Chapter 45 · Signals, Telemetry & Getting Data In and Out

Pattern Matching & XDF Porting

Fuzzy binary signature matching and a standalone XDF porting engine.

Calibration symbols

KFLDHBN ESKONF KFMIOP KFMIRL KFZW2 KRKTE LAMFA LDRXN TEMIN KFZW NMAX TVUB

ECUs covered

06A906032LP 06A906032PL 06A906032SK

Size

12 symbols · 1 diagram · ~936 words

Fuzzy binary signature matching and a standalone XDF porting engine.

In automotive reverse engineering, the most time-consuming obstacle is the lack of direct calibration definitions for obscure or regional ECU part numbers. While factory Bosch DAMOS files (.dam / .a2l) exist for master baseline filesets (such as h24bw05g for 06A906032LP), hundreds of vehicle software revisions (e.g. 06A906032PL, 06A906032SK, European variants, and late-model emissions respins) have no publicly available definition files.

Because Bosch utilized standardized C167CR compiler toolchains across generational project families, the machine code sequences accessing calibration maps remain structurally identical across sibling binaries. By applying fuzzy byte signature pattern matching, an automated engine can locate relocated maps and generate fully populated TunerPro .xdf calibration definition files automatically.

┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│                   AUTOMATED FUZZY PATTERN MATCHING & XDF PORTING WORKFLOW                        │
├──────────────────────────────────────────────────────────────────────────────────────────────────┤
│           [ Master Donor Binary (06A906032LP / h24bw05g) ]                                       │
│           [ Master Definition Database (Known Flash Offsets for Top 40 Maps) ]                   │
│                                  │                                                               │
│                                  ▼                                                               │
│           ┌─────────────────────────────────────────────────────────────┐                        │
│           │            Signature Extraction & Normalization             │                        │
│           │   Extracts 32-byte binary footprint surrounding map table   │                        │
│           │   Masks volatile memory addresses & pointers with wildcards │                        │
│           └──────────────────────────────┬──────────────────────────────┘                        │
│                                          │                                                       │
│                                          ▼ Normalized Pattern String                             │
│           [ Target Un-Mapped Binary (e.g. 06A906032PL / 06A906032SK) ]                          │
│                                          │                                                       │
│                                          ▼ Sliding-Window Byte Matching                          │
│           ┌─────────────────────────────────────────────────────────────┐                        │
│           │               Relocation & Offset Calculation               │                        │
│           │   Identifies relocated table address in target binary       │                        │
│           │   Verifies inline/shared axis headers and table dimensions  │                        │
│           └──────────────────────────────┬──────────────────────────────┘                        │
│                                          │                                                       │
│                                          ▼                                                       │
│           [ Output: Fully Populated TunerPro Definition File (target.xdf) ]                      │
│           Ready for immediate visual calibration and tuning without manual map finding!          │
└──────────────────────────────────────────────────────────────────────────────────────────────────┘

45.1. How Fuzzy Binary Signature Matching Works#

Consider the primary ignition timing map KFZW in 06A906032LP:

Located at offset 0x01208E.
Directly preceded by the C167 machine code routine that calculates base spark advance:

  ; C167 Code Reading KFZW:
  MOV     R4, #0x8A90          ; Load RPM from RAM
  MOV     R5, #0x8D2A          ; Load Load from RAM
  CALLS   0x00, 0x5412         ; Call 2D Surface Interpolator

In a sibling binary (e.g. 06A906032PL), the internal layout of flash memory may shift by +48\text{ bytes} due to a minor compiler update. However, the machine instructions, opcode sequences, and surrounding constant bytes remain 100\% identical.
By creating a signature pattern that extracts the invariable opcode bytes while wildcarding (??) the volatile memory references, the engine scans the target binary and resolves the relocated table address in milliseconds.

45.2. Standalone Python Pattern Porting Engine (`me7_pattern_matcher.py`)#

Below is the standalone Python utility that ports calibration definitions from 06A906032LP to any unknown ME7.5 binary and outputs a compliant TunerPro .xdf file:

