MSS60 XDF Mappings

[tdott]

Delete the whole string.

Actually I figured it out. I did not need to remove the whole string. For example for DTC 2B70, it is not at offset 2B70, it's somewhere else in the file (forgot the offset, don't have the file open anymore. That was not clear to me before. Figured it out now and confirmed it's working.

Can you confirm what the difference between the two methods are?

[Martyn]

Can someone help me with this?

For example, before was:
00002B70: 00 16 00 14 00 10 00 0F 00 0D 00 0C 00 05 00 1E

Based on the above, I changed it to:
00002B70: 00 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00

The DTC came back and wasnt remove.

Can anyone explain if I did it wrong? Thanks.

Delete the whole string.

[tdott]

DTCs

Each DTC has a 26 byte row

To delete a DTC, null 3rd to 10th and the 13 byte

The DTC code is on the 2 first byte, all code id coulb be find on tool32

Can someone help me with this?

For example, before was:
00002B70: 00 16 00 14 00 10 00 0F 00 0D 00 0C 00 05 00 1E

Based on the above, I changed it to:
00002B70: 00 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00

The DTC came back and wasnt remove.

Can anyone explain if I did it wrong? Thanks.

[MtoufP]

Hey everyone,

I'm trying to create an XDF to share with the forum with the binaries that we are reading from the MSS6X Flasher.

Just sharing some of my identifying findings using the MSS6X Flasher so far. Hopefully we can identify some more mappings! I am looking for servotronic comfort/sport addresses. pedal throttle map comfort/sport, ignition min(KF TZ VL MIN), WOT Fueling. I won't bother with cold start, o2 dtc stuff since ECUWORX tool can handle that.

Please share if you have any!

This is from 241E read.

RPM Limiter:
0x6062
1x8
16 bit
Columns: 0x6052

values:
8000 8300 8300 8300 8300 8300 8300 8300

TEMP RPM
0x6088
6x1
columns: 0x6088
row conversion: (X*0.1)-273.2 to degrees

-25.0 0.0 25.0 50.0 60.0 80.0
5000.0 6000.0 6500.0 7000.0 7500.0 8300.

Vanos Admission:
0xA862
16x12 table
16 bit
Row: 0xA82A
Column: 0xA84A
Conversion: X/10

stock values:
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 112.0 103.5 97.7
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 113.7 105.0 100.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 113.7 103.9 98.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 113.7 101.1 95.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 118.0 97.0 87.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 123.7 114.0 87.0
131.0 130.9 131.0 131.0 131.0 131.0 131.0 131.0 131.0 123.6 116.0 83.0
131.0 131.0 131.0 130.0 127.0 126.0 124.0 124.0 128.1 124.0 115.7 83.0
131.0 131.0 131.2 130.0 127.0 127.0 127.1 130.0 128.5 122.5 115.7 83.0
131.0 131.0 131.0 131.0 130.0 130.0 130.0 130.0 126.6 122.8 114.9 92.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 130.0 124.4 118.1 112.4 93.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 129.0 118.6 114.2 109.3 99.8
131.0 131.0 131.0 131.0 131.0 131.0 131.0 123.6 112.8 111.6 107.9 104.0
131.0 131.0 131.0 131.0 131.0 131.0 125.8 108.7 99.4 101.3 103.8 108.2
131.0 131.0 131.0 131.0 131.0 131.0 122.0 102.0 94.1 96.0 101.5 112.0
131.0 131.0 131.0 131.0 131.0 131.0 121.9 100.1 92.2 95.8 103.5 120.0


Vanos Admission Heating (KATH):
0xABD6
16x12
16 bit
Row: 0xAB9E
Column: 0xABBE
Conversion: X/10

