would update it to the newest version and email me back the file so I can write it onto the ECU. They sent me a link of a KWP2000 reader/writer on Ebay, but it was only like $24.00 and I was a little skeptical of using it. 

Anyone have any experience with this?


----------



## reflected (Apr 6, 2007)

ill do it for you. im in greensboro. or search galletto 1260 on ebay.


----------



## chaveezy (Jan 31, 2010)

I appreciate it man! 4 hours away, ugh, if you were closer I'd def. take you up on the offer and pay you in beers :beer:, but I think I'll just order a cable. Will this cable also work with VAG-COM? 

Also, about the boot mode, what pin will need to be grounded?


----------



## reflected (Apr 6, 2007)

will not work with vagcom. 
boot mode requires use of pin 24 on flash. and usually a bench harness set up. though, it should work over obd in the car. assuming mika doesnt use any protection on their tunes. i doubt they do.


----------



## chaveezy (Jan 31, 2010)

They didn't say they did but I will ask them. I was looking on youyoukiller.free.fr and I saw this photo for an ME7.5, how accurate is this to get into boot mode?


----------



## reflected (Apr 6, 2007)

accurate. connect 1k resistor to ground, hold resistor to point on ecu, power ecu, count to 5, remove resistor. ecu is now in boot mode. 

edit: this works too. in case you have an epoxied ecu.


----------



## chaveezy (Jan 31, 2010)

I'll be attempting this through the OBDII port, so will key on/key off suffice for power on/off? Getting it out of boot mode will just take power off --> power on?


----------



## reflected (Apr 6, 2007)

i guess i should have made it more clear in my earlier post when i said "should work over obd". i meant that you should be able to read/write over standard obd without having to use boot mode. boot mode is a last resort if everything else fails.


----------



## chaveezy (Jan 31, 2010)

Oh ok I gotcha. The KWP2000 says you should have to use Boot Mode, so I just figured this would be of the same nature. Def. will attempt this without boot mode first!

Thanks again, owe you a few rounds :biggrinsanta:


----------



## bootymac (Apr 19, 2005)

Are you going to use the Galletto 1260? Keep us posted on how it goes!


----------



## chaveezy (Jan 31, 2010)

I've ordered it, should be here today/tomorrow so I'll def. do a write up on pulling the file. :beer:


----------



## Ph8 (Apr 19, 2005)

please do, I'm very interested!


----------



## hootyburra (Feb 19, 2007)

never had a successful read over obdII with my ebay galletto.
Hopefully your luck is better. 

I would hook up a battery tender while doing this. You don't want your voltage dropping.


----------



## chaveezy (Jan 31, 2010)

Thanks for the input, how was your experience with the Galletto? I assume you had to go ahead with the boot mode then?


----------



## Turbo freak (May 9, 2005)

hootyburra said:


> never had a successful read over obdII with my ebay galletto.
> Hopefully your luck is better.
> 
> I would hook up a battery tender while doing this. You don't want your voltage dropping.


All galletto clones (cheap ebay) work only with boot mode. If you want read/write by obd you need to buy original tool.... like 3000 euro!


----------



## Turbo freak (May 9, 2005)

reflected said:


> accurate. connect 1k resistor to ground, hold resistor to point on ecu, power ecu, count to 5, remove resistor. ecu is now in boot mode.
> 
> edit: this works too. in case you have an epoxied ecu.



What kind of protection is that??? LOL


----------



## chaveezy (Jan 31, 2010)

I thought the same thing, I guess that's their attempt at "securing" the flash chip.. Nice job. :screwy:


----------



## reflected (Apr 6, 2007)

Turbo freak said:


> What kind of protection is that??? LOL


unitronic = fail.


----------



## Turbo freak (May 9, 2005)

reflected said:


> unitronic = fail.



Nice epoxy encryption chip! 

I may think thats the reason you have to send the ecu for a big turbo file all the way to canada.


----------



## AmIdYfReAk (Nov 8, 2006)

Turbo freak said:


> all the way to canada.


----------



## reflected (Apr 6, 2007)

lol. :biggrinsanta:


----------



## FuzzyVW537 (Feb 22, 2008)

Shot in the dark...
but I ran across this a little while ago

http://www.nefariousmotorsports.com/forum/index.php?topic=254.0


----------



## chaveezy (Jan 31, 2010)

Nice! I wonder if it'd work. I received the cable yesterday, popped open the ECU today and will be attempting to retrieve the file after a little while here, just have to go pick up a 1k ohm resistor and a battery tender (good call on this).

