E46 Fanatics Forum banner

ZF Alpina EGS software checksum correction? (done)

17K views 11 replies 11 participants last post by  daniel_f. 
#1 ·
As I may have the possibility to buy a used Alpina B3 EGS, I would like to do something good for the community and upload the readout (if its working flawless at my car), so that anyone with a ZF5HP19 could flash it. Maybe its possible that someone could create a flashable file for WinKFP? I haven’t found one so far.

Last but most important, i hope the Alpina EGS will raise the ShiftRPM under WOT from 6300 to 6X00. If so, i would like to play with the HP19 a bit more and now comes the tricky part:

How does one find the checksum positions, and how can they be corrected?
 
#2 · (Edited)
I think I could create a WinKFP flashable file, especially if you can also send me a dump of a stock TCU flashed with its latest software. Not sure about the checksum correction. If it's a simple CRC16 that's easy enough to figure out.

Alpina software might be lurking somewhere in the Ista/P files, since there is an Alpina TCU flash for E9x vehicles available. The E46 files are unfortunately not labeled so it's near impossible to find such a file if it's there
 
#6 ·
well, as most of the time its best to do it yourself, so here is a short explanation of what i did to get the tcu checksums right. I´ve been playing with checksums the last few hours and its really simple.

all you have to do is to convert your bin file to hex file with bin2hex.exe (google), open it in windows editor, save it as txt file. then you open your txt file in windows excel and separate the columns according to this:
http://en.wikipedia.org/wiki/Intel_HEX#Example

so your first column only contains the start count ":", followed by the byte count "xy" and so on. it will then look like this:
(see picture at the bottom)
the last column shows the new calculated checksum in decimal value, just convert it to hex and use the last two digits, e.g. dez.-chk. of "-1228" converted to hex is "FFFFFFFFFFFFFB34"

i agree its a bit of work, but maybe someone is more skilled than me programming in Vbasic or c++ and can do it better. i´m definately interested in progress. 👍
 

Attachments

#7 · (Edited)
I'll try to cook up a program

Edit: Apparently there is an AWD B3 -- for non Alpinas, didn't all of the XIs get GM transmissions? It's possible the same applies to the AWD B3

Edit 2: Figured out the layout of the full binary.

0x0000 - 0x7FFF = Boot sector and other personalized data (e.g AIF)
0x8000 - 0x6FFFF = 0PA
0x70000 - 0x7FFFF = 0DA

The 0PA and 0DA are in big endian, the actual dump is in little endian. You need to byte swap the data to get it to match.
 
#10 ·
It seems, that it corrects the checksumms according to the hex-file chk´s. i changed a few bits, exported the converted file as bin, imported it as hex into my chk-excel sheet to correct the chk´s and they were already corrected :yikes:

:clap:

i double checked if the file had the changes and indeed, all the changes i made were there.

the bad thing is, after around one mile, the gearbox fault appears and the actual gear gets stuck. faultcode is "internal ecu error" or something similar.

i double check tomorrow what happens when i just change one hex-chk to a wrong value, but i remember that the gearbox directly locks and the faultlamp appears directly, too.
 
#11 · (Edited)
Hex file chks? As in those checksums at the end each line in a hex file (like 0pas and 0das)? Those aren't very relevant. They're not present in the binary that's written to the chip. Those only serve as a quick and dirty integrity check for the programmer itself (it tells the programmer that the address, length, and binary are all likely to be correct). Any bin2hex (and bin2srec) converter will generate those.

What they will not generate is the checksum in the binary itself. I have identified at least one at the end of the data section, but I don't know the checked region, nor do I know the formula (if its just a crc16, I made a program that can generate possible start points, so I'll run multiple files through that and see or any common start offsets are generated). I suppose I could modify my program to try different polynomials too, but that will generate more results than I can parse through.

If it's more complex like the ms42/43, then I'm not sure how to go about solving it.
 
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top