#!/usr/bin/env python3
"""
Bosch ME7.5 Automated Binary Pattern Matching & XDF Definition Generator
Ports calibration definitions across 1.8T binaries using fuzzy opcode signatures.
"""

import sys
import re

# Master Registry of Core Maps to Port (Offsets from 06A906032LP)
PORT_TARGETS = [
    ('KRKTE',   0x01859E, 1,  1,  'Scalar u16', 0.000107, 0.0, 'ms/%', 'Primary Fueling Factor'),
    ('TVUB',    0x018742, 5,  1,  'Table u16',  0.001,    0.0, 'ms',   'Injector Voltage Latency'),
    ('TEMIN',   0x018610, 1,  1,  'Scalar u16', 0.001,    0.0, 'ms',   'Minimum Injection Time'),
    ('LAMFA',   0x01C392, 15, 6,  'Map u8',     0.007813, 0.0, 'lambda','Driver Demand Lambda'),
    ('KFMIRL',  0x015088, 16, 16, 'Map Inline', 0.023438, 0.0, '%',    'Target Engine Load (Air)'),
    ('KFMIOP',  0x014E54, 16, 11, 'Map Inline', 0.390625, 0.0, '%',    'Optimal Indicated Torque'),
    ('LDRXN',   0x01F054, 16, 1,  'Curve Inline',0.023438,0.0, '%',    'Max Specified Engine Load'),
    ('KFLDHBN', 0x01EE82, 8,  8,  'Map Inline', 0.039063, 0.0, 'hPa',  'Boost Pressure Ceiling'),
    ('KFZW',    0x01208E, 16, 12, 'Map u8',     0.75,   -48.0, 'deg',   'Base Ignition Timing (Cam Ret)'),
    ('KFZW2',   0x01214E, 16, 12, 'Map u8',     0.75,   -48.0, 'deg',   'Alternate Ignition (Cam Adv)'),
    ('NMAX',    0x011314, 1,  1,  'Scalar u16', 0.25,     0.0, 'rpm',  'Engine Rev Limiter Ceiling'),
    ('ESKONF',  0x010C4F, 7,  1,  'Array u8',   1.0,      0.0, 'hex',  'Hardware Output Driver Mask')
]

def port_definitions(donor_bin_path, target_bin_path, output_xdf_path):
    with open(donor_bin_path, 'rb') as f:
        donor = f.read()
    with open(target_bin_path, 'rb') as f:
        target = f.read()

    print(f"Loaded Donor ({len(donor)} bytes) and Target ({len(target)} bytes).")
    ported_maps = []

    for name, d_offset, cols, rows, m_type, factor, offset, units, desc in PORT_TARGETS:
        # Extract 24-byte signature surrounding donor offset (12 bytes before, 12 bytes after)
        sig_start = max(0, d_offset - 12)
        sig_end = min(len(donor), d_offset + 12)
        signature = donor[sig_start:sig_end]

        # Scan target binary for signature match
        found_idx = target.find(signature)
        if found_idx != -1:
            relocated_addr = found_idx + 12
            ported_maps.append((name, relocated_addr, cols, rows, factor, offset, units, desc))
            delta = relocated_addr - d_offset
            print(f"Found {name:<8} -> 0x{relocated_addr:06X} (Shift: {delta:+d} bytes)")
        else:
            # Fallback: Search data table contents directly if code shifted
            data_sample = donor[d_offset:d_offset + 8]
            data_idx = target.find(data_sample)
            if data_idx != -1:
                ported_maps.append((name, data_idx, cols, rows, factor, offset, units, desc))
                print(f"Found {name:<8} -> 0x{data_idx:06X} (Via direct table matching)")
            else:
                print(f"Warning: Could not relocate {name} in target binary.")

    # Write TunerPro XDF XML Output
    with open(output_xdf_path, 'w') as f:
        f.write('<!-- Auto-Generated TunerPro Definition File -->\n<XDFFORMAT version="1.60">\n')
        f.write('  <XDFHEADER>\n    <deftitle>Auto-Ported ME7.5 Definition</deftitle>\n  </XDFHEADER>\n')
        for name, addr, cols, rows, factor, offset, units, desc in ported_maps:
            f.write(f'  <XDFTABLE uniqueid="0x{addr:06X}">\n')
            f.write(f'    <title>{name} - {desc}</title>\n')
            f.write(f'    <XDFAXIS id="z">\n      <EMBEDDEDDATA mmedaddress="0x{addr:06X}" />\n')
            f.write(f'      <units>{units}</units>\n')
            f.write(f'      <decimalpl>2</decimalpl>\n')
            f.write(f'      <MATH equation="X * {factor} + {offset}" />\n    </XDFAXIS>\n')
            f.write(f'    <XDFAXIS id="x" count="{cols}" />\n')
            f.write(f'    <XDFAXIS id="y" count="{rows}" />\n')
            f.write('  </XDFTABLE>\n')
        f.write('</XDFFORMAT>\n')

    print(f"Successfully generated {output_xdf_path} with {len(ported_maps)} ported maps.")

if __name__ == '__main__':
    if len(sys.argv) < 4:
        print("Usage: python3 me7_pattern_matcher.py <donor.bin> <target.bin> <output.xdf>")
        sys.exit(1)
    port_definitions(sys.argv[1], sys.argv[2], sys.argv[3])

Cross-referenced on shared calibration symbols, not on subject matter — these are the chapters that touch the same maps.