Once I get it into boot mode and pull the file, will I need to do anything special to get it out of boot mode? Or just key off and key on without pin 24 grounded?

Stand by opcorn:


----------



## chaveezy (Jan 31, 2010)

I know I need a 1k ohm resistor but bow many watt? 1/8? What is the purpose of this? Just surge prot?


----------



## reflected (Apr 6, 2007)

watt shouldnt really matter. 1/4 watt would be fine.


----------



## chaveezy (Jan 31, 2010)

Currently reading the ECU file, didn't put it into boot mode yet, we'll see what happens but it looks to be copying it down (65% at 300 sec)

Update: Well it looks to have saved a 1024 byte file that I named, but it doesn't have an extension, I opened the file using the Galletto software and it looks to have the checksum and ecu info on there so I guess I'm good. I'll email this file off to Mika and see what they say.

Hopefully (if this actually written properly) writing it back onto the ECU is as easy as reading it, I took my ECU apart and was prepared to go into bootmode but it hasn't been necessary yet. I'll wait until I write it back on to put everything back together. :thumbup:


----------



## chaveezy (Jan 31, 2010)

I had a little scare when my screen saver came on at 84%, luckily I wasn't writing but I turned off all my power saving features and the file copied right. 

I did go and pick up a 1 to 2 amp trickle charger just for this procedure.

So writing onto the ECU might require boot mode when reading doesn't?


----------



## Turbo freak (May 9, 2005)

Boot mode is the safest mode to read/write a file.

You should read it again in boot mode so you have a good file. If your write fail (normal mode), you will brick your ecu. In boot mode you can even stop your writing by any mean and then putting it again in boot mode and re start without any trouble.

You should ask mika if the checksum of your read is OK, if not you will need to read again in boot mode. Other thing is that it is a lot faster, like 150 seconds to read or write.


----------



## l88m22vette (Mar 2, 2006)

I attempted some of this stuff before taking the plunge on Maestro7, keep at it guys I want open-source/user flashing and mods to explode by the end of 2011. The ME7 is due :thumbup:


----------



## chaveezy (Jan 31, 2010)

I will ask Mika if the checksums are good but he's already contacted me about the file and said it should be good. He is going to make some updates, adjustments and a few other deletes I've asked him to and send me the file back.

There seems to be various programs already developed for read/writing/modifying the ecu data as I've been searching a lot online, would it be possible to decode some of the Unisettings or Lemmiwinks software to check modifcation tables and what not? 

This may have been attempted previously but what exactly (data wise) is Mika/Unitronics/Revo/others modifying for all these adjustments?


----------



## Ph8 (Apr 19, 2005)

As soon as APR or another forum sponsor sees the answer out in the open, the thread will likely be black-holed...

I have a check-sum calculator I picked up somewhere, if you need it.


----------



## thom337 (Oct 13, 2007)

chaveezy said:


> I will ask Mika if the checksums are good but he's already contacted me about the file and said it should be good. He is going to make some updates, adjustments and a few other deletes I've asked him to and send me the file back.
> 
> There seems to be various programs already developed for read/writing/modifying the ecu data as I've been searching a lot online, would it be possible to decode some of the Unisettings or Lemmiwinks software to check modifcation tables and what not?
> 
> This may have been attempted previously but what exactly (data wise) is Mika/Unitronics/Revo/others modifying for all these adjustments?



There is a big difference between the modifications made by unisettings/lemmiwinks and "tuning the ECU". The adaptation values are stored in the EEPROM, which has its own separate checksum strategy, which is actually fairly simple. The 512kb-1Mb flash eeprom contains the nitty gritty, operating code and data. Its checksum is not as simple and it has both 8 and 16 bit tables/etc. There is open source software in the works that will correct the checksums, and there is also some out there currently if you're willing to shell out a small ammount of $. For a lot more money, you can turn to some of the big companies, but you will pay for their expertise.


----------



## chaveezy (Jan 31, 2010)

Since they all operate using the same modifications, it would be impossible for them to justify a copyright infringement, as it's Bosch (if anyone) that would hold copyright. Now if you used their specific code source to make the modifications, then yes, they could get upset and have a leg to stand on. 

