NefMoto

i tried useing the flash tool avail here to read my ecu in an attempt to modify the .bin,I have much experience with writig code and editing hex for the 1g and 2g dsm applications and have added many extras to those ecu's. now im interested in tweeking on this audi, anyhow to get back to the point. I have the ebay cable the software is able to connect to my ecu i used Slow initialization and connected good. BUT the screen shows the option to pull the .bin greyed out. I will update with a log from the ecu shortly. anyone have any ideas?
also does anyone have any .bins or info regarding modding this application?

thanks everyone
Walter

Exactly the problem I had, looking forward to seeing if you find a solution.

ok, please do the same as well. i am going to go outside in few min to get the ecu log maybe someone can help further.

when i "read ecu info" i get this.

Reading ECU info.
Negotiating communication timings.
Successfully changed to new communication timings.
Reading ECU identification option: ECUIdentificationScalingTable
Successfully read ECU identification information
Reading ECU identification option: systemSupplierECUHardwareNumber
Read ECU Identification systemSupplierECUHardwareNumber: 0261207939,
Successfully read ECU identification information
Reading ECU identification option: systemSupplierECUSoftwareNumber
Read ECU Identification systemSupplierECUSoftwareNumber: 1037366883,
Successfully read ECU identification information
Reading ECU identification option: vehicleManufacturerECUHardwareNumber
Read ECU Identification vehicleManufacturerECUHardwareNumber: 0x0D, 8E0909018A  , 0xFF,
Successfully read ECU identification information
Reading ECU identification option: calibrationDate
Read ECU Identification calibrationDate: 8E0909518AF , 0003, 0x0300413D, 0x36353236, 0x3836, 1.8L R4/5VT    ,  G03 ,
Successfully read ECU identification information
Reading ECU identification option: calibrationEquipmentSoftwareNumber
Read ECU Identification calibrationEquipmentSoftwareNumber: 0x00000100,
Successfully read ECU identification information
Reading ECU info succeeded.

Maybe you forgot using the "validate memory" option first?
Or display info.. reading the firmware doesn't always seem to work as the first operation.

i did try each of the memory maps that are available in the install directory and each one failed. I will go back out in a few in and see if i am missing something. will report back shortly. does anyone else have any tips?

