NefMoto

First of all thanks for the great software. I'm a bit new to all this, just discovered it last night, and haven't been able to get it to work with my car.

I am able to communicate and get ECU info using a blue ebay cable (FTDI), and enter programming mode and exit it again (ignition on/off). However when I try to use the Read ECU function to dump the maps, it fails with the infamous "RequestUpload may have been disabled by aftermarket engine software". But my car has no tune that I am aware of (bought it second hand), and I confirmed that fact today by logging the boost pressure, never went higher than 10.8 psi.

I also tried the me7eeprom.exe (1.40) program, and it fails to communicate with the ECU entirely.

According to VCDS my ECU is 06A906032LP (which is in the supported list), and I made sure to select the appropriate memory layout in NefMoto.

Any ideas? Am I not able to read this ECU via OBDII?

That does not mean it is stock. Could easily be switchable maps or something else.

Open the ecu and make sure it doensn't have a riser. And if it doesn't, you can flash a stock file using bootmode.

Hmm okay good point. Anything I should be aware of before I remove the ECU from the car? Won't wreck anything by disconnecting it?

Not sure what you mean by a riser. And for boot mode I have to do that on a bench right? Or is it possible via OBD2? Thanks.

After doing a lot more reading on the forum, I'm thinking it would be a good idea to get a spare ECU and try to tune with that, and leave my original one alone. I still have to do some more checking but I believe it should be possible to get my SKC with some other tools here, and program the spare ECU with it so the immo is compatible.

I would bet the ecu has a riser board soldered to it, probably old apr garbage.  Remove the ecu and take a look for yourself, it's not difficult to do so.

Yup gonna do that later today and report back!

i am trying to read a 2001 mk4 jetta 1.8T with mpps ECU is 06A 906 032 CL would BDM reader work?

So after some difficulty (damn wiper arms are really stuck on there), I have my ECU in front of me. I've removed the 4 screws at the corners but it's resisting any further attempts to come apart. I've already slightly bent the corners trying to pry it open. Is it glued together or something??? Not sure what to do, I don't want to wreck it.

There is some black goop holding it together and sealing it up I guess. Made a big mess but got it open. Photos attached. No riser that I can see.

https://i.imgur.com/rFS9UeM.jpg
https://i.imgur.com/MtmZBCu.jpg

BDM is not used in that ecu.

Okay I was able to dump the cluster EEPROM and the ECU EEPROM with some software I found here, and now I have my SKC. However still no luck with reading the ECU's flash. VAG-K+CAN Commander 2.5 will read the ECU's EEPROM with mode 11, but doesn't let me read flash with that mode. Mode 01 fails to read EEPROM and just hangs forever when trying to read flash.

Not sure what has been done to my ECU but time to order a used one from ebay I guess.

Oh and I noticed with NefMoto when I attempt to read the ECU, the CEL and EPC lights go out, and the anti-skid (ASR) light turns on. Anyone have any idea what that's about?

Interesting, can you please take some screenshots how you managed to read ecu's eeprom with vagkcan?

Sure I will do that later today.

youre wasting your time with k-can commander

read procedure probably disabled in this file

if you want to save this tune, you should try to read with bootmode

or just flash stock over it

Yeah I agree that the read procedure is disabled, I just don't understand why, especially since it seems to be a stock equivalent tune. I would like to save it just to get a look at it. I am not sure how to do bootmode yet, need to do some more research.

Okay here are my screenshots.

1. (https://i.imgur.com/c0ch89Z.png?1) Open vagkcan, select k-line, 01 Engine, and open channel. Then click the Engine Control Unit button.
2. (https://i.imgur.com/wvNfbS7.png) That brings you to this window, with the modes I mentioned for my ECU.
3. (https://i.imgur.com/mcRQwWQ.png) Mode 1 allows Read EEPROM and Read Flash buttons. Read EEPROM will time out after trying to connect to the ECU. Read Flash just hangs the whole program.
4. (https://i.imgur.com/PjLEwGK.png?1) Mode 11 only allows Read EEPROM (after successful read it gives more options, but not Read Flash). Takes about 10-15 seconds to read and then displays it like in the screenshot.

thank you

Spare ECU + female OBD connector + ECU harness ordered :D

Will be several weeks for it all to arrive unfortunately, but then I should be able to do some bench work!

Well everything finally arrived a couple of days ago and I got my cable built and was able to successfully communicate with the new ecu on the bench. Reads are not successful as immo is enabled, but that's fine, I know it is working at least. I started working on cloning my existing immo to the new ecu, still learning about that.

Because I was comparing EEPROM images between the ecus, I was taking a closer look at them with a hex editor and noticed my car's ecu eeprom says REVO right in it near the bottom. Guess that answers the question why I am not able to read the flash via OBD2. Unfortunately REVO maps cannot be changed without the REVO SPS device from what I can find (unless someone knows a way to do this with nefmoto? :)). I am planning to dump the REVO software using bootmode, would anyone be interested in seeing that if I am allowed to post it here?

Edit: interesting note, according to 95040tool.exe my car's ecu eeprom has invalid checksum(s). I guess the REVO software does not care about checksums and does not check them. Kind of scary.

Pretty sure I have successfully cloned my immobilizer, haven't had a chance to try it though. Writing the flash in bootmode is failing with Galletto, likely due to lack of sufficient voltage (I am using an ATX power supply that is only putting out 11.4v). I am going to pick up a proper bench supply that outputs 13.8v and try again.

So I got a better power source today and Galletto was still unable to write the flash in bootmode. Strangely it would instantly fail write after erasing the flash. On a whim I tried a different .bin (both files I got from here in original ECU file section and both are 032LP files) and it worked! Also it worked on my ATX PSU which I switched back to after it still failed with the new power source. So the problem is the file all along.

Success! My spare ECU was cloned successfully and is now running the car with a bin from the original ECU bins here. I have also dumped the Revo bin on my original ECU, if anyone wants a copy to look at, let me know. Keep in mind I have no idea what it is, though I am guessing it is a 30 day trial of Revo software for a 1.8t AWP. Comparing it to a stock 032LP bin there is slightly less than half of it altered, so it may just be changed maps. It was also running the car basically equivalent to factory software, never saw more than 10.8 psi of boost, so if there is a way to "unlock" it, I have no idea how. EEPROM settings maybe?

revo stores boost/timing settings in eeprom so you can manually adjust them without sps
but if there is an attempt to read flash via obd (not bootmode), this eeprom section probably overwrited with flasher and after that you got default timing/boost

i was playin a few years ago with revo tune. any protection can be easily cracked but there is no reason to do that cos no interesting stuff

If it's stored in the eeprom why would it be lost when the battery is disconnected though? As that is what seems to happen, from my research (Revo tune reverts to stock performance when battery is disconnected, which may be what happened to my car). Maybe I'm just not understanding how the eeprom works?