OpenGK - User contributions [en]

Bootstrap Loader

2026-07-06T08:52:12Z

Dmg210: /* Entering the BSL mode (2.0L) */

{{Stub}}

Bootstrap Loader (BSL) on the C166 MCUs allows to execute code in memory, bypassing code stored on the EEPROM.

This is often used to flash regions of memory inaccessible through OBD2, such as the bootloader. Most notable case would be removing the [[immobiliser]], or performing a ca663056->ca663057 upgrade, which requires changing the bootloader.

To enter BSL mode, you must ground the BOOT pin and then feed power to the ECU, which will make the CPU wait for input over serial port instead of executing code stored on the flash memory. Then, typically a small loader is uploaded which later facilitates upload and execution of the proper BSL program, which will offer ways to manipulate memory.

[https://github.com/dante383/gkflasher GKFlasher] supports BSL mode.

== Entering BSL mode (2.0L) ==
[[File:Boot pin ziome3eg.png|thumb|BOOT pin]]

=== Non-immo ECUs ===

# Connect ECU pins 3, 14, 21 and 22 to +12V.
# Connect [[K-Line]] per [[Siemens 5WY 2 Connector Pinout|ECU pinout.]]
# Pull down the BOOT pin to Ground through a 10kΩ resistor. (Most V6 ECU's have the resistor onboard).
# Connect power and ground to the ECU.
# ECU is now ready for BSL input - you can press any button in the BSL tab in GKFlasher.

=== Immo ECUs ===

# Connect ECU pins 3, 14, 21 and 22 to +12V.
# Connect K-Line (pin 77) per [[Siemens 5WY 2 Connector Pinout|ECU pinout]].
#Attach a 470Ω resistor on the [[W-Line|W-Line(? citation needed)]].
#Splice [[K-Line]] into [[K-Line]] on the ECU header - if you're using a Y-split OBD2 cable, that'd be [[Data link connector (OBD2)|pin 9]].
# Pull down the BOOT pin to Ground through a 10kΩ resistor.
# Connect power and ground to the ECU.
# ECU is now ready for BSL input - you can press any button in the BSL tab in GKFlasher.
[[File:Bsl pins dmg210.png|thumb]]If the method above does not work, try the following:

# Connect ECU pins 3, 14, 21 and 22 to +12V.
# Connect K-line (OBD pin 7) to W-Line on the ECU header (pin 47).
# Pull down the BOOT pin (pin 28 of the flash chip) to Ground through a 10kΩ resistor.
# Connect power and ground to the ECU.
# ECU is now ready for BSL input - you can press any button in the BSL tab in GKFlasher.

Bootstrap Loader

2026-07-06T08:51:40Z

Dmg210: /* Non-immo ECUs */

{{Stub}}

Bootstrap Loader (BSL) on the C166 MCUs allows to execute code in memory, bypassing code stored on the EEPROM.

This is often used to flash regions of memory inaccessible through OBD2, such as the bootloader. Most notable case would be removing the [[immobiliser]], or performing a ca663056->ca663057 upgrade, which requires changing the bootloader.

To enter BSL mode, you must ground the BOOT pin and then feed power to the ECU, which will make the CPU wait for input over serial port instead of executing code stored on the flash memory. Then, typically a small loader is uploaded which later facilitates upload and execution of the proper BSL program, which will offer ways to manipulate memory.

[https://github.com/dante383/gkflasher GKFlasher] supports BSL mode.

== Entering the BSL mode (2.0L) ==
[[File:Boot pin ziome3eg.png|thumb|BOOT pin]]

=== Non-immo ECUs ===

# Connect ECU pins 3, 14, 21 and 22 to +12V.
# Connect [[K-Line]] per [[Siemens 5WY 2 Connector Pinout|ECU pinout.]]
# Pull down the BOOT pin to Ground through a 10kΩ resistor. (Most V6 ECU's have the resistor onboard).
# Connect power and ground to the ECU.
# ECU is now ready for BSL input - you can press any button in the BSL tab in GKFlasher.

=== Immo ECUs ===

# Connect ECU pins 3, 14, 21 and 22 to +12V.
# Connect K-Line (pin 77) per [[Siemens 5WY 2 Connector Pinout|ECU pinout]].
#Attach a 470Ω resistor on the [[W-Line|W-Line(? citation needed)]].
#Splice [[K-Line]] into [[K-Line]] on the ECU header - if you're using a Y-split OBD2 cable, that'd be [[Data link connector (OBD2)|pin 9]].
# Pull down the BOOT pin to Ground through a 10kΩ resistor.
# Connect power and ground to the ECU.
# ECU is now ready for BSL input - you can press any button in the BSL tab in GKFlasher.
[[File:Bsl pins dmg210.png|thumb]]If the method above does not work, try the following:

# Connect ECU pins 3, 14, 21 and 22 to +12V.
# Connect K-line (OBD pin 7) to W-Line on the ECU header (pin 47).
# Pull down the BOOT pin (pin 28 of the flash chip) to Ground through a 10kΩ resistor.
# Connect power and ground to the ECU.
# ECU is now ready for BSL input - you can press any button in the BSL tab in GKFlasher.

2.0L ECM

2026-01-19T10:41:04Z

Dmg210: /* Bootloader & UIF */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==

=== Memory offset & bin offset ===
Through OpenGK wiki and projects, you'll often find the terms memory offset, and bin offset.

You might notice that memory offset is usually either 0x40000 or 0x80000 larger than bin offset when referring to the same spot (such as the calibration zone).

Bin offset is referring to the position in your .bin file - and the EEPROM. Memory offset is referring to the CPU offset - such as when reading using ReadMemoryByAddress.

This is because of the c166 memory layout, depending on the installed EEPROM.

2mbit chips will have a 0x40000 memory offset, 4mbit chips - 0x80000 and 8mbit chips - 0.

While it can be seen clearly in the tables below, a quick example:

* if you open a .bin file for a 2mbit SIMK41, you'll find that the calibration zone starts at 0x8000. If you wanted to use [[CAN Calibration Protocol|CCP]] or ReadMemoryByAddress to read it out from the ECU, you'd adjust this address to 0x8000 + 0x40000 = 0x48000.
* if you open a .bin file for a 4mbit SIMK43, you'll find that the calibration zone starts at 0x10000. If you wanted to use [[CAN Calibration Protocol|CCP]] or ReadMemoryByAddress to read it out from the ECU, you'd adjust this address to 0x10000 + 0x80000 = 0x90000.
* If you open a .bin file for a 4mbit SIMK43 and find the calibration zone checksum area stop address, chances are it'll be equal to 0x98000. If you wanted to find that location in your bin file, you'd subtract the bin offset: 0x98000 - 0x80000 = 0x18000

=== Regions ===
Both units memory can be separated into 5 regions:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===
All provided offsets are in hex

==== SIMK41 - 2mbit ====
{| class="wikitable"
!Memory start
!Memory end
! style="text-align: center; font-weight:bold;" | Bin start
! style="text-align: center; font-weight:bold;" | Bin end
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
|
|
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
|
|
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
|
|
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
|
|
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
!Memory start
!Memory end
! style="text-align: center; font-weight:bold;" | Bin start
! style="text-align: center; font-weight:bold;" | Bin end
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" |0
| style="text-align: center; background-color:#fe996b;" |3FFF
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" |C000
| style="text-align: center; background-color:#ff9797;" |FFFF
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center;" |E000
| style="text-align: center;" |E7FF
| style="text-align: center;" |E000
| style="text-align: center;" |E7FF
| style="text-align: center;" |XRAM
| style="text-align: center;" |2 kByte
|-
| style="text-align: center;" |EF00
| style="text-align: center;" |F000
| style="text-align: center;" |EF00
| style="text-align: center;" |F000
| style="text-align: center;" |CAN1
| style="text-align: center;" |256 bytes
|-
| style="text-align: center;" |F000
| style="text-align: center;" |F200
| style="text-align: center;" |F000
| style="text-align: center;" |F200
| style="text-align: center;" |ESFR
| style="text-align: center;" |512 bytes
|-
| style="text-align: center;" |F600
| style="text-align: center;" |FBFF
| style="text-align: center;" |F600
| style="text-align: center;" |FBFF
| style="text-align: center;" |Internal RAM
| style="text-align: center;" |1.5 kByte
|-
| style="text-align: center;" |FC00
| style="text-align: center;" |FFFF
| style="text-align: center;" |FC00
| style="text-align: center;" |FFFF
| style="text-align: center;" |Internal SFRs
| style="text-align: center;" |1 kByte
|-
| style="text-align: center; background-color:#ff9797;" |FD00
| style="text-align: center; background-color:#ff9797;" |FF55?
| style="text-align: center; background-color:#ff9797;" |FD00
| style="text-align: center; background-color:#ff9797;" |FF55?
| style="text-align: center; background-color:#ff9797;" |INT_RAM_BIT
| style="text-align: center; background-color:#ff9797;" |256 bytes
|-
| style="text-align: center; background-color:#bfbdbf;" |88000
| style="text-align: center; background-color:#bfbdbf;" |97FFF
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" |90000
| style="text-align: center; background-color:#9aff99; color:#000000;" |AFFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" |A0000
| style="text-align: center; background-color:#fffc9e;" |11FFFF
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Memory start
Bin start
! style="text-align: center; font-weight:bold;" | Memory end
Bin end
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 50000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 5FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 2
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|87FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | 8FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 1
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIM2K-47 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Memory start
Bin start
! style="text-align: center; font-weight:bold;" | Memory end
Bin end
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 52000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 5EFF0
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 2
| style="text-align: center; background-color:#9aff99; color:#000000;" | 52 kByte
|-
| style="text-align: center; background-color:#aadae3;" |82000
| style="text-align: center; background-color:#aadae3;" |87FFF
| style="text-align: center; background-color:#aadae3;" |Recovery (RSW)
| style="text-align: center; background-color:#aadae3;" |24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | 8FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 92000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 9EFF0
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 1
| style="text-align: center; background-color:#9aff99; color:#000000;" | 52 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key verification enabled flag]]
|0x3E00
|1
|
{{HexConverter|hex=00}}
|Flag determining whether the ECU should ask for KWP authorization key. 0x00 - security access verification enabled, 0xFF - disabled
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|[[K-Line|KWP seed/key]]: Siemens level access
|0x3F5C
|8
|{{HexConverter|hex=46A019B2CEC64252|default-display=hex}}
|Seed and key (4 bytes each) for the highest level of access. $27 SecurityAccess: 0xFD for requesting seed, 0xFE for sending key
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMxxDD)
|0x3F98
|8
|
{{HexConverter|hex=0x3037303431353132|default-display=ascii}}
(2007, April 12th)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified. xx is unknown
|-
|ECU lock status flag
|0x3FBE
|1
|{{HexConverter|hex=0x00|default-display=hex}}
|Flag determining whether the ECU is locked. 0x00 by default, setting it to 0xFF will allow to read the whole ECU including bootzone over KWP2000
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32 kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - INT_RAM [15872]
* 0xFD00 - INT_RAM_BIT [256]
* 0xFF800 - RAM [2048]
* 0xCA4E - CCP Seed/key e.g. DEET (within RAM)
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block for CCP within bootloader 2
* 0x3000000 - FLASH_DR [65520]

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|[[Chassis identifiers|Chassis identifier]]
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.
[[Category:Siemens L4 2.0L]]

2.0L ECM

2025-12-07T15:18:49Z

Dmg210:

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==

=== Memory offset & bin offset ===
Through OpenGK wiki and projects, you'll often find the terms memory offset, and bin offset.

You might notice that memory offset is usually either 0x40000 or 0x80000 larger than bin offset when referring to the same spot (such as the calibration zone).

Bin offset is referring to the position in your .bin file - and the EEPROM. Memory offset is referring to the CPU offset - such as when reading using ReadMemoryByAddress.

This is because of the c166 memory layout, depending on the installed EEPROM.

2mbit chips will have a 0x40000 memory offset, 4mbit chips - 0x80000 and 8mbit chips - 0.

While it can be seen clearly in the tables below, a quick example:

* if you open a .bin file for a 2mbit SIMK41, you'll find that the calibration zone starts at 0x8000. If you wanted to use [[CAN Calibration Protocol|CCP]] or ReadMemoryByAddress to read it out from the ECU, you'd adjust this address to 0x8000 + 0x40000 = 0x48000.
* if you open a .bin file for a 4mbit SIMK43, you'll find that the calibration zone starts at 0x10000. If you wanted to use [[CAN Calibration Protocol|CCP]] or ReadMemoryByAddress to read it out from the ECU, you'd adjust this address to 0x10000 + 0x80000 = 0x90000.
* If you open a .bin file for a 4mbit SIMK43 and find the calibration zone checksum area stop address, chances are it'll be equal to 0x98000. If you wanted to find that location in your bin file, you'd subtract the bin offset: 0x98000 - 0x80000 = 0x18000

=== Regions ===
Both units memory can be separated into 5 regions:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===
All provided offsets are in hex

