Ferrari Life Forum banner
41 - 54 of 54 Posts

·
Registered
Joined
·
356 Posts
Discussion Starter · #41 ·
Hi guys,

I got V1.40 to pull the data as 95040 chip but based on what the Alfa (also 7.3.1 H4)guys were saying I also tried setting the mem to 95080 (1024bit) and it appears that there is some more data in there. I have not been able to posted the files here as they are "invalid" file types.

Trev referenced an immo killer, I was looking for more info about that. Ferrari in their perfect wisdom used immobilizers on the challenge car even though there are no keys?!?! Now 13 years later the immo's are causing some of us issues. Does anyone know which bits turn them off? and which bits are the checksums?

Thanks
If you can send me both left and right bank ecu EEPROM dumps we can easily get this all done and dusted...

To attach it to the post just change the filename extension to something this forum accepts.

-T
 

·
Registered
Joined
·
10 Posts

·
Registered
Joined
·
75 Posts
Trev,


This site is preventing all uploads for these files, tried changing file ext to txt, and removing extension completely, tried ZIP, 7Z all to no avail. I did post the files in 2 other locations


That other forum - /forum/technical-q-sponsored-algar-ferrari/465836-360-challenge-me7-3h4-maps-eeprom.html#post143481087


or


Immo off Help request- factory race car=


Thank you for your help!!!
I had a quick look at your files :
- I have the exact same dump for the main EEPROM
- I do think that the 1024 bytes dump (95080) are the correct ones. The main reason is that they comply with the line checksum computation as explicited on nefariousmotorsports (see attached file): checksum at the end of the lines (in the 95040 dump, checksum is not at the end of the line) and consistent with the content of the first 14 bytes.

I'll try to read my ECUs in 95080 mode to see how different they are from yours.

Though, it doesn't help you for the immo off ....
 

Attachments

·
Registered
Joined
·
10 Posts
Trev,

Thanks -- That's a terrific document, I had missed it. :thumbsup:

I purchased via ebay one ecu from a wreck that is an EU version - F# 178765. I will post the EEPROM & map data up as well, it is different, but not much. All the difference are in the first set of data. Would be interested to see the differences between these 2 and yours.

I am wondering if the differences would be a unique immo paring code & resulting checksum. Posted in same Nefmoto thread.

Notice that the second sets of data are identical from offset 0x190 - 0x1D0, for both the CH and the EU ecu's.

BTW- I am totally out of my depth here...
 

·
Registered
Joined
·
10 Posts
OK, I flashed EU_ECU to US_CH car and I flashed the EEPROM in 1024 mode. Then I reread the newly flashed ECU to confirm the data did change. It did.

I installed the ECU into my CH car. Results....

The ECU did work correctly on the drivers side, it failed on the passengers side. The immo must have tripped, the car started but was only running on the drivers side bank, then quit. Would not start after that and I stopped trying after 2 more attempts.

What do you think? Did I miss something? Could there be more data in the EEPROM? I'm going to do test run at the immo off with the alfa changes to the ECU code. Any other ideas?
 

·
Registered
Joined
·
75 Posts
OK, I flashed EU_ECU to US_CH car and I flashed the EEPROM in 1024 mode. Then I reread the newly flashed ECU to confirm the data did change. It did.

I installed the ECU into my CH car. Results....

The ECU did work correctly on the drivers side, it failed on the passengers side. The immo must have tripped, the car started but was only running on the drivers side bank, then quit. Would not start after that and I stopped trying after 2 more attempts.

What do you think? Did I miss something? Could there be more data in the EEPROM? I'm going to do test run at the immo off with the alfa changes to the ECU code. Any other ideas?
Interesting ...
Don't know where you are but I guess that driver side is LHS and corresponds to bank 2.
Which data have you put in the EEPROM, the ones from your "Master" ECU (RHS?) or the ones from your "Slave" ECU (LHS?) ?
You have now 3 CH ECUs, which other ECU have you used to run your engine? The OEM RHS or the OEM LHS?
Have you already tried to run the engine with the OEM ECUs swapped?
 

·
Registered
Joined
·
10 Posts
Eric,


Yes very sorry - I'm in the US, all the cars I have access to are LH drive models.


I did not try swapping them, nor do I know if someone else has done that in the past. I was trying to avoid that until I found out more about how the whole system works together. The test was with flash data from what I called the "master" - passengers side - RH side, except modified to remove immo functions. Didn't have time this weekend but will try again with a exact copy of the "master" - no mods. Hopefully that will work and at very least we will be able to duplicate a damaged ECU without Ferrari's assistance.


