Ashcon Mohseninia (RAND_ASH) (@rndashm) / X

Ashcon Mohseninia (RAND_ASH)

2,135 posts

Ashcon Mohseninia (RAND_ASH)

@rndashm

🇮🇷/🇬🇧 Car hacker | Rust Programmer | Youtuber github.com/rnd-ash

South East, England

youtube.com/c/RANDASH

Joined September 2017

Pinned
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 7, 2025
Hey @MercedesBenz , thought I'd ask, but is it possible to speak to someone who worked on the 722.6's EGS52/53 ECUs back in the early 2000s? - Almost completed reverse engineering the entire ECU, and I'd like to ask a couple questions about its very interesting design choices!
1.2M
Ashcon Mohseninia (RAND_ASH)
@rndashm
Nov 22, 2022
WOW! So the new 2021 BMW clusters are basically Chromebooks!?😂. Powered by intel atom!
Ashcon Mohseninia (RAND_ASH)
@rndashm
Dec 6, 2023
Best CLI interface? - Use your cars instrument cluster 🤣
35K
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 8, 2025
Replying to @rndashm
0/7 Did not expect this tweet to blow up as much as it did! - So lets do a thread on some of the oddities that I found in the firmware!
72K
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 8, 2025
Replying to @rndashm
2/7 No optimizations at all. There are so many wasted instructions in the Mercedes app layer! Most famously, the program instructs the CPU to multiply numbers by 0, and then parse the result. Any modern compiler would skip this and just put 0 into the dest register
64K
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 8, 2025
Replying to @rndashm
1/7 The firmware is structured in a really interesting way. EGS has a bootloader, but then 2 different blocks for the main app. One is Siemens and one is MB. Siemens exposes 1 function which MB uses for their entire app. So the entire gearbox execution is single threaded...
72K
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 8, 2025
Replying to @rndashm
1.5/7 ... this also means it was possible for MB and Siemens to write their code base(s) and then link the compiled output together into 1 app, so both companies never saw each-others source code!
64K
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 8, 2025
Replying to @rndashm
7/7 Now with all this work ive been doing to reverse the original unit, I've been putting it into my own 722.6 TCU (Ultimate-NAG52), and its very interesting to improve things! Stay tuned on Youtube, I'll likely do a video when I have time documenting EVERYTHING I've found!
45K
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 8, 2025
Replying to @rndashm
6/7 Conclusion So, its fair to say, I suspect the development of this unit was done in a model simulation software like Matlab, which then outputs generated code to be compiled, and the developers did not care about optimization at all
44K
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 8, 2025
Replying to @rndashm
I just hope that one day, it would be possible to sit with one of the developers of this EGS52 ECU and ask what/how the development process was, as I find it fascinating, and to ask why certain decisions were taken where better solutions seem obvious!
44K
Ashcon Mohseninia (RAND_ASH)
@rndashm
Sep 6, 2021
Finally after 1 year in development, I have a first actual working PCB for testing in my car for my custom 722.6 TCM!!!!!!!
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 8, 2025
Replying to @rndashm
For those who want to see what I've done, you can checkout the repository for my 722.6 TCU! - Its about 20K lines of C++ :) about 3 years worth of work so far, and supports all 3 CAN Matrix versions mercedes used from 1998-2014 github.com/rnd-ash/ultima…
24K
Ashcon Mohseninia (RAND_ASH)
@rndashm
May 8, 2025
Replying to @rndashm
3/7 Profiling was left inside the firmware! - Which is quite nice as on my real unit I can now see (By reading memory using KWP 0x23 service), how long the original EGS52 unit is spending in each execution phase of its main single threaded loop.
57K
Ashcon Mohseninia (RAND_ASH)
@rndashm
Dec 23, 2022
After 2 years of hard work, this is the first production batch for the Ultimate-Nag52 #opensource #esp32 powered #mercedes 722.6 gearbox ECU! So proud to finally get these. Thanks to @JLCPCB for the help assembling these! 🎉. Website TBA!
34K