==== SIMK41 - 2mbit ====
{| class="wikitable"
!Memory start
!Memory end
! style="text-align: center; font-weight:bold;" | Bin start
! style="text-align: center; font-weight:bold;" | Bin end
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
|
|
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
|
|
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
|
|
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
|
|
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
!Memory start
!Memory end
! style="text-align: center; font-weight:bold;" | Bin start
! style="text-align: center; font-weight:bold;" | Bin end
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" |0
| style="text-align: center; background-color:#fe996b;" |3FFF
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" |C000
| style="text-align: center; background-color:#ff9797;" |FFFF
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center;" |E000
| style="text-align: center;" |E7FF
| style="text-align: center;" |E000
| style="text-align: center;" |E7FF
| style="text-align: center;" |XRAM
| style="text-align: center;" |2 kByte
|-
| style="text-align: center;" |EF00
| style="text-align: center;" |F000
| style="text-align: center;" |EF00
| style="text-align: center;" |F000
| style="text-align: center;" |CAN1
| style="text-align: center;" |256 bytes
|-
| style="text-align: center;" |F000
| style="text-align: center;" |F200
| style="text-align: center;" |F000
| style="text-align: center;" |F200
| style="text-align: center;" |ESFR
| style="text-align: center;" |512 bytes
|-
| style="text-align: center;" |F600
| style="text-align: center;" |FBFF
| style="text-align: center;" |F600
| style="text-align: center;" |FBFF
| style="text-align: center;" |Internal RAM
| style="text-align: center;" |1.5 kByte
|-
| style="text-align: center;" |FC00
| style="text-align: center;" |FFFF
| style="text-align: center;" |FC00
| style="text-align: center;" |FFFF
| style="text-align: center;" |Internal SFRs
| style="text-align: center;" |1 kByte
|-
| style="text-align: center; background-color:#ff9797;" |FD00
| style="text-align: center; background-color:#ff9797;" |FF55?
| style="text-align: center; background-color:#ff9797;" |FD00
| style="text-align: center; background-color:#ff9797;" |FF55?
| style="text-align: center; background-color:#ff9797;" |INT_RAM_BIT
| style="text-align: center; background-color:#ff9797;" |256 bytes
|-
| style="text-align: center; background-color:#bfbdbf;" |88000
| style="text-align: center; background-color:#bfbdbf;" |97FFF
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" |90000
| style="text-align: center; background-color:#9aff99; color:#000000;" |AFFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" |A0000
| style="text-align: center; background-color:#fffc9e;" |11FFFF
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Memory start
Bin start
! style="text-align: center; font-weight:bold;" | Memory end
Bin end
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 50000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 5FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 2
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|87FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | 8FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 1
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIM2K-47 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Memory start
Bin start
! style="text-align: center; font-weight:bold;" | Memory end
Bin end
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 52000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 5EFF0
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 2
| style="text-align: center; background-color:#9aff99; color:#000000;" | 52 kByte
|-
| style="text-align: center; background-color:#aadae3;" |82000
| style="text-align: center; background-color:#aadae3;" |87FFF
| style="text-align: center; background-color:#aadae3;" |Recovery (RSW)
| style="text-align: center; background-color:#aadae3;" |24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | 8FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 92000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 9EFF0
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 1
| style="text-align: center; background-color:#9aff99; color:#000000;" | 52 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key verification enabled flag]]
|0x3E00
|1
|
{{HexConverter|hex=00}}
|Flag determining whether the ECU should ask for KWP authorization key. 0x00 - security access verification enabled, 0xFF - disabled
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|[[K-Line|KWP seed/key]]: Siemens level access
|0x3F5F
|8
|{{HexConverter|hex=46A019B2CEC64252|default-display=hex}}
|Seed and key (4 bytes each) for the highest level of access. $27 SecurityAccess: 0xFD for requesting seed, 0xFE for sending key
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMxxDD)
|0x3F98
|8
|
{{HexConverter|hex=0x3037303431353132|default-display=ascii}}
(2007, April 12th)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified. xx is unknown
|-
|ECU lock status flag
|0x3FBE? (lost during a page edit)
|1
|{{HexConverter|hex=0x00|default-display=hex}}
|Flag determining whether the ECU is locked. 0x00 by default, setting it to 0xFF will allow to read the whole ECU including bootzone over KWP2000
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32 kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - INT_RAM [15872]
* 0xFD00 - INT_RAM_BIT [256]
* 0xFF800 - RAM [2048]
* 0xCA4E - CCP Seed/key e.g. DEET (within RAM)
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block for CCP within bootloader 2
* 0x3000000 - FLASH_DR [65520]

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|[[Chassis identifiers|Chassis identifier]]
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.
[[index.php?title=Category:Siemens L4 2.0L]]

Cross Flash Kia Spectra

2025-11-19T11:49:23Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.
[[File:Kia crossflash prog.png|thumb|[[File:Kia crossflash cal.png|thumb]]
[[File:Kia crossflash gui.png|thumb]]]]
In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
Once the version details have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

Please note:

'''If your car ''is not equipped'' with immobilizer hardware''' (an immobilizer coil and keys containing a PCF793 transponder) then you'll be unable to programme the immobiliser data into the ECU. In this scenerio, you won't be able to start the car or re-program the ECU. The only option is to remove the ECU from the vehicle and bench flash via BSL. To avoid this scenerio, only load ECU firmware appropriate for your region where the immobiliser is preconfigured.

'''If your car ''is equipped'' with immobilizer hardware''' you may need to re-program the immobilizer by running through the Teach Keys procedure (if the Immo status is 'virgin' or 'not learnt'). Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the 0x22 error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

Cross Flash Kia Spectra

2025-11-19T11:47:21Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.
[[File:Kia crossflash prog.png|thumb|[[File:Kia crossflash cal.png|thumb]]
[[File:Kia crossflash gui.png|thumb]]]]
In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
Once the version details have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

Please note:

'''If your car ''is not equipped'' with immobilizer hardware''' (an immobilizer coil and keys containing a PCF793 transponder) then you'll be unable to programme the immobiliser data into the ECU. In this scenerio, you won't be able to start the car or re-program the ECU. The only option is to remove the ECU from the vehicle and bench flash via BSL. To avoid this scenerio, only load ECU firmware appropriate for your region where the immobiliser is preconfigured.

'''If your car ''is equipped'' with immobilizer hardware''' you may need to re-program the immobilizer by running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'. Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the 0x22 error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

Cross Flash Kia Spectra

2025-11-19T11:47:01Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.
[[File:Kia crossflash prog.png|thumb|[[File:Kia crossflash cal.png|thumb]]
[[File:Kia crossflash gui.png|thumb]]]]
In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
Once the version details have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

Please note:

'''If your car ''is not equipped'' with immobilizer hardware''' (an immobilizer coil and keys containing a PCF793 transponder) then you'll be unable to programme the immobiliser data into the ECU. In this scenerio, you won't be able to start the car or re-program the ECU. The only option here is to remove the ECU from the vehicle and bench flash via BSL. To avoid this scenerio, only load ECU firmware appropriate for your region where the immobiliser is preconfigured.

'''If your car ''is equipped'' with immobilizer hardware''' you may need to re-program the immobilizer by running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'. Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the 0x22 error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

Cross Flash Kia Spectra

2025-11-19T11:46:27Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.
[[File:Kia crossflash prog.png|thumb|[[File:Kia crossflash cal.png|thumb]]
[[File:Kia crossflash gui.png|thumb]]]]
In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
Once the version details have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

Please note:

'''If your car ''is not equipped'' with immobilizer hardware''' (an immobilizer coil and keys containing a PCF793 transponder) then you'll be unable to programme the immobiliser data into the ECU. In this scenerio, you won't be able to start the car or re-program the ECU. The only option is to remove the ECU from the vehicle and bench flash via BSL. To avoid this scenerio, only load ECU firmware appropriate for your region where the immobiliser is preconfigured.

'''If your car ''is equipped'' with immobilizer hardware''' you may need to re-program the immobilizer by running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'. Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the 0x22 error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

Cross Flash Kia Spectra

2025-11-19T11:45:22Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.
[[File:Kia crossflash prog.png|thumb|[[File:Kia crossflash cal.png|thumb]]
[[File:Kia crossflash gui.png|thumb]]]]
In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
Once the version details have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

Please note:

'''If your car is not equipped with immobilizer hardware''' (an immobilizer coil and keys containing a PCF793 transponder) then you'll be unable to programme the immobiliser data into the ECU. In this scenerio, you won't be able to start the car or re-program the ECU. The only option is to remove the ECU from the vehicle and bench flash via BSL. To avoid this scenerio, only load ECU firmware appropriate for your region where the immobiliser is preconfigured.

'''If your car is equipped with immobilizer hardware''' you may need to re-program the immobilizer by running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'. Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the 0x22 error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

Cross Flash Kia Spectra

2025-11-19T11:44:39Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.
[[File:Kia crossflash prog.png|thumb|[[File:Kia crossflash cal.png|thumb]]
[[File:Kia crossflash gui.png|thumb]]]]
In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
Once the version details have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

Please note:

'''If your car is not equipped with immobilizer hardware''' (an immobilizer coil and keys containing a PCF793 transponder) then you'll be unable to programme the immobiliser data into the ECU. In this scenerio, you won't be able to start the car or re-programme the ECU. The only option is to remove the ECU from the vehicle and bench flash via BSL. To avoid this scenerio, only load ECU firmware appropriate for your region where the immobiliser is preconfigured.

'''If your car is equipped with immobilizer hardware''' you may need to re-program the immobilizer by running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'. Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the 0x22 error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

Cross Flash Kia Spectra

2025-11-19T11:43:43Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.
[[File:Kia crossflash prog.png|thumb|[[File:Kia crossflash cal.png|thumb]]
[[File:Kia crossflash gui.png|thumb]]]]
In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
Once the version details have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

'''Please note:'''

'''If your car is not equipped with immobilizer hardware''' (an immobilizer coil and keys containing a PCF793 transponder) then you'll be unable to programme the immobiliser data into the ECU. In this scenerio, you won't be able to start the car or re-programme the ECU. The only option is to remove the ECU from the vehicle and bench flash via BSL. To avoid this scenerio, only load ECU firmware appropriate for your region where the immobiliser is preconfigured.

'''If your car is equipped with immobilizer hardware''' you may need to re-program the immobilizer by running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'. Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the 0x22 error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

Cross Flash Kia Spectra

2025-11-19T11:30:07Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.
[[File:Kia crossflash cal.png|thumb]]
[[File:Kia crossflash prog.png|thumb]]
In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
Once the version detials have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

You may need to re-program the Immobilizer running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'

Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

'''Please note:''' If your car doesn't have immobilizer hardware (an immobilizer coil and keys containing a PCF793 transponder) then you'll be unable to programme the immobiliser data into the ECU. In this scenerio, you won't be able to start the car and the only option is to remove the ECU from the vehicle and bench flash via BSL.

To avoid this scenerio, only load ECU firmware appropriate for your region where the immobiliser is preconfigured.
[[File:Kia crossflash gui.png|thumb]]

2.0L ECM

2025-03-26T20:10:38Z

Dmg210: /* SIMK43 - 4mbit */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==

=== Memory offset & bin offset ===
Through OpenGK wiki and projects, you'll often find the terms memory offset, and bin offset.

You might notice that memory offset is usually around 0x80000 larger than bin offset when referring to the same spot (such as the calibration zone).

Bin offset is referring to the position in your .bin file - and the EEPROM. Memory offset is referring to the CPU offset - such as when reading using ReadMemoryByAddress.

This is because of the c166 memory layout and DPP (Data Page Pointer) configuration. In general, on every c166 project, the memory offset will be at least 0x80000 higher than the bin offset - further description needed.

=== Regions ===
Both units memory can be separated into 5 regions:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===
All provided offsets are in hex

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
!Memory start
!Memory end
! style="text-align: center; font-weight:bold;" | Bin start
! style="text-align: center; font-weight:bold;" | Bin end
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" |0
| style="text-align: center; background-color:#fe996b;" |3FFF
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" |C000
| style="text-align: center; background-color:#ff9797;" |FFFF
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center;" |E000
| style="text-align: center;" |E7FF
| style="text-align: center;" |E000
| style="text-align: center;" |E7FF
| style="text-align: center;" |XRAM
| style="text-align: center;" |2 kByte
|-
| style="text-align: center;" |EF00
| style="text-align: center;" |F000
| style="text-align: center;" |EF00
| style="text-align: center;" |F000
| style="text-align: center;" |CAN1
| style="text-align: center;" |256 bytes
|-
| style="text-align: center;" |F000
| style="text-align: center;" |F200
| style="text-align: center;" |F000
| style="text-align: center;" |F200
| style="text-align: center;" |ESFR
| style="text-align: center;" |512 bytes
|-
| style="text-align: center;" |F600
| style="text-align: center;" |FBFF
| style="text-align: center;" |F600
| style="text-align: center;" |FBFF
| style="text-align: center;" |Internal RAM
| style="text-align: center;" |1.5 kByte
|-
| style="text-align: center;" |FC00
| style="text-align: center;" |FFFF
| style="text-align: center;" |FC00
| style="text-align: center;" |FFFF
| style="text-align: center;" |Internal SFRs
| style="text-align: center;" |1 kByte
|-
| style="text-align: center; background-color:#ff9797;" |FD00
| style="text-align: center; background-color:#ff9797;" |FF55?
| style="text-align: center; background-color:#ff9797;" |FD00
| style="text-align: center; background-color:#ff9797;" |FF55?
| style="text-align: center; background-color:#ff9797;" |INT_RAM_BIT
| style="text-align: center; background-color:#ff9797;" |256 bytes
|-
| style="text-align: center; background-color:#bfbdbf;" |88000
| style="text-align: center; background-color:#bfbdbf;" |97FFF
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" |90000
| style="text-align: center; background-color:#9aff99; color:#000000;" |AFFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" |A0000
| style="text-align: center; background-color:#fffc9e;" |11FFFF
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 50000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 5FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 2
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|87FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | 8FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 1
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key verification enabled flag]]
|0x3E00
|1
|
{{HexConverter|hex=00}}
|Flag determining whether the ECU should ask for KWP authorization key. 0x00 - security access verification enabled, 0xFF - disabled
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|-
|ECU lock status flag
|1
|{{HexConverter|hex=0x00|default-display=hex}}
|Flag determining whether the ECU is locked. 0x00 by default, setting it to 0xFF will allow to read the whole ECU including bootzone over KWP2000
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32 kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - INT_RAM [15872]
* 0xFD00 - INT_RAM_BIT [256]
* 0xFF800 - RAM [2048]
* 0xCA4E - CCP Seed/key e.g. DEET (within RAM)
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block for CCP within bootloader 2
* 0x3000000 - FLASH_DR [65520]

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.

K-Line

2025-03-18T10:44:54Z

Dmg210: /* Input-Output local identifiers */

K-Line on SIMK43 runs at 10400 baud and uses the KWP2000 protocol for diagnostic communication.

== Connection points ==

=== OBD2 ===
K-line uses the standard pin 7 on the [[Data link connector (OBD2)|OBD2 connector]]

=== ECU ===

==== If you have 1.6 or 2.0 without immobilizer installed: ====
Good news! Your K-Line pins (OBD2/MCC) are connected directly to the K-line pin on the ECU (2.0 - 77)

==== If you have 1.6 or 2.0 with immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). '''THERE IS NOTHING CONNECTED TO K-LINE PIN AT THE ECU!!''' (2.0 77). Instead, all K-line stuff is connected to the ECU's W-Line (2.0 - 47)

==== If you have 2.7 with or without immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). Your K/Immo-Line pin at the ECU (C133-1, pin 3) is connected to BCM's "Immo W-line" (BCM-IM, pin 20). 2.7 ECUs don't have a separate K and W line - it's all integrated in one pin, you don't have nothing to worry about.

== KWP2000 ==
Recommended document: [https://opengk.org/files/Users/dante383/OBDII%20Specifications%20-%20KWP2000%20DaimlerChrysler%202002.pdf OBDII Specifications - KWP2000 DaimlerChrysler 2002.pdf]

To start communication, you need to use Fast Init - so bring the K-line down for exactly 25ms, then up for 25ms followed by StartCommunication request. Python example of that using a FTDI cable [https://github.com/Dante383/gkbus/blob/a3ff894e8352ef2faab36e22553da7ddf5688cb8/gkbus/interface/kline/KLineSerial.py#L48 can be found in GKBus] code.

