NefMoto

any ideas on how to remove tprot? someone mentioned you a need an original version of the software before tprot was activated.
i guess you would just patch the bootloader from one file to the other? or something to that affect. but there has to be another way.

my edc17 has tprot 7.

You don't need to do this if you are boot loading, I thought that is how you are loading your file?

TPROT is hardware, NOT software.

Please explain.

it is, using x17. but its a pain to have to pull and open the ecu every time i want to flash a file. it would be much more convenient to just plug and flash via obd.

You get ECU say xxx022XY with software version 1234 that's non TP. You can flash it OBD2 all day long. Then the same xxx022XY ECU comes out of the factory with software version 8899 that has TP in it. If you downgrade this ECU to version 1234 by doing a full 2 or 4MB flash, it will still have TPROT and you won't be able to flash it OBD2 unless the TPROT is patched in the code.

You need to be able to write over the "OTP" area to be able to do that.

Seeing that I can turn it on/off in software, and software is what runs on the processor inside the ECU then TPROT is controlled by software.

I can update/downgrade any software version on any ECU, however, writing over OTP sectors is not possible as they are just what it says on the tin: One Time Programmable :)

You can not "downgrade" a full TPROT ECU in the true sense of the word with out writing the OTP.


If TPROT is hardware then to change it you need to change hardware, yet above you say change software to do so. So which is it?

so do you modify the hardware to write the otp area? (i would assume this is possible. ive read about hardware modification for tp) or just patch the tprot in a different location in the software?

sorted. :)

What's the point of making a such remark without writing how you sorted things?

Probably worst thing you can do on a forum, is ask a question regarding a problem, have people suggest things, then just write "fixed" or "sorted" without any explanation.

Sorry for rant, but I think this behaviour is just horrible.

i bought a solution. thats how i sorted things.

Might be interesting for others which solution you bought. Don't you think?

it was a software patch.

Have you managed to get it to flash over OBD after patching in boot?

What is TPROT ?

Tuner Protection

Thanks for the reply Rick. Could you please tell a bit more about it.

I know a guy (Dera) that is selling the software to remove protection and a bunch of other cool stuff. e1000, and e500 per year for updates.
I'm not sure he'd want me to post his details, so pm me if you want to know more.

the details are posted on chiptuners in a thread. its pretty public knowledge.

http://www.sharkperformance.co.uk/news/article.asp?id=129 (http://www.sharkperformance.co.uk/news/article.asp?id=129)

Theres good info to read about tprot if you want to get an idea of what it is

Thanks RaraK.

The Shark Performance article (which, btw, is written by me. The Shark version is the original one by me, written for Shark. You can find alot of copies of that same text all around the internet now) is pretty close on how it really works. Obviously its not 100%, but its close enough.

Unipatch itself is public knowledge, no need to hide that. If you have any questions, feel free to shoot an email to:
my first name @ unipatch dot co dot uk

Hope you appreciate the fact that I earn my living by developing this stuff, and thus wont necessarily share everything out in the open. I keep that as my prerogative.

Thanks alot :)

-Mikko

Well said.

I guess there are a few tools available now (CMD for instance) that will allow writing over the OBD port once the ECU has been cracked open initially?

yes, several tools will patch the tprot for you but you still must open and bootloader flash the ecu with the mod file.

I'm not aware of any other tool that patches all Bosch MEDC17 common bootloaders apart from Unipatch?
Magpro/CMD only work with EDC17C46?

(This is not sales talk, all licenses are sold already :))

x17 only does the cp14 that i know of.

 ;D ;D sold out.
good one!

is there any way to recognise certain tuning protection (level) especially when the OBD tool let me read it?

like this?
tprot v7.

(http://i795.photobucket.com/albums/yy231/k0mpresd/D8D98DA3-C959-4D68-A3DE-283B5D90086A-12202-00000534183B2534.jpg)

OBD read will not give you that section.

MED17 ECU's first read should always be boot mode.  OBD is always a gamble.

Rick

Agreed

Not true. There are a few "easy" ways to detect TP level, but this requires manual checksum/RSA verification.

Most transverse MED17's are fine over OBD, and with correct tools, OBD is not a gamble, just needs programming the original file back over OBD and car runs fine after that.

The part where TPROT info is stored can be read over OBD, thats not the issue. I can now flash a couple of TP software versions over OBD with tuned software, but to get it actually into commercial distribution will take a long time, unless someone at Bosch is going to take an early retirement package.

