NefMoto

Hi chaps

Has anyone managed to clone one of these newer Audi Bosch ECU's?

Is it a similar case of OTP and encryption as the older med17's?

I think HexProg can bench read and write them, but was wondering what is involved in cloning the immo etc

Cheers

There is no tool that can R/W the HSM, so no, you will not clone one of these.

https://www.youtube.com/watch?v=1caaSttfMGY

 ???

Although that demo is with a MG1CS003

Well, buy it and test it.
If you read out the full read (EEPROM + IROM) from one ECU and write it into another, you will have the VIN from old ECU, this is my experience on VAG, because some data is stored in HSM.

I just immo them off, and everything is fine, except the VIN is still the old one.

MG1CS003 is a BMW ECU, that is a completely different story.
You asked about VAG, why are you bringing BMW into this?

AFAIK there is no tool that can clone a VAG MDG ECU, because there is no tool that can read/write the HSM.

It says you dont answer PM's so dont even try, can you Immo off the MG1CS002? If so could you PM me ill get the bench read to you. not for free obviously.

I can.

i managed to clone a mg1 ecu for a audi sq5 ea389, i initially thought that the original ecu was faulty as it was getting cam and crank signals g40 g28 but no trigger output on coils meant no spark. i had purchased the same hw ecu with different software from a audi s4 b9 which also has the ea839 engine.

initially because there is no immo off technique currently for the mg1, i decided to activate the immo on odis online, then go into odis engineering and flash the sq5 frf to the ecu, updating it to sq5 from s4 b9.

while this method has worked previously on older ecus it failed on the mg1, i believe its because frf does not update everything in eprom data and this can cause issues with the flash,

anyway i turned on the reds,  no errors on obd scan or anything, immo and everything looked like it was working 100% but when i disconnected multiple plugs in the engine, i didn't get any open circuits so i knew new ecu was not actually working correctly.

at this point i figured i would attempt to clone ecu even though i knew otp section cannot be written to which would not allow the new clone to work however i went ahead cloning both eprom and flash from sq5 old ecu to the new ecu.

I then plugged in s4 b9 ecu with cloned sq5 sw and had seen checksum error "expected with otp" then i went back into odis-e and reflashed sq5 frf correcting otp with flash to generate correct checksum. this worked successfully and now new ecu is 100% programmed to vehicle without immo defeat. 

i hope this information helps someone, hopefully i plan on making a youtube video explaining it all alittle easier.

It's enough to just make backup of one ECU and then write it to another.
If they are compatible then the ECU will already work, but you will have the wrong VIN and of course immo will be on, as that stuff is in HSM.

After that code it with ODIS if you have online access or immo it off if you don't, and done.

All the FRF this, FRF that is not neccessary. You can not even flash FRF if the immo is not authenticated, and if the ECU is from a different model (e.g. Porsche ECU in Audi) then there is no way to do anything with ODIS before writing the backup first anyway.

well i don't know what your doing wrong and i understand about the hardware security module, they have something similar in all the virtual clusters as well "she module" but what i did was clone the eprom and flash from one ecu to the other and then i was able to frf it to correct the checksum as the flash otp doesn't match the cloned flash writable section. i am aware that odis prevents frf flashing to ecus that have immo not authorized and previously whenever i need to recover a ecu , lets say med17 and the tuner attempted to flash via obd only to find they flashed a bad file and they didn't have a ori backed away, they can't go back in time and restore ori as the eprom/flash will be corrupt and the vr file will only have tuning section. in this case I search on the net for the same sw dump from a eprom/flash and because i know its not going to accept someone else's flash, i disable the immo in flash wfs5/wfs6 then i flash both eprom+flash to the corrupted ecu,. at this point the ecu will start the car but i want to restore original immo and not keep it in immo off state, so i then reflash original frf in odis and this restores immo and corrects checksum with otp and ecu is back to stock. "I've done this situation multiple times"  ... as long as immo is off or authorized, i can update with frf. also mg1 ecus, no one has immo off solution so i have no choice but to work with what i have. this s4 b9 ecu with completely different software is now running perfectly on the sq5, starts and drive's without issue after i cloned and frf it.

If ECU does not have valid file in it, it will be stuck in bootloader and you can also flash FRF.

What's the reason for the wall of text? I have the MG1 Immo off solution for a couple years now, and I've done many clones of the ECU.

I am saying how it is. After full backup flash nothing is corrupted for me and I don't need to flash it.
Either remove Immo off pair with ODIS, and that's it.