i tried everythingposible i think to try and get this to read the binary on the ecu but it just does not work, here is the log file generated can someone please advise? I cannot contribute to the B6 1.8t stuff until im able to get his thing going. kinda sucks.
----------------------------------------------------------------------------------------------
06/Dec/2010 02:36:54.719: USER: Validating memory layout.
06/Dec/2010 02:36:54.724: USER: Reading ECU identification option: calibrationEquipmentSoftwareNumber
06/Dec/2010 02:36:54.762: LOG: Sent message with service ID ReadECUIdentification
06/Dec/2010 02:36:54.806: LOG: Received message with service ID ReadECUIdentificationPositiveResponse
06/Dec/2010 02:36:54.845: USER: Read ECU Identification calibrationEquipmentSoftwareNumber: 0x00000100,
06/Dec/2010 02:36:54.861: USER: Successfully read ECU identification information
06/Dec/2010 02:36:54.889: USER: ECU reports programming session preconditions have been met.
06/Dec/2010 02:36:54.892: LOG: Starting diagnostic session type: ProgrammingSession
06/Dec/2010 02:36:54.919: USER: Starting diagnostic session.
06/Dec/2010 02:36:54.932: LOG: Sent message with service ID StartDiagnosticSession
06/Dec/2010 02:36:54.960: LOG: Received message with service ID NegativeResponse
06/Dec/2010 02:36:54.963: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: SecurityAccessDenied_SecurityAccessRequested
06/Dec/2010 02:36:55.001: USER: Start diagnostic session failed, ECU reports security access is required.
06/Dec/2010 02:36:55.012: USER: Validating memory layout failed.
06/Dec/2010 02:36:57.610: LOG: Sent message with service ID TesterPresent
06/Dec/2010 02:36:57.624: LOG: Received message with service ID TesterPresentPositiveReponse
06/Dec/2010 02:37:00.124: LOG: Sent message with service ID TesterPresent
06/Dec/2010 02:37:00.134: LOG: Received message with service ID TesterPresentPositiveReponse
06/Dec/2010 02:37:02.639: LOG: Sent message with service ID TesterPresent
06/Dec/2010 02:37:02.653: LOG: Received message with service ID TesterPresentPositiveReponse
06/Dec/2010 02:37:04.098: USER: Validating memory layout.
06/Dec/2010 02:37:04.104: USER: Reading ECU identification option: calibrationEquipmentSoftwareNumber
06/Dec/2010 02:37:04.131: LOG: Sent message with service ID ReadECUIdentification
06/Dec/2010 02:37:04.145: LOG: Received message with service ID ReadECUIdentificationPositiveResponse
06/Dec/2010 02:37:04.189: USER: Read ECU Identification calibrationEquipmentSoftwareNumber: 0x00000100,
06/Dec/2010 02:37:04.199: USER: Successfully read ECU identification information
06/Dec/2010 02:37:04.227: USER: ECU reports programming session preconditions have been met.
06/Dec/2010 02:37:04.241: LOG: Starting diagnostic session type: ProgrammingSession
06/Dec/2010 02:37:04.273: USER: Starting diagnostic session.
06/Dec/2010 02:37:04.277: LOG: Sent message with service ID StartDiagnosticSession
06/Dec/2010 02:37:04.305: LOG: Received message with service ID NegativeResponse
06/Dec/2010 02:37:04.308: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: SecurityAccessDenied_SecurityAccessRequested
06/Dec/2010 02:37:04.359: USER: Start diagnostic session failed, ECU reports security access is required.
06/Dec/2010 02:37:04.368: USER: Validating memory layout failed.
06/Dec/2010 02:37:06.812: LOG: Sent message with service ID TesterPresent
06/Dec/2010 02:37:06.823: LOG: Received message with service ID TesterPresentPositiveReponse
06/Dec/2010 02:37:09.328: LOG: Sent message with service ID TesterPresent
06/Dec/2010 02:37:09.345: LOG: Received message with service ID TesterPresentPositiveReponse
06/Dec/2010 02:37:11.850: LOG: Sent message with service ID TesterPresent
06/Dec/2010 02:37:11.863: LOG: Received message with service ID TesterPresentPositiveReponse
06/Dec/2010 02:37:14.371: LOG: Sent message with service ID TesterPresent
06/Dec/2010 02:37:14.382: LOG: Received message with service ID TesterPresentPositiveReponse
06/Dec/2010 02:37:15.025: USER: Clearing ECU diagnostic information.
06/Dec/2010 02:37:15.029: LOG: Starting diagnostic session type: StandardSession
06/Dec/2010 02:37:15.056: USER: Starting diagnostic session.
06/Dec/2010 02:37:15.063: LOG: Sent message with service ID StartDiagnosticSession
06/Dec/2010 02:37:15.122: LOG: Received message with service ID NegativeResponse
06/Dec/2010 02:37:15.150: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: SubFunctionNotSupported_InvalidFormat
06/Dec/2010 02:37:15.191: USER: Failed to start diagnostic session.
06/Dec/2010 02:37:15.207: USER: Received negative message response with code: SubFunctionNotSupported_InvalidFormat
06/Dec/2010 02:37:15.238: USER: Clearing ECU diagnostic information failed.
06/Dec/2010 02:37:17.618: LOG: Sent message with service ID TesterPresent
06/Dec/2010 02:37:17.648: LOG: Received message with service ID TesterPresentPositiveReponse
06/Dec/2010 02:37:20.155: LOG: Sent message with service ID TesterPresent
06/Dec/2010 02:37:20.185: LOG: Received message with service ID TesterPresentPositiveReponse
06/Dec/2010 02:37:22.692: LOG: Sent message with service ID TesterPresent

