[Jbam9]

Originally Posted by Jbam9

My guess is the software version. Check out this guide and redownload the 3.9 software instead of 4.8. Also make sure your RPM source is MazdaSpeed3 or 6

forgot to include the link lol
here it is: wotbox install

[Hauteknits]

Yeah I tried other versions of the software, N2MB got back to me and there was clearly something wrong as the light wasn't responding to the button presses and none of their debugging steps produced anything. I sent it back to them and should receive a new box within a week or so. I'll post updates as I hear them

Edit: Fun fact, for anyone wondering what the debug password is, its "PIDControl", the only thing that debug mode appears to do unlock the PID control that is greyed out, nothing else. FWIW I'm NOT sharing information that N2MB has shared with me, I decompiled the program and the password check is a simple StringCompare with no obfuscation or hashing, almost trivial to find

[Hauteknits]

Deleting the codes does not stop the fault condition. The codes don't appear though, but the engine still shuts off after ~1s of launch control and I don't really want to test NLS currently since other people said they get 3-5s and mine is shutting off almost immediately

[Hauteknits]

Upon driving around and testing NLS, 150ms is golden. Big pops and fast shifts. Lowered the 2step to 3100 and it seems to let me hit it for ~2-3s now. Not sure if the driving or the lower limit helped but I'm going to do some launches and dial in what's best for me. Thinking around ~2500-2800

[bbnks2]

Originally Posted by Hauteknits

Upon driving around and testing NLS, 150ms is golden. Big pops and fast shifts. Lowered the 2step to 3100 and it seems to let me hit it for ~2-3s now. Not sure if the driving or the lower limit helped but I'm going to do some launches and dial in what's best for me. Thinking around ~2500-2800

the lower limit helps. think I posted that somewhere in here... and you really don't need to be dumping the clutch any higher than ~3,000rpm anyway or you'll just be doing burnouts.

You'll still get a check engine light after a while though which is unfortunate. NLS is fun but kills your synchro's. For these two reasons I opted to remove the wotbox. Fun to mess around with but not really doing much for you outside of maybe some hardcore/max effort drag strip runs or parking lot engine revving.

[Hauteknits]

Yeah, if the car didn't throw codes it would be golden, but unfortunately this just isn't the case. My current unachievable project is decompiling the IJE0S bin and seeing if I can find the logic that reads the misfire active data or anything that shutsdown the engine, and find the related code in the 9E60B bin. From there, DME logic can either be reworked to add an if statement (jnz in assembly) to that segment, or a new table can just be added if the jnz is already there. I've gotten the bin back to C but I haven't devoted enough time to reverse engineering the bin. If anyone has more knowledge on Tricore architecture that would be super helpful as I'm not 100% sure how the functions read in the data from the EEPROM. Functions appear to be either referencing RAM/EEPROM directly, but none of the addresses line up to the tables in TunerPro

[bbnks2]

Originally Posted by Hauteknits

Yeah, if the car didn't throw codes it would be golden, but unfortunately this just isn't the case. My current unachievable project is decompiling the IJE0S bin and seeing if I can find the logic that reads the misfire active data or anything that shutsdown the engine, and find the related code in the 9E60B bin. From there, DME logic can either be reworked to add an if statement (jnz in assembly) to that segment, or a new table can just be added if the jnz is already there. I've gotten the bin back to C but I haven't devoted enough time to reverse engineering the bin. If anyone has more knowledge on Tricore architecture that would be super helpful as I'm not 100% sure how the functions read in the data from the EEPROM. Functions appear to be either referencing RAM/EEPROM directly, but none of the addresses line up to the tables in TunerPro

This was done for N54. Spool and Street forum has a thread about it and removing some other torque limiters that are still unfixed on N55. V8bait worked on it? I dont remember but maybe read through that forum.

[Hauteknits]

Originally Posted by bbnks2

This was done for N54. Spool and Street forum has a thread about it and removing some other torque limiters that are still unfixed on N55. V8bait worked on it? I dont remember but maybe read through that forum.

Do you happen to have a link for this?