ID of the ECU is 0x11, and as a diagnostic device you should be using ID 0xF1. So an example command and response would look like this:

Diagnostic device: <code>82 11 F1 27 01 AC</code> (security access request)

ECU response: <code>83 F1 11 67 02 34 22</code>

==== Baudrate ====

By default, SIMK43 uses 10400 baud. On some ECUs (so far testing revealed that <2005 ECUs might not support that), baudrate can be manipulated by additional undocumented parameter of the StartDiagnosticSession service:
{| class="wikitable"
|+
!Baudrate identifier,
passed to StartDiagnosticSession
!Baudrate on K-line
(bits per second)
|-
|0x01
|10400
|-
|0x02
|20000
|-
|0x03
|40000
|-
|0x04
|60000
|-
|0x05
|120000
|}
<blockquote>
</blockquote>

==== Challenge-response calculation ====
SIMK43/41 uses a 2 byte seed and 2 byte key for security access. You can take a look at it's Python implementation in GKFlasher: https://github.com/Dante383/GKFlasher/blob/15a715b18f2119d697a5ceed00f6383f690c4a23/ecu.py#L42

The algorithm presents as so (Python):

<code>def calculate_key (seed):</code>

<code> key = 0x9360</code>

<code> </code>

<code> for index in range(0x24):</code>

<code> key = key * 2 ^ seed</code>

<code> </code>

<code> return key & 0xFFFF</code>

==== Input-Output local identifiers ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x10
|check engine light
|
|-
|0x11
|EVAP canister close valve (on)
|
|-
|0x12
|fuel pump relay
|
|-
|0x13
|a/c compressor relay
|
|-
|0x14
|fuel pump control
|
|-
|0x15
|?
|
|-
|0x16
|Canister Close Valve-Lock
|
|-
|0x1A
|cooling fan relay high
|-
|0x1B
|cooling fan relay low
|
|-
|0x1C
|main relay
|
|-
|0x20
|canister purge valve
|
|-
|0x23
|idle speed actuator
|
|-
|0x24
|cvvt valve
|
|-
|0x30
|fuel cut-4 cylinders
|i4 non-cvvt only
|-
|0x31
|ignition coil #1, 4
|
|-
|0x32
|ignition coil #2, 3
|Coil #5 v6 only
|-
|0x33
|ignition coil #3, 6
|Coil #6 v6 only
|-
|0x39
|injector cylinder 1
|i4 only
|-
|0x3A
|injector cylinder 2
|i4 only
|-
|0x3B
|injector cylinder 3
|i4 only
|-
|0x3C
|injector cylinder 4
|i4 only
|-
|0x300701
|injector cylinder 1
|v6 only
|-
|0x300702
|injector cylinder 2
|v6 only
|-
|0x300704
|injector cylinder 3
|v6 only
|-
|0x300708
|injector cylinder 4
|v6 only
|-
|0x300710
|injector cylinder 5
|v6 only
|-
|0x300720
|injector cylinder 6
|v6 only
|-
|0x40
|Version Configuration
|Automatic Transaxle (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x41
|Version Configuration
|Traction Control System (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x42
|?
|
|-
|0x50
|adaptive values
|0x04 - clear function
|-
|0x71
|?
|
|-
|0x72
|?
|
|-
|0x73
|?
|
|-
|0x74
|?
|
|-
|0x79
|?
|
|-
|0x7A
|?
|
|-
|0x95
|evap leakage test
|0x06 - start function
|-
|0x96
|?
|
|-
|0xA0
|?
|
|}
<blockquote></blockquote>

==== Routines by local identifier ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x00
|erase program section
|
|-
|0x01
|erase calibration section
|
|-
|0x02
|verify and mark blocks as ready to execute
|Needs to be called after flashing
|
|-
|0x03
|unknown
|requires security access, returned 0x33 0xE0 on a bench ecu
|-
|0x04
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x05
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x12
|query immobilizer info
|1 byte number of keys learnt, 1 bytes immo status (0x01 = learnt), 1 byte key status (0x00 not learnt), 1 byte smartra status if applicable
|
|-
|0x13
|needs to be called before immobilizer password teaching/changing
|
|-
|0x14
|needs to be called before immobilizer teaching.
|
|-
|0x15
|needs to be called before ECU immobilizer reset
|
|-
|0x16
|needs to be called before putting immobilizer in limp home mode
|
|-
|0x17
|input new limp home password
|
|-
|0x18
|activate limp home mode
|takes user-provided (default: 2345) password as parameters
|-
|0x19
|confirm limp home password change
|takes 0x01 as a parameter
|-
|0x1A
|input 6 digit immobilizer password
|Needs to be called before teaching, resetting or other actions modifying the immo system. Takes password and 6x 0xFF as parameters
|-
|0x1B, 0x1C, 0x1D, 0x1E
|teach keys 1,2,3,4
|Takes 0x01 as a parameter
|-
|0x20
|reset ECU immo.
|Takes 0x01 as a parameter
|-
|0x25
|needs to be called before neutralizing smartra
|
|-
|0x26
|confirm neutralizing smartra.
|takes 0x01 as a parameter
|}

K-Line

2025-03-18T10:34:43Z

Dmg210: /* Input-Output local identifiers */

K-Line on SIMK43 runs at 10400 baud and uses the KWP2000 protocol for diagnostic communication.

== Connection points ==

=== OBD2 ===
K-line uses the standard pin 7 on the [[Data link connector (OBD2)|OBD2 connector]]

=== ECU ===

==== If you have 1.6 or 2.0 without immobilizer installed: ====
Good news! Your K-Line pins (OBD2/MCC) are connected directly to the K-line pin on the ECU (2.0 - 77)

==== If you have 1.6 or 2.0 with immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). '''THERE IS NOTHING CONNECTED TO K-LINE PIN AT THE ECU!!''' (2.0 77). Instead, all K-line stuff is connected to the ECU's W-Line (2.0 - 47)

==== If you have 2.7 with or without immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). Your K/Immo-Line pin at the ECU (C133-1, pin 3) is connected to BCM's "Immo W-line" (BCM-IM, pin 20). 2.7 ECUs don't have a separate K and W line - it's all integrated in one pin, you don't have nothing to worry about.

== KWP2000 ==
Recommended document: [https://opengk.org/files/Users/dante383/OBDII%20Specifications%20-%20KWP2000%20DaimlerChrysler%202002.pdf OBDII Specifications - KWP2000 DaimlerChrysler 2002.pdf]

To start communication, you need to use Fast Init - so bring the K-line down for exactly 25ms, then up for 25ms followed by StartCommunication request. Python example of that using a FTDI cable [https://github.com/Dante383/gkbus/blob/a3ff894e8352ef2faab36e22553da7ddf5688cb8/gkbus/interface/kline/KLineSerial.py#L48 can be found in GKBus] code.

ID of the ECU is 0x11, and as a diagnostic device you should be using ID 0xF1. So an example command and response would look like this:

Diagnostic device: <code>82 11 F1 27 01 AC</code> (security access request)

ECU response: <code>83 F1 11 67 02 34 22</code>

==== Baudrate ====

By default, SIMK43 uses 10400 baud. On some ECUs (so far testing revealed that <2005 ECUs might not support that), baudrate can be manipulated by additional undocumented parameter of the StartDiagnosticSession service:
{| class="wikitable"
|+
!Baudrate identifier,
passed to StartDiagnosticSession
!Baudrate on K-line
(bits per second)
|-
|0x01
|10400
|-
|0x02
|20000
|-
|0x03
|40000
|-
|0x04
|60000
|-
|0x05
|120000
|}
<blockquote>
</blockquote>

==== Challenge-response calculation ====
SIMK43/41 uses a 2 byte seed and 2 byte key for security access. You can take a look at it's Python implementation in GKFlasher: https://github.com/Dante383/GKFlasher/blob/15a715b18f2119d697a5ceed00f6383f690c4a23/ecu.py#L42

The algorithm presents as so (Python):

<code>def calculate_key (seed):</code>

<code> key = 0x9360</code>

<code> </code>

<code> for index in range(0x24):</code>

<code> key = key * 2 ^ seed</code>

<code> </code>

<code> return key & 0xFFFF</code>

==== Input-Output local identifiers ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x10
|check engine light
|
|-
|0x11
|EVAP canister close valve (on)
|
|-
|0x12
|fuel pump relay
|
|-
|0x13
|a/c compressor relay
|
|-
|0x14
|fuel pump control
|
|-
|0x16
|Canister Close Valve-Lock
|
|-
|0x1A
|cooling fan relay high
|-
|0x1B
|cooling fan relay low
|
|-
|0x1C
|main relay
|
|-
|0x20
|canister purge valve
|
|-
|0x23
|idle speed actuator
|
|-
|0x24
|cvvt valve
|
|-
|0x30
|fuel cut-4 cylinders
|i4 non-cvvt only
|-
|0x31
|ignition coil #1, 4
|
|-
|0x32
|ignition coil #2, 3
|Coil #5 v6 only
|-
|0x33
|ignition coil #3, 6
|Coil #6 v6 only
|-
|0x39
|injector cylinder 1
|i4 only
|-
|0x3A
|injector cylinder 2
|i4 only
|-
|0x3B
|injector cylinder 3
|i4 only
|-
|0x3C
|injector cylinder 4
|i4 only
|-
|0x300701
|injector cylinder 1
|v6 only
|-
|0x300702
|injector cylinder 2
|v6 only
|-
|0x300704
|injector cylinder 3
|v6 only
|-
|0x300708
|injector cylinder 4
|v6 only
|-
|0x300710
|injector cylinder 5
|v6 only
|-
|0x300720
|injector cylinder 6
|v6 only
|-
|0x40
|Version Configuration
|Automatic Transaxle (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x41
|Version Configuration
|Traction Control System (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x50
|adaptive values
|0x04 - clear function
|-
|0x95
|evap leakage test
|0x06 - start function
|}
<blockquote></blockquote>

==== Routines by local identifier ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x00
|erase program section
|
|-
|0x01
|erase calibration section
|
|-
|0x02
|verify and mark blocks as ready to execute
|Needs to be called after flashing
|
|-
|0x03
|unknown
|requires security access, returned 0x33 0xE0 on a bench ecu
|-
|0x04
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x05
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x12
|query immobilizer info
|1 byte number of keys learnt, 1 bytes immo status (0x01 = learnt), 1 byte key status (0x00 not learnt), 1 byte smartra status if applicable
|
|-
|0x13
|needs to be called before immobilizer password teaching/changing
|
|-
|0x14
|needs to be called before immobilizer teaching.
|
|-
|0x15
|needs to be called before ECU immobilizer reset
|
|-
|0x16
|needs to be called before putting immobilizer in limp home mode
|
|-
|0x17
|input new limp home password
|
|-
|0x18
|activate limp home mode
|takes user-provided (default: 2345) password as parameters
|-
|0x19
|confirm limp home password change
|takes 0x01 as a parameter
|-
|0x1A
|input 6 digit immobilizer password
|Needs to be called before teaching, resetting or other actions modifying the immo system. Takes password and 6x 0xFF as parameters
|-
|0x1B, 0x1C, 0x1D, 0x1E
|teach keys 1,2,3,4
|Takes 0x01 as a parameter
|-
|0x20
|reset ECU immo.
|Takes 0x01 as a parameter
|-
|0x25
|needs to be called before neutralizing smartra
|
|-
|0x26
|confirm neutralizing smartra.
|takes 0x01 as a parameter
|}

K-Line

2025-03-17T19:14:35Z

Dmg210: /* Input-Output local identifiers */

K-Line on SIMK43 runs at 10400 baud and uses the KWP2000 protocol for diagnostic communication.

== Connection points ==

=== OBD2 ===
K-line uses the standard pin 7 on the [[Data link connector (OBD2)|OBD2 connector]]

=== ECU ===

==== If you have 1.6 or 2.0 without immobilizer installed: ====
Good news! Your K-Line pins (OBD2/MCC) are connected directly to the K-line pin on the ECU (2.0 - 77)

==== If you have 1.6 or 2.0 with immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). '''THERE IS NOTHING CONNECTED TO K-LINE PIN AT THE ECU!!''' (2.0 77). Instead, all K-line stuff is connected to the ECU's W-Line (2.0 - 47)

==== If you have 2.7 with or without immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). Your K/Immo-Line pin at the ECU (C133-1, pin 3) is connected to BCM's "Immo W-line" (BCM-IM, pin 20). 2.7 ECUs don't have a separate K and W line - it's all integrated in one pin, you don't have nothing to worry about.

== KWP2000 ==
Recommended document: [https://opengk.org/files/Users/dante383/OBDII%20Specifications%20-%20KWP2000%20DaimlerChrysler%202002.pdf OBDII Specifications - KWP2000 DaimlerChrysler 2002.pdf]

To start communication, you need to use Fast Init - so bring the K-line down for exactly 25ms, then up for 25ms followed by StartCommunication request. Python example of that using a FTDI cable [https://github.com/Dante383/gkbus/blob/a3ff894e8352ef2faab36e22553da7ddf5688cb8/gkbus/interface/kline/KLineSerial.py#L48 can be found in GKBus] code.

ID of the ECU is 0x11, and as a diagnostic device you should be using ID 0xF1. So an example command and response would look like this:

Diagnostic device: <code>82 11 F1 27 01 AC</code> (security access request)

ECU response: <code>83 F1 11 67 02 34 22</code>

==== Baudrate ====

By default, SIMK43 uses 10400 baud. On some ECUs (so far testing revealed that <2005 ECUs might not support that), baudrate can be manipulated by additional undocumented parameter of the StartDiagnosticSession service:
{| class="wikitable"
|+
!Baudrate identifier,
passed to StartDiagnosticSession
!Baudrate on K-line
(bits per second)
|-
|0x01
|10400
|-
|0x02
|20000
|-
|0x03
|40000
|-
|0x04
|60000
|-
|0x05
|120000
|}
<blockquote>
</blockquote>

==== Challenge-response calculation ====
SIMK43/41 uses a 2 byte seed and 2 byte key for security access. You can take a look at it's Python implementation in GKFlasher: https://github.com/Dante383/GKFlasher/blob/15a715b18f2119d697a5ceed00f6383f690c4a23/ecu.py#L42

The algorithm presents as so (Python):

<code>def calculate_key (seed):</code>

<code> key = 0x9360</code>

<code> </code>

<code> for index in range(0x24):</code>

<code> key = key * 2 ^ seed</code>

<code> </code>

<code> return key & 0xFFFF</code>

==== Input-Output local identifiers ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x10
|check engine light
|
|-
|0x11
|EVAP canister close valve (on)
|
|-
|0x12
|fuel pump relay
|
|-
|0x13
|a/c compressor relay
|
|-
|0x14
|fuel pump control
|
|-
|0x16
|Canister Close Valve-Lock
|
|-
|0x1A
|cooling fan relay high
|-
|0x1B
|cooling fan relay low
|
|-
|0x1C
|main relay
|
|-
|0x20
|canister purge valve
|
|-
|0x23
|idle speed actuator
|
|-
|0x24
|cvvt valve
|
|-
|0x31
|ignition coil #1, 4
|
|-
|0x32
|ignition coil #2, 3
|Coil #5 v6 only
|-
|0x33
|ignition coil #3, 6
|Coil #6 v6 only
|-
|0x39
|injector cylinder 1
|i4 only
|-
|0x3A
|injector cylinder 2
|i4 only
|-
|0x3B
|injector cylinder 3
|i4 only
|-
|0x3C
|injector cylinder 4
|i4 only
|-
|0x300701
|injector cylinder 1
|v6 only
|-
|0x300702
|injector cylinder 2
|v6 only
|-
|0x300704
|injector cylinder 3
|v6 only
|-
|0x300708
|injector cylinder 4
|v6 only
|-
|0x300710
|injector cylinder 5
|v6 only
|-
|0x300720
|injector cylinder 6
|v6 only
|-
|0x41
|Version Configuration
|Automatic Transaxle (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x42
|Version Configuration
|Traction Control System (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x50
|adaptive values
|0x04 - clear function
|-
|0x95
|evap leakage test
|0x06 - start function
|}
<blockquote></blockquote>