06/Dec/2010 02:37:27.152: LOG: Failed to read the number of bytes pending receive from the FTDI device.
06/Dec/2010 02:37:27.154: LOG: Resending message. Send attempts: 2
06/Dec/2010 02:37:27.158: LOG: Failed to read the number of bytes pending receive from the FTDI device.
06/Dec/2010 02:37:27.163: LOG: Resending message. Send attempts: 2
06/Dec/2010 02:37:27.168: LOG: Failed to read the number of bytes pending receive from the FTDI device.
06/Dec/2010 02:37:27.170: LOG: Resending message. Send attempts: 2
06/Dec/2010 02:37:27.174: LOG: Failed to read the number of bytes pending receive from the FTDI device.
06/Dec/2010 02:37:27.176: LOG: Resending message. Send attempts: 2
06/Dec/2010 02:37:27.180: LOG: Failed to read the number of bytes pending receive from the FTDI device.
06/Dec/2010 02:37:27.182: LOG: Resending message. Send attempts: 2
06/Dec/2010 02:37:27.187: LOG: Failed to read the number of bytes pending receive from the FTDI device.
06/Dec/2010 02:37:27.659: LOG: Resending message. Send attempts: 2
06/Dec/2010 02:37:27.722: LOG: Failed to read the number of bytes pending receive from the FTDI device.
06/Dec/2010 02:37:27.752: LOG: Resending message. Send attempts: 2
06/Dec/2010 02:37:27.787: USER: Disconnecting because there was no successful communication within the max time limit.
06/Dec/2010 02:37:27.802: USER: Disconnected
06/Dec/2010 02:37:27.806: LOG: Closing FTDI device.
06/Dec/2010 02:37:27.820: LOG: Send receive thread now terminated.
06/Dec/2010 02:40:57.411: LOG: Closing NefMoto ME7 ECU Flasher BETA 1.6.0.0
06/Dec/2010 02:47:16.680: LOG: Opened NefMoto ME7 ECU Flasher BETA 1.6.0.0

as a sidenote i did hve the Revo trial intalled before an has expired. if tis makes any difference.

That Revo tune should not be a problem. From what Tony has said, if the code to communicate the flash out is present on the ECU, it will spit it out to his software, and the software will write all the chunks to a file.

But back to the point. You will need to select a memory layout _before_ the software will let you click that button to read the flash out. I am not sure which chip the ECU of the B6 Audis have, but maybe there is info in the Wiki -- look there for it.

Once you load the right memory layout file, the gray button will become usable and you will be able to command the software to pull the flash to a file.

And a final remark. I have a B5 S4 Abox with an ECu that supposedly came from the factory with the stock program. Having done this before and successfully having pulled flashes from a different ECU that I have for this car, I have consistently failed to get the flash out and the software terminates with errors. Tony and I have been trying to figure out what is going on. Just letting you know that there may be an issue like that, but you'd get to a potential problem like this if you had successfully loaded a memory layout as I mentioned earlier.

i have tried each memory layout availabe in the 1.6 release (4 in all) and when i clicked verify memory layout it returns a failed each time. It will not lt me read or clear DTC's as well. From what i gather it has a 800 chip in it. His wicki states a 2002 conains a 800BB, BUT mine is  2003 not sure if it is still the same. Im hopeing i get to figure this out because i got some cool ideas id like to work on, to possibly add a couple new features to these ecu's.

ive devloped and sucessfully tested for the DSMS,
Antilag
Studderbox
Native wideband for the ecu
RPM activated switch off an ecu output.
converted the boost guage to read other engine peramaters
and a bunch more.
id really like to do something similar for the audi community.