Do you find it strange that the data & EEPROM from both ECU's are identical? Wouldn't that mean that the "pairing" is actually occurring in the Alarm ECU, not the engine control ECU's?


Thanks
 

·
Premium Member
Joined
·
11,887 Posts
Both Motronic ECUs start out identical, with exactly the same contents and part number. When the system first initializes, the alarm ECU looks for the PIN stored in its memory and compares it to the one in the Motronic ECU. If blank, the PIN is passed over the CAN and written in the Motronic memory.
 

·
Registered
Joined
·
75 Posts
Eric,

I did not try swapping them, nor do I know if someone else has done that in the past. I was trying to avoid that until I found out more about how the whole system works together. The test was with flash data from what I called the "master" - passengers side - RH side, except modified to remove immo functions. Didn't have time this weekend but will try again with a exact copy of the "master" - no mods. Hopefully that will work and at very least we will be able to duplicate a damaged ECU without Ferrari's assistance.
I think you are right, don't try to swap your OEM TCU for now. Better to wait knowing how it works.
Writting an exact copy of the Master is indeed a good idea. One mod at a time! Try first to make an exact clone which sould work on both banks. Removing or clearing immo could be done in a second step.
Also, making an exact clone of the Slave, which should also work on both banks (provided that your Slave OEM never went in right position on another car) and looking at how its content is modified once installed in the right position would be interesting.


Do you find it strange that the data & EEPROM from both ECU's are identical? Wouldn't that mean that the "pairing" is actually occurring in the Alarm ECU, not the engine control ECU's?

Thanks
Why do you write that? Data are NOT the same in the 1024 bytes dumps of your Master and Slave OEM ECUs. A few bytes are different in the first lines, so there is still some hope that the immo data are hiden there.
 

·
Registered
Joined
·
10 Posts
Thank you guys for your input!!

Sorry, got confused, too many projects - Eric you are correct the EEPROM data is different left to right.

What I meant to say was - Isn't it strange that the EEPROM & program data is byte for byte identical between the original right side ECU and the flashed ebay ECU but the clone still did not work with the immobilizer? If both data sets are identical but one starts the car and the other does not...what does that mean?

???could the "key" be stored somewhere else in the ECU that I am not reading???

So next test - I will flash the "slave" left side ECU & EEPROM to the ebay ecu, as the data on that side is different perhaps it has not ever been paired to the immo and the clone may pair up as tazandjan describes.
 

·
Registered
Joined
·
75 Posts
Thank you guys for your input!!

Sorry, got confused, too many projects - Eric you are correct the EEPROM data is different left to right.

What I meant to say was - Isn't it strange that the EEPROM & program data is byte for byte identical between the original right side ECU and the flashed ebay ECU but the clone still did not work with the immobilizer? If both data sets are identical but one starts the car and the other does not...what does that mean?

???could the "key" be stored somewhere else in the ECU that I am not reading???
So, you have tested an exact copy of the Master, and a modified copy with a tentative of "immo off", and none of them worked in the right place. Right?
This is not really the expected result!! I don't know exactly which version of the processor is inside the ECU, C166 or C167. Some versions of the C166 have an internal flash EPROM. We can imagine that the immo data could be written there. Time to find more data/info on the ME7 family of ECUs.
 

·
Registered
Joined
·
10 Posts
Yes Eric- test both exact copy & immo off copy of the right-pass side ecu.

That make sense that there would be a separate internal men location for pairing. I did find a procedure to viginize an me7.3h4. Not for fcars but it may erase that memory location and allow the ecu to pair w the immo. I will try that after I flash the left side ecu & EEPROM data and test.

As I am experimenting with an eBay ecu, it was most likely already paired with another immo, so getting it to be vigin would be a small win. None of this seems to get me any closer to being able to remove my mostly working immo.
 

·
Registered
Joined
·
8 Posts
Anyone in Los Angeles, Southern California, or even the US who can make one of my ECUs virgin again?

I had to get new remotes, immobilizer, and interface box. Just switching my ECUs from left to right and right to left did not work. Motor cranks but does not start.

Thank you.

Oliver
 

·
Registered
Joined
·
1 Posts
google finds me lots of old thread where people discuss swapping the TCU from the F360, or flashing the F360 software onto the existing TCU. There is usually a lot of arguing about how the 4200 and GS are different, someone usually talks about how they should just buy a F360 instead of being poor, then something about production numbers, how the alignment of Jupiter and the conjunction with Venus affect the gear box internals and eventually the original question never gets answered.

It has been a good decade since people started asking these questions - surely someone has an answer by now!

Can the TCU be swapped from an F360 to a GS/4200, do you even need to go that far and can you just flash the software? techzpod download mobdro
 
41 - 54 of 54 Posts
Top