Added experimental support for modified Haldex flashing & checksumming - Githubissues

bri3d / VW_Flash

Flashing tools for VW AG control units over UDS. Compression, encryption, RSA bypass, and checksums are supported for Simos18.1/6/10, DQ250-MQB, DQ381-MQB, and Haldex4Motion-Gen5-MQB.

Other

299 stars 77 forks source link

Added experimental support for modified Haldex flashing & checksumming #98

Closed ConnorHowell closed 1 year ago

ConnorHowell commented 1 year ago

!! ACTUAL FLASHING IS UNTESTED !!
Added Haldex checksum algorithm
Brought haldex_flash_utils.py more inline with DSG flash utils
Added support for Haldex flashing to the UI

Haldex Checksum

10 byte header section roughly at the start of each block (excl. DRIVER). First 4 bytes is the block address in flash, following 4 bytes is the length of the block. Final 2 bytes is the current checksum.
"Checksummable area" is any bytes prior to the signature (evident in blocks 2 & 3) and all bytes after to the end of the block.
The checksum itself is every 2 bytes expressed as an unsigned 16 bit integer added (rolling over once reaching 0xFFFF), then the NOT of this result.

bri3d commented 1 year ago

Thanks for finally doing this, Connor!

For anyone reading along, this is still likely to brick your Haldex. Tread with extreme caution.