I

The 800BB should be the right chip. Reading and Clearing DTCs does not require a memory layout. I think that functionality is simply OBD2 directives, not "programming mode" commands for the specific chip, which requires a memory layout.

Something else is going on. It sounds like you are having the same problems I am having. I cannot verify the memory either. However, when I load the wrong memory layout, it gives an error right away, while the correct memory layout (800BB for my car) goes a lot farther until an error is returned.

Nice work on those DSMs. I did not know that the DSM had such an advanced ECU. I am sued to the DSM from pre-OBD2 days, which a couple of friends of mine have turned into dragsters... I think we will all benefit from your work and experience. Also, the Motronic and the flashes that we use have plenty of empty memory to put your own functions. It may not be exactly easy to implement, but it is worth the try. Did you write assembler functions for achieving the modifications and augmentations that you mentioned?

I will PM Tony about this thread.

interesting, Why am i not able to read or clear DTC's then if a memory layout is not required? It returns a failed everytime i try to read DTC's and or clear them.

Also should i just try reading the flash, im a lil leary of trying to read the ecu if the memory layout is returning a fail, im not new to ECU modding, but these ECU's in the audi seem very picky and finiky i just really dont want to cause any problems.

All my work in the dsm world was done in ASM and compiled i then just put jump to commands in the orginal .bin via Hexidecimal and pointed them to a area of the .bin that was empty and wrote in my new assembled hex with the modifications.

Go ahead and read the flash with the memory layout loaded. It should work... Nothing will go wrong. When you start and stop a programming mode (reading the flash, etc) cycle power to the ECU with the ignition.

As for the finickiness and pickiness of the ECUs, it is the protocols that are important, not the chips. having said that, I cannot rule out problems because of noise in the wires, etc, which cannot be tackled by electronic means if they are a product of the physical layer of things. What I am saying is that errors may be a result of noise in the serial line from the OBD2 port to your "tester" (that is the laptop running the software).

Yup, I figured you had codes those new functions in just that way.

I suspect this is the issue:

06/Dec/2010 02:37:04.308: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: SecurityAccessDenied_SecurityAccessRequested
06/Dec/2010 02:37:04.359: USER: Start diagnostic session failed, ECU reports security access is required.

Ok, i will go out in a few and try and read this flash hopefully it works.
i still dont get why it will not read DTC's and clear them (not that i have any)
My cable works fin with VCDS so i dont beleve its an issue with the cable.

