Vida CEM swapping

[oscilloscope]

5- SerialBDM programmer works with Arduino Uno as well

6- Whole CEM flash memory dump writing takes about 6 minutes
.
SerialBDM@Kaev__write_whole_dump.jpg
.
7- Most important - for the SerialBDM programmer to work properly you need to open the Arduino IDE,
upload the sketch to the Arduino memory and close the Arduino IDE, otherwise the programmer will not work.

looks a pretty cool alterative tool, is the dev ( if you know) actively developing the software for further functionality ?

[abscate]

I’m not a programmer any more but most of my readers flash ABS light or SRS light while actively talking to the ECU, FWIW

[dikidera]

I have already reflashed my TCM at least 20 maybe even 30 times. The SH7055 ROM has a max erase cycle of 100 times, and reflashing for small changes is slow and cumbersome.

It will be a real technical challenge to enable real-time tuning on this so I can change the maps on the fly.

[prometey1982]

I have already reflashed my TCM at least 20 maybe even 30 times. The SH7055 ROM has a max erase cycle of 100 times, and reflashing for small changes is slow and cumbersome.

It will be a real technical challenge to enable real-time tuning on this so I can change the maps on the fly.

100 раз, это оценка снизу. На самом деле, они переживают сильно больше перепрошивок.

[dikidera]

I have already reflashed my TCM at least 20 maybe even 30 times. The SH7055 ROM has a max erase cycle of 100 times, and reflashing for small changes is slow and cumbersome.

It will be a real technical challenge to enable real-time tuning on this so I can change the maps on the fly.

100 раз, это оценка снизу. На самом деле, они переживают сильно больше перепрошивок.

I will keep that in mind, thank you prometey.

I have in the process also discovered one of the adaptations for P->R and possibly P->D or even R->D and the clunk or harsh reverse/harsh drive.
The adaptation had a too high pressure set, it actually amounts to a raw pressure of 2.84 PSI, which is not a whole lot, but it is enough to cause a harsh engagement. What I did was invert it, now it was negative 3 or negative 4 psi. Buttery smooth reverse and drive engagements, in fact imperceptible. However it was only tested on a specific gearbox temperature of around 45-50c and an ambient temp of 27c.
It is more than possible that at super low or super high temps(70-80-90c and above) that this too low of a pressure results in slow engagement/delayed. Who knows.


In other experiments I increased the shift time from 2-3 to be nearly double what it was set in an attempt to make it smoother. This did in fact make it smoother BUT I have noticed that as the transmission re-adapted that there is a slight slip in certain situations, aka flare.

[vtl]

I will keep that in mind, thank you prometey.

I have in the process also discovered one of the adaptations for P->R and possibly P->D or even R->D and the clunk or harsh reverse/harsh drive.
The adaptation had a too high pressure set, it actually amounts to a raw pressure of 2.84 PSI, which is not a whole lot, but it is enough to cause a harsh engagement. What I did was invert it, now it was negative 3 or negative 4 psi. Buttery smooth reverse and drive engagements, in fact imperceptible. However it was only tested on a specific gearbox temperature of around 45-50c and an ambient temp of 27c.
It is more than possible that at super low or super high temps(70-80-90c and above) that this too low of a pressure results in slow engagement/delayed. Who knows.


In other experiments I increased the shift time from 2-3 to be nearly double what it was set in an attempt to make it smoother. This did in fact make it smoother BUT I have noticed that as the transmission re-adapted that there is a slight slip in certain situations, aka flare.

All shifts should be firm. Butter smooth means frictions are slipping.

[dikidera]

One can always tune the parameter to make it as worse as needed. I have crafted a small application that will, provided you have a binary dump of an AW55(5 speed), will try and extract the memory address of the adaptation.

Then one should note the original value of the adaptation for garage shifts(and to have as backup if modifying it makes things worse.

Two CAN commands are all that is needed.

CF6EA7<address>0110 where address is in the form of FFAABB aka if the adaptation is FFFFBC64 address will be three bytes aka FFBC64. 01 means send once, 10 means send 16 bytes which you will receive from CAN ID 01200005 there you will see the origina value, potentially it will be 00C8

Then to modify, simply do CF6EBA<address><two byte value in hex>

[dikidera]

One of the issues I've noticed when trying to use some J2534 apis is that the DLLs are 32-bit, and my applications 64-bit. Not an issue if you were building native code directly but I like the speed and prototyping ability of Python.

I was to see our beloved Mongoose DLL was 32-bit. This complicates things and necessitates a wrapper so we can call 32-bit code from within 64-bit address space. Although there are 32 bit python installations, it seems like some issues arise with pip and some packages.

[Yariy]

Hello everyone. I have been studying the work of CEMB until 2004. At this stage, having a pin code, I change the configuration, read and write flash on OBD2. You don't need SBL to read and write areas of the flash, all functions are already implemented. These functions alone do not allow read and write access to the EEPROM area ($4,000 - $8000) and write to SRAM. It remains to write your SBL, but where to upload it if access to upload to SRAM is closed? When replacing CEM, VBF 9438273 is loaded into Vida. Does anyone have this vbf? Tell me knowledgeable people, give me a direction. Am I missing something

[dikidera]

I have progressed further in developing the Windows J2534 python tool usng the Mongoose JLR clone drivers. I have with reverse engineering figured out it only supports CAN_XON_XOFF_PS(or ISO15765) protocol aka 0x800A(according to github) from the J2534-2 API spec, provide anything else and it wiill error out with 0xA error code.
The Mongoose driver reverse engineering was terrible, it uses try catch exceptions, stack canaries(VS stuff) and every C++ bell and whistle, everything is interspersed with unwinds and whatnot.

Oh yeah I also found out Python still produce x86(32-bit) packages and binaries. Meaning I did away with the wrapper/glue bridge for 64-bit drivers.
I am on error 0x13(ERROR_PIN_INVALID) because of 0 flags for the protocol, which I will take care off soon.