Digging up this old topic.
What is the TPROT password reading that is done by the tools?

I understand it reads the password *doh* but from where and is it a part of RSA calculation or is it just an password to get programming access to the ECU?

And what is the difference between TP7,8,9,10,11 etc? The CAN read protocol I assume is the same?

Protocol is the same.  The password is to access the bootloader.

Rick

Ok, and how can te password be read by the tools?

The tool needs to have an option to read the password, which is done over OBD when the ECU is not in bootmode.

Rick

And this is possible due to a flaw in the software i suppose? Would be stupid having a documented possibility to read out the password and then use it for security access :)

Not a flaw as such, just the password wasn't encrypted. On the very latest ECU's it is, which is why for example we can't tune a BMW F30.

Rick

yes, its the same with Volvo 2012 and onward. And this password is calculated from VIN or something I guess, because it is different for each car.

http://en.bsr.se/about/volvo-pin/

It will be cracked soon enough.  There already a few cars out there running tunes as a test.  I've got an F30 so am very keen...

Is there a solution for these ecus yet? I haven't found any serious information about progress or if it's already available.

Either Rica have found a way or they have good friends at the local Volvo dealer sneaking them the PIN code for any car they want to sell a tuning kit to.
http://www.rica.nl/nieuws.php?news=51

Interesting. Yes, someone at the inside or they must have found a flaw in the software somehow...

Makes me really curious actually... If they don't need the pin it might be a good time to invest in an ecu and the iSoftloader...

They have "good friends" at Volvo locally, at least that is what they say actually although not in that exact wording.  ;)

Yes, they have access to codes.

but F30 still no chance?

Even some 2011 Volvo has EDC17CP48 ecu. I hate Volvo   :)

There are some out in the wild, so it will come.  I have one so am waiting eagerly :)

Rick

Some tuners reflash F30 from stock 184 hp to stock 245 hp
So they just flash another ori file, but from more powerful engine version. I dont know how but suppose they reflash it with a dealer tool. 

Any news about later Volvo or BMW F30? I have heard zilch.

No :(

I had someone wanting their new BMW 420D doing last week.  :o

That sucks. I know someone with a Volvo 2012 D5 waiting eagerly :P

its a tiny market, but I would dearly love to be able to bypass this on Lotus Europa rather than go aftermarket

Sorry for bumping... EDC17CP48,  any news?

Perhaps although CP48 is not stated. http://www.flashtec.ch/

PLEASE NOTE...THIS IS NOT MY WORK...

So here is fully disclosed version. It worked on 2.0TDI engine but sure if will work on others.

Tprot patch

To be able to flash files trough OBD in Tuning Protected ECU's such as EDC17 all yuo need to do is:

1 - Read full ecu in bootmode
2 - Open file in hex editor
3 - Find in Hex following string "3C2B" It usually appears very close to the beginning of the file not in the map area.
4 - Replace with "OOOO"
5 - Flash modified file back in bootmode
6 - You can now flash maps trough OBD. RSA signature check is bypassed.

I would not recommend doing anything to MED/EDC 17 manually , they are very different from ME7.5 MED9 and I have seen a lot of trouble and changes with simple Factory Updates.

OTP areas CAN be re-written with tools like VAS and also recently I came upon a TPOT3 MED17 that wasnt able to be patched because of a recent Dealer Update (1.4 TSI) .

Anyway the bottom line is ,don`t bother to do anything without a tool ,these ECU`s are expensive :/

Volvo EDC17CP48 can be done by X17 now.

med17.5.2 vr/w/chk via obd now too.  :)

Upon my request  ;D 8)

it was high time!

Yes it was , but i had answer from MMS that no one requested this protocol before  ;D

BTW . MPPS also added Med17.5.2 by OBD but i haven't tested it successfully ... X17 works ok - tested :)
 

via OBD???

MPPS protocol only works if you have made "Unlock" by boot beforehand.

Yes , i have removed TPROT first , but it hasn't worked for me ... i got reply from AMT that i should use golf med17.5.2 instead of scirocco that i used.
I have to test this.

Under Scirocco is the general " ALL TFSI MED17" protocol.

Use the one listed as MED17.5.2 shown here:

(http://www.chiptuningshop.co.uk/wp-content/uploads/2015/02/MPPS_18.6.4.14-636x358.png) (http://www.chiptuningshop.co.uk/wp-content/uploads/2015/02/MPPS_18.6.4.14.png)

do you mean that with tprot of RSA data is not checked by ecu? only need a checksum like old ecu?