well i just loaded the 800BB memory layout and the 800BT memory layout and it does not read the stock flash.So KLS I think your right man, It tells me security acess is required. Attached is the log file generated.
============================================================
07/Dec/2010 09:03:10.617: USER: Switching to KWP2000 session.
07/Dec/2010 09:03:10.671: LOG: Opened FTDI device.
07/Dec/2010 09:03:10.693: LOG: FTDI device info - Description: USB <-> Serial Serial Number:  Device Type: FT_DEVICE_BM Device ID: 0x4036001 Device Flags: 0x0
07/Dec/2010 09:03:10.695: LOG: FTDI ChipID DLL is loaded, checking chip ID...
07/Dec/2010 09:03:10.715: LOG: Unable to read FTDI device chip ID
07/Dec/2010 09:03:10.763: LOG: Starting send receive thread.
07/Dec/2010 09:03:10.789: LOG: Send receive thread now started.
07/Dec/2010 09:03:10.795: USER: Disconnected
07/Dec/2010 09:03:10.842: USER: Connection attempt number 1.
07/Dec/2010 09:03:10.851: USER: Connecting...
07/Dec/2010 09:03:11.177: USER: Connecting to address 0x01.
07/Dec/2010 09:03:13.323: USER: Slow init succeeded.
07/Dec/2010 09:03:13.351: USER: Switching to KWP2000 session.
07/Dec/2010 09:03:13.662: LOG: Sent message with service ID StartCommunication
07/Dec/2010 09:03:13.698: LOG: Received message with service ID StartCommunicationPositiveResponse
07/Dec/2010 09:03:13.707: USER: Connected
07/Dec/2010 09:03:16.213: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:16.256: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:18.768: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:18.810: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:21.331: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:21.366: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:23.884: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:23.928: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:26.450: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:26.484: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:29.004: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:29.047: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:31.570: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:31.604: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:34.123: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:34.165: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:36.687: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:36.771: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:39.287: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:39.311: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:41.826: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:41.862: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:44.379: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:44.421: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:46.939: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:46.970: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:48.507: USER: Reading ECU flash memory.
07/Dec/2010 09:03:48.512: USER: Disabling Windows sleep mode.
07/Dec/2010 09:03:48.557: USER: Reading ECU identification option: calibrationEquipmentSoftwareNumber
07/Dec/2010 09:03:48.597: LOG: Sent message with service ID ReadECUIdentification
07/Dec/2010 09:03:48.650: LOG: Received message with service ID ReadECUIdentificationPositiveResponse
07/Dec/2010 09:03:48.661: USER: Read ECU identification option with unknown scaling record.
07/Dec/2010 09:03:48.686: USER: Successfully read ECU identification information
07/Dec/2010 09:03:48.692: USER: ECU reports programming session preconditions have been met.
07/Dec/2010 09:03:48.712: LOG: Starting diagnostic session type: ProgrammingSession
07/Dec/2010 09:03:48.731: USER: Starting diagnostic session.
07/Dec/2010 09:03:48.762: LOG: Sent message with service ID StartDiagnosticSession
07/Dec/2010 09:03:48.793: LOG: Received message with service ID NegativeResponse
07/Dec/2010 09:03:48.816: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: SecurityAccessDenied_SecurityAccessRequested
07/Dec/2010 09:03:48.822: USER: Start diagnostic session failed, ECU reports security access is required.
07/Dec/2010 09:03:48.846: USER: Restoring Windows sleep mode.
07/Dec/2010 09:03:48.858: USER: Reading ECU flash memory failed.
07/Dec/2010 09:03:51.315: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:51.351: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:53.870: LOG: Sent message with service ID TesterPresent
07/Dec/2010 09:03:53.913: LOG: Received message with service ID TesterPresentPositiveReponse
07/Dec/2010 09:03:55.497: USER: Disconnecting...
07/Dec/2010 09:03:55.539: LOG: Sent message with service ID StopCommunication
07/Dec/2010 09:03:55.578: LOG: Received message with service ID StopCommunicationPositiveResponse
07/Dec/2010 09:03:55.593: USER: Disconnected
07/Dec/2010 09:03:55.663: LOG: Closing FTDI device.
07/Dec/2010 09:03:55.671: LOG: Send receive thread now terminated.

Thanks for trying to help each other out guys.  ;D

The 2003 A4 will not let you start a standard diagnostic session if one is already running. This prevents reading/clearing DTCs, because my software always tries to start a standard diagnostic session when doing those operations. I have a bug fix for this, but the next release with it in it isn't ready yet.

The next release will also tell you why buttons are greyed out. Buttons get greyed out when the memory layout isn't specified, or the file to flash isn't specified. Validating the memory layout requires a memory layout. Reading the flash requires a memory layout. Writing the flash requires a memory layout and a file to flash.

The 2003 A4 also requires a different format for the security login when starting the programming session. A programming session is required when validating the memory layout, reading flash, or writing flash. I am currently working with the 2003 A4 owners that have contacted me about this problem. I have been sending them test releases with my best guess for what the format of the security login protocol is for this car. If you have run into this problem and have not sent me a PM about it, please send me a PM and I can give you a test release that will hopefully get us closer to a solution.

 ;D

sending you a pm now, can you please forward right away i will go out right now and test it out and report back!