stock values:
131.0 131.0 131.0 131.0 131.0 131.0 131.0 126.8 123.0 109.0 98.5 97.7
131.0 131.0 131.0 131.0 131.0 130.9 129.3 124.0 119.0 110.7 100.0 100.0
131.0 131.0 129.0 125.6 123.0 120.3 117.0 119.0 119.0 116.7 98.9 98.0
131.0 131.0 127.3 120.5 117.1 115.8 114.4 117.2 124.8 117.0 95.5 95.0
131.0 131.0 127.3 120.4 117.0 116.0 115.0 117.3 125.7 117.0 91.0 77.0
131.0 131.2 127.0 120.0 118.0 116.0 115.0 117.0 125.0 123.7 106.0 77.0
131.0 130.9 129.1 124.0 118.0 116.5 116.6 119.1 127.0 123.6 111.0 77.0
131.0 131.3 129.7 125.0 118.0 117.0 117.6 120.6 128.1 124.0 110.7 75.0
131.0 131.0 131.2 130.0 127.0 127.0 127.1 130.0 128.5 122.5 110.7 78.0
131.0 131.0 131.0 131.0 130.5 130.0 130.0 130.0 126.6 122.8 114.9 87.0
131.0 131.0 131.0 131.0 131.0 131.0 131.3 130.0 124.4 118.1 112.4 93.0
131.0 131.0 131.0 131.0 131.0 131.0 131.9 129.0 118.6 114.2 109.3 99.8
131.0 131.0 131.0 131.0 131.0 131.0 131.3 123.6 112.8 111.6 107.9 105.0
131.0 131.0 131.0 131.0 131.0 131.0 125.8 108.7 99.4 101.3 103.8 110.0
131.0 131.0 131.0 131.0 131.0 131.0 122.0 102.0 94.1 96.0 101.5 112.0
131.0 131.0 131.0 131.0 131.0 131.0 121.9 100.1 92.2 95.8 103.5 120.0



WOT Ignition Timing KF_TZ_VL
0x28E1EC
16x3
Row: 0x28E1C2
Column: 0x28E1E6
Conversion: x/10

stock values:
3.0 3.0 3.0
16.0 16.0 16.0
20.0 20.0 20.0
27.0 27.0 27.0
30.0 30.0 30.0
30.0 30.0 30.0
34.0 34.0 34.0
33.0 33.0 33.0
33.0 33.0 33.0
31.0 31.0 31.0
33.0 33.0 33.0
33.0 33.0 33.0
30.0 30.0 30.0
30.0 30.0 30.0
30.0 30.0 30.0
31.0 31.0 31.0
32.0 32.0 32.0
32.0 32.0 32.0


Limp Mode Pedal
0x28ACC6
10x1
Column: 0x28ACB2
Conversion: x/10

00 08 16 25 30 35 40 43 46 50

hi thx for this info
Do you know where the vanos exhausts are please?

[MtoufP]

Yes

[tdott]

K_KH_N_MAX ( RPM threshold for cat preheat deactivation ) -> set this to a low value to deactivate cold start.

Is this the stock cold start max rpm value in the screenshot or lowered value to deactivate code start?

[isma_s54]

here damos file
if any membre have map pack please send here

https://www88.zippyshare.com/v/xeuRPyOQ/file.html

[MtoufP]

hi guys
thank you for sharing i'm slowly interested in the s65 do you know where the exhaust vanos tables are, and exhaust heating, i found the intake / and heating vanos tables but the exhaust tables i have a doubt, thank you
for 240e soft

[dmlf]

@16AEE
KL_MD_RF_MAX_ROH ( Max relative Filling / RPM )

20x1

X : RPM x 1 , precision 0
relative filling, x/10000 , precision 3

[dmlf]

K_KH_N_MAX ( RPM threshold for cat preheat deactivation ) -> set this to a low value to deactivate cold start.

[dmlf]

Hey guys, I think I've found KF_TI_SOLL_MIN ( minimum injection time ) and KF_TI_SOLL_UB_OFFS ( injector dead times )


Comments are welcome

[dmlf]

Well I have a version of IDA installed and already did some tinkering with embedded systems ( jtag, gdb, crosscompilation, creating board support packages ).
I need some help guiding me through because I am pretty certain I am completly oblivious on a lot of the power of IDA.


Would a full read of one side ( inj or ign ) would be a good starting point ? Will I miss some boot code ?

[terra]

Guys, any tips on decompiling my bin with IDA ? I find myself stuck know, I've a bunch of maps that I see in the bin but can't identify further. If I could correlate block diagrams from the funktionrahmen to some decompiled subroutine I guess I could identify them ?
terra Martyn ?

Are you already familiar with IDA and want to know specifics like memory map and whatnot? Or is this a more general question?

[dmlf]

Guys, any tips on decompiling my bin with IDA ? I find myself stuck know, I've a bunch of maps that I see in the bin but can't identify further. If I could correlate block diagrams from the funktionrahmen to some decompiled subroutine I guess I could identify them ?
terra Martyn ?

[dmlf]

2 new values identified :
K_GANG_I_HA_HS - Final drive Manual - 0x13632
K_GANG_I_HA_DKG - Final drive DCT - 0x13634

x/1024
Precision 3