Hallo. I have some experience in reverse engineering just to be in condition
- have good projects for ms41,42,43, mss50, mss54hp, GS20 (5L40E - made XDF, can generate 0DA from modified bins and flash via winkfp) and GDSMG2 (also can see all main stuff, change and write).
Now im starting to dive into GS40. Already combined 7844978A.0pa and A7848443.0DA (GTS) and started disassembing.
It seems damn thing is Infineon TriCore chip and program was written not in pure assembler (good old days), maybe C and has huge and excess code. Plus Infineon mnemonic is new to me, so its just started
Already found found CAN, KWP2K, RSA, CRC, DTC, final drive and wheel size factors constants... more to come.
Goal is to made XDF for calibration bins, tune and then convert, crc and write back with winkfp.
Maybe convert stock maps for gts, or use m3 gws on 335 without recoding or complete reflash. Of course change or enable LC, burnout mode.
For that i need to see how program and data is protected and made some crc fixer. If anyone have full dumps of entire chip and share, it helps a lot.
Now im starting to dive into GS40. Already combined 7844978A.0pa and A7848443.0DA (GTS) and started disassembing.
It seems damn thing is Infineon TriCore chip and program was written not in pure assembler (good old days), maybe C and has huge and excess code. Plus Infineon mnemonic is new to me, so its just started
Already found found CAN, KWP2K, RSA, CRC, DTC, final drive and wheel size factors constants... more to come.
Goal is to made XDF for calibration bins, tune and then convert, crc and write back with winkfp.
Maybe convert stock maps for gts, or use m3 gws on 335 without recoding or complete reflash. Of course change or enable LC, burnout mode.
For that i need to see how program and data is protected and made some crc fixer. If anyone have full dumps of entire chip and share, it helps a lot.
Last edited: