ECU Hackers Forum - The 413 Definitive Bin File!

Page 1 of 3

User
ECU Hackers Forum > BMW Technical > Motronic 3.3.1 DME User Name b Remember Me?
c
d
e
f
g
Name
The 413 Definitive Bin File! Password Log in

Register FAQ Members List Calendar Today's Posts Search

Page 2 of 2 < 1 2

Thread Tools Search this Thread Display Modes

12-02-2006, 01:26 AM #11

Join Date: Feb 2006

zilog357 Location: San Juan, Puerto Rico (U.S.A)
Newbie ECU Hacker Posts: 12

Hello 325icintn.

The data block is the block at the end of the file that says the ecu number, the software number, etc. Only that it is
in backwards. For example, the ecu number 0 261 200 413 is shown as 3140021620 and so on.

Also, I'm a little confused about the revlimiter as explained in this article. If it really is about those two bytes, I
think it is a bit more complicated, but you have the last word on that calculation if you do the test.

I worked with some motronics ecus for Hyundai and the revlimiter was also two bytes, resembling those on BMW
ecus and the algorythm was something like the following:

(Xtal Frequency (V)) / X / Y

_______________________
(MSB) (LSB ^ (LowByte))

Where V, X and Y are unique parameters of the ecu and/or the engine, but it didn't make sense using the numbers
on this chip since the Least Significant Byte (LSB) is too high as an exponent of 2.

Does anybody happens to know the crystal frequency of the 413 ecu?

Regards,

Richard

12-03-2006, 05:00 PM #12

Join Date: Dec 2005

325icintn Posts: 38
Senior ECU Hacking Technician

Quote:

Originally Posted by zilog357

Hello.
About the checksum, yes, the checksum is identified in the begining of the data block as told by Jim
Conforti in some other forum. In this chip, the data block start like this at FDF4h:

F7 A8 F8 B0 E7 E2 92 FB 08 FC 3A...

Always the fifth word (2 bytes) in that line, in this case with value "FC 3A", is the address right after the
checksum that protects the area of the maps. So the area of the maps begins at E000h (in other chips at
D000h, but it is easily identifiable) and ends at "FC3A", including the checksum.

You just go two bytes back that area to find the written checksum (CCFB in this chip) that covers from
E000h to right before the checksum (FC37h).

That is why I said before that the checksum seems to be wrong, because if you do a cumulative checksum
from E000h to FC37h in this chip, the result is CD40 instead CCFB. If you look in other similar 413 chips,
the checksum fit exactly as explained above no problem. Just the begining of the block changes from

http://www.greystonesagainst3g.co.uk/showthread.php?t=42&page=2&pp=10 06/04/07
ECU Hackers Forum - The 413 Definitive Bin File! Page 2 of 3

D000h to E000h.

I've been trying to use the checksum function of Tunerpro. So far no go.
Looking at my 1094m50 bin, i believe the data block to which you refer resides at FE14h: D0 02 D1 06 D2 E8 E6
7E E7 B2 ...

Following your formula, the checksum should be cumulative value of D000h to E7AFh. The address of the checksum
should be E7B0 and E7B1 (values E2 57).

I've attached a screenshot of the checksum parameters with my entries. So far, the saving any map (without
changes) still recalculates the checksum, but the entry in the checksum address does not change.

Anyone have suggestions for getting the Tunerpro function to work?

Attached Images
Checksum.jpg (13.0 KB, 15 views)

12-03-2006, 06:23 PM #13

Join Date: Feb 2006

zilog357 Location: San Juan, Puerto Rico (U.S.A)
Newbie ECU Hacker Posts: 12

You got it right about checksum and its locations on your chip.

On my behalf, I don't know anything about TunerPro, but the screenshot you posted have the right parameters.

Any chance that TunerPro have something like "Automatic Checksum Correction" or something alike that has to be
turned on?

BTW; Yesterday I checked inside the 413 ecu, the crystal frequency is 12 MHz. Just in case it helps finding out the
algorythm for revlimiter.

12-05-2006, 03:17 PM #14

Join Date: Dec 2005

techno550 Location: Atlanta, GA
Posts: 31
Senior ECU Guru

I'm using a different data size for the checksum. 16 bit store size with 8 bit data. I'll need to go back and look at
"the" bin again and check the address there. There's a lot of extra junk that got left in the 413 that can be cleared
out.

For the rev limiter, it has an odd *not-quite-linear* quality to it. then again, the idle speeds don't line up so well
with the numbers on the tach either.

12-05-2006, 03:36 PM #15

Join Date: Dec 2005

325icintn Posts: 38
Senior ECU Hacking Technician

Techno, see if you can get the auto checksum to work in tunerpro. Thanks.

12-05-2006, 03:58 PM #16

Join Date: Dec 2005

techno550 Location: Atlanta, GA
Posts: 31
Senior ECU Guru

http://www.greystonesagainst3g.co.uk/showthread.php?t=42&page=2&pp=10 06/04/07
ECU Hackers Forum - The 413 Definitive Bin File! Page 3 of 3

Quote:

Originally Posted by 325icintn

Techno, see if you can get the auto checksum to work in tunerpro. Thanks.

autochecksum definately works in tunerpro. I use it on all of my 506 and modified 413 applications.

12-05-2006, 09:47 PM #17

Join Date: Dec 2005

techno550 Location: Atlanta, GA
Posts: 31
Senior ECU Guru

I get a different value for checksum than is in the chip calculating it at either checksum point. I've stripped the
extra crap out of the 413 file though and the resulting bin still runs a car. so I'm going to redo the checksum bits
for the cleaned up version and see if that still works too. if so, I'll just post the "cleaned and corrected" bin.

12-10-2006, 01:37 AM #18

Join Date: Dec 2005

325icintn Posts: 38
Senior ECU Hacking Technician

Autochecksum working for me too. Thanks.

Page 2 of 2 < 1 2

« Previous Thread | Next Thread »

Posting Rules

You may not post new threads

You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On Forum Jump
HTML code is Off Motronic 3.3.1 DME Go

All times are GMT. The time now is 12:27 PM.

Contact Us - http://www.and1c.com/forums - Archive - Top

Powered by: vBulletin Version 3.0.7

Copyright ©2000 - 2007, Jelsoft Enterprises Ltd.
Copyright ECU Hackers 2005

http://www.greystonesagainst3g.co.uk/showthread.php?t=42&page=2&pp=10 06/04/07