NefMoto

I don't mean to over simplify this, but I'm going into this with the assumption that you, the reader, have 0 prior knowledge of the subject.

For those of you that don't know, the immobilizer is a passive anti theft system used in various VAG (Volkswagen Audi Group) vehicles over the years. The ross-tech wiki

http://wiki.ross-tech.com/wiki/index.php/Immobilizer (http://wiki.ross-tech.com/wiki/index.php/Immobilizer)

has some very good information. This guide is designed for those who need information above and beyond what is offered there.

First things first. Do you have an immobilizer? If you own a north american b5 s4, or c5 a6<2001, the answer is no. The only reason you would want to keep reading is if you
1: have to work with an ecu that does have an immobilizer, 2: want to use a flash from a car that originally had an immobilizer, or 3: wish to retrofit an immobilizer to your car.

The immobilizer data isn't stored on the flash memory chip. Instead it is stored on a seperate chip in the ecu known as the 95040, and is 512 bytes in size. All me7 ecu's have one (later 7.1.1 ecu's use a different chip, but I'll go into that some other time) and it's used for adaptation settings as well as the immobilizer data. When you write a new bin to it, you will clear your adaptations. Lemmiwinks hacks beware.

Part 1. You bought a used ecu that has an immobilizer and want to install it into a car that doesn't.

Simply flashing a bin from a car that didn't have the immobilizer referenced in the programming (any North american s4) will disable checking, allowing you to run a mismatched ecu. If you do this the contents of the 95040 are irrelevant. Any used ecu that came from a vehicle containing an immobilizer must be flashed in bootmode initially as attempting to flash over obd will result in nefmoto reporting "security access rejected", or "conditions not met". In addition, the large connector has a different guide pin. Simply snap it off (carefully!) in order to install it in your vehicle.

Part 2. You want to use a bin from an immo equipped car on a car that didn't come with an immobilizer.

Say you want to use an rs4 bin. Doing so will result in your car starting briefly and then dying, and may be accompanied by a DTC stating "engine start blocked by immobilizer". This condition isn't covered by the ross-tech wiki. The solution to this is to write the 95040 with a bin that has been modified so as to disable the immobilizer. Argdub's tool is great for doing so.

http://nefariousmotorsports.com/forum/index.php?topic=1168.0title=  (http://nefariousmotorsports.com/forum/index.php?topic=1168.0title=)

You should do this prior to flashing the ecu, as once you do nefmoto will no longer be able to connect, as the ecu will report "security access rejected" until the 95040 has the proper pertinent data. A immo-off bin is attached.

Part 3

You want to retrofit your North American S4 with an immobilizer.

This requires several things. The first is a bin that references the immobilizer (or an immo equipped ecu), along with a 95040 bin containing the SKC you want to use. For simplicity's sake lets say the rs4 k-box, and the 95040 bin attached here, although any a6 bin from 01-02 will also work. The second is an instrument cluster from an immo2 equipped car. Ideally it would be best if you got a cluster that matched the ecu, but this isn't always possible. If your cluster and ecu aren't a matched set, you will have to adapt them so that they match.

http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_Immobilizer_Swapping_(Instrument_Cluster) (http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_Immobilizer_Swapping_(Instrument_Cluster))

You can retrieve the SKC (secret key code) from the ecu by reading off the 95040. This code is required to login with VCDS in order to adapt the rfid chip in the key. Basically you're giving the key permission to start the car. If the rfid chip doesn't match the ecu, even if the ignition turns the car won't run. If you open the bin you read from the 95040 with a hex editor, the SKC is a 5 digit code and is located at 0x32, and 0x33. The format is as follows:

Digit 1=0
Digits 2-5 are bits 32 and 33 reversed and converted to decimal. EXAMPLE: Bit 32 is b5 and Bit 33 is 15. Since the format is to put bit 33 before bit 32 we end up with 15b5. Convert that to decimal and we get 5557. Ad a zero in front and our SKC is 05557. I suppose you could change the SKC to whatever you wanted (then convert it to hex and change bits 32 and 33 to reflect the new value), but remember, anytime you make changes you need to update the checksum. An explanation is available in the thread containing argdub's tool I linked to earlier.

(http://i46.tinypic.com/bioy7d.jpg)

Now your ecu and cluster should match, and we have the SKC. Every car I've seen thus far has had the RFID receiver coil around the ignition lock cylinder, but you might want to ensure your's does. If not, you will need to install one. A picture of what I'm referring to is attached below.

(http://i50.tinypic.com/2jbmgyc.jpg)

Next is adapting the keys. First, take your key apart. There is a philips screw beneath the audi emblem on the back. Remove the screw, pull the battery/remote section off and gently pry the key apart. It has a spring inside, so be careful. Buy a blank key for an immo3 equipped car (2001 a6) and insert the RFID chip (glass cylinder)

(http://i47.tinypic.com/juyeqq.jpg)

into your existing key. Now we can finish the adaptation. Again, the ross-tech wiki is very handy. The login code is your SKC.

http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_Key_Matching_(Cluster) (http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_Key_Matching_(Cluster))

If all goes as planned, you now have a working immobilizer in your NA s4.

Keep in mind this is a work in progress. Any questions, post! Suggestions? PM me.

great writeup!

The informations regarding the SKC were new to me.

