e92 emulator and tuning assistant

[fl0wl0w]

I finished up the E92 Kernel for now. It can now Write to flash and I also refactored it to be more similar to E78 Kernel. Probably a bit easier to follow how to keep the external watchdog happy.

[enslaved87]

Update:

new git release has both EARLY and LATE cal and write entire fully debugged, fleshed out and proven on real donor ECU's.

Working on adding some bells and whistles next. Namely, a full ecu CLONE, VIN change, NVPWD change and a couple other small options.

https://github.com/enslaved87/sCANtool-public

[gmtech825]

I finished up the E92 Kernel for now. It can now Write to flash and I also refactored it to be more similar to E78 Kernel. Probably a bit easier to follow how to keep the external watchdog happy.

This kernel writes the boot segment also then? sorry if this was already cleared up

[enslaved87]

I finished up the E92 Kernel for now. It can now Write to flash and I also refactored it to be more similar to E78 Kernel. Probably a bit easier to follow how to keep the external watchdog happy.

This kernel writes the boot segment also then? sorry if this was already cleared up

Depends which write you pick, and whether the module is EARLY or LATE.

The helper can program boot flash. The public dest list is what actually gets sent.

• Write calibration / Write entire — no. Those are cal, OS, and HAS. Boot stays on the module.
• Clone, LATE — yes. Clone writes boot last (0xC000 / 0x8000 / 0x4000 / 0x0), plus the rest of the chip except 4 KiB at 0x1F000 (left erased FF) and immobilizer/BCM. Shadow/NVPWD only if a 16 KiB shadow dump sits next to the image.
• Clone, EARLY — no. Still cal + OS + HAS + VIN page only. Boot is not in that dest list. My last spare EARLY donor died on me so I havent been able to complete this portion yet. In fact, this is the last little bit remaining for the emulator as well to sign seal and deliver it.

The Write tab shows the dest list before you confirm. Spare has to already be the same family (EARLY vs LATE).

[gmtech825]

I finished up the E92 Kernel for now. It can now Write to flash and I also refactored it to be more similar to E78 Kernel. Probably a bit easier to follow how to keep the external watchdog happy.

This kernel writes the boot segment also then? sorry if this was already cleared up

Depends which write you pick, and whether the module is EARLY or LATE.

The helper can program boot flash. The public dest list is what actually gets sent.

• Write calibration / Write entire — no. Those are cal, OS, and HAS. Boot stays on the module.
• Clone, LATE — yes. Clone writes boot last (0xC000 / 0x8000 / 0x4000 / 0x0), plus the rest of the chip except 4 KiB at 0x1F000 (left erased FF) and immobilizer/BCM. Shadow/NVPWD only if a 16 KiB shadow dump sits next to the image.
• Clone, EARLY — no. Still cal + OS + HAS + VIN page only. Boot is not in that dest list. My last spare EARLY donor died on me so I havent been able to complete this portion yet. In fact, this is the last little bit remaining for the emulator as well to sign seal and deliver it.

The Write tab shows the dest list before you confirm. Spare has to already be the same family (EARLY vs LATE).

sorry, this question was geared towards flowlow and that kernel

[kur4o]

Hi enslaved87,

Can you share the e92 42 OS archive you have gathered. I want to fix some of the extra checksum, and don`t have enough examples to look at.

Another question is, how hard will be to implement j2534 tools support in the flasher.

Thanks

[gmtech825]

Hi enslaved87,

Can you share the e92 42 OS archive you have gathered. I want to fix some of the extra checksum, and don`t have enough examples to look at.

Another question is, how hard will be to implement j2534 tools support in the flasher.

Thanks

If you would like the .txt file for extra checksums i made in .csv format let me know.

[fl0wl0w]

This kernel writes the boot segment also then? sorry if this was already cleared up

Depends which write you pick, and whether the module is EARLY or LATE.

The helper can program boot flash. The public dest list is what actually gets sent.

• Write calibration / Write entire — no. Those are cal, OS, and HAS. Boot stays on the module.
• Clone, LATE — yes. Clone writes boot last (0xC000 / 0x8000 / 0x4000 / 0x0), plus the rest of the chip except 4 KiB at 0x1F000 (left erased FF) and immobilizer/BCM. Shadow/NVPWD only if a 16 KiB shadow dump sits next to the image.
• Clone, EARLY — no. Still cal + OS + HAS + VIN page only. Boot is not in that dest list. My last spare EARLY donor died on me so I havent been able to complete this portion yet. In fact, this is the last little bit remaining for the emulator as well to sign seal and deliver it.

The Write tab shows the dest list before you confirm. Spare has to already be the same family (EARLY vs LATE).

sorry, this question was geared towards flowlow and that kernel

Yes, it can write any portion of flash including the boot segment

[gmtech825]

Thanks, and it is impressively fast!. FUll clone including boot and EEPROM in under 3 minutes. full reads were around 2 minutes I think. Very nice work. I did modify the kernel to read the shadow password region as well.

[fl0wl0w]

Thanks, and it is impressively fast!. FUll clone including boot and EEPROM in under 3 minutes. full reads were around 2 minutes I think. Very nice work. I did modify the kernel to read the shadow password region as well.

Awesome! Thank you for testing! Did you try using LZ4 compression? I am able to read in 90 seconds and write in less than 2 minutes. but you have to pipeline it just right, Erase Block, Write Block, Erase Block... My kernel queues up the erases and writes so if you pipeline it like this there is always data in flight in the CAN.