I'm just trying to understand the encryption method I guess, when you say "checksum", are you referring to the process of verification that the ECU uses to validate data? If so, what does that have to do with the actual modification process? I could see where making a modification will require a checksum to validate the operation..

Am I off base?


----------



## thom337 (Oct 13, 2007)

chaveezy said:


> Since they all operate using the same modifications, it would be impossible for them to justify a copyright infringement, as it's Bosch (if anyone) that would hold copyright. Now if you used their specific code source to make the modifications, then yes, they could get upset and have a leg to stand on.


Yes, the issue isn't with making modifications, its with taking apart other people's software and copying it. Lemmi/Unisettings are already free, but I'm not sure what laws would apply to freeware as far as reverse engineering. The best way to progress safely (and in the open on vwvortex) with the open source route is for people to start understanding the communication protocol and the hardware/memory layout and doing it themselves. 




chaveezy said:


> I'm just trying to understand the encryption method I guess, when you say "checksum", are you referring to the process of verification that the ECU uses to validate data? If so, what does that have to do with the actual modification process? I could see where making a modification will require a checksum to validate the operation..
> 
> Am I off base?


If you modify something, the checksum will be different. If the ECU goes through its checksum routine and the checksum storage locations don't equal what it just calculated it will at best throw an error and at worst completely shutdown and become a paperweight until you can recover. You must modify both the data you want to change, and then correctly change the checksumm storage locations.


----------



## chaveezy (Jan 31, 2010)

Yep, so that checksum calculator would be of use in that sense. However, what fields and data to change to make table modifications is what we're really after. That's basically what I was getting at in looking into the software to see what fields they modify for timing/boost/fuel tables (short and long), etc. 

Thanks, you guys rock  

I'm just waiting on Mika to send my file back mainly, the modifying discussion can be started on a new thread at a later date. This really perked my interest in this though, I think I'm going to build a test bench harness and get a few ME7.5 ECU's to play around with. :biggrinsanta:


----------



## Ph8 (Apr 19, 2005)

Here's a link from NefMoto that might be of interest to you:

http://www.nefariousmotorsports.com/wiki/index.php/Reverse_Engineering_ME7.5

And checksum info (I thought I had some for 7.5 but I guess it's only 7.1)

http://www.andywhittaker.com/ECU/BoschMotronicME71/tabid/68/Default.aspx


----------



## chaveezy (Jan 31, 2010)

erevlydeux said:


> Already well on the way. Check out nefmoto's forums. There are already free tools for reading/writing to the ME7 and apparently checksum fixing + pro-level logging (logging speed that makes VAG-COM look stupid) are following shortly.


He has only updated the ecu specifics, I emailed him to check the status on the actual progress.




erevlydeux said:


> The contents of the EEPROM are checksum'd. As in... there are multiple points (if I remember correctly) where there is a checksum value for all the data before it. Basically, a checksum is: you take X number of bytes, add them all together, do a little magic math, and arrive at a single value that represents a fingerprint of all of those bytes. The ECU checks this checksum(s) every single time you start the car, verifying that the ECU code is good and not corrupted.
> 
> What this has to do with the modification process is that any time you change something, it invalidates the previously generated checksum(s). This is why you need a tool to regenerate the checksums. WinOLS has plugins to do it (diferent plugin for different ECU types, etc) and there are countless checksum fixing programs... ECUFix is a big one.


I think ECUFix is only for ME7.1 w/ 512byte files, I emailed him as well to see if this would work with the ME7.5.X systems with 1024byte files, waiting on replies, and will post updates when I hear back from both of them! eace:


----------



## chaveezy (Jan 31, 2010)

erevlydeux said:


> Like I said, the nefmoto forums. I'm on active threads there as we speak.


I see, it's all in the Forums now and not so much on his online Google spreadsheet. BTW, I think I'm in love with that site :biggrinsanta:


----------



## chaveezy (Jan 31, 2010)

Ordered another cable besides the Galletto that I've got so that I could perform some datalogging for Mika Karala.

I couldn't find much information on the internal construction of the Galletto 1260 cable but what is the difference between the internal pin-out of the 1260 and a KII-USB?