Also no, you don't understand the HSM. There's no OTP in MG1 processor flash either.

sorry correct.. i was also writing to another ecu that day with otp and got the two mixed up.....

this one does not have otp.... i could not find anyone who has solution for immo off on mg1.. please enlighten me...

but i have cloned without issue and then corrected with frf and the sq5 starts and runs perfectly.

my point of this wall of text is to just inform people that it is possible to change firmware to different vehicle s4-sq

---------- Write Full Backup Started ------------------------------


File loaded: vag_bosch_mg1cs002_spc5777_bench_fullbackup_33304b363030323007800012201703240a13ffffffaaaaaaffffffffffffffff_20220413113722.zip ( 5.28 MB )

Writing...
Checksum calculation, please wait...
Checksum already correct
Writing... Internal Flash
Skip sector 1 / 35
Skip sector 2 / 35
Skip sector 3 / 35
Skip sector 4 / 35
Skip sector 5 / 35
Erasing sector  6 / 35, address: 0x00040000, size: 256 KB
Erasing successful
Writing sector  6 / 35, address: 0x00040000, size: 256 KB
Writing successful.
Verifying sector  6 / 35, address: 0x00040000, size: 256 KB
Verify OK.
Erasing sector  7 / 35, address: 0x00080000, size: 256 KB
Erasing successful
Writing sector  7 / 35, address: 0x00080000, size: 256 KB
Writing successful.
Verifying sector  7 / 35, address: 0x00080000, size: 256 KB
<strong>Verify failed.</strong>
Erasing sector  7 / 35, address: 0x00080000, size: 256 KB
Erasing successful
Writing sector  7 / 35, address: 0x00080000, size: 256 KB
Writing successful.
Verifying sector  7 / 35, address: 0x00080000, size: 256 KB
Verify OK.
Erasing sector  8 / 35, address: 0x000C0000, size: 256 KB
Erasing successful
Writing sector  8 / 35, address: 0x000C0000, size: 256 KB
Writing successful.
Verifying sector  8 / 35, address: 0x000C0000, size: 256 KB
Verify OK.
Erasing sector  9 / 35, address: 0x00100000, size: 256 KB
Erasing successful
Writing sector  9 / 35, address: 0x00100000, size: 256 KB
Writing successful.
Verifying sector  9 / 35, address: 0x00100000, size: 256 KB
Verify OK.
Erasing sector 10 / 35, address: 0x00140000, size: 256 KB
Erasing successful
Writing sector 10 / 35, address: 0x00140000, size: 256 KB
Writing successful.
Verifying sector 10 / 35, address: 0x00140000, size: 256 KB
Verify OK.
Erasing sector 11 / 35, address: 0x00180000, size: 256 KB
Erasing successful
Writing sector 11 / 35, address: 0x00180000, size: 256 KB
Writing successful.
Verifying sector 11 / 35, address: 0x00180000, size: 256 KB
Verify OK.
Erasing sector 12 / 35, address: 0x001C0000, size: 256 KB
Erasing successful
Writing sector 12 / 35, address: 0x001C0000, size: 256 KB
Writing successful.
Verifying sector 12 / 35, address: 0x001C0000, size: 256 KB
Verify OK.
Erasing sector 13 / 35, address: 0x00200000, size: 256 KB
Erasing successful
Writing sector 13 / 35, address: 0x00200000, size: 256 KB
Writing successful.
Verifying sector 13 / 35, address: 0x00200000, size: 256 KB
Verify OK.
Erasing sector 14 / 35, address: 0x00240000, size: 256 KB
Erasing successful
Writing sector 14 / 35, address: 0x00240000, size: 256 KB
Writing successful.
Verifying sector 14 / 35, address: 0x00240000, size: 256 KB
Verify OK.
Erasing sector 15 / 35, address: 0x00280000, size: 256 KB
Erasing successful
Writing sector 15 / 35, address: 0x00280000, size: 256 KB
Writing successful.
Verifying sector 15 / 35, address: 0x00280000, size: 256 KB
Verify OK.
Erasing sector 16 / 35, address: 0x002C0000, size: 256 KB
Erasing successful
Writing sector 16 / 35, address: 0x002C0000, size: 256 KB
Writing successful.
Verifying sector 16 / 35, address: 0x002C0000, size: 256 KB
Verify OK.
Erasing sector 17 / 35, address: 0x00300000, size: 256 KB
Erasing successful
Writing sector 17 / 35, address: 0x00300000, size: 256 KB
Writing successful.
Verifying sector 17 / 35, address: 0x00300000, size: 256 KB
Verify OK.
Erasing sector 18 / 35, address: 0x00340000, size: 256 KB
Erasing successful
Writing sector 18 / 35, address: 0x00340000, size: 256 KB
Writing successful.
Verifying sector 18 / 35, address: 0x00340000, size: 256 KB
Verify OK.
Erasing sector 19 / 35, address: 0x00380000, size: 256 KB
Erasing successful
Writing sector 19 / 35, address: 0x00380000, size: 256 KB
Writing successful.
Verifying sector 19 / 35, address: 0x00380000, size: 256 KB
Verify OK.
Erasing sector 20 / 35, address: 0x003C0000, size: 256 KB
Erasing successful
Writing sector 20 / 35, address: 0x003C0000, size: 256 KB
Writing successful.
Verifying sector 20 / 35, address: 0x003C0000, size: 256 KB
Verify OK.
Erasing sector 21 / 35, address: 0x00400000, size: 256 KB
Erasing successful
Writing sector 21 / 35, address: 0x00400000, size: 256 KB
Writing successful.
Verifying sector 21 / 35, address: 0x00400000, size: 256 KB
Verify OK.
Erasing sector 22 / 35, address: 0x00440000, size: 256 KB
Erasing successful
Writing sector 22 / 35, address: 0x00440000, size: 256 KB
Writing successful.
Verifying sector 22 / 35, address: 0x00440000, size: 256 KB
Verify OK.
Erasing sector 23 / 35, address: 0x00480000, size: 256 KB
Erasing successful
Writing sector 23 / 35, address: 0x00480000, size: 256 KB
Writing successful.
Verifying sector 23 / 35, address: 0x00480000, size: 256 KB
Verify OK.
Erasing sector 24 / 35, address: 0x004C0000, size: 256 KB
Erasing successful
Writing sector 24 / 35, address: 0x004C0000, size: 256 KB
Writing successful.
Verifying sector 24 / 35, address: 0x004C0000, size: 256 KB
Verify OK.
Erasing sector 25 / 35, address: 0x00500000, size: 256 KB
Erasing successful
Writing sector 25 / 35, address: 0x00500000, size: 256 KB
Writing successful.
Verifying sector 25 / 35, address: 0x00500000, size: 256 KB
Verify OK.
Skip sector 26 / 35, CRC of sector in the file and in the flash is the same
Skip sector 27 / 35, CRC of sector in the file and in the flash is the same
Skip sector 28 / 35, CRC of sector in the file and in the flash is the same
Erasing sector 29 / 35, address: 0x00600000, size: 256 KB
Erasing successful
Writing sector 29 / 35, address: 0x00600000, size: 256 KB
Writing successful.
Verifying sector 29 / 35, address: 0x00600000, size: 256 KB
Verify OK.
Erasing sector 30 / 35, address: 0x00640000, size: 256 KB
Erasing successful
Writing sector 30 / 35, address: 0x00640000, size: 256 KB
Writing successful.
Verifying sector 30 / 35, address: 0x00640000, size: 256 KB
Verify OK.
Erasing sector 31 / 35, address: 0x00680000, size: 256 KB
Erasing successful
Writing sector 31 / 35, address: 0x00680000, size: 256 KB
Writing successful.
Verifying sector 31 / 35, address: 0x00680000, size: 256 KB
Verify OK.
Erasing sector 32 / 35, address: 0x006C0000, size: 256 KB
Erasing successful
Writing sector 32 / 35, address: 0x006C0000, size: 256 KB
Writing successful.
Verifying sector 32 / 35, address: 0x006C0000, size: 256 KB
Verify OK.
Skip sector 33 / 35, CRC of sector in the file and in the flash is the same
Skip sector 34 / 35, CRC of sector in the file and in the flash is the same
Erasing sector 35 / 35, address: 0x00780000, size: 256 KB
Erasing successful
Writing sector 35 / 35, address: 0x00780000, size: 256 KB
Writing successful.
Verifying sector 35 / 35, address: 0x00780000, size: 256 KB
Verify OK.