OK Just to update Tony has sent me the test version of the new software and i have tried it.
I am now able to READ DTC'S and CLEAR DTC's, although i had none to begin with, those two functions worked now. However Validate MEM layout returns a failed and Read flash fails on both the 800BB and 800BT memory layouts. I have constructed a organized Log file that should be easy to follow, I recommend opening it in microsoft wordpad as this is what i typed it in. It is a Rich Text File (RTF). Perhaps some of you can possibly come up with some ideas.

Ok i just finished testing the new version of the software for tony, and finally it will read the ECU binary now. But Will not read it if you have any aftermarket software installed. If anyone needs the factory Bin for their 2003 audi 1.8t i have posted it in the original section. I am going to attempt to reflash over the revo trial so i have full original functionality of the ecu. i will report back to this thread to let you all know how it works.
Walter

I'll be interests in how this pans out :)

Ok, I was able to sucessfully reflash my 2003 audi A4 1.8T today using tonys beta of the new software. I installed a battery charger and let the battery top off on 10 amps before proceeding, i left the charger on during the reflash. (Stock file to overwrite Revo trial) i loaded the 800BB memory file (this still fails memory layout valadation however) i proceeded anyway despite the warning. (Slow init connection)loaded the factory .bin file that i uploaded to the original section and hit write to ecu. It turned out it actually worked and did overwrite the REVO trial that was previously installed. i then hit validate flash file with binary and it said it is good. However for some reason when i did the security reset (Letting the car sit for 10 min key on after i cycled the power the read ecu function seemed flakey. It would not read finally after a few tries it read the ecu and i saved the .bin and put it thru a hex compare and it was an exact match. Started the car after i let the throttleplate servo calibrate and the car starts and runs great. Believe it or not The car is actually got a lil more power then with the expired revo trial, which leads me to believe that after the trial expires your car is detuned from the factory file. hmmmmmmmm

Now since this works mostly, its time to start modding the binary file to get a lil more power out of this thing. who wants to work with me on this???

Glad to hear everything worked out. It's always nice when ECUs work after being reflashed.  ;D

I am working on putting the latest test release together into a full release. Hopefully it will be ready in the next week. This release is bug fixes and user interface improvements, no new features.

sounds good tony, email me when its ready. I am going to start modding the factory bin. Do you have a suggestion as to what program i should use that is free? i know win ols can do this but their interface is a lil wierd,and its just a trial version they want me to pay for their definition file.

I am going to dissassemble this as well after i make a tune i like and start writing some code for a few new features.

TunerPro is free, but kind of lame.
WinOLS is way way too expensive for the full version, but supports everything if you get all the modules and definition files.

Most people on the forum appear to be using TunerPro and cross referencing with the WinOLS demo.

If you sweet talk "spen" on the forum, you may convince him to auto generate a TunerPro XDF definition file for you.

I will be releasing my editing software at some point in the future. But soon is not the word I would use to describe the time frame.

Nice job guys.

Hi everyone:

I have an A4 1.8L turbo and I cannot read flash.

Requesting security access.
Received unknown message during security negotiation. Security negotiation failed.
Disconnecting...
Restoring Windows sleep mode.
Reading ECU flash memory failed.

Only using Slow connection because Fast cannot connect.

I really don't know if Tony's BETA software worked for you.  Also I cannot erase DTC's. 

ECU 0261207934
8E0909518AA
1.8L Turbo R4/5VT

Hope that info helps for future releases.

CU

 

Yes Tonys new version that is coming out will support this, The problem is your ecu uses a different security key. What year is your car? I have sucessfully tested the new version and it now works. perhaps if you send tony a PM he can let you test the beta, but that is up to him.

Walter

Same year as yours, 2003, no quattro version.  I will go and test it on an Audi A4 2004 just to see if the are different.  Both have the B6 chassis.  I hope Tony agrees to share the software so I can feedback him. 

Reading ECU info successfully on my audi a4 b6 2003 1.8t. Battery was connected to the charger during flash.
I had chosen ME7 29F800BB memory layout.

