NefMoto

Hi guys,

I'm quite new to this but I have been researching for the past couple days trying to learn how to remove the immo from my ecu.

The details of the ecu are-
pn: 022906032
eeprom type: 95160 ST
me7.1.1
removed from a 3.2 audi tt

I got myself a eeprom reader and ive removed the 95160 chip from the ecu. now im at the point where i need to remove the immo. researching online it seems like most peoples byte size is quite lower. the byte size of mine is 2048.. Is that correct?

now ive changed the immo bytes manually but i want to check if ive done it correctly.
Also does the eepromtool_04 work for this as I tried to use it but was getting the following errors

>eepromtool_04.exe 95160.BIN
Read in 2048bytes
Detected 2kb bin, parsing as a cluster eeprom (prevent this guessing by using --force)
WARNING: Cluster Code Block 1 and 2 do not match, this may indicate an error in the file, or a format not supported by this tool
WARNING: Cluster Code Block 2 and 3 do not match, this may indicate an error in the file, or a format not supported by this tool
WARNING: cannot decode VIN, try setting VIN to fix
WARNING: cannot decode ImmmoID
EEPROM Status:
- Type: Cluster
- VIN:
- SKC: 047
- Cluster Code: 22 04 D4 00 06 05 00
- Immo ID:


anyway here are the files with immo on and off please can you check if i have done it correctly

Immo off is good.

Thanks ill flash it and see if it works

Wrong conclusion.
This solution will not work on MY2007 me7.1.1 ecu with ST10F275 mcu inside.
The engine starts only once. After the ignition is turned off, the engine will not start again.
Mcu internal firmware should also be patched.

Are you sure Gremlin? I put a '032CE ecu with just the eeprom immo off in my 2009 R32 and its worked fine for years.

Nope, I recently swapped my ecu with the mentioned ST10F275 mcu inside, ME7.1.1 from exactly 2007MY TT 8J 3.2, 022906032HJ and this immo off solution is working.

It's another case.   032CE SW origin date is 06/2005 and ecu not use ST10F275 MCU.

I maybe be wrong. I dont recall which ecu was already immo off'ed, previous C167 or this ST10. Sorry.

What’s the solution to remove the immo?
I haven’t tried to flash the 95160 eeprom yet.

Thanks

No, the 'CE is definitely an ST10F gremilin!

This is my 022906032KG, into which I cloned the  MPC,FLASH and EEPROM from a '032CE ECU. The 'CE is the same inside, it was the first of the mk5 R32 golf ECUs, which all had ST10Fs inside. 
I didnt bother changing over anything from the KG eeprom ,I just made it immo off by the usual method. It works well.

I cloned the CE into the KG because you kindly posted the complete Damo for the CE, but the KG is not around.

Please read carefully what was written initially. I was talking about MY2007+ firmware.
Your firmware 032CE is 2004...2005.

well as there was no actual answer how to do this i removed the 95160 chip and flashed the file above. well it didnt work. if anyone knows how to actually remove the immo from this ecu please let me know im really stuck now

The answer was already above.
You need to patch the internal firmware of the ST10F275 microcontroller.
But I don't think anyone here can explain how to do it.

no worries thanks ill try and do some research into that. just needed a direction to take haha. i was just confused as it seemed some people thought it would still work without the patch. Thanks  8)

Are you able to read/write MPC and flash? Feel free to upload your readout here, I will look into it. That's an interesting case

I need to figure out how to red/write to the mpc. i think i might need to purchase a cable and read in boot mode using argdubs tool?
I have a feeling that the EEprom dump isnt 100% correct but im not sure.

Once i try and get the ST10F275 chip read then ill post my findings here. i think it would be good to figure this out as there isnt much info online for this (ive been trying to research this for a couple days now  ;D)

Try st10ripper to get the mpc off without a fuss. Otherwise mpps in boot mode works

If anyone is stumbling upon this post and they would like to try this solution I came up with, here are the instructions

I haven't tried it on a car yet, only in bench with MY2007+ firmware. The immobilizer shows as disabled in channel 91 and OBD2 flashing works

1) Search for this in the MPC
E6 FC 80 00 F2 F8 ?? ?? 48 84 2D 04 48 82 2D 02 E6 FC 81 00

?? is a wildcard. You should have only one result. Take note of the value found with the wildcard.
For example F2 F8 4C CC, note down 4C CC

2) Search backwards for
C0 2C F6 FC XX XX

XX XX would be the value you noted, in this example it would be C0 2C F6 FC 4C CC

Replace C0 2C by E0 2C

The same works on C167CS, the code would be found in the flash instead. Don't forget to properly fix checksums or disable them. Instructions can be found on the forum.

Legend! Keep up the great work.