[fastboatster]

a2l file is probably what you are looking for, xdf just describes the calibration area in the flash. A2l also includes ram variable addreses, if you got a funktionsrahmen doc then you can find the vars from it in the a2l file for your software version. I.e., you’ll need an a2l for 9e60b software, it should come up if you search around, I don’t have one, though. I wouldn’t look at the n54 Siemens dme stuff, it’s way too different from the Bosch’s ME(V)D 17, I’d probably look for how it’s done for other med17 family dmes like the ones in the f series n20/n55s. Anyhow, you need to locate 2 things - funktionsrahmen for the dme and correct a2l file then your project will move from impossible to very difficult
P.S. 3rd item you would also need is something to read and write your dme on the bench cause you are going to brick it many times if you start modifying program area of the flash, and you’ll need to write the old flash content back. Mhd won’t do as it doesn’t work if the dme doesn’t respond to obd2. will need something else. That really should be a prerequisite before starting to think about this kind of stuff.

[Hauteknits]

Originally Posted by fastboatster

a2l file is probably what you are looking for, xdf just describes the calibration area in the flash. A2l also includes ram variable addreses, if you got a funktionsrahmen doc then you can find the vars from it in the a2l file for your software version. I.e., you’ll need an a2l for 9e60b software, it should come up if you search around, I don’t have one, though. I wouldn’t look at the n54 Siemens dme stuff, it’s way too different from the Bosch’s ME(V)D 17, I’d probably look for how it’s done for other med17 family dmes like the ones in the f series n20/n55s. Anyhow, you need to locate 2 things - funktionsrahmen for the dme and correct a2l file then your project will move from impossible to very difficult
P.S. 3rd item you would also need is something to read and write your dme on the bench cause you are going to brick it many times if you start modifying program area of the flash, and you’ll need to write the old flash content back. Mhd won’t do as it doesn’t work if the dme doesn’t respond to obd2. will need something else. That really should be a prerequisite before starting to think about this kind of stuff.

Beautiful. Going down this path. I'll look for the A2L. As for the funktionsrahmen: I looked for this for a while months ago and found nothing, short of shelling out $600 for one from BMW (not even sure they'd sell to me). I have a pretty in depth understanding of assembly, even if its not for this particular architecture. I don't plan to recompile the program necessarily, more over try to modify the binary directly to add a single jnz instruction (or potentially find a reference to an undocumented variable). Worst case is that there isn't an easy way to disable the function and I'll have to recompile the BIN, adding an if statement. At any rate, having something to bench the DME is defiantly something I should get. Usually removing a function is easier than adding one. Worst case if I find the function and don't find an easy way to toggle it, I could always just jump over the instruction, but thats more of a max-lazy/min-effort way of doing it and will surely mess something up in the engine. Ofc all of this is assuming I can even find what im looking for . Looks like I got my work cutout for me

[fastboatster]

sent you a DM with some potentially useful (or not, lol) info. also, I highly recommend checking out nefmoto forum, has lots of generally useful info like this thread:
http://nefariousmotorsports.com/foru...p?topic=6990.0
this is MED17/EDC17, basically, a generic MEVD 17.

[Hauteknits]

Short update, school is winding down a bit and I picked this up again. I got my hands on an A2L and have been working on translating the categories to english. Finally got it translated over. Still pouring over the docs and seeing if i can find anything

[wheela]

Originally Posted by Hauteknits

Short update, school is winding down a bit and I picked this up again. I got my hands on an A2L and have been working on translating the categories to english. Finally got it translated over. Still pouring over the docs and seeing if i can find anything

Wow, you got an A2L for 9e60b? So does this mean you've been able to create an XDF that's more complete than the public XDF for 9e60b?

[Hauteknits]

Unfortunately, no. The closest I found was an a2l/hex for X5 xDrive35i. The SW revision is different, but the tables seem to be similar and I've already located a new table for which I will submit a PR for ('Pre-control correction bank 2/1 in the function monitoring", not sure how useful but still nice to have; 1:1 match between the 2 files and only a single match between the 2, roughly in the same address space.) Currently counting on locality to achieve my goals, lots of time spend in HxD. Still focusing on finding the misfire logic, and then working on generally improving 9e60b. There are online sellers that claim to sell the 9e60B A2L/Damos, but if they really had something of value, wouldn't someone on the internet have those files for download? I'm willing to fork over the cash if I can get some reassurance that the files are somewhat reputable.