----------



## chaveezy (Jan 31, 2010)

Welp, just flashed without boot mode and it took perfectly. Used the ME7.5.5 driver that came with the Galletto software, so now I have the most updated Mika Tune.. Gotta go put some miles on it to get all the readiness checked, so I'll report back after and let you all know how it worked... 

BTW, I tried to use that ECUFix to look at this file he sent me and it said the file was not supported? 

Interesting, also one other thing. Is there a way to compare these two files to see what exactly was changed?


----------



## reflected (Apr 6, 2007)

winols will compare stock vs modded of the same ecu #. 
send me your file. ill fix readiness for you.


----------



## hodfolly (Jun 15, 2010)

jesus, i went down this road before myself, made my own bench harness ect... pointless, all of it.your all pissing up the wrong tree. 

pretty much 1 ecu strategy for all of it, all based on torque. bosch has done everything already for you, you need just raise 1 parameter. BASIC TORQUE LEVEL. doing much more then that is figure ****ing mary. unless you can right out the ecus main function of adaptation. which i wouldn't do that. 

at your own risk, login with vcds with 45678, do your adaptions, and go for a spin.


----------



## thom337 (Oct 13, 2007)

:facepalm:


----------



## chaveezy (Jan 31, 2010)

Hrmm!? Well anyways, all readiness passes except catalytic converter. I don't get a MIL but I'm sure that's what the tune takes out. Just MIL... If I just install a spacer will it pass readiness? Car def. runs better part throttle... Getting misfires though at idle and just off idle, replaced coils, still same.. Guess I'm looking at a harness, or something.. :beer:


----------



## RaraK69 (Jan 16, 2001)

hodfolly said:


> jesus, i went down this road before myself, made my own bench harness ect... pointless, all of it.your all pissing up the wrong tree.
> 
> pretty much 1 ecu strategy for all of it, all based on torque. bosch has done everything already for you, you need just raise 1 parameter. BASIC TORQUE LEVEL. doing much more then that is figure ****ing mary. unless you can right out the ecus main function of adaptation. which i wouldn't do that.
> 
> at your own risk, login with vcds with 45678, do your adaptions, and go for a spin.


 WOW! :facepalm:


----------



## Gonzzz (Apr 27, 2010)

hodfolly said:


> jesus, i went down this road before myself, made my own bench harness ect... pointless, all of it.your all pissing up the wrong tree.
> 
> pretty much 1 ecu strategy for all of it, all based on torque. bosch has done everything already for you, you need just raise 1 parameter. BASIC TORQUE LEVEL. doing much more then that is figure ****ing mary. unless you can right out the ecus main function of adaptation. which i wouldn't do that.
> 
> at your own risk, login with vcds with 45678, do your adaptions, and go for a spin.


 You are retarded :thumbup:


----------



## DMVDUB (Jan 11, 2010)

WTF?! 

What is this as$hat trying to say? That you can flash your ECU with VAgCOM? If so why are we all paying an arm and a leg for Tunes, Software and the Such?:banghead:

Please Kill yourself now. Thanks:wave:


----------



## Gonzzz (Apr 27, 2010)

DMVDUB said:


> WTF?!
> 
> What is this as$hat trying to say? That you can flash your ECU with VAgCOM? If so why are we all paying an arm and a leg for Tunes, Software and the Such?:banghead:
> 
> Please Kill yourself now. Thanks:wave:


 Well, you can 

Check out Nefmoto's application:
http://nefariousmotorsports.com/blog/

It will let you read and flash your ECU thru OBD port with VCDS interface.

Still not as close as what the other retard said about adaptation...


----------



## RaraK69 (Jan 16, 2001)

this guy is epic, he needs to respond so we can $h!t on him some more


----------



## DMVDUB (Jan 11, 2010)

That's what I was saying this whole adaptation thing. If I can go make more power with a simple adaptation let me know which one.:sly:


----------



## Gonzzz (Apr 27, 2010)

DMVDUB said:


> That's what I was saying this whole adaptation thing. If I can go make more power with a simple adaptation let me know which one.:sly:


 UniSettings tinkers with the adaptation settings. Goes further than VCDS lets you. -Thread hijack: I can't get it to work though. Is it only ME7.5 compatible or does it work on 7.1 too?


