VAG Simos2 ECU read with Galetto

[tonyM_75]

I successfuly read VAG Simos2 ECU (06A906019BQ_5WP4441-02, processor C167CR, flash 29F200BB) with Galetto1260 through boot mode on a bench.
If I use ME 7.1.5 29F400BB setting, dump is 512KB with 2 equal parts of 256KB.
If I use ME 7.5.5 29F800BB setting, dump is 1024KB with 4 equal parts of 256KB.
Writing isn't possible.

Does someone can tell me if the dump content is OK?

[tonyM_75]

ECU flash also read with Minimon (tool for C16x processors) through K-line.
So, I read the address space from 080000 to 0BFFFF, and the result is axactly the same as Galetto output.

Could someone tell me the proper address spaces for external flash in that configuration (C167CR/SC)? I suppose they are the same for all ECUs with C167 processor.

[tonyM_75]

I found useful info rearding discussed problem here: Need help Minimon + C167 + 29F400 (Read Ok/Write impossible)

To prove this, on a dissasembled ECU, I routed the data lines between C167-proc and AMD-flash. Here is the result:

C167CR-LM / AMD29F200BB
AD0 / DQ4
AD1 / DQ12
AD2 / DQ5
AD3 / DQ13
AD4 / DQ6
AD5 / DQ14
AD6 / DQ7
AD7 / DQ15
AD8 / DQ11
AD9 / DQ3
AD10 / DQ10
AD11 / DQ2
AD12 / DQ9
AD13 / DQ1
AD14 / DQ8
AD15 / DQ0

So, the problem with write/erase fails is that the data lines are crossed (for routing simplification): when the C167 "wants" to write the "sequences" (see the AMD datasheet), the memory doesen't see the right values.

Actually, this problem is well known in Siemens automotive ECU units.

For example, in some cases you must write "44h" on the proc side, if you want the memory to see part of the unlock sequence "A0h".

So, I have to rewrite (and recompile) the minimon driver in order to correct the memory patterns.

Progs as WinOls and ECM2001 have integated option to code/decode dumps BIN<->SIE, due to swapped data lines.

For comparision, find two attached files: one is in-circuit read with Minimon, the other is read by eeprom programmer (flash chip desoldered).

Could someone help me to write a new driver for AMD29F200BB and AMD29F400BB, which will work in the case with swapped data lines?

Thanks.