Warning! Checksum not calculated
Writing... Internal EEPROM
Skip sector 1 / 8, CRC of sector in the file and in the flash is the same
Erasing sector 2 / 8, address: 0x00010000, size: 64 KB
Erasing successful
Writing sector 2 / 8, address: 0x00010000, size: 64 KB
Writing successful.
Verifying sector 2 / 8, address: 0x00010000, size: 64 KB
Verify OK.
Erasing sector 3 / 8, address: 0x00020000, size: 64 KB
Erasing successful
Writing sector 3 / 8, address: 0x00020000, size: 64 KB
Writing successful.
Verifying sector 3 / 8, address: 0x00020000, size: 64 KB
Verify OK.
Erasing sector 4 / 8, address: 0x00030000, size: 64 KB
Erasing successful
Writing sector 4 / 8, address: 0x00030000, size: 64 KB
Writing successful.
Verifying sector 4 / 8, address: 0x00030000, size: 64 KB
Verify OK.
Erasing sector 5 / 8, address: 0x00040000, size: 64 KB
Erasing successful
Writing sector 5 / 8, address: 0x00040000, size: 64 KB
Writing successful.
Verifying sector 5 / 8, address: 0x00040000, size: 64 KB
Verify OK.
Erasing sector 6 / 8, address: 0x00050000, size: 64 KB
Erasing successful
Writing sector 6 / 8, address: 0x00050000, size: 64 KB
Writing successful.
Verifying sector 6 / 8, address: 0x00050000, size: 64 KB
Verify OK.
Erasing sector 7 / 8, address: 0x00060000, size: 64 KB
Erasing successful
Writing sector 7 / 8, address: 0x00060000, size: 64 KB
Writing successful.
Verifying sector 7 / 8, address: 0x00060000, size: 64 KB
Verify OK.
Erasing sector 8 / 8, address: 0x00070000, size: 64 KB
Erasing successful
Writing sector 8 / 8, address: 0x00070000, size: 64 KB
Writing successful.
Verifying sector 8 / 8, address: 0x00070000, size: 64 KB
Verify OK.

