RAM Address Finder
Every CAN message of your ECU, mapped to RAM — from the firmware alone.
Upload a full flash read and get the CAN matrix of your firmware: IDs, frame fields, RAM variables, names where an open DBC knows them.
Accepts: Full flash read (.bin, 4 MB) · Bosch EDC17CP44 (more ECUs coming) · Free
Upload the flash read on the start page; the file page shows the button when the tool takes your ECU.
Why read it from the firmware
A public DBC tells you what a car model may send on the bus. It does not tell you what your ECU actually receives, where each field lands in RAM, or which messages your software variant really has. The firmware does: the CAN driver tables are the source the ECU itself runs from.
What you get
- Every CAN ID the ECU receives and sends, with direction and acceptance mask.
- Every field of every frame: start bit, length, the RAM variable it is written to or read from.
- Names and physical units where the open DBC (opendbc, VW MLB / PQ) knows the signal — marked where it does not.
- Downloads: DBC for SavvyCAN, PCAN-Explorer or CANHacker; CSV with the full matrix; JSON.
- Honest limits: supported are the EDC17CP44 software layouts used in Audi/VW 3.0 TDI and Q7 4L (two of three known). Calibration-only reads have no program area and cannot be processed.
How it works
- Upload a full flash read (.bin, 4 MB) on the start page.
- Start RAM Address Finder from the file page — it runs under a minute.
- Read the matrix on the result page or download it as DBC, CSV or JSON.
Who it's for
- Calibrators who need the RAM address behind a CAN signal — torque, speed, pedal — for a datalog or a patch.
- Tuners building CAN interfaces for a swapped engine or a stand-alone setup.
- Reverse engineers who want the real message set of a software variant, not the model-wide DBC.
Requirements: A full flash read of a Bosch EDC17CP44 (.bin, 4 MB)