==== Routines by local identifier ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x00
|erase program section
|
|-
|0x01
|erase calibration section
|
|-
|0x02
|verify and mark blocks as ready to execute
|Needs to be called after flashing
|
|-
|0x03
|unknown
|requires security access, returned 0x33 0xE0 on a bench ecu
|-
|0x04
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x05
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x12
|query immobilizer info
|1 byte number of keys learnt, 1 bytes immo status (0x01 = learnt), 1 byte key status (0x00 not learnt), 1 byte smartra status if applicable
|
|-
|0x13
|needs to be called before immobilizer password teaching/changing
|
|-
|0x14
|needs to be called before immobilizer teaching.
|
|-
|0x15
|needs to be called before ECU immobilizer reset
|
|-
|0x16
|needs to be called before putting immobilizer in limp home mode
|
|-
|0x17
|input new limp home password
|
|-
|0x18
|activate limp home mode
|takes user-provided (default: 2345) password as parameters
|-
|0x19
|confirm limp home password change
|takes 0x01 as a parameter
|-
|0x1A
|input 6 digit immobilizer password
|Needs to be called before teaching, resetting or other actions modifying the immo system. Takes password and 6x 0xFF as parameters
|-
|0x1B, 0x1C, 0x1D, 0x1E
|teach keys 1,2,3,4
|Takes 0x01 as a parameter
|-
|0x20
|reset ECU immo.
|Takes 0x01 as a parameter
|-
|0x25
|needs to be called before neutralizing smartra
|
|-
|0x26
|confirm neutralizing smartra.
|takes 0x01 as a parameter
|}

K-Line

2025-03-17T19:14:05Z

Dmg210: /* Input-Output local identifiers */

K-Line on SIMK43 runs at 10400 baud and uses the KWP2000 protocol for diagnostic communication.

== Connection points ==

=== OBD2 ===
K-line uses the standard pin 7 on the [[Data link connector (OBD2)|OBD2 connector]]

=== ECU ===

==== If you have 1.6 or 2.0 without immobilizer installed: ====
Good news! Your K-Line pins (OBD2/MCC) are connected directly to the K-line pin on the ECU (2.0 - 77)

==== If you have 1.6 or 2.0 with immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). '''THERE IS NOTHING CONNECTED TO K-LINE PIN AT THE ECU!!''' (2.0 77). Instead, all K-line stuff is connected to the ECU's W-Line (2.0 - 47)

==== If you have 2.7 with or without immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). Your K/Immo-Line pin at the ECU (C133-1, pin 3) is connected to BCM's "Immo W-line" (BCM-IM, pin 20). 2.7 ECUs don't have a separate K and W line - it's all integrated in one pin, you don't have nothing to worry about.

== KWP2000 ==
Recommended document: [https://opengk.org/files/Users/dante383/OBDII%20Specifications%20-%20KWP2000%20DaimlerChrysler%202002.pdf OBDII Specifications - KWP2000 DaimlerChrysler 2002.pdf]

To start communication, you need to use Fast Init - so bring the K-line down for exactly 25ms, then up for 25ms followed by StartCommunication request. Python example of that using a FTDI cable [https://github.com/Dante383/gkbus/blob/a3ff894e8352ef2faab36e22553da7ddf5688cb8/gkbus/interface/kline/KLineSerial.py#L48 can be found in GKBus] code.

ID of the ECU is 0x11, and as a diagnostic device you should be using ID 0xF1. So an example command and response would look like this:

Diagnostic device: <code>82 11 F1 27 01 AC</code> (security access request)

ECU response: <code>83 F1 11 67 02 34 22</code>

==== Baudrate ====

By default, SIMK43 uses 10400 baud. On some ECUs (so far testing revealed that <2005 ECUs might not support that), baudrate can be manipulated by additional undocumented parameter of the StartDiagnosticSession service:
{| class="wikitable"
|+
!Baudrate identifier,
passed to StartDiagnosticSession
!Baudrate on K-line
(bits per second)
|-
|0x01
|10400
|-
|0x02
|20000
|-
|0x03
|40000
|-
|0x04
|60000
|-
|0x05
|120000
|}
<blockquote>
</blockquote>

==== Challenge-response calculation ====
SIMK43/41 uses a 2 byte seed and 2 byte key for security access. You can take a look at it's Python implementation in GKFlasher: https://github.com/Dante383/GKFlasher/blob/15a715b18f2119d697a5ceed00f6383f690c4a23/ecu.py#L42

The algorithm presents as so (Python):

<code>def calculate_key (seed):</code>

<code> key = 0x9360</code>

<code> </code>

<code> for index in range(0x24):</code>

<code> key = key * 2 ^ seed</code>

<code> </code>

<code> return key & 0xFFFF</code>

==== Input-Output local identifiers ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x10
|check engine light
|
|-
|0x11
|EVAP canister close valve (on)
|
|-
|0x12
|fuel pump relay
|
|-
|0x13
|a/c compressor relay
|
|-
|0x14
|fuel pump control
|
|-
|0x16
|Canister Close Valve-Closed
|
|-
|0x1A
|cooling fan relay high
|-
|0x1B
|cooling fan relay low
|
|-
|0x1C
|main relay
|
|-
|0x20
|canister purge valve
|
|-
|0x23
|idle speed actuator
|
|-
|0x24
|cvvt valve
|
|-
|0x31
|ignition coil #1, 4
|
|-
|0x32
|ignition coil #2, 3
|Coil #5 v6 only
|-
|0x33
|ignition coil #3, 6
|Coil #6 v6 only
|-
|0x39
|injector cylinder 1
|i4 only
|-
|0x3A
|injector cylinder 2
|i4 only
|-
|0x3B
|injector cylinder 3
|i4 only
|-
|0x3C
|injector cylinder 4
|i4 only
|-
|0x300701
|injector cylinder 1
|v6 only
|-
|0x300702
|injector cylinder 2
|v6 only
|-
|0x300704
|injector cylinder 3
|v6 only
|-
|0x300708
|injector cylinder 4
|v6 only
|-
|0x300710
|injector cylinder 5
|v6 only
|-
|0x300720
|injector cylinder 6
|v6 only
|-
|0x41
|Version Configuration
|Automatic Transaxle (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x42
|Version Configuration
|Traction Control System (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x50
|adaptive values
|0x04 - clear function
|-
|0x95
|evap leakage test
|0x06 - start function
|}
<blockquote></blockquote>

==== Routines by local identifier ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x00
|erase program section
|
|-
|0x01
|erase calibration section
|
|-
|0x02
|verify and mark blocks as ready to execute
|Needs to be called after flashing
|
|-
|0x03
|unknown
|requires security access, returned 0x33 0xE0 on a bench ecu
|-
|0x04
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x05
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x12
|query immobilizer info
|1 byte number of keys learnt, 1 bytes immo status (0x01 = learnt), 1 byte key status (0x00 not learnt), 1 byte smartra status if applicable
|
|-
|0x13
|needs to be called before immobilizer password teaching/changing
|
|-
|0x14
|needs to be called before immobilizer teaching.
|
|-
|0x15
|needs to be called before ECU immobilizer reset
|
|-
|0x16
|needs to be called before putting immobilizer in limp home mode
|
|-
|0x17
|input new limp home password
|
|-
|0x18
|activate limp home mode
|takes user-provided (default: 2345) password as parameters
|-
|0x19
|confirm limp home password change
|takes 0x01 as a parameter
|-
|0x1A
|input 6 digit immobilizer password
|Needs to be called before teaching, resetting or other actions modifying the immo system. Takes password and 6x 0xFF as parameters
|-
|0x1B, 0x1C, 0x1D, 0x1E
|teach keys 1,2,3,4
|Takes 0x01 as a parameter
|-
|0x20
|reset ECU immo.
|Takes 0x01 as a parameter
|-
|0x25
|needs to be called before neutralizing smartra
|
|-
|0x26
|confirm neutralizing smartra.
|takes 0x01 as a parameter
|}

K-Line

2025-03-17T19:13:00Z

Dmg210: /* Input-Output local identifiers */

K-Line on SIMK43 runs at 10400 baud and uses the KWP2000 protocol for diagnostic communication.

== Connection points ==

=== OBD2 ===
K-line uses the standard pin 7 on the [[Data link connector (OBD2)|OBD2 connector]]

=== ECU ===

==== If you have 1.6 or 2.0 without immobilizer installed: ====
Good news! Your K-Line pins (OBD2/MCC) are connected directly to the K-line pin on the ECU (2.0 - 77)

==== If you have 1.6 or 2.0 with immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). '''THERE IS NOTHING CONNECTED TO K-LINE PIN AT THE ECU!!''' (2.0 77). Instead, all K-line stuff is connected to the ECU's W-Line (2.0 - 47)

==== If you have 2.7 with or without immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). Your K/Immo-Line pin at the ECU (C133-1, pin 3) is connected to BCM's "Immo W-line" (BCM-IM, pin 20). 2.7 ECUs don't have a separate K and W line - it's all integrated in one pin, you don't have nothing to worry about.

== KWP2000 ==
Recommended document: [https://opengk.org/files/Users/dante383/OBDII%20Specifications%20-%20KWP2000%20DaimlerChrysler%202002.pdf OBDII Specifications - KWP2000 DaimlerChrysler 2002.pdf]

To start communication, you need to use Fast Init - so bring the K-line down for exactly 25ms, then up for 25ms followed by StartCommunication request. Python example of that using a FTDI cable [https://github.com/Dante383/gkbus/blob/a3ff894e8352ef2faab36e22553da7ddf5688cb8/gkbus/interface/kline/KLineSerial.py#L48 can be found in GKBus] code.

ID of the ECU is 0x11, and as a diagnostic device you should be using ID 0xF1. So an example command and response would look like this:

Diagnostic device: <code>82 11 F1 27 01 AC</code> (security access request)

ECU response: <code>83 F1 11 67 02 34 22</code>

==== Baudrate ====

By default, SIMK43 uses 10400 baud. On some ECUs (so far testing revealed that <2005 ECUs might not support that), baudrate can be manipulated by additional undocumented parameter of the StartDiagnosticSession service:
{| class="wikitable"
|+
!Baudrate identifier,
passed to StartDiagnosticSession
!Baudrate on K-line
(bits per second)
|-
|0x01
|10400
|-
|0x02
|20000
|-
|0x03
|40000
|-
|0x04
|60000
|-
|0x05
|120000
|}
<blockquote>
</blockquote>

==== Challenge-response calculation ====
SIMK43/41 uses a 2 byte seed and 2 byte key for security access. You can take a look at it's Python implementation in GKFlasher: https://github.com/Dante383/GKFlasher/blob/15a715b18f2119d697a5ceed00f6383f690c4a23/ecu.py#L42

The algorithm presents as so (Python):

<code>def calculate_key (seed):</code>

<code> key = 0x9360</code>

<code> </code>

<code> for index in range(0x24):</code>

<code> key = key * 2 ^ seed</code>

<code> </code>

<code> return key & 0xFFFF</code>

==== Input-Output local identifiers ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x10
|check engine light
|
|-
|0x11
|EVAP canister close valve (on)
|
|-
|0x12
|fuel pump relay
|
|-
|0x13
|a/c compressor relay
|
|-
|0x14
|fuel pump control
|
|-
|0x16
|"Canister Close Valve-Clocked" (whatever that means)
|
|-
|0x1A
|cooling fan relay high
|-
|0x1B
|cooling fan relay low
|
|-
|0x1C
|main relay
|
|-
|0x20
|canister purge valve
|
|-
|0x23
|idle speed actuator
|
|-
|0x24
|cvvt valve
|
|-
|0x31
|ignition coil #1, 4
|
|-
|0x32
|ignition coil #2, 3
|Coil #5 v6 only
|-
|0x33
|ignition coil #3, 6
|Coil #6 v6 only
|-
|0x39
|injector cylinder 1
|i4 only
|-
|0x3A
|injector cylinder 2
|i4 only
|-
|0x3B
|injector cylinder 3
|i4 only
|-
|0x3C
|injector cylinder 4
|i4 only
|-
|0x300701
|injector cylinder 1
|v6 only
|-
|0x300702
|injector cylinder 2
|v6 only
|-
|0x300704
|injector cylinder 3
|v6 only
|-
|0x300708
|injector cylinder 4
|v6 only
|-
|0x300710
|injector cylinder 5
|v6 only
|-
|0x300720
|injector cylinder 6
|v6 only
|-
|0x41
|Version Configuration
|Automatic Transaxle (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x42
|Version Configuration
|Traction Control System (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x50
|adaptive values
|0x04 - clear function
|-
|0x95
|evap leakage test
|0x06 - start function
|}
<blockquote></blockquote>

==== Routines by local identifier ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x00
|erase program section
|
|-
|0x01
|erase calibration section
|
|-
|0x02
|verify and mark blocks as ready to execute
|Needs to be called after flashing
|
|-
|0x03
|unknown
|requires security access, returned 0x33 0xE0 on a bench ecu
|-
|0x04
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x05
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x12
|query immobilizer info
|1 byte number of keys learnt, 1 bytes immo status (0x01 = learnt), 1 byte key status (0x00 not learnt), 1 byte smartra status if applicable
|
|-
|0x13
|needs to be called before immobilizer password teaching/changing
|
|-
|0x14
|needs to be called before immobilizer teaching.
|
|-
|0x15
|needs to be called before ECU immobilizer reset
|
|-
|0x16
|needs to be called before putting immobilizer in limp home mode
|
|-
|0x17
|input new limp home password
|
|-
|0x18
|activate limp home mode
|takes user-provided (default: 2345) password as parameters
|-
|0x19
|confirm limp home password change
|takes 0x01 as a parameter
|-
|0x1A
|input 6 digit immobilizer password
|Needs to be called before teaching, resetting or other actions modifying the immo system. Takes password and 6x 0xFF as parameters
|-
|0x1B, 0x1C, 0x1D, 0x1E
|teach keys 1,2,3,4
|Takes 0x01 as a parameter
|-
|0x20
|reset ECU immo.
|Takes 0x01 as a parameter
|-
|0x25
|needs to be called before neutralizing smartra
|
|-
|0x26
|confirm neutralizing smartra.
|takes 0x01 as a parameter
|}

K-Line

2025-03-17T19:03:12Z

Dmg210: /* Input-Output local identifiers */

K-Line on SIMK43 runs at 10400 baud and uses the KWP2000 protocol for diagnostic communication.

