Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Request: Audi AL551 support #123

Open
kippdipp opened this issue Feb 9, 2024 · 9 comments
Open

Request: Audi AL551 support #123

kippdipp opened this issue Feb 9, 2024 · 9 comments

Comments

@kippdipp
Copy link

kippdipp commented Feb 9, 2024 •
edited
Loading

New to GitHub so don’t know if there’s another place for comments / requests like this..
For “kicks and giggles” I connected my D4 Audi A8 4.2FSI 8HP55, Audi calls this transmission AL551, to VW_Flash since it uses same controller as DQ380/381 (Renesas SH72519/SH72549). Get info appears to be working and I have an A2L+Hex for the AL551 Hybrid which is similar to this transmission I could share. What would it take to get VW_Flash working on the AL551?

Side note, CCP is enabled so I was able to use the upload command to dump 0x180000 -0x200000 and 0x600000-0x680000 without seed/key command. My main goal is to edit the ASW but I couldn’t dump any of the ASW addresses to sadly.
1706935084953blob
@bri3d
Copy link
Owner

bri3d commented Feb 25, 2024

The best way to figure out what's going on would be to look at an ODX. It will contain the SA2 Seed/Key and the update payload. It might be the same as DQ381 entirely (same seed/key and joke AES key/IV) or it could differ.

@kippdipp
Copy link
Author

kippdipp commented Feb 25, 2024 •
edited
Loading

Here’s the FRF for the 1006 software version on my AL551: https://race-tun.com/vag-sgo-frf/audi/fl4h1927158ad1006.frf/fl-4h1927158ad-1006.frfori/

looks like the memory layout is different than DQ381

@aarons3
Copy link
Contributor

aarons3 commented Feb 25, 2024

I compared a common 0GC300012A_14XX file to what was uploaded...

SA2 bytefields are identical

DQ381 uses ENCRYPT-COMPRESS-METHOD "AA"

That AL551 file uses "22"

@kippdipp
Copy link
Author

kippdipp commented Mar 4, 2024 •
edited
Loading

I compared a common 0GC300012A_14XX file to what was uploaded...

SA2 bytefields are identical

DQ381 uses ENCRYPT-COMPRESS-METHOD "AA"

That AL551 file uses "22"

How big of a change does this require? I'm not familiar with compress methods

@ConnorHowell
Copy link
Contributor

I compared a common 0GC300012A_14XX file to what was uploaded...
SA2 bytefields are identical
DQ381 uses ENCRYPT-COMPRESS-METHOD "AA"
That AL551 file uses "22"

How big of a change does this require? I'm not familiar with compress methods

A bench dump would be needed to reverse engineer whatever encryption/compression methods are used for the flash when flashing the TCU.

@averagejoe8
Copy link

New to GitHub so don’t know if there’s another place for comments / requests like this.. For “kicks and giggles” I connected my D4 Audi A8 4.2FSI 8HP55, Audi calls this transmission AL551, to VW_Flash since it uses same controller as DQ380/381 (Renesas SH72519/SH72549). Get info appears to be working and I have an A2L+Hex for this transmission I could share. What would it take to get VW_Flash working on the AL551?

Side note, CCP is enabled so I was able to use the upload command to dump 0x180000 -0x200000 and 0x600000-0x680000 without seed/key command. My main goal is to edit the ASW but I couldn’t dump any of the ASW addresses to sadly. 1706935084953blob

It will be nice if You can share hex+a2l for this TCU.

@kippdipp
Copy link
Author

I compared a common 0GC300012A_14XX file to what was uploaded...
SA2 bytefields are identical
DQ381 uses ENCRYPT-COMPRESS-METHOD "AA"
That AL551 file uses "22"

How big of a change does this require? I'm not familiar with compress methods

A bench dump would be needed to reverse engineer whatever encryption/compression methods are used for the flash when flashing the TCU.

Here's bench dump from my transmission.
R5F72519R_bhid0301_1034420214_eeprom-20240413-150127.zip

@kippdipp
Copy link
Author

kippdipp commented Dec 6, 2024

"AL551 decompression is 2047 sliding instead of the conventional 1023" if that helps...

@kippdipp
Copy link
Author

kippdipp commented Dec 9, 2024 •
edited
Loading

I was able to cross reference and figure out the memory segments for the AL551 with the SH72519, see below in A2L format:
CRC32 is used for CAL checksum (0x190000 to 0x1FFD5F) and is located at 0x180244.

  /begin MEMORY_SEGMENT
    Pst0 "" RESERVED FLASH INTERN 0x0 0x40000 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x0 0x0 0x40000
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x0 0x0 0x40000
    /end IF_DATA
  /end MEMORY_SEGMENT
  /begin MEMORY_SEGMENT
    Pst40000 "" RESERVED FLASH INTERN_2 0x40000 0x80 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x40000 0x40000 0x80 
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x40000 0x40000 0x80 
    /end IF_DATA
  /end MEMORY_SEGMENT
  /begin MEMORY_SEGMENT
    Pst40080 "" CODE FLASH INTERN_1 0x40080 0x13FAF0 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x40080 0x13FAF0
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x40080 0x13FAF0
    /end IF_DATA
  /end MEMORY_SEGMENT
  /begin MEMORY_SEGMENT
    Pst17FB70 "" RESERVED FLASH INTERN_3 0x17FB70 0x490 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x17FB70 0x17FB70 0x490
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x17FB70 0x17FB70 0x490
    /end IF_DATA
  /end MEMORY_SEGMENT
  /begin MEMORY_SEGMENT
    Dst180000 "" RESERVED FLASH INTERN_4 0x180000 0x280 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x180000 0x180000 0x280
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x180000 0x180000 0x280
    /end IF_DATA
  /end MEMORY_SEGMENT
  /begin MEMORY_SEGMENT
    Dst180280"" CODE FLASH INTERN_2 0x180280 0xFD80 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x180280 0x180280 0xFD80
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x180280 0x180280 0xFD80
    /end IF_DATA
  /end MEMORY_SEGMENT
  /begin MEMORY_SEGMENT
    Dst190000 "" DATA FLASH INTERN_1 0x190000 0x6FD60 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x190000 0x190000 0x6FD60
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x190000 0x190000 0x6FD60
    /end IF_DATA
  /end MEMORY_SEGMENT
  /begin MEMORY_SEGMENT
    Dst1FFD60 "" RESERVED FLASH INTERN_5 0x1FFD60 0xA4 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x1FFD60 0x1FFD60 0xA4
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x1FFD60 0x1FFD60 0xA4
    /end IF_DATA
  /end MEMORY_SEGMENT
  /begin MEMORY_SEGMENT
    Dst1FFE04 "" DATA FLASH INTERN_2 0x1FFE04 0x4 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x1FFE04 0x1FFE04 0x4 
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x1FFE04 0x1FFE04 0x4 
    /end IF_DATA
  /end MEMORY_SEGMENT
  /begin MEMORY_SEGMENT
    Dst1FFE08 "" RESERVED FLASH INTERN_6 0x1FFE08 0x1F8 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_DIAGNOSTIC_SERVICES 
      ADDRESS_MAPPING 0x1FFE08 0x1FFE08 0x1F8
    /end IF_DATA
    /begin IF_DATA ETK 
      ADDRESS_MAPPING 0x1FFE08 0x1FFE08 0x1F8
    /end IF_DATA
  /end MEMORY_SEGMENT

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@bri3d @ConnorHowell @aarons3 @kippdipp @averagejoe8