Writing successful.
Detecting unlock...
ECU status: LOCKED

 ---------- Write Full Backup Finished ( Time: 00:15:52 )

I made my own. Simple as that. No, I will not sell it to you.

who said anything about selling anything to me, all i said prior is if you have information that can help people on this forum with the mg1, maybe its nice to share so the world isn't at your knees  ::)

i don't need your help, i didn't ask for it, my only intention was to let everyone else know there is another way out to resolve mg1.

I replaced my sq5 mg1 ecu with a s4 mg1 ecu from ebay, I did this because i couldn't find a second hand sq5 ecu and both ecu's hw part no are the same, I knew there would be a bunch of errors as the software on these ecu's is different, and they are looking for other modules/other software to communicate with, which i knew would happen but i had hope, i then went online with odis, serviced immo in ecu., once ecu was unlocked, i would be able to frf flash the ecu via odis-e to correct sw, so i frf the ecu to sq5 software however even though it said that it was successful and no errors on obd when i did a vcds scan, the car still didn't start, i disconnected multiple sensors in the engine and the ecu would not detect the open circuit, this told me the ecu is not functioning even though i could go into it via vcds and see no errors,  at this stage i was hoping i managed to update immo data correctly so then i cloned old ecu to new ecu via bench with eprom+flash and then the ecu had an error, which i corrected with a frf update on top of the cloned eprom+flash, then finally the car started and ran perfectly with the new ecu and no errors and best yet, immo enabled! which i prefer over immo disabled. i made a video of the process which i will be posting on youtube to help those who don't have enough information about the mg1 ecu.

this information is simply for those who get stuck on the mg1 and don't know how to resolve it on a audi. nothing to do with you grumpy pants! just trying to help people sheesh :o
that's what forum communities are all about. i understand your hesitation to help people, you possibly get asked all the time to help with little to no benefit in return, but not all of us are bad.

all i can say is i hope this benefits someone one day, as i noticed the sale of second hand mg1 ecus on ebay being excessive for a new vehicle. peace out  8)

Instead of this wall of text, what can be done is:
1. "Clone" ECU in bench.
2. Adapt immo with ODIS or bypass it.

Finished, nothing else need to be done. No yadda yadda flashing FRF first etc. NONE OF IT. Works every time first go.
You screwed up your ECU by adapting immo to different car with different sw then flashing real SW there in the first place without doing a full clone. All the rest of the things you went through is because of that.

But hey, keep writing what you are writing over and over, it's not going to change anything.

i know you hate hearing that you may be wrong once in a while  :o but your wrong.

if you clone ecu, you cannot adapt because ecu has corrupted clone which does not match the hsm or something like that because after i had cloned it, it wouldn't communicate correctly. only after i had re frf after cloning did it fix the issue. this is what happened in my experience.

You originally did the immo work before you bench flashed the flash and EEPROM to the original ECU?

The reason that happened is that you adapted immo on the wrong software before you cloned anything.
I've done this many times using the same procedure. You've done it once and screwed everything up. Congrats.

If immo is not authenticated or you are not in bootloader, then you can't "FRF" anything, it won't enter CBOOT.
But there's no sense talking to you because you don't even have a clue what you did anymore.

The difference between me and you is, that I know how it works, you don't. But IDC, do what you like.
I'll keep using the working method I described, which doesn't involve voodoo and flashing shit 10 times instead of doing it once.

Boy that escalated quickly  ;D

Just a question what tool did you chaps use to clone MG1CS002 (VAG)

Watching this video we can read/write flash and eeprom using Bitbox

https://www.youtube.com/watch?v=zdlrGP-knME&t=68s

However when I spoke to BitBox support they mention this tool is not good for cloning as it "does not write FULLFLASH"

What does that mean as in the video it appears the flash (8mb) and Eeprom are read and written successfully?

No tool has access to the HSM, and for a full clone you would also need to clone the HSM.
Hence the option is to copy the eeprom and flash and then either immo it off or adapt it with ODIS.

Makes sense now, thankyou

did you have a solution to immo off the MG1CS002 Audi S4 ecu?

He does not, he used ODIS to adapt it with a GEKO subscription.