== Connection points ==

=== OBD2 ===
K-line uses the standard pin 7 on the [[Data link connector (OBD2)|OBD2 connector]]

=== ECU ===

==== If you have 1.6 or 2.0 without immobilizer installed: ====
Good news! Your K-Line pins (OBD2/MCC) are connected directly to the K-line pin on the ECU (2.0 - 77)

==== If you have 1.6 or 2.0 with immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). '''THERE IS NOTHING CONNECTED TO K-LINE PIN AT THE ECU!!''' (2.0 77). Instead, all K-line stuff is connected to the ECU's W-Line (2.0 - 47)

==== If you have 2.7 with or without immobilizer installed: ====
Your K-Line pins (OBD2/MCC) are connected to BCM's "Diagnosis" pin (BCM-IM, pin 19). Your K/Immo-Line pin at the ECU (C133-1, pin 3) is connected to BCM's "Immo W-line" (BCM-IM, pin 20). 2.7 ECUs don't have a separate K and W line - it's all integrated in one pin, you don't have nothing to worry about.

== KWP2000 ==
Recommended document: [https://opengk.org/files/Users/dante383/OBDII%20Specifications%20-%20KWP2000%20DaimlerChrysler%202002.pdf OBDII Specifications - KWP2000 DaimlerChrysler 2002.pdf]

To start communication, you need to use Fast Init - so bring the K-line down for exactly 25ms, then up for 25ms followed by StartCommunication request. Python example of that using a FTDI cable [https://github.com/Dante383/gkbus/blob/a3ff894e8352ef2faab36e22553da7ddf5688cb8/gkbus/interface/kline/KLineSerial.py#L48 can be found in GKBus] code.

ID of the ECU is 0x11, and as a diagnostic device you should be using ID 0xF1. So an example command and response would look like this:

Diagnostic device: <code>82 11 F1 27 01 AC</code> (security access request)

ECU response: <code>83 F1 11 67 02 34 22</code>

==== Baudrate ====

By default, SIMK43 uses 10400 baud. On some ECUs (so far testing revealed that <2005 ECUs might not support that), baudrate can be manipulated by additional undocumented parameter of the StartDiagnosticSession service:
{| class="wikitable"
|+
!Baudrate identifier,
passed to StartDiagnosticSession
!Baudrate on K-line
(bits per second)
|-
|0x01
|10400
|-
|0x02
|20000
|-
|0x03
|40000
|-
|0x04
|60000
|-
|0x05
|120000
|}
<blockquote>
</blockquote>

==== Challenge-response calculation ====
SIMK43/41 uses a 2 byte seed and 2 byte key for security access. You can take a look at it's Python implementation in GKFlasher: https://github.com/Dante383/GKFlasher/blob/15a715b18f2119d697a5ceed00f6383f690c4a23/ecu.py#L42

The algorithm presents as so (Python):

<code>def calculate_key (seed):</code>

<code> key = 0x9360</code>

<code> </code>

<code> for index in range(0x24):</code>

<code> key = key * 2 ^ seed</code>

<code> </code>

<code> return key & 0xFFFF</code>

==== Input-Output local identifiers ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x10
|check engine light
|
|-
|0x11
|EVAP canister close valve (on)
|
|-
|0x12
|fuel pump relay
|
|-
|0x13
|a/c compressor relay
|
|-
|0x14
|fuel pump control
|
|-
|0x16
|"Canister Close Valve-Clocked" (whatever that means)
|
|-
|0x1A
|cooling fan relay high
|-
|0x1B
|cooling fan relay low
|
|-
|0x1C
|main relay
|
|-
|0x20
|canister purge valve
|
|-
|0x23
|idle speed actuator
|
|-
|0x24
|cvvt valve
|
|-
|0x31
|ignition coil #1, 4
|
|-
|0x32
|ignition coil #2, 3
|Coil #5 v6 only
|-
|0x33
|ignition coil #3, 6
|Coil #6 v6 only
|-
|0x39
|injector cylinder 1
|i4 only
|-
|0x3A
|injector cylinder 2
|i4 only
|-
|0x3B
|injector cylinder 3
|i4 only
|-
|0x3C
|injector cylinder 4
|i4 only
|-
|0x300701
|injector cylinder 1
|v6 only
|-
|0x300702
|injector cylinder 2
|v6 only
|-
|0x300704
|injector cylinder 3
|v6 only
|-
|0x300708
|injector cylinder 4
|v6 only
|-
|0x300710
|injector cylinder 5
|v6 only
|-
|0x300720
|injector cylinder 6
|v6 only
|-
|0x41
|Version Configuration
|Automatic Transaxle (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x42
|Version Configuration
|Traction Control System (0x08) - This is the ECU reset function to install M/T or Non-TCS system.
|-
|0x50
|adaptive values
|0x04 - clear function
|}
<blockquote></blockquote>

==== Routines by local identifier ====
{| class="wikitable"
|+
!Identifier (hex)
!Description
!Notes
|-
|0x00
|erase program section
|
|-
|0x01
|erase calibration section
|
|-
|0x02
|verify and mark blocks as ready to execute
|Needs to be called after flashing
|
|-
|0x03
|unknown
|requires security access, returned 0x33 0xE0 on a bench ecu
|-
|0x04
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x05
|unknown
|returns 0x22 Conditions Not Correct Or Request Sequence Error
|
|-
|0x12
|query immobilizer info
|1 byte number of keys learnt, 1 bytes immo status (0x01 = learnt), 1 byte key status (0x00 not learnt), 1 byte smartra status if applicable
|
|-
|0x13
|needs to be called before immobilizer password teaching/changing
|
|-
|0x14
|needs to be called before immobilizer teaching.
|
|-
|0x15
|needs to be called before ECU immobilizer reset
|
|-
|0x16
|needs to be called before putting immobilizer in limp home mode
|
|-
|0x17
|input new limp home password
|
|-
|0x18
|activate limp home mode
|takes user-provided (default: 2345) password as parameters
|-
|0x19
|confirm limp home password change
|takes 0x01 as a parameter
|-
|0x1A
|input 6 digit immobilizer password
|Needs to be called before teaching, resetting or other actions modifying the immo system. Takes password and 6x 0xFF as parameters
|-
|0x1B, 0x1C, 0x1D, 0x1E
|teach keys 1,2,3,4
|Takes 0x01 as a parameter
|-
|0x20
|reset ECU immo.
|Takes 0x01 as a parameter
|-
|0x25
|needs to be called before neutralizing smartra
|
|-
|0x26
|confirm neutralizing smartra.
|takes 0x01 as a parameter
|}

GKFlasher Instructions

2025-02-21T12:49:39Z

Dmg210:

<div style="float:right">__TOC__</div>
GKFlasher is an open source Python project supported by OpenGK, written by dante383 and dmg210. This project is a multi OBD2 tool for the Siemens ECUs found on the Hyundai and Kia vehicles. It can read & write tune data, correct EEPROM checksums and clear adaptive values from your ECU.

== MSI Install Package ==
We have precompiled MSI install packages available from the GitHub releases page:

https://github.com/Dante383/GKFlasher/releases

=== Prerequisites ===
'''1)''' First you will need a FTDI USB-OBD2 interface cable. This is often the same cable used on German vehicles. The chipset on the board must be a real FTDI chip and cannot be one of the CH340C chips. Through extensive testing we found that the following cable is the least expensive and most reliable cable for GKFlasher:

[https://www.aliexpress.us/item/2251832612703671.html Galletto 1260 ECU Chip Tuning Tool EOBD Programmer FTDI] Note: These adapters are not currently supported with BSL.

Pictured here shows the good FTDI chipset and the CH340C chipsets.

[[File:FTDI Example.png|269x269px]]:[[File:CH340C Example.png]]

<nowiki>*</nowiki>from GKFlasher v1.0.5 we have added support for the CH340 chipset.

== Manual Windows 10 & 11 Installation ==
If you'd like to participate in the development of GKFlasher the guide below will demonstrate how to download, install and configure all the prerequisites for GKFlasher. If you are a GitHub user, please go star the following repository:

https://github.com/Dante383/GKFlasher

'''1)''' Download the following files:

[https://github.com/git-for-windows/git/releases/download/v2.44.0.windows.1/Git-2.44.0-64-bit.exe Git-2.44.0-64-bit.exe]

[https://www.python.org/ftp/python/3.11.9/python-3.11.9-amd64.exe python-3.11.9-amd64.exe]

''Optional download for npcap if you are using a CAN BUS interface for a specific purpose:''

[https://npcap.com/dist/npcap-1.79.exe npcap-1.79.exe]

=== Install GIT & Python ===
'''3)''' Open the Git install file named Git-2.44.0-64-bit.exe selecting "Git from the command line" from the following screen, then continue with all the default options afterwards:

[[File:Git Install 1.png|border]]

'''4)''' Open the Python installation file named python-3.11.9-amd64.exe and on the first dialogue select "Add python.exe to PATH"

[[File:Python Install 1.png]]

Keep all the default values on the following screen:

[[File:Python Install 2.png]]

Select "Install Pyhon 3.11 for all users" from the following screen: '''"Add Python to environment variables" has to be selected!'''

[[File:Python Install 3.png]]

'''5)''' Once installation is complete you may need to logout of windows or restart your computer before the Powershell will recognize the new PATH entries for GIT and Python. To test if either program works, try the following commands after the '''>''' symbol in Windows Powershell and you should see the following responses if all is well. If you do not see these responses or receive a "ObjectNotFound" type of error, then try the above installations again.
PS C:\Users\cfham> '''python -V'''
Python 3.11.9

PS C:\Users\cfham> '''git.exe -v'''
git version 2.44.0.windows.1

=== NPCAP Install (Optional) ===
'''1)''' If you are using CANBUS for your read/write functions, open and install the file named npcap-1.79.exe using default options.

=== GKFlasher Setup ===
'''1)''' Open your Powershell or Command prompt and change to the desired directory where you will be installing the GKFlasher files. A typical example directory might be in C:\GIT Repos\ so create yourself a directory in the C:\ drive named "GIT Repos" for this example. Use the following commands after the '''>''' symbol:
PS C:\Users\cfham> '''mkdir "C:\GIT Repos"'''

Directory: C:\

Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 4/6/2024 7:10 PM GIT Repos
'''2)''' Change to the "GIT Repos" directory and run the GIT command to download the GKFlasher files to your desired directory using the following command after the '''>''' symbol:
PS C:\Users\cfham> '''cd "C:\GIT Repos"'''

PS C:\GIT Repos> '''git clone <nowiki>https://github.com/Dante383/GKFlasher</nowiki>'''
Cloning into 'GKFlasher'...
remote: Enumerating objects: 1071, done.
remote: Counting objects: 100% (117/117), done.
remote: Compressing objects: 100% (69/69), done.
remote: Total 1071 (delta 58), reused 96 (delta 48), pack-reused 954
Receiving objects: 100% (1071/1071), 446.77 KiB | 7.45 MiB/s, done.
Resolving deltas: 100% (672/672), done.
'''3)''' Change to the GKFlasher directory then install the required Python packages with the following commands after the '''>''' symbol:
PS C:\GIT Repos> '''cd GKFlasher'''

PS C:\GIT Repos\GKFlasher> '''python -m pip install -r requirements.txt'''
Requirement already satisfied: alive_progress==3.1.5 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 1)) (3.1.5)
Requirement already satisfied: crcmod==1.7 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 2)) (1.7)
Requirement already satisfied: gkbus==0.1.8 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 3)) (0.1.8)
Requirement already satisfied: pyftdi==0.55.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 4)) (0.55.0)
Requirement already satisfied: pyqt5==5.15.9 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 5)) (5.15.9)
Requirement already satisfied: PyYAML==6.0.1 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 6)) (6.0.1)
Requirement already satisfied: about-time==4.2.1 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from alive_progress==3.1.5->-r requirements.txt (line 1)) (4.2.1)
Requirement already satisfied: grapheme==0.6.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from alive_progress==3.1.5->-r requirements.txt (line 1)) (0.6.0)
Requirement already satisfied: pyserial==3.5 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from gkbus==0.1.8->-r requirements.txt (line 3)) (3.5)
Requirement already satisfied: scapy==2.5.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from gkbus==0.1.8->-r requirements.txt (line 3)) (2.5.0)
Requirement already satisfied: pyusb!=1.2.0,>=1.0.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from pyftdi==0.55.0->-r requirements.txt (line 4)) (1.2.1)
Requirement already satisfied: PyQt5-sip<13,>=12.11 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from pyqt5==5.15.9->-r requirements.txt (line 5)) (12.13.0)
Requirement already satisfied: PyQt5-Qt5>=5.15.2 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from pyqt5==5.15.9->-r requirements.txt (line 5)) (5.15.2)
'''4)''' If everything went well you should now be able to start the GKFlasher GUI with the USB cable plugged in. Try the following command and you should see the GKFlasher window appear:
PS C:\GIT Repos\GKFlasher> '''python gui.py'''
[[File:GKFlasher First Time.png|701x701px]]

'''5) Optional:''' Create a desktop shortcut to open GKFlasher easily. First we'll need to know the location of your python3.11.exe executable. Execute the following command from your Powershell or command prompt and enter the command after the '''>''' symbol. The following line you will use to copy/paste into your desktop shortcut. In this example it is located in my local user's directory within a subfolder. Yours will vary depending on your username.
PS C:\GIT Repos\GKFlasher> '''(Get-Command python.exe).Path'''
C:\Users\cfham\AppData\Local\Microsoft\WindowsApps\python.exe
Right click on your desktop and go to "New" and "Shortcut", then paste the line you found from the last Powershell command and click next:

[[File:GKFlasher Desktop Shortcut 1.png]]

[[File:GKFlasher Desktop Shortcut 2.png|border]]

Type in "GKFlasher" into the next window and press Finish:

[[File:GKFlasher Desktop Shortcut 3.png|border]]

Now right click on that new shortcut and select properties. You will change a couple of settings in this new window so that it starts the GKFlasher app and change to the correct starting directory. First add " gui.py" (Contains a space) to the end of the target prompt and copy/paste the directory location you chose for your GIT Repos containing GKFlasher and press apply. The following is using my example directory. Yours may be unique.

[[File:GKFlasher Desktop Shortcut 4.png|border]]

If you would like to add an icon to your shortcut, you can download the OpenGK/GKFlasher logo from [https://opengk.org/files/Users/chase206/Siemens_T_Logo.ico Siemens_T_Logo.ico] and add it to your GKFLasher shortcut using the "Change Icon" button.

