NefMoto

Evening all,

Today, i've been having a fiddle with trying to get the Immobiliser off a spare ECU i've got.

I've booted into Boot Mode, removed the bin file, opened the file in Hex Editor and in MPPS, removed the full file from there.

I've gone into the hex editor to change the values,

Standard file:
(https://i.imgur.com/FMV2Rlb.jpg)

And here's the modified file:
(https://i.imgur.com/22Gacf1.jpg)

I say modified loosely, I've managed to just change the 1's too 2's. I'm confused about the FF's and getting the login code, or SKC?

I changed to 2's, in VCDS I wasn't showing an IMMO code but I did get an EEPROM error code.

I have also tried using the tool that someone has kindly made but I just cannot get it to work.

BTW, this is all on test bench. I've been reading all evening and cannot make any progress, and i feel like i'm going in circles.

Would someone please be able to point me in the right direction?

Thanks,
Sam

You need to update the checksums for the 2 pages you modified

Just use the program.

Ah okay, I'll look into that. I must have over read that earlier.

I would, but I can't get it to work. Feel free to show me what i'm doing wrong but no matter what, it just won't detect or do anything.

Its immo2 , so no skc

Okay thanks.

I've been doing a bit of playing,

If i read the standard file in MPPS, off the ECU it'll check sum no problem. If I modify it, say randomly changing a value, it'll detect it in the checksum.

If I take the file off, using bootmode as shown in the how to thread, getting a much smaller file in hex editor once opened, I cannot get this file to be recognised by check sum at all, standard or modified file. What am I doing wrong here?

Thanks

OP, you are changing the wrong bits.

http://nefariousmotorsports.com/forum/index.php?topic=2973.msg36532#msg36532

G

Starting fresh.. I think i'm getting myself confused over something that I must be missing.

ECU code: 06A 906 032 HJ

Below I have attached the Boot mode .bin that is saved and the file that I was able to read/extract from MPPS. These are both standard, non modified files. 

Now I was given this ECU by a friend, and apparently this already has the Immobiliser off but won't start his car. So he took this out and it's been sat for a year or so since. He knew I had a 1.8t so throw it at me to see If i wanted it, does the usual, start and die a couple of seconds after.

From having a look at the file, I can see that it's 01/01 therefore the immobiliser is still on, correct?

I have opened ECU, entered into boot mode, saved the file - Happy days.

Go into Hex Editor, using the 95040.bin and you can see..

(https://i.imgur.com/jPBYPve.png)


Now going to the picture that shows the immo off stuff, no login in pin, correct? So If I change the 1's to 2's, that's the easy part. I'm getting confused by the checksum section.

(https://i.imgur.com/kXdlPe6.png)

Would someone be able to clarify, starting a fresh? I've done a lot of reading and i'm massively confused by what I've read.

--

Checksums, using the ME7 correction tool someone has kindly made. When I enter the standard 95040.bin file into it i get this..

(https://i.imgur.com/SaY3Kgh.png)

But If i enter the full file from MPPS, i get a happy file.

(https://i.imgur.com/nC0b0RL.png)

So.. Do I have to manually checksum the smaller bin file before writing it back on? If so, that's where i'm stuck..

I'm tearing my hair out here, can someone please help?


Just to clarify, I'm not doing this to benefit, purely to have some fun messing around with this ECU. I do not even have a car to test it in :(



 

LOL.

Try to understand the difference between flash and eeprom :)

ME7 check/sum is only for the main flash, not the EEPROM.

http://nefariousmotorsports.com/forum/index.php?topic=362.0

No need to be a d*** about it.

Well I'm only going off the guides that people have made on here, so I apologise that i'm not as "smart" as you.

Thank you.

There is enough material on here and elsewhere to understand that the ECU has more than one writeable memory.
The fact that the file sizes were different by a factor of over a 100 should have also been a pretty dead giveaway, regardless if you know anything about ECM's or not.
That's what I found funny, but I did tell you exactly where your error was.

But hey, good luck to you.

I understand that it has more than one writable memory. I also understand the difference In file size. What I didn't understand was that the program didn't checksum on the EEPROM Bin file. Something that I must have misread.

But I really appreciate your help :)

I read a few times 95040 and 4 byte from 00112 to 0115 always are different after disconnect voltage. If I read two times without disconnect are the same. It's normal?
Ecu is from A4 B6 BFB