Stevebe wrote: ↑24 Jun 2019, 14:49
tried v1.2.0 with FL14xx reads eeprom fine the file i loaded intp EEprom direct is on left the file read with your reader on right
this was a Diesel convers 14xx a converted to Petrol so has moded code. the mph to kmph as you know 097 00p 01 km i think i have found the flagg byte
for the 6k Diesel 8k petrol ill confirm later.
Also, the mileage is stored in the next lines:
0770: xx xx xx xx 32 D1 xx xx 32 D1 xx xx 32 D1 xx xx
0780: 32 D1 xx xx 32 D1 xx xx xx xx xx xx xx xx xx xx
where the next bytes:
32 D1 - is a mileage in km, calculated with using XOR-table
great work on the mileage will have a play.
I use the Convers CM327 interface works fine
Go4IT wrote: ↑24 Jun 2019, 21:16
Awesome, Ursadon!
I try to use it, but your tool claims about a wrong identifier when trying to access my TRE27 from Tunnelratselectronics.
Just curious, what protocol do you use?
Goof info of the mileage. Yes, i read somewjere else that vendors place the value multiple time inside the eeprom or flash.
So, did you find it by readout after driven a mile?
And what about the XOR „encryption“? Do you know how the value is calculated and where this XOR Lookuptable is in the eeprom?
What km does the odo show with the value given as example?
And, is it possible to read the on chip bootloader code? I would need this to restore a bricked/locked odo.
i'm using AT commands. It seems like that TRE27=ELS27. Сan you connect to the adapter's com-port using the terminal and post the output of the "AT I" and "ST I" commands?
Mileage location described in "TachoSoft 23.1 Mileage Calculator" software. Also i trying to reverse main fw.
Go4IT wrote: ↑24 Jun 2019, 21:16
And, is it possible to read the on chip bootloader code? I would need this to restore a bricked/locked odo.
No, it's impossible. All requests to memory section below 0x5000 are failed with error code 0x31 - "requestOutOfRange"
Not native English speaker
IPC hacker, embedded cracker, tamer of bears & beers
Ursadon wrote: ↑25 Jun 2019, 02:14
i'm using AT commands. It seems like that TRE27=ELS27. Сan you connect to the adapter's com-port using the terminal and post the output of the "AT I" and "ST I" commands?
Ursadon wrote: ↑25 Jun 2019, 02:14
i'm using AT commands. It seems like that TRE27=ELS27. Сan you connect to the adapter's com-port using the terminal and post the output of the "AT I" and "ST I" commands?
The adapter connects with 9600 Baud 8N1 by default.
You cable - ELS27 (STN chip). Native ELM327 will be supported soon.
Software connects at 2000000bps. Autobaud will be added soon. For workaround try to use ELS27_Baudrate - viewtopic.php?f=25&t=33&start=20#p338
Artist wrote: ↑26 Jun 2019, 09:51
Km raid would be enough to set eg. to 1km. There is no problem upward editing through Forscan, Ucds, Elmconfig.
So it would be enough to add "Set IPC to 1km" ...
Resetting odometer to zero is too easy. Calculate the odometer value using Tachosoft and write to it in the industry - the same simple task.
Much more interesting to crack the algorithm. By the way, in the next release there will be a functional to write data in eeprom. I plan to integrate ConversHacker and IPCupdate functionality in one app
Last edited by Ursadon on 26 Jun 2019, 15:09, edited 1 time in total.
Not native English speaker
IPC hacker, embedded cracker, tamer of bears & beers
Artist wrote: ↑26 Jun 2019, 09:51
Hi, this is best software after years...
It's free and works perfectly!
Thanks ...
It may not be a problem to update older dashboards with red LCDs.
Can I also support the J2534 protocol for UCDS cables?
When reading main and extended flash, you can do a Convers + clone with additional features.
Km raid would be enough to set eg. to 1km. There is no problem upward editing through Forscan, Ucds, Elmconfig.
So it would be enough to add "Set IPC to 1km" ...
I'm glad to hear it, thx!
I don't have ucds cable, so i cant test j2534.
Additional features - is our primary task.
Not native English speaker
IPC hacker, embedded cracker, tamer of bears & beers
Ursadon wrote: ↑26 Jun 2019, 14:35
It seems like that TRE27=ELS27.
You cable - ELS27 (STN chip). Native ELM327 will be supported soon
I use this one https://images.app.goo.gl/oyBCfCHAvhsnMMeT6
Maybe it's a special firmware on it to support ELMconfig.
What does AT I say on ELS27?
Maybe ignoring the string it sufficient.
Also ordered an ELS27 on ebay für 20 bucks.
Ursadon wrote: ↑26 Jun 2019, 14:35
It seems like that TRE27=ELS27.
You cable - ELS27 (STN chip). Native ELM327 will be supported soon
I use this one https://images.app.goo.gl/oyBCfCHAvhsnMMeT6
Maybe it's a special firmware on it to support ELMconfig.
What does AT I say on ELS27?
Maybe ignoring the string it sufficient.
Also ordered an ELS27 on ebay für 20 bucks.
Just use ELS27_baudrate program, to change baudrate to 2000000.
Not native English speaker
IPC hacker, embedded cracker, tamer of bears & beers
Ursadon wrote: ↑26 Jun 2019, 17:20
Just use ELS27_baudrate program, to change baudrate to 2000000.
Could not find this tool. Where should i look?
It seems that my current FTDI driver (downloaded latest from website of FTDI) does not support such high baudrates. The fastest is about 900.000