2.0L ECM

2025-01-05T16:33:35Z

Dmg210: /* SIMK43 - 8mbit */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==
Both units memory can be separated into 5 sections:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 50000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 5FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 2
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|87FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | 8FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 1
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32 kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - INT_RAM [15872]
* 0xFD00 - INT_RAM_BIT [256]
* 0xFF800 - RAM [2048]
* 0xCA4E - CCP Seed/key e.g. DEET (within RAM)
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block for CCP within bootloader 2
* 0x3000000 - FLASH_DR [65520]

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.

2.0L ECM

2025-01-05T16:30:58Z

Dmg210: /* SIMK43 - 8mbit */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==
Both units memory can be separated into 5 sections:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | FFFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 50000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 5FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 2
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|5FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 1
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32 kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - INT_RAM [15872]
* 0xFD00 - INT_RAM_BIT [256]
* 0xFF800 - RAM [2048]
* 0xCA4E - CCP Seed/key e.g. DEET (within RAM)
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block for CCP within bootloader 2
* 0x3000000 - FLASH_DR [65520]

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.

2.0L ECM

2025-01-05T16:26:14Z

Dmg210: /* SIMK43 - 8mbit */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==
Both units memory can be separated into 5 sections:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | C000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 50000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 2
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|5FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone 1
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32 kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - INT_RAM [15872]
* 0xFD00 - INT_RAM_BIT [256]
* 0xFF800 - RAM [2048]
* 0xCA4E - CCP Seed/key e.g. DEET (within RAM)
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block for CCP within bootloader 2
* 0x3000000 - FLASH_DR [65520]

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.

2.0L ECM

2025-01-05T16:23:03Z

Dmg210: /* Bootloader 2 (32 kByte) */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==
Both units memory can be separated into 5 sections:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|5FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32 kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - INT_RAM [15872]
* 0xFD00 - INT_RAM_BIT [256]
* 0xFF800 - RAM [2048]
* 0xCA4E - CCP Seed/key e.g. DEET (within RAM)
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block for CCP within bootloader 2
* 0x3000000 - FLASH_DR [65520]

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.

2.0L ECM

2025-01-05T16:00:04Z

Dmg210: /* Bootloader 2 (32 kByte) */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==
Both units memory can be separated into 5 sections:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|5FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32 kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - INT_RAM [15872]
* 0xFD00 - INT_RAM_BIT [256]
* 0xFF800 - RAM [2048]
* 0x50000 - RAMCAL1 [65520]
* 0x90000 - ROM [65520]
* 0xCA4E - CCP Seed/key e.g. DEET (within RAM)
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block for CCP within bootloader 2

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.

2.0L ECM

2024-12-28T17:34:31Z

Dmg210: /* Bootloader 2 (32kByte) */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==
Both units memory can be separated into 5 sections:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|5FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32 kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - bootloader 2 version e.g. 66340560
* 0xCA4E - CCP Seed/key e.g. DEET
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.

2.0L ECM

2024-12-28T17:34:03Z

Dmg210: /* Bootloader 2 (32kByte) */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==
Both units memory can be separated into 5 sections:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|5FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

ca663056 locations:

* 0xC000 - bootloader 2 version e.g. 66340560
* 0xCA4E - CCP Seed/key e.g. DEET
* 0xEE00 - CCP Registers

ca663057/58+:

* 32kb data block

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.

MediaWiki:Sidebar

2024-12-28T15:22:35Z

Dmg210:

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
* Siemens L4 2.0L
** 5WY_ECM_Identification#Siemens_5WY_2_Connector_.282.0L_L4.29 | ECM Identification
** 2.0L_PCB_Layouts | 2.0L PCB Layouts
** Siemens_5WY_2_Connector_Pinout | 2.0L L4 Pinout
** 2.0L_ECM | 2.0L ECM
** CAN_Bus_messages | CAN Bus
* Siemens V6 2.7L
** 5WY_ECM_Identification#Siemens_5WY_5_Connector_.282.7L_V6.29 | ECM Identification
** 2.7L_V6_PCB_Layouts | 2.7L PCB Layouts
** Siemens_5WY_5_Connector_Pinout | 2.7L V6 Pinout
* Downloads
** https://opengk.org/files/ | File Repository
* SEARCH
* TOOLBOX
* LANGUAGES

2.0L ECM

2024-12-28T14:14:01Z

Dmg210:

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==
Both units memory can be separated into 5 sections:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 8000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|5FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#bfbdbf;" | 88000
| style="text-align: center; background-color:#bfbdbf;" | FFFF
| style="text-align: center; background-color:#bfbdbf;" | Bootloader 2
| style="text-align: center; background-color:#bfbdbf;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Bootloader 2 (32kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs or SIMK43's running less than ca663056.

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" refers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine.

2.0L ECM

2024-12-28T12:49:46Z

Dmg210: /* Memory layouts per ECU */

Vehicles equipped with the 2.0L Beta used the 2mbit SIMK41 up until the first [[Hyundai Tiburon|facelift model]] (2005), when CVVT was introduced and 4mbit SIMK43 was used.

== Memory layout ==
Both units memory can be separated into 5 sections:

* bootloader & UIF
* adaptive values
* calibration zone
* program code

=== Memory layouts per ECU ===

==== SIMK41 - 2mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 8000
| style="text-align: center; background-color:#9aff99; color:#000000;" | FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 10000
| style="text-align: center; background-color:#fffc9e;" | 3FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 192 kByte
|}

==== SIMK43 - 4mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 8000
| style="text-align: center; background-color:#fffc9e;" | FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 10000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 20000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

==== SIMK43 - 8mbit ====
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 0
| style="text-align: center; background-color:#fe996b;" | 3FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 1
| style="text-align: center; background-color:#fe996b;" | 16 kByte
|-
| style="text-align: center; background-color:#ff9797;" | 4000
| style="text-align: center; background-color:#ff9797;" | 7FFF
| style="text-align: center; background-color:#ff9797;" | Adaptive values
| style="text-align: center; background-color:#ff9797;" | 16 kByte
|-
| style="text-align: center; background-color:#aadae3;"|82000
| style="text-align: center; background-color:#aadae3;"|5FFF
| style="text-align: center; background-color:#aadae3;"|Recovery (RSW)
| style="text-align: center; background-color:#aadae3;"|24 kByte
|-
| style="text-align: center; background-color:#fe996b;" | 88000
| style="text-align: center; background-color:#fe996b;" | FFFF
| style="text-align: center; background-color:#fe996b;" | Bootloader 2
| style="text-align: center; background-color:#fe996b;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 90000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 1FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Calibration Zone
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | A0000
| style="text-align: center; background-color:#fffc9e;" | 7FFFF
| style="text-align: center; background-color:#fffc9e;" | Program Code
| style="text-align: center; background-color:#fffc9e;" | 384 kByte
|}

=== Description of memory sections ===

==== Bootloader & UIF ====
This section is 16 kilobytes in size and contains the boot code that initializes the ECU and verifies that everything is ok before control is handed over to the program code section.
This section also contains one time writeable data such as hardware identifier, manufacturer information and user information fields (UIF).

Offsets and data structure in the table below are shared across all variants.
{| class="wikitable"
|+
!Name
!Offset
!Size (bytes, decimal)
!Example
!Notes
|-
|[[K-Line|KWP seed/key]]
|0x3E01
|4
|
{{HexConverter|hex=58D8C848}}
|Two bytes seed, followed by two bytes key
|-
|[[Vehicle identification number (VIN)|VIN]]
|0x3E22
|17
|
|2.0 ECUs don't store VIN. Instead, sometimes there's a [[Vehicle identification number (VIN)|wildcard that narrows the VIN down to Tiburon models]], sometimes it's just 'xxxxxxxxxxxxxxxxx'
|-
|Socket
|0x3F70
|2
|
{{HexConverter|hex=0x5539|default-display=ascii}}
|Value from the small sticker usually located on the ECU socket. [[:File:Socket label example SIMK43 U9 5WY1923A.png|Click for example with "U9" label]]
|-
|[[ECU family]]
|0x3F80
|8
|
{{HexConverter|hex=0x3557593139323341|default-display=ascii}}
|In short - ECU hardware variant from the main label. For more in-depth analysis, see [[ECU family]]
|-
|Serial number
|0x3F8A
|50
|
{{HexConverter|hex=0x2D313038313033363236322D484D4330383033313030363039323931384B523737303237363034422D4B5237373032353036|default-display=ascii}}
|This actually contains three separate (not all unique) identifiers and will be split into three sections - TODO.
|-
|Date (YYMMDD)
|0x3F98
|6
|
{{HexConverter|hex=0x303830333130|default-display=ascii}}
(2008, March 31st)
|Production/first flash date. This '''might'''/should be updated after flashing, might be updated after flashing with an official dealer tool - to be verified.
|}

==== Adaptive values ====
This section potentially acts as RAM? It also stores adaptive values - short/long range fuel trims and other adjustments. This section has not been analyzed in depth yet, but there's a high possibility the data inside is [https://github.com/Dante383/siemens-simk43-decrypt scrambled (crossed EEPROM lines, resulting in swapped bits in every pair of bytes)]

==== Program code (32kByte) ====
This section has not been analyzed in depth yet. It's not present on SIMK41 ECUs

==== Calibration zone ====
Calibration zone contains all the calibration data and maps used for managing the engine.

Position and structure varies depending on the calibration version, but the structure of first 96 (0x60) bytes is standarized.

"start" reefers to the calibration zone offset (SIMK41 - 0x8000, SIMK43 - 0x10000)
{| class="wikitable"
|+
!Name
!Offset
!Size
!Example
!Notes
|-
|Chassis identifier
|start
|8
|
{{HexConverter|hex=0x4B394E3756533041|default-display=ascii}}
|Siemens calls it "calibration version" (confusing, I know)
|-
|Calibration version (#1 occurence)
|start + 0x8
|6
|
{{HexConverter|hex=0x363535303239|default-display=ascii}}
|
|-
|Calibration [[Checksum|checksum initial value]]
|start + 0xC
|2
|
{{HexConverter|hex=0x3239}}
|Overlap of offsets isn't a typo here - last two digits of the first occurence of calibration version are also the [[Checksum|initial value for the calibration zone checksum]]
|-
|Calibration version
(#2 occurence)
|start + 0x40
|12
|
{{HexConverter|hex=0x63613635353032392E444154|default-display=ascii}}
|Siemens calls it "description identifier".
Notice the "ca" prefix and ".DAT" suffix - this is likely the filename from proprietary OEM software that was used to compile the EEPROM image.
'''While not confirmed''', it appears that lowercase 'ca' suffix was used through the SIMK4x series, with uppercase 'CA' first appearing in SIM2K series
|}

==== Program code ====
This section contains the program code used for operating the engine

MediaWiki:Sidebar

2024-12-28T12:20:57Z

Dmg210:

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
* Siemens L4 2.0L
** 5WY_ECM_Identification#Siemens_5WY_2_Connector_.282.0L_L4.29 | ECM Identification
** CAN_Bus_messages | CAN Bus
** 2.0L_PCB_Layouts | 2.0L PCB Layouts
** Siemens_5WY_2_Connector_Pinout | 2.0L L4 Pinout
** 2.0L_ECM | 2.0L ECM
* Siemens V6 2.7L
** 5WY_ECM_Identification#Siemens_5WY_5_Connector_.282.7L_V6.29 | ECM Identification
** 2.7L_V6_PCB_Layouts | 2.7L PCB Layouts
** Siemens_5WY_5_Connector_Pinout | 2.7L V6 Pinout
* Downloads
** https://opengk.org/files/ | File Repository
* SEARCH
* TOOLBOX
* LANGUAGES

MediaWiki:Sidebar

2024-12-28T12:20:27Z

Dmg210:

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
* Siemens L4 2.0L
** 5WY_ECM_Identification#Siemens_5WY_2_Connector_.282.0L_L4.29 | ECM Identification
** CAN_Bus_messages | CAN Bus
** 2.0L_PCB_Layouts | 2.0L PCB Layouts
** Siemens_5WY_2_Connector_Pinout | 2.0L L4 Pinout
** 2.0L_ECM | 2.0L ECM
* Siemens V6 2.7L Hardware
** 5WY_ECM_Identification#Siemens_5WY_5_Connector_.282.7L_V6.29 | ECM Identification
** 2.7L_V6_PCB_Layouts | 2.7L PCB Layouts
** Siemens_5WY_5_Connector_Pinout | 2.7L V6 Pinout
* Downloads
** https://opengk.org/files/ | File Repository
* SEARCH
* TOOLBOX
* LANGUAGES

Main Page

2024-12-28T12:19:27Z

Dmg210: /* General */

<div style="float:right">__TOC__</div>
'''Welcome to the OpenGK Wiki'''
[[File:Siemens T Logo.gif|frameless|right]]
[[File:Discord-Logo+Wordmark-Color.png|150px|frameless|right|link=https://discord.gg/a4fWuBTfxV]]
Our goal is to open source the Hyundai/Kia Siemens ECMs on the Beta and Delta motors to provide tuning options to the DIY enthusiasts. This project originally started for the [[Hyundai Tiburon|Hyundai Coupe/Tuscani/Tiburon platform]] but as we collected more data from other platforms with similar ECMs, it was clear that those other platforms can be supported using the same principals.

We are looking for smart individuals that have experience with IDA Pro and disassembly that are willing to help push this project further. Please contact '''info(at)opengk.org''' or join our Discord if you would like to contribute to this project.

If you are a tuner and found this site to be useful, please consider a donation to Paypal: '''donate(at)opengk.org''' to help keep the site alive.

==== General ====
[https://vin.opengk.org VIN Decoder]
 
[[Hyundai Tiburon]]
 
[[Vehicle identification number (VIN)]]
 
[[Data link connector (OBD2)]]
 
[[Immobiliser]]
 
[[SMARTRA|Smartra]]
 
[[Body Control Module]]
 
[[Instrument Cluster]]
 
==== Communication protocols ====
[[K-Line]]
 
[[SIMK43 CAN Bus|CAN Bus messages]]
 
==== ECM Tuning ====
[[GKFlasher Instructions]]
 
[[Cross Flash Kia Spectra|Cross-Flash Kia Spectra > Tiburon Firmware]]
 
==== Siemens L4 2.0L Hardware ====
[[5WY ECM Identification#Siemens 5WY 2 Connector .282.0L L4.29| ECM Identification]]
 
[[2.0l PCB Layouts| 2.0L PCB Layouts]]
 
[[Siemens 5WY 2 Connector Pinout| 2.0L L4 Pinout]] 
[[2.0L ECM]]
 

==== Siemens V6 2.7L Hardware ====
[[5WY ECM Identification#Siemens 5WY 5 Connector .282.7L V6.29|ECM Identification]]
 
[[2.7L V6 PCB Layouts]]
 
[[Siemens 5WY 5 Connector Pinout| 2.7L V6 Pinout]]
 

==== Parts Compatibility ====
[[Sensor Information]]
 
[[Fuel Injector Specifications]]
 
[[Camshaft Specifications]]
 
[[Bosch Chip Part Numbers]]

==== Downloads ====
[https://opengk.org/files/ File Repository]

Main Page

2024-12-28T12:12:36Z

Dmg210:

<div style="float:right">__TOC__</div>
'''Welcome to the OpenGK Wiki'''
[[File:Siemens T Logo.gif|frameless|right]]
[[File:Discord-Logo+Wordmark-Color.png|150px|frameless|right|link=https://discord.gg/a4fWuBTfxV]]
Our goal is to open source the Hyundai/Kia Siemens ECMs on the Beta and Delta motors to provide tuning options to the DIY enthusiasts. This project originally started for the [[Hyundai Tiburon|Hyundai Coupe/Tuscani/Tiburon platform]] but as we collected more data from other platforms with similar ECMs, it was clear that those other platforms can be supported using the same principals.