----------



## reflected (Apr 6, 2007)

DJ Gonzo said:


> UniSettings tinkers with the adaptation settings. Goes further than VCDS lets you. -Thread hijack: I can't get it to work though. Is it only ME7.5 compatible or does it work on 7.1 too?


should work with any me7. you probably have a cable/driver issue. those adaptation softwares like serial cables.


----------



## Gonzzz (Apr 27, 2010)

reflected said:


> should work with any me7. you probably have a cable/driver issue. those adaptation softwares like serial cables.


 Like the old clone KKL interfaces?

It doesn't work with my VCDS interface. Then again it might be a driver issue since I use 64 bit...

God I hate all the hassles my 64bit Win7 installation makes...


----------



## reflected (Apr 6, 2007)

dont hate the serial, hate the game.


----------



## DMVDUB (Jan 11, 2010)

unisettings / lemmiwinks and CC's Customsettings all do the same thing with a VC cable, I know all that, it's his whole adaptation for power thing....huh?


----------



## Gonzzz (Apr 27, 2010)

DMVDUB said:


> unisettings / lemmiwinks and CC's Customsettings all do the same thing with a VC cable, I know all that, it's his whole adaptation for power thing....huh?


 Saying you will get more power with VCDS itself is retarded. 

Getting more power with UniSettings, very possible. Then again, I have never used it. Just increase the boost maps, tweak the N75 a little and *slightly* alter the timing and you got yourself a tune. You can do a quick tune in about 30 minutes. Prob less if you just turn the boost up. Flashing in car takes 2 minutes.

I don't see the point in messing with UniSettings


----------



## liloldbie (Jun 23, 2007)

Real good info here :thumbup:


----------



## AmIdYfReAk (Nov 8, 2006)

DJ Gonzo said:


> Saying you will get more power with VCDS itself is retarded.
> 
> Getting more power with UniSettings, very possible. Then again, I have never used it. Just increase the boost maps, tweak the N75 a little and *slightly* alter the timing and you got yourself a tune. You can do a quick tune in about 30 minutes. Prob less if you just turn the boost up. Flashing in car takes 2 minutes.
> 
> I don't see the point in messing with UniSettings


Sounds easy enough, Till you load a map and just see how many are there.... and its all in german


----------



## Gonzzz (Apr 27, 2010)

AmIdYfReAk said:


> Sounds easy enough, Till you load a map and just see how many are there.... and its all in *german*


 I love that part :laugh:

EDC15 is much easier. Once you get good, you just search for a chunk of hex string and you find maps very easily. Most of the maps can be easily found in the suggested maps list on WinOLS. No DAMOS file required. :laugh:


----------



## RaraK69 (Jan 16, 2001)

AmIdYfReAk said:


> Sounds easy enough, Till you load a map and just see how many are there.... and its all in german


i would say almost every mainstream tuner changes only a handful of maps, easily done. You dont get into changing a lot of maps until you start changing displacement/ TB size, Intake mani, stuff like that. But thats just the proper way of doing things, you dont really need to change them to make it run and make power.


----------



## AmIdYfReAk (Nov 8, 2006)

I totally agree!

Though, he's making it sound like all you need to do is move a slide bar and pow! you're good.

Learning how to flash, getting the tools and know how takes a while to even get close to the 30 min tune + flash settings.


----------



## Gonzzz (Apr 27, 2010)

AmIdYfReAk said:


> I totally agree!
> 
> Though, he's making it sound like all you need to do is move a slide bar and pow! you're good.
> 
> Learning how to flash, getting the tools and know how takes a while to even get close to the 30 min tune + flash settings.


 Im sure I could whip something up (maybe something with Visual Basic) that could just use a bar and tune your files 

Just run it thru ME7 Checksum Calc and your set :laugh:


----------



## bootymac (Apr 19, 2005)

DJ Gonzo said:


> Like the old clone KKL interfaces?
> 
> It doesn't work with my VCDS interface. Then again it might be a driver issue since I use 64 bit...
> 
> God I hate all the hassles my 64bit Win7 installation makes...


My blue KKL cable works with VCDS Lite on Win7 64-bit. Let me know if you want me to send you the drivers I used :thumbup:


----------



## RaraK69 (Jan 16, 2001)

Virtual machines FTW. I flash through a VMware image flawlessly many times before. I would say roughly 100+ flashes without a single failure. ECUx and VCDS work as intended too 

My base OS is Win7 x64 Ultimate


----------