Edit: I've done pretty in-depth searching for anything 9e60b or 98GOB, including searching some private tracker sites. Most promising has been stuff from MHHAuto, but I'm not going to pay the entrance fee especially when there isn't a 100% guarantee that someone has the A2L i'm looking for. If anyone has some more places to search that would be awesome, but I think I've exhausted most forums on the internet. 79S2EH0B is the closest I've been able to find

[wheela]

Originally Posted by Hauteknits

Unfortunately, no. The closest I found was an a2l/hex for X5 xDrive35i. The SW revision is different, but the tables seem to be similar and I've already located a new table for which I will submit a PR for ('Pre-control correction bank 2/1 in the function monitoring", not sure how useful but still nice to have; 1:1 match between the 2 files and only a single match between the 2, roughly in the same address space.) Currently counting on locality to achieve my goals, lots of time spend in HxD. Still focusing on finding the misfire logic, and then working on generally improving 9e60b. There are online sellers that claim to sell the 9e60B A2L/Damos, but if they really had something of value, wouldn't someone on the internet have those files for download? I'm willing to fork over the cash if I can get some reassurance that the files are somewhat reputable.

Edit: I've done pretty in-depth searching for anything 9e60b or 98GOB, including searching some private tracker sites. Most promising has been stuff from MHHAuto, but I'm not going to pay the entrance fee especially when there isn't a 100% guarantee that someone has the A2L i'm looking for. If anyone has some more places to search that would be awesome, but I think I've exhausted most forums on the internet. 79S2EH0B is the closest I've been able to find

Wow you're really digging into this, that's awesome! Thanks for your hard work and contributions!!

[Hauteknits]

Christmas time update, pretty sure I've found some helpful tables. Found a 16 bit unsigned int for "Misfire frequency per bank to achieve a fuel cutoff (Default val: 2500)" as well as "Frequency of interruptions to achieve hiding of further functions. (Default val: 12500)". Haven't tested the changes yet as I'm home for the holidays and don't want to 2-step in my neighborhood lol. At a cursory glance, changing these values won't solve the engine shutoff, but should greatly extend the time it takes before the engine shuts off (consitering you can go from a default val of 2500 to 65535). Not a perfect solution, but a decent solution. Still pouring through the tables, looking for a permanent solution.

Look for an update on my repo on Christmas Eve
https://github.com/Hauteknits/N55e-CustomMaps

[wheela]

Thanks for your continued efforts, great to see people further developing these XDF's for n55e! That skill is definately not in my wheelhouse, lol!

[boostd92]

So glad someone is putting in the effort! I've held off on buying this since I don't have the capability to do what you're doing, Hauteknitz!

I take my PS2 N55 335i to the strip quite often but struggle for consistency out of the hole. You have a paypal donation from me if you can solve this problem.

[bbnks2]

Yeah I am hoping it works to extend the time. I really liked being able to bang off the limiter without torque cuts from the soft limiter. There are some autocross courses where you just barely max out 2nd and shifting to 3rd would be a waste of time. hitting the soft limiter slows you down. i would re-buy a wotbox just for the hard limiter if this works.

Just keep some spare relays on hand because these wotboxes kill the ignition relay.

[DayneDude]

Originally Posted by bbnks2

Yeah I am hoping it works to extend the time. I really liked being able to bang off the limiter without torque cuts from the soft limiter. There are some autocross courses where you just barely max out 2nd and shifting to 3rd would be a waste of time. hitting the soft limiter slows you down. i would re-buy a wotbox just for the hard limiter if this works.

Just keep some spare relays on hand because these wotboxes kill the ignition relay.

Had there been any updates on this fun??

I have recently installed a Wotbox on an auto n52 328i and the first few times worked great. And now it’s pretty quick to limp mode.

I’m heavily following this and would love to help or find a way around this issue!

[Hauteknits]

Originally Posted by DayneDude

Had there been any updates on this fun??

I have recently installed a Wotbox on an auto n52 328i and the first few times worked great. And now it’s pretty quick to limp mode.

I’m heavily following this and would love to help or find a way around this issue!

There has been progress. I'm finding new tables atm and I'm in stages of testing, but my car has been hitting issue after issue (sludge in oil, boost leaks, convertible top issues, headlight issues) and I haven't put in much time to solving. I have found a table that I believe might help, but its a lot of guess and check at this point. Also don't want to be the bearer of bad news but this stuff is, at least for the time being, N55e specific. I could potentially find some tables for N52 but I'm not super hopeful. I'd be happy to get another N52 tuner in the ballpark though. If I could somehow get a debugger on the DME this would be a piece of cake, but I don't have the knowledge or ability to do that so guess and check is all I have

[DayneDude]

I’m just happy to see the progress!

your already much further then anyone else I’ve read about. Check and guess is the best way we have for learning and progressing something like this. Cheers for your effort brother!