We are looking for smart individuals that have experience with IDA Pro and disassembly that are willing to help push this project further. Please contact '''info(at)opengk.org''' or join our Discord if you would like to contribute to this project.

If you are a tuner and found this site to be useful, please consider a donation to Paypal: '''donate(at)opengk.org''' to help keep the site alive.

==== General ====
[https://vin.opengk.org VIN Decoder]
 
[[Hyundai Tiburon]]
 
[[Vehicle identification number (VIN)]]
 
[[Data link connector (OBD2)]]
 
[[Immobiliser]]
 
[[Body Control Module]]
 
[[Instrument Cluster]]

==== Communication protocols ====
[[K-Line]]
 
[[SIMK43 CAN Bus|CAN Bus messages]]

==== ECM Tuning ====
[[GKFlasher Instructions]]
 
[[Cross Flash Kia Spectra|Cross-Flash Kia Spectra > Tiburon Firmware]]

==== Siemens L4 2.0L Hardware ====
[[5WY ECM Identification#Siemens 5WY 2 Connector .282.0L L4.29| ECM Identification]] 
[[2.0l PCB Layouts| 2.0L PCB Layouts]] 
[[Siemens 5WY 2 Connector Pinout| 2.0L L4 Pinout]] 
[[2.0L ECM]] 

==== Siemens V6 2.7L Hardware ====
[[5WY ECM Identification#Siemens 5WY 5 Connector .282.7L V6.29|ECM Identification]] [[2.7L V6 PCB Layouts]] 
[[Siemens 5WY 5 Connector Pinout| 2.7L V6 Pinout]] 

==== Parts Compatibility ====
[[Sensor Information]]
 
[[Fuel Injector Specifications]]
 
[[Camshaft Specifications]]
 
[[Bosch Chip Part Numbers]]

==== Downloads ====
[https://opengk.org/files/ File Repository]

MediaWiki:Sidebar

2024-12-28T12:10:50Z

Dmg210:

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
* Siemens L4 2.0L Hardware
** 5WY_ECM_Identification#Siemens_5WY_2_Connector_.282.0L_L4.29 | ECM Identification
** CAN_Bus_messages | CAN Bus
** 2.0L_PCB_Layouts | 2.0L PCB Layouts
** Siemens_5WY_2_Connector_Pinout | 2.0L L4 Pinout
** 2.0L_ECM | 2.0L ECM
* Siemens V6 2.7L Hardware
** 5WY_ECM_Identification#Siemens_5WY_5_Connector_.282.7L_V6.29 | ECM Identification
** 2.7L_V6_PCB_Layouts | 2.7L PCB Layouts
** Siemens_5WY_5_Connector_Pinout | 2.7L V6 Pinout
* Downloads
** https://opengk.org/files/ | File Repository
* SEARCH
* TOOLBOX
* LANGUAGES

Main Page

2024-12-28T12:01:01Z

Dmg210: /* ECM Tuning: */

<div style="float:right">__TOC__</div>
'''Welcome to the OpenGK Wiki'''
[[File:Siemens T Logo.gif|frameless|right]]
[[File:Discord-Logo+Wordmark-Color.png|150px|frameless|right|link=https://discord.gg/a4fWuBTfxV]]
Our goal is to open source the Hyundai/Kia Siemens ECMs on the Beta and Delta motors to provide tuning options to the DIY enthusiasts. This project originally started for the [[Hyundai Tiburon|Hyundai Coupe/Tuscani/Tiburon platform]] but as we collected more data from other platforms with similar ECMs, it was clear that those other platforms can be supported using the same principals.

We are looking for smart individuals that have experience with IDA Pro and disassembly that are willing to help push this project further. Please contact '''info(at)opengk.org''' or join our Discord if you would like to contribute to this project.

If you are a tuner and found this site to be useful, please consider a donation to Paypal: '''donate(at)opengk.org''' to help keep the site alive.

==== General ====
[https://vin.opengk.org VIN Decoder]

[[Hyundai Tiburon]]

[[Vehicle identification number (VIN)]]

[[Data link connector (OBD2)]]

[[Immobiliser]]

[[Body Control Module]]

[[Instrument Cluster]]

==== Communication protocols ====
[[K-Line]]

[[SIMK43 CAN Bus|CAN Bus messages]]

==== ECM Tuning ====
[[GKFlasher Instructions]]

[[Cross Flash Kia Spectra|Cross-Flash Kia Spectra > Tiburon Firmware]]

==== Siemens L4 2.0L Hardware ====
[[5WY ECM Identification#Siemens 5WY 2 Connector .282.0L L4.29| ECM Identification]] 
[[2.0l PCB Layouts| 2.0L PCB Layouts]] 
[[Siemens 5WY 2 Connector Pinout| 2.0L L4 Pinout]] 
[[2.0L ECM]] 

==== Siemens V6 2.7L Hardware ====
[[5WY ECM Identification#Siemens 5WY 5 Connector .282.7L V6.29|ECM Identification]] [[2.7L V6 PCB Layouts]] 
[[Siemens 5WY 5 Connector Pinout| 2.7L V6 Pinout]] 

==== Parts Compatibility ====
[[Sensor Information]]
 
[[Fuel Injector Specifications]]
 
[[Camshaft Specifications]]
 
[[Bosch Chip Part Numbers]]

==== Downloads ====
[https://opengk.org/files/ File Repository]

Cross Flash Kia Spectra

2024-12-19T12:13:08Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.
[[File:Kia crossflash cal.png|thumb]]
[[File:Kia crossflash prog.png|thumb]]
In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
Once the version detials have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

You may need to re-program the Immobilizer running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'

Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.
[[File:Kia crossflash gui.png|thumb]]

File:Kia crossflash gui.png

2024-12-19T12:13:00Z

Dmg210:

kia_crossflash_gui

File:Kia crossflash prog.png

2024-12-19T12:11:59Z

Dmg210:

kia_crossflash_prog

File:Kia crossflash cal.png

2024-12-19T12:10:53Z

Dmg210:

kia_crossflash_cal

Cross Flash Kia Spectra

2024-12-19T12:05:00Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.

In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
[[File:Kia crossflash 3.png|thumb]]
Once the version detials have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

You may need to re-program the Immobilizer running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'

Bear in mind, if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

Cross Flash Kia Spectra

2024-12-19T10:53:03Z

Dmg210:

The Kia Spectra runs calibration version ca662008 which has a very similar bootloader to ca663056 used on the GK Chassis.

The goal of this article is to cross-flash the Tiburon program code and calibration zone avoiding the error:<syntaxhighlight lang="text">
'Negative response', '<0x22 - Conditions Not Correct Or Request Sequence Error>'
</syntaxhighlight>The reason for this error, when performing a flash operation via k-line the bootloader validates the firmware that is being uploaded using the 0x2 subroutine.

The idea is to prevent a mismatch where the bootloader is unable to load the program code which would essentially brick the ECU requiring a BSL re-flash recovery.

In order to by-pass the validation check we can insert the ca662008 version number into the ca663056 program code and calibration zone tricking the ECU into thinking it's running an older version. The two sections of code that need updating, 0x20000 (program code) and 0x10000 (calibration zone)
[[File:Kia crossflash 1.png|thumb]]
[[File:Kia crossflash 2.png|thumb]]
[[File:Kia crossflash 3.png|thumb]]
Once the version detials have been updated, correct the checksum and upload via GKFlasher using the 'Full Flash' option.

You may need to re-program the Immobilizer running through the Teach Keys procedure if the Immo status is 'virgin' or 'not learnt'

Bear in mind if the immobilizer hasn't been programmed correctly you'll be unable to re-flash and will receive the error above prior to the erase operation. This won't brick the ECU, its a security feature to prevent you tampering with the ECU if the keys aren't present.

Cross Flash Kia Spectra

2024-12-19T10:47:38Z

Dmg210:

Cross Flash Kia Spectra

2024-12-19T10:45:49Z

Dmg210:

Cross Flash Kia Spectra

2024-12-19T10:39:38Z

Dmg210:

Main Page

2024-12-19T10:13:59Z

Dmg210: /* ECM Tuning: */

<div style="float:right">__TOC__</div>
'''Welcome to the OpenGK Wiki'''
[[File:Siemens T Logo.gif|frameless|right]]
[[File:Discord-Logo+Wordmark-Color.png|150px|frameless|right|link=https://discord.gg/a4fWuBTfxV]]
Our goal is to open source the Hyundai/Kia Siemens ECMs on the Beta and Delta motors to provide tuning options to the DIY enthusiasts. This project originally started for the [[Hyundai Tiburon|Hyundai Coupe/Tuscani/Tiburon platform]] but as we collected more data from other platforms with similar ECMs, it was clear that those other platforms can be supported using the same principals.

We are looking for smart individuals that have experience with IDA Pro and disassembly that are willing to help push this project further. Please contact '''info(at)opengk.org''' or join our Discord if you would like to contribute to this project.

If you are a tuner and found this site to be useful, please consider a donation to Paypal: '''donate(at)opengk.org''' to help keep the site alive.

==== General: ====
[https://vin.opengk.org VIN Decoder]

[[Hyundai Tiburon]]

[[Vehicle identification number (VIN)]]

[[Data link connector (OBD2)]]

[[Immobiliser]]

[[Body Control Module]]

[[Instrument Cluster]]

==== Communication protocols ====
[[K-Line]]

[[SIMK43 CAN Bus|CAN Bus messages]]

==== ECM Tuning: ====
[[GKFlasher Instructions]]

[[Cross Flash Kia Spectra|Cross-Flash Kia Spectra > Tiburon Firmware]]

==== Siemens L4 2.0L Hardware ====
[[5WY ECM Identification#Siemens 5WY 2 Connector .282.0L L4.29| ECM Identification]] 
[[2.0l PCB Layouts| 2.0L PCB Layouts]] 
[[Siemens 5WY 2 Connector Pinout| 2.0L L4 Pinout]]

==== Siemens V6 2.7L Hardware ====
[[5WY ECM Identification#Siemens 5WY 5 Connector .282.7L V6.29|ECM Identification]] [[2.7L V6 PCB Layouts]] 
[[Siemens 5WY 5 Connector Pinout| 2.7L V6 Pinout]] 

==== Parts Compatibility ====
[[Sensor Information]]

[[Fuel Injector Specifications]]

[[Camshaft Specifications]]

[[Bosch Chip Part Numbers]]

==== Downloads ====
[https://opengk.org/files/ File Repository]

Cross Flash Kia Spectra

2024-12-19T10:13:16Z

Dmg210: Created page with "Cross-Flash Kia Spectra > Tiburon Firmware"

Cross-Flash Kia Spectra > Tiburon Firmware

Main Page

2024-12-19T10:10:29Z

Dmg210: /* ECM Tuning: */

<div style="float:right">__TOC__</div>
'''Welcome to the OpenGK Wiki'''
[[File:Siemens T Logo.gif|frameless|right]]
[[File:Discord-Logo+Wordmark-Color.png|150px|frameless|right|link=https://discord.gg/a4fWuBTfxV]]
Our goal is to open source the Hyundai/Kia Siemens ECMs on the Beta and Delta motors to provide tuning options to the DIY enthusiasts. This project originally started for the [[Hyundai Tiburon|Hyundai Coupe/Tuscani/Tiburon platform]] but as we collected more data from other platforms with similar ECMs, it was clear that those other platforms can be supported using the same principals.

We are looking for smart individuals that have experience with IDA Pro and disassembly that are willing to help push this project further. Please contact '''info(at)opengk.org''' or join our Discord if you would like to contribute to this project.

If you are a tuner and found this site to be useful, please consider a donation to Paypal: '''donate(at)opengk.org''' to help keep the site alive.

==== General: ====
[https://vin.opengk.org VIN Decoder]

[[Hyundai Tiburon]]

[[Vehicle identification number (VIN)]]

[[Data link connector (OBD2)]]

[[Immobiliser]]

[[Body Control Module]]

[[Instrument Cluster]]

==== Communication protocols ====
[[K-Line]]

[[SIMK43 CAN Bus|CAN Bus messages]]

==== ECM Tuning: ====
[[GKFlasher Instructions]]

Cross-Flash Kia Spectra > Tiburon Firmware

==== Siemens L4 2.0L Hardware ====
[[5WY ECM Identification#Siemens 5WY 2 Connector .282.0L L4.29| ECM Identification]] 
[[2.0l PCB Layouts| 2.0L PCB Layouts]] 
[[Siemens 5WY 2 Connector Pinout| 2.0L L4 Pinout]]

==== Siemens V6 2.7L Hardware ====
[[5WY ECM Identification#Siemens 5WY 5 Connector .282.7L V6.29|ECM Identification]] [[2.7L V6 PCB Layouts]] 
[[Siemens 5WY 5 Connector Pinout| 2.7L V6 Pinout]] 

==== Parts Compatibility ====
[[Sensor Information]]

[[Fuel Injector Specifications]]

[[Camshaft Specifications]]

[[Bosch Chip Part Numbers]]

==== Downloads ====
[https://opengk.org/files/ File Repository]

GKFlasher Instructions

2024-12-18T20:51:18Z

Dmg210: /* Windows 10 & 11 Installation */

<div style="float:right">__TOC__</div>
GKFlasher is an open source Python project supported by OpenGK, written by dante383 and dmg210. This project is a multi OBD2 tool for the Siemens ECUs found on the Hyundai and Kia vehicles. It can read & write tune data, correct EEPROM checksums and clear adaptive values from your ECU. The purpose of this article is to instruct you how to download, install and configure all the prerequisites for GKFlasher. If you are a GitHub user, please go star the following repository:

https://github.com/Dante383/GKFlasher

== Windows 10 & 11 Installation ==
=== Prerequisites ===
'''1)''' First you will need a FTDI USB-OBD2 interface cable. This is often the same cable used on German vehicles. The chipset on the board must be a real FTDI chip and cannot be one of the CH340C chips. Through extensive testing we found that the following cable is the least expensive and most reliable cable for GKFlasher:

[https://www.aliexpress.us/item/2251832612703671.html Galletto 1260 ECU Chip Tuning Tool EOBD Programmer FTDI] Note: These adapters are not currently supported with BSL.