Read 5 ECU info entries:
   0x92, System Supplier ECU Hardware Number: 0261207934
   0x94, System Supplier ECU Software Number: 1037366494
   0x91, Vehicle Manufacturer ECU Hardware Number: 0x0D, 8E0909018A  , 0xFF
   0x9B, Calibration Date: 8E0909518AA , 0004, 0x03002CED, 0x00000000, 0xF777, 1.8L R4/5VT    ,  G01
   0x9C, Calibration Equiment Software Number: 0x00000000


When I'm trying to full read flash, it fails and says:

validating flash memory starts at 0x00800000 and ends at 0x00900000.
Validation failed, ECU reports that security access is not granted.
Memory layout validation failed.
Reading ECU flash memory failed. Trying to force ECU to recognize read operation is complete.
Finished forcing ECU to recognize that failed read operation is complete.
Reading ECU flash memory failed.
100% complete.
Restoring Windows sleep mode.

31.loka.2012 05:49:34.468: LOG: Received message with service ID: SecurityAccessPositiveResponse
31.loka.2012 05:49:34.468: USER: Security access granted.
31.loka.2012 05:49:34.468: USER: Validating flash memory starts at 0x00800000 and ends at 0x00900000.
31.loka.2012 05:49:34.468: LOG: Sent message with service ID RequestUpload
31.loka.2012 05:49:34.500: LOG: Received message with service ID: NegativeResponse
31.loka.2012 05:49:34.515: LOG: Received negative response for service ID: RequestUpload, with response code: SecurityAccessDenied_SecurityAccessRequested
31.loka.2012 05:49:34.515: USER: Validation failed, ECU reports that security access is not granted.
31.loka.2012 05:49:34.531: USER: Memory layout validation failed.

What should I try next.

You probably have aftermarket software installed.
Flash to stock.

I have had this car ~ one year. What car feels like and last owners said it has no aftermarket software on it. What I have been logging with vag-com, highest maf what I have seen is ~130kg/s at full throttle. But it can be some expired trial tho.
Ok, I need to upload the original file from original section and try to flash it to the ECU.
Is it 800BB layout in my ECU since I have not yet opened it.

Before you flash and potentially brick your ECU make sure you have a backup plan. I strongly recommend a MPPS cable so you can recover the ECU if needed.

OK, thanks for the advice! How about if I brick my ECU with flash and I have another same chip, can I desolder bricked chip out of my ECU and solde a new one with original .bin file? Does it work that way...just wondering.

Not so fast !

If the ECU has a encrypt borad you can read it normally, but when you try to write it will stop in any point and brick the ECU.

I had an 2001 S3 Yesterday like this, open the ECU and there was the board, desolded the flash and resoldered again, tryed bootmode with Galetto and MPPS  and could read, but not write anithing.

I finally desoldered again, programed externally and resoldered and job done.

If you have the tools to do so, sure, it will work if the software is exactly the same.
But boot mode is much easier...

I'm able to connect, and then read a little information, but I can't get much farther than this. I see .bin files posted by a few people, but I'm not sure if they've been able to do it through OBDII or if they're pulling their chips on this particular platform. It would be nice, as my intent is to decipher the SKC code.

