5

I am seeking for a CRC calculation on EEPROM content. I try to add options to my car with BOSCH ECU. MCU in this ECU is Tricore TC1793 and EEPROM content seems to be divided into blocks of 128 bytes each.

When I try to change a byte from one block, ECU stop working so I get another ECU from another car and grab some blocks to compare :

  1. a Block from my ECU:

    26 13 01 00 89 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 BD 8E

  2. Same ID (26 13) Block from another ECU:

    26 13 01 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 C1 69

  3. Another block from my ECU with same data (as number 1) except first 2 bytes: 

    6A DF 01 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 A8 E5

  4. Another block from my ECU:

    A9 68 01 00 1B 09 CB 0D FF 7F 00 80 FF 7F 00 80  
FF 7F 00 80 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 71 DD

  5. 0xA968 from the other one ECU:

    A9 68 01 00 FF 7F 00 80 FF 7F 00 80 FF 7F 00 80  
FF 7F 00 80 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 74

I think first 2 bytes is an ID and I think the two last bytes are a checksum and I am sure that CRC is calculated depending first two bytes cause with another block with same data but two first bytes different CRC differs.

I have tried to found some clues with Reveng but not found anything...

If someone can help me to found how this checksum is calculated or give me some clues to investigate.

Here is full data of my ECU (eeprom + mcu flash TC1793).

Improve this question
4
  • You could buy this here: usprog.ru/en/component/jshopping/for-repair/…. Legal?
    – josh
    Commented Jul 19, 2017 at 13:50
  • Who has a CRC algro for this TriCore 1793? that Russian Webpage requires you to buy the hardware to use the software for the CheckSum. Please post website with CRC software for the Checksum calculation. Thanks
    – Floyd
    Commented Feb 9, 2019 at 3:54
  • What algorithm is used to calculate Checksum Or if any of the members can give us a used algorithm
    – delenda alex
    Commented Nov 26, 2023 at 19:25
  • A9 68 01 00 FF 7F 00 80 FF 7F 00 80 FF 7F 00 80 FF 7F 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 74 initial:68A9 is crc poly 1021, the result is 7478. What algorithm is used to calculate Checksum Or if any of the members can give us a used algorithm
    – delenda alex
    Commented Nov 30, 2023 at 21:14

2 Answers 2

Reset to default
4

MED17 functional description docs will help with overview of the EEP handler, but not the checksum routine.

Usually it is best to go through the front door with coding tools rather than try to change EEPROM (actually dataflash on most Tricore) directly.

Given time I could probably locate the checksum routines and reverse them, but it is not a small job and fixing those may still leave you with other dependencies or some TPROT EEPROM contents that give you trouble that are difficult to fix.

Depends how deep you want to go, I think it is a time question beyond a simple CRC formula.

Improve this answer
3 
A9 68 01 00 FF 7F 00 80 FF 7F 00 80 FF 7F 00 80  
FF 7F 00 80 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 74

is crc poly 1021, the result is 7478.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.