xbyte
20th December, 2012, 01:46 PM
Yesterday i tried to flash an BMW E61 EDC16c31 DDE7 with an mpps v12 clone, and software locked at "erasing flash"
and car did not start after this.
Luckely i had taken full bdm backup of this DDE first, car was started two times after i read bdm.
When i read out with bdm after crash i could see that parts of the flash where erased, and part of the EEprom was changed, so i then wrote back both orginal flash and eeprom.
Car started right after this, and i did not even need to do ews alignment even if i started the car two times after i read the bdm backup, why did this happening ?
And why was the eeprom changed after i tried to write this car ?
does flash tools write stuff to the eeprom for getting write access to the flashchip ?
I have now moved the data from the tuned flash tool read over to the bdm (29bl802c) dump with an hex editor, i found out that offset was at "000C0000" , everything before that is just not read or flashed by k-line flashing.
I then tried to load this modified (29bl802c) bdm dump into winols to correct checksum, but it seems that the checksum was correct.
Is there stored any checksums of the (29bl802c) content inside the eeprom in these DDE`s ? or are all checksums located in the (29bl802c) ?
Why does flash tools correct checksum while flashing on edc16 ecu`s ? and would it mess anything up if the checksum already where corrected before flashing ?
Today im gonna try write back the modified flash by bdm, is there anything i need to keep in mind regarding checksums ?
and car did not start after this.
Luckely i had taken full bdm backup of this DDE first, car was started two times after i read bdm.
When i read out with bdm after crash i could see that parts of the flash where erased, and part of the EEprom was changed, so i then wrote back both orginal flash and eeprom.
Car started right after this, and i did not even need to do ews alignment even if i started the car two times after i read the bdm backup, why did this happening ?
And why was the eeprom changed after i tried to write this car ?
does flash tools write stuff to the eeprom for getting write access to the flashchip ?
I have now moved the data from the tuned flash tool read over to the bdm (29bl802c) dump with an hex editor, i found out that offset was at "000C0000" , everything before that is just not read or flashed by k-line flashing.
I then tried to load this modified (29bl802c) bdm dump into winols to correct checksum, but it seems that the checksum was correct.
Is there stored any checksums of the (29bl802c) content inside the eeprom in these DDE`s ? or are all checksums located in the (29bl802c) ?
Why does flash tools correct checksum while flashing on edc16 ecu`s ? and would it mess anything up if the checksum already where corrected before flashing ?
Today im gonna try write back the modified flash by bdm, is there anything i need to keep in mind regarding checksums ?