Using Nefmoto 1.9.3.2

ECU hard 0261207939
ECU soft 1037366446
ECU Part 8E0909018A

16/Jan/2013 02:23:18.403: USER: Connected
16/Jan/2013 02:23:20.957: LOG: Sent message with service ID TesterPresent
16/Jan/2013 02:23:20.997: LOG: Received message with service ID: TesterPresentPositiveReponse
16/Jan/2013 02:23:23.490: LOG: Sent message with service ID TesterPresent
16/Jan/2013 02:23:23.531: LOG: Received message with service ID: TesterPresentPositiveReponse
16/Jan/2013 02:23:25.864: USER: Disabling Windows sleep mode.
16/Jan/2013 02:23:25.874: USER: Reading all ECU info.
16/Jan/2013 02:23:25.914: LOG: Reading ECU identification option: 0x9C
16/Jan/2013 02:23:25.944: LOG: Sent message with service ID ReadECUIdentification
16/Jan/2013 02:23:25.984: LOG: Received message with service ID: ReadECUIdentificationPositiveResponse
16/Jan/2013 02:23:25.984: LOG: Read ECU identification option: 0x9C
16/Jan/2013 02:23:25.984: LOG: Successfully read ECU identification information
16/Jan/2013 02:23:25.984: USER: ECU reports programming session preconditions have been met.
16/Jan/2013 02:23:25.984: USER: Negotiating communication timings.
16/Jan/2013 02:23:25.984: LOG: Reading current communication timings.
16/Jan/2013 02:23:26.054: LOG: Sent message with service ID AccessTimingParameters
16/Jan/2013 02:23:26.104: LOG: Received message with service ID: AccessTimingParametersPositiveResponse
16/Jan/2013 02:23:26.104: LOG: Set timing parameters to new values.
16/Jan/2013 02:23:26.104: LOG: Setting communication timing to defaults.
16/Jan/2013 02:23:26.164: LOG: Sent message with service ID AccessTimingParameters
16/Jan/2013 02:23:26.204: LOG: Received message with service ID: AccessTimingParametersPositiveResponse
16/Jan/2013 02:23:26.204: LOG: Reading current communication timings.
16/Jan/2013 02:23:26.284: LOG: Sent message with service ID AccessTimingParameters
16/Jan/2013 02:23:26.335: LOG: Received message with service ID: AccessTimingParametersPositiveResponse
16/Jan/2013 02:23:26.335: USER: Successfully changed to new communication timings.
16/Jan/2013 02:23:26.335: LOG: Starting ProgrammingSession diagnostic session with 124800 baud rate.
16/Jan/2013 02:23:26.335: USER: Starting diagnostic session.
16/Jan/2013 02:23:26.365: LOG: Sent message with service ID StartDiagnosticSession
16/Jan/2013 02:23:26.405: LOG: Received message with service ID: NegativeResponse
16/Jan/2013 02:23:26.415: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: SecurityAccessDenied_SecurityAccessRequested
16/Jan/2013 02:23:26.415: USER: Start diagnostic session failed, ECU reports security access is required.
16/Jan/2013 02:23:26.425: USER: Reading all ECU info failed.
16/Jan/2013 02:23:26.425: USER: 100% complete.
16/Jan/2013 02:23:26.435: USER: Restoring Windows sleep mode.

The skc isn't stored in the main flash. It's in the eeprom (95040). Use argdubs tool to read it.

Thanks for replying so fast ddillenger, I'll give it a try now.

getting farther with the Nefmoto read, I just need to pick a memory layout, but I don't see a corresponding one to my ECU. Has anyone been able to successfully read through OBD connection on North American 2003 Audi A4's?

Still can't get ArgDub to work on this, application returns error:
"Initiating communication ... FAIL. (error=0x01)"

800bb, obd reading shouldn't be an issue as long as the ecu is installed in the car with a matching immobilizer.

I have read my 2003 A4 using nefmoto just fine, I pulled a BIN but not sure if what i have is correct or not. If someone wants to take a look i can post it. I got the security error as well and had to change this option to bypass it.

There are 2 check boxes, I dont recall what i did, but whatever yours is at, do the opposite.

under the KWP2000 Settings
last 2 check boxes
Security Use Extended Seed Request mine is checked
Security Support Special Key mine is checked.

as for memory map I used ME7 29F800BB.MemoryLayout.xml

thanks guys, I was able to get it working with a suggestion I received from "jimmcgee5" to drop the baud rate down after connection and that worked.

http://nefariousmotorsports.com/forum/index.php?topic=3069.0title=