NefMoto

Does anyone know where the obd read protection is in the MED9.1 ecu for VAG's and how to remove it once i has been applied? A lot of tools can enable it but none of them can disable it. And most tools does other stuff than just enable the read protection so even though i tried to enable it and compare bin's after a lot has changed.

Any help?

Good question.

Yeah. Funny no tools has a reverse function. Should be easy to fix i guess?!

Easy.

Could you elaborate a bit?

Lazyness didn`t help anyone and the most simple thing to do here is to use an original file patch it with the tools you have and then compare it in your hex editor.

Or you could just wait and ask around and wait to get the info fed to you...

If you are unable to do that i can only assume you are trying to remove it on a file you did read through bdm.

What a great member you are helping others. This is exactly what was the intention of this forum!

Lazyness makes people forget to read the post before they answer! As mentioned in the first post the tools around apply more patches than the read protection only so getting an idea of where the read protection is are not that simple otherwise i would have sorted it myself!

And you are right! This is a dump read by bdm! It is an spare ecu purchased on eBay for a complete engine rebuild and as we tried to edit the program it refused to read the ecu over obd and running the flash through the eeprom 2.1.1 tool it detected read protection was enabled.

But anyway thanks for the huge help! A pleasure have such a beneficial member in here!
 

1. You never wrote what you are using for patching.... Guesses here do not work...
2.if you define the patched areas you will find easily what you are looking for at least with some tools that are floating around.

3."But anyway thanks for the huge help! A pleasure have such a beneficial member in here! " 

Said the member with 39posts, 39questions and no contributions....

Why do i even bother.. My bad...In your posts this will not happen again.

1. Load flash into eeprom tool
2. Enable read protect
3. Export
4. Load both ori and read protected flashes
5. Discover that's a very simple change
6. Apologize for being lazy

I feel like this was taken as sarcasm, when that wasn't the intention.

Jesus you are really clever!

1. That is pretty easy
2. Done that
3. File exported
4. Loaded both an protected and unprotected dump before and after into the hex editor
5. PROBLEM!! even after changing the 2 areas that are not identical in the 4 files compared the eeprom 2.1.1 still says file already obd protected. So i guess even though i was not lazy it didn't work.
6. Apologize for being a arrogant.

I actually already tried that. several times i have been spending hours trying to figure what the changes where. and even after comparing bdm's from the same ecu obd read on and obd read off and files patched with eeprom 2.1.1 i haven't been able to find the changes that made the file obd read protected. Questions is what make you smarter. so sorry mr i know i all and i don't wanna tell.

Here is what i tried.

I have a similar dump different software version same part number. On of the boxes has OBD read disabled the other one does not.

So i ran the dump from the ECU with OBD read disabled through Eeprom tool 2.1.1 and applied the Read prot patch. then i took the dump from the ECU with OBD read allowed and ran that through Eeprom 2.1.1 and enabled read prot.

From these two dumps i found that there where different areas patched in the MCU.

as seen in the pictures.

(https://image.ibb.co/d7jokR/Screen_Shot_2017_12_18_at_09_36_32.png)
(https://image.ibb.co/e9EokR/Screen_Shot_2017_12_18_at_09_32_33.png)

Then i tried to reverse the changes but the Eeprom 2.1.1 still detecs the obd read already patched. Reversed changes shown in the yellow area

(https://image.ibb.co/c6Yg5R/Screen_Shot_2017_12_18_at_09_32_24.png)
(https://image.ibb.co/joY3Km/Screen_Shot_2017_12_18_at_09_24_39.png)

No files, no file numbers, nothing, only weird pictures. Write another ori file (expect unique crypt area) to that ecu and problem is gone...

Write another ori file?? Sgo?

SGO or other ori file does not matter. Please read a little bit more about MED9.1. It´s all in this and other boards. You can use any other file with same number just copy 6C00-6CFF, you didnt recognize that while your tests? Which range is you tool flashing via OBD? Maybe not full flash?

Obviously you're not working with an original file.

For the 1K0907115L_0030 file you're talking about the read protection is located at 0xA59A0  Stock value will be [00 01 11 70] this comes from the read seed/key algorithm is key = seed + 0x11170, read protect will change that to anything else.

But another file will make the map i have for this sw ver not fit the ecu anymore right? So if i update the ecu now the program i just wrote by bdm doesn’t necessarily fit the new se version?

But you are right that solution would have been perfect from the start!

Immo data is no problem those I know how to change in the Ecu.

I’ve been reading quiet a few posts about med9.1 but unlike the ME7.1.1 there is not total write up so all the data is hidden in threads with other subject. So any reference is appreciated!

I would say you are probably right! I working with an Ecu purchased from German Ebay so most likely it is not standard or have been altered somehow.

However it doesn’t make my problem not exist. I think Lars was the helpful person that fixed the issue I just need testing now. So let’s see how this file works out.