[Diy_efi] Motronic checksum

[Henrik Johnsson]

Hello, glogovacs

======= At 2004-06-10, 00:07:00 you wrote: =======

>I am trying to figure out how a checksum on older Motronic eproms is 
>formed. I am targeting last 2 bytes on 32kb eproms (actualy, it is last 
>24bits, since the highest 4 bit nibble is always 0000). I was lucky enough 
>to have access to eproms for the same car that only had a few different 
>locations, and of course the checksum.
>

That would actually be 12 bits, wouldn't it?

>I tried 8 bit sum, 16 bit sum... xor etc, but no success :(. I can also 
>post examples... Any help is welcome.
>

The checksum isn't necessarily stored in the last 2 bytes. I'm disassembling an older Motronic EPROM which has the checksum in 0x7F00 and 0x7F01. The checksum is calculated as the sum of all bytes in the address range 0x000 through 0x7EFF. Some Motronics allegedly has more than one checksum though.

>Also, can you suggest some good 8051 disassembler? I have d51, but it 
>produces much garbage - considering I am dummy for i8051. I was trying to 
>locate instruction that would access last two bytes of eprom, and I failed. 
>Where in address space is eprom located?
>
>I am talking about boxes 0 261 200 087 (BMW), 0 261 200 185, 0 261 200 190 
>(Opel) and similar.
>

It doesn't matter what disassembler you use, you will have to help it by identifying which portions of the EPROM is used for code and which is used for data. Also, make sure those ECUs really use an 8051-derivative.

I believe I read in an old message on this list that the code in the EPROM may be "folded", you might have to rearrange the EPROM data before disassembly to get a useful result. I'm sorry I cant find that particular message right now.

/Henrik


_______________________________________________
diy_efi mailing list
diy_efi at diy-efi.org
http://lists.diy-efi.org/mailman/listinfo/diy_efi