Pictured here shows the good FTDI chipset and the bad CH340C chipset. Avoid the CH340C chipsets completely.

[[File:FTDI Example.png|269x269px]]:[[File:CH340C Example.png]]

<nowiki>*</nowiki>from GKFlasher v1.0.5 we have added support for the CH340 chipset.

'''2)''' Download the following files:

[https://github.com/git-for-windows/git/releases/download/v2.44.0.windows.1/Git-2.44.0-64-bit.exe Git-2.44.0-64-bit.exe]

[https://www.python.org/ftp/python/3.11.9/python-3.11.9-amd64.exe python-3.11.9-amd64.exe]

''Optional download for npcap if you are using a CAN BUS interface for a specific purpose:''

[https://npcap.com/dist/npcap-1.79.exe npcap-1.79.exe]

=== Install GIT & Python ===
'''3)''' Open the Git install file named Git-2.44.0-64-bit.exe selecting "Git from the command line" from the following screen, then continue with all the default options afterwards:

[[File:Git Install 1.png|border]]

'''4)''' Open the Python installation file named python-3.11.9-amd64.exe and on the first dialogue select "Add python.exe to PATH"

[[File:Python Install 1.png]]

Keep all the default values on the following screen:

[[File:Python Install 2.png]]

Select "Install Pyhon 3.11 for all users" from the following screen: '''"Add Python to environment variables" has to be selected!'''

[[File:Python Install 3.png]]

'''5)''' Once installation is complete you may need to logout of windows or restart your computer before the Powershell will recognize the new PATH entries for GIT and Python. To test if either program works, try the following commands after the '''>''' symbol in Windows Powershell and you should see the following responses if all is well. If you do not see these responses or receive a "ObjectNotFound" type of error, then try the above installations again.
PS C:\Users\cfham> '''python -V'''
Python 3.11.9

PS C:\Users\cfham> '''git.exe -v'''
git version 2.44.0.windows.1

=== NPCAP Install (Optional) ===
'''1)''' If you are using CANBUS for your read/write functions, open and install the file named npcap-1.79.exe using default options.

=== GKFlasher Setup ===
'''1)''' Open your Powershell or Command prompt and change to the desired directory where you will be installing the GKFlasher files. A typical example directory might be in C:\GIT Repos\ so create yourself a directory in the C:\ drive named "GIT Repos" for this example. Use the following commands after the '''>''' symbol:
PS C:\Users\cfham> '''mkdir "C:\GIT Repos"'''

Directory: C:\

Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 4/6/2024 7:10 PM GIT Repos
'''2)''' Change to the "GIT Repos" directory and run the GIT command to download the GKFlasher files to your desired directory using the following command after the '''>''' symbol:
PS C:\Users\cfham> '''cd "C:\GIT Repos"'''

PS C:\GIT Repos> '''git clone <nowiki>https://github.com/Dante383/GKFlasher</nowiki>'''
Cloning into 'GKFlasher'...
remote: Enumerating objects: 1071, done.
remote: Counting objects: 100% (117/117), done.
remote: Compressing objects: 100% (69/69), done.
remote: Total 1071 (delta 58), reused 96 (delta 48), pack-reused 954
Receiving objects: 100% (1071/1071), 446.77 KiB | 7.45 MiB/s, done.
Resolving deltas: 100% (672/672), done.
'''3)''' Change to the GKFlasher directory then install the required Python packages with the following commands after the '''>''' symbol:
PS C:\GIT Repos> '''cd GKFlasher'''

PS C:\GIT Repos\GKFlasher> '''python -m pip install -r requirements.txt'''
Requirement already satisfied: alive_progress==3.1.5 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 1)) (3.1.5)
Requirement already satisfied: crcmod==1.7 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 2)) (1.7)
Requirement already satisfied: gkbus==0.1.8 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 3)) (0.1.8)
Requirement already satisfied: pyftdi==0.55.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 4)) (0.55.0)
Requirement already satisfied: pyqt5==5.15.9 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 5)) (5.15.9)
Requirement already satisfied: PyYAML==6.0.1 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 6)) (6.0.1)
Requirement already satisfied: about-time==4.2.1 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from alive_progress==3.1.5->-r requirements.txt (line 1)) (4.2.1)
Requirement already satisfied: grapheme==0.6.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from alive_progress==3.1.5->-r requirements.txt (line 1)) (0.6.0)
Requirement already satisfied: pyserial==3.5 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from gkbus==0.1.8->-r requirements.txt (line 3)) (3.5)
Requirement already satisfied: scapy==2.5.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from gkbus==0.1.8->-r requirements.txt (line 3)) (2.5.0)
Requirement already satisfied: pyusb!=1.2.0,>=1.0.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from pyftdi==0.55.0->-r requirements.txt (line 4)) (1.2.1)
Requirement already satisfied: PyQt5-sip<13,>=12.11 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from pyqt5==5.15.9->-r requirements.txt (line 5)) (12.13.0)
Requirement already satisfied: PyQt5-Qt5>=5.15.2 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from pyqt5==5.15.9->-r requirements.txt (line 5)) (5.15.2)
'''4)''' If everything went well you should now be able to start the GKFlasher GUI with the USB cable plugged in. Try the following command and you should see the GKFlasher window appear:
PS C:\GIT Repos\GKFlasher> '''python gui.py'''
[[File:GKFlasher First Time.png|701x701px]]

'''5) Optional:''' Create a desktop shortcut to open GKFlasher easily. First we'll need to know the location of your python3.11.exe executable. Execute the following command from your Powershell or command prompt and enter the command after the '''>''' symbol. The following line you will use to copy/paste into your desktop shortcut. In this example it is located in my local user's directory within a subfolder. Yours will vary depending on your username.
PS C:\GIT Repos\GKFlasher> '''(Get-Command python.exe).Path'''
C:\Users\cfham\AppData\Local\Microsoft\WindowsApps\python.exe
Right click on your desktop and go to "New" and "Shortcut", then paste the line you found from the last Powershell command and click next:

[[File:GKFlasher Desktop Shortcut 1.png]]

[[File:GKFlasher Desktop Shortcut 2.png|border]]

Type in "GKFlasher" into the next window and press Finish:

[[File:GKFlasher Desktop Shortcut 3.png|border]]

Now right click on that new shortcut and select properties. You will change a couple of settings in this new window so that it starts the GKFlasher app and change to the correct starting directory. First add " gui.py" (Contains a space) to the end of the target prompt and copy/paste the directory location you chose for your GIT Repos containing GKFlasher and press apply. The following is using my example directory. Yours may be unique.

[[File:GKFlasher Desktop Shortcut 4.png|border]]

If you would like to add an icon to your shortcut, you can download the OpenGK/GKFlasher logo from [https://opengk.org/files/Users/chase206/Siemens_T_Logo.ico Siemens_T_Logo.ico] and add it to your GKFLasher shortcut using the "Change Icon" button.

GKFlasher Instructions

2024-12-08T21:19:29Z

Dmg210:

<div style="float:right">__TOC__</div>
GKFlasher is an open source Python project supported by OpenGK, written by dante383 and dmg210. This project is a multi OBD2 tool for the Siemens ECUs found on the Hyundai and Kia vehicles. It can read & write tune data, correct EEPROM checksums and clear adaptive values from your ECU. The purpose of this article is to instruct you how to download, install and configure all the prerequisites for GKFlasher. If you are a GitHub user, please go star the following repository:

https://github.com/Dante383/GKFlasher

== Windows 10 & 11 Installation ==
=== Prerequisites ===
'''1)''' First you will need a FTDI USB-OBD2 interface cable. This is often the same cable used on German vehicles. The chipset on the board must be a real FTDI chip and cannot be one of the CH340C chips. Through extensive testing we found that the following cable is the least expensive and most reliable cable for GKFlasher:

[https://www.aliexpress.us/item/2251832612703671.html <s>Galletto 1260 ECU Chip Tuning Tool EOBD Programmer FTDI</s>] There is a bug with these adapters preventing the hardware flow control from being disabled. These adapters no longer work with GKFlasher and fail on fast-init stage.

Pictured here shows the good FTDI chipset and the bad CH340C chipset. Avoid the CH340C chipsets completely.

[[File:FTDI Example.png|269x269px]]:[[File:CH340C Example.png]]

<nowiki>*</nowiki>from GKFlasher v1.0.5 we have added support for the CH340 chipset.

'''2)''' Download the following files:

[https://github.com/git-for-windows/git/releases/download/v2.44.0.windows.1/Git-2.44.0-64-bit.exe Git-2.44.0-64-bit.exe]

[https://www.python.org/ftp/python/3.11.9/python-3.11.9-amd64.exe python-3.11.9-amd64.exe]

''Optional download for npcap if you are using a CAN BUS interface for a specific purpose:''

[https://npcap.com/dist/npcap-1.79.exe npcap-1.79.exe]

=== Install GIT & Python ===
'''3)''' Open the Git install file named Git-2.44.0-64-bit.exe selecting "Git from the command line" from the following screen, then continue with all the default options afterwards:

[[File:Git Install 1.png|border]]

'''4)''' Open the Python installation file named python-3.11.9-amd64.exe and on the first dialogue select "Add python.exe to PATH"

[[File:Python Install 1.png]]

Keep all the default values on the following screen:

[[File:Python Install 2.png]]

Select "Install Pyhon 3.11 for all users" from the following screen: '''"Add Python to environment variables" has to be selected!'''

[[File:Python Install 3.png]]

'''5)''' Once installation is complete you may need to logout of windows or restart your computer before the Powershell will recognize the new PATH entries for GIT and Python. To test if either program works, try the following commands after the '''>''' symbol in Windows Powershell and you should see the following responses if all is well. If you do not see these responses or receive a "ObjectNotFound" type of error, then try the above installations again.
PS C:\Users\cfham> '''python -V'''
Python 3.11.9

PS C:\Users\cfham> '''git.exe -v'''
git version 2.44.0.windows.1

=== NPCAP Install (Optional) ===
'''1)''' If you are using CANBUS for your read/write functions, open and install the file named npcap-1.79.exe using default options.

=== GKFlasher Setup ===
'''1)''' Open your Powershell or Command prompt and change to the desired directory where you will be installing the GKFlasher files. A typical example directory might be in C:\GIT Repos\ so create yourself a directory in the C:\ drive named "GIT Repos" for this example. Use the following commands after the '''>''' symbol:
PS C:\Users\cfham> '''mkdir "C:\GIT Repos"'''

Directory: C:\

Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 4/6/2024 7:10 PM GIT Repos
'''2)''' Change to the "GIT Repos" directory and run the GIT command to download the GKFlasher files to your desired directory using the following command after the '''>''' symbol:
PS C:\Users\cfham> '''cd "C:\GIT Repos"'''

PS C:\GIT Repos> '''git clone <nowiki>https://github.com/Dante383/GKFlasher</nowiki>'''
Cloning into 'GKFlasher'...
remote: Enumerating objects: 1071, done.
remote: Counting objects: 100% (117/117), done.
remote: Compressing objects: 100% (69/69), done.
remote: Total 1071 (delta 58), reused 96 (delta 48), pack-reused 954
Receiving objects: 100% (1071/1071), 446.77 KiB | 7.45 MiB/s, done.
Resolving deltas: 100% (672/672), done.
'''3)''' Change to the GKFlasher directory then install the required Python packages with the following commands after the '''>''' symbol:
PS C:\GIT Repos> '''cd GKFlasher'''

PS C:\GIT Repos\GKFlasher> '''python -m pip install -r requirements.txt'''
Requirement already satisfied: alive_progress==3.1.5 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 1)) (3.1.5)
Requirement already satisfied: crcmod==1.7 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 2)) (1.7)
Requirement already satisfied: gkbus==0.1.8 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 3)) (0.1.8)
Requirement already satisfied: pyftdi==0.55.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 4)) (0.55.0)
Requirement already satisfied: pyqt5==5.15.9 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 5)) (5.15.9)
Requirement already satisfied: PyYAML==6.0.1 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from -r requirements.txt (line 6)) (6.0.1)
Requirement already satisfied: about-time==4.2.1 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from alive_progress==3.1.5->-r requirements.txt (line 1)) (4.2.1)
Requirement already satisfied: grapheme==0.6.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from alive_progress==3.1.5->-r requirements.txt (line 1)) (0.6.0)
Requirement already satisfied: pyserial==3.5 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from gkbus==0.1.8->-r requirements.txt (line 3)) (3.5)
Requirement already satisfied: scapy==2.5.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from gkbus==0.1.8->-r requirements.txt (line 3)) (2.5.0)
Requirement already satisfied: pyusb!=1.2.0,>=1.0.0 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from pyftdi==0.55.0->-r requirements.txt (line 4)) (1.2.1)
Requirement already satisfied: PyQt5-sip<13,>=12.11 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from pyqt5==5.15.9->-r requirements.txt (line 5)) (12.13.0)
Requirement already satisfied: PyQt5-Qt5>=5.15.2 in c:\users\cfham\appdata\local\packages\pythonsoftwarefoundation.python.3.11_qbz5n2kfra8p0\localcache\local-packages\python311\site-packages (from pyqt5==5.15.9->-r requirements.txt (line 5)) (5.15.2)
'''4)''' If everything went well you should now be able to start the GKFlasher GUI with the USB cable plugged in. Try the following command and you should see the GKFlasher window appear:
PS C:\GIT Repos\GKFlasher> '''python gui.py'''
[[File:GKFlasher First Time.png|701x701px]]

'''5) Optional:''' Create a desktop shortcut to open GKFlasher easily. First we'll need to know the location of your python3.11.exe executable. Execute the following command from your Powershell or command prompt and enter the command after the '''>''' symbol. The following line you will use to copy/paste into your desktop shortcut. In this example it is located in my local user's directory within a subfolder. Yours will vary depending on your username.
PS C:\GIT Repos\GKFlasher> '''(Get-Command python.exe).Path'''
C:\Users\cfham\AppData\Local\Microsoft\WindowsApps\python.exe
Right click on your desktop and go to "New" and "Shortcut", then paste the line you found from the last Powershell command and click next:

[[File:GKFlasher Desktop Shortcut 1.png]]

[[File:GKFlasher Desktop Shortcut 2.png|border]]

Type in "GKFlasher" into the next window and press Finish:

[[File:GKFlasher Desktop Shortcut 3.png|border]]

Now right click on that new shortcut and select properties. You will change a couple of settings in this new window so that it starts the GKFlasher app and change to the correct starting directory. First add " gui.py" (Contains a space) to the end of the target prompt and copy/paste the directory location you chose for your GIT Repos containing GKFlasher and press apply. The following is using my example directory. Yours may be unique.

[[File:GKFlasher Desktop Shortcut 4.png|border]]

If you would like to add an icon to your shortcut, you can download the OpenGK/GKFlasher logo from [https://opengk.org/files/Users/chase206/Siemens_T_Logo.ico Siemens_T_Logo.ico] and add it to your GKFLasher shortcut using the "Change Icon" button.