Thank you sir  :)

May I suggest another scenario:
Installing Immo3 ECU into another Immo3 car (in my case: swapping ECU between two 2002 Audi Allroad 6 spd).

a) Just flash the 4Z7 907 551 L stock ECU with an S4 (non immo) tune from this forum list
b) Make stock ECU work on other car (beyond my current skill level (newbie); would need someone to walk me through step by step)

(read NOTE at bottom)

As long as you currently have the car, and the immobilizer is functioning, you can just use nefmoto to write an m-box bin to the ecu. Then it's irrelevant what is on the immo eeprom, as the m-box doesn't reference the immo in the software.

This becomes more complicated if all you have is an ecu, as in order to flash (via obd without bootmode) you need the ecu to be installed and adapted to/in the car.

So, if the car is currently running, just flash an m-box (or l-box for tips) to the allroad ecu. At this point the ecu will run whatever car it's installed in.

NOTE: make sure you have a me7.1 ecu, not 7.1.1. If you put an m-box bin on a 7.1.1 ecu, it won't work.

What I am trying to do is Part 2.


I just want to be sure I am understanding this correct. This is for a 4.2 V8. The file I am trying to write to my ECU has a immobilizer. Current ECU does not. I will use argdub's tool and load your 'no immo' bin. After that, I will flash my ecu using the regular nefmoto tool with the file I want (with immobilizer) and this will defeat it

YES! Just in case, here's another immo-off bin.

I would love to run say RS4 bin in my allroad but I am too heavily invested in S4 M-box (logging variables, NLS, etc, etc) to make a switch... now if there was a magical switch that we could flip and make M-box immo aware... I wouldn't be surprised if it was possible as euro S4s do have immo stuff...

What ecu's did 95040 come on all me7 anyothers ?

I honestly don't know. I know there were some me7's with other ic's, but I haven't really dug into it that much. This is a work in progress, I'll keep it updated.

nice post, ive always wanted to add the immo into a NA s4, i had a post about it long ago here, but it didnt gain too much traction.

I wonder what chip on say an a6 cluster holds the immo info, and wonder if that can be programmed to the na s4 cluster so you dont have to change it.


I would think the guys running the rs4 cluster would benefit from this info as they can simply switch to an rs4 code and utilize the immo.

Well, I can tell you the immobilizer data is stored on the eprom that stores everything else-mileage, adaptations, etc. If you erase that eprom, the car won't start any longer, and you'll have a blinking immobilizer light. I'm trying to get my hands on a spare immo-cluster to hack into, but so far no luck.

According to Bentley service manual, all MY2001 and up Audi and VW chassis in NA had IMMO generation III, excepting the following:

• B6 Passat (MY2006 and up) IMMO generation IV
• MkV Golf, GTI, Jetta, Eos and Rabbit (MY2006 and up) IMMO generation IV
• Phaeton MY2007 IMMO generation IV
• New Beetle MY2007 IMMO generation IV

• Audi A8/S8 (MY2004 and up) IMMO generation IV
• Audi A4/S4 (MY2005 and up) IMMO generation IV
• Audi A6/S6 (MY2005 and up) IMMO generation IV
• Audi A3 (MY2006 and up) IMMO generation IV
• Audi Q7 (MY2006 and up) IMMO generation IV

Prior to MY2001, the only Audi equipped with IMMO (generation III) was the 2000 A8/S8. The MY1998-MY2000 A4/S4/A6/S6/TTs had no IMMO systems.

I am going to post the reference table when I can get a screen grab. I have been rebuilding my XP laptop this weekend after crashing the HD Thursday.

If this is accurate, and the generation corresponds with the IMMO version, e.g. generation III is IMMO-3 or IMMO-III, then recoding a replacement ECU to work with existing IMMO-3 cluster requires a secure one-day-only 7-digit pin from the WIN2 system in the dealer service department.

I likes it very much that the first tune I received from J.Fonz was coded with IMMO deleted. Saved me a huge amount of headache.

Or perhaps I am overly intimidated by this.

 :-\

I have a couple of IMMO-3 clusters laying about. I can send you hex dumps from all of them if that helps. The IMMO serial number is a 14 digit value stored on the cluster's EEPROM. the IMMO serial number is not the same as the IMMO PIN or the SKC. The cluster EEPROM also stores the Vehicle VIN, and as you noted above, the mileage as well as a number of adaptations.

Just as there are developing ECU tuning whizzes in residence on this site and others, there are similar sites with dedicated cadres of cluster tinkerers, veterans that can look at cluster hex dumps and rewrite whatever is needed to adapt. It was was my original speculation that perhaps there was a similar, abbreviated hexidecimal stack within the ECU that corresponds with this cluster EEPROM on IMMO-3 equipped cars, allowing for the two to handshake and let authorized users start the card successfully. In reading a bit more about the depth of the ECU bin files, and the 95040 EEPROM, I am very disoriented at this point as to where the critical info on an IMMO-3 ECU would be stored.

Do you have matching ecu's for any of the clusters? It would be great if I could get the ecu eeprom dumps as well!

If you don't have the ability to pull the bins, LMK. I'd be willing to do it/ship the cluster back (or buy it if the price were right-bad LCD not an issue).

I have the OE ECU bin from my car 3B0 907 551 DB and the VDO FIS cluster dump from the same. They are attached.

I have a copy of VAG Tacho and a working cluster bench harness, so I can pull my original V6 MFA cluster dump if it would be of value.

If you want a primer on reading cluster hex values, you might try polo-mk3 on ukpassats.co.uk. He seems to know where all the Easter eggs lie.

Keith-the eeprom I'm referring to isn't the main flash (29f800bb), but rather the 95040 that stores immobilizer data/adaptations/skc. Having the contents of the 95040 as well as the cluster dump would help me identify where the skc is stored in the cluster, and how it interacts with the rest of the systems.

The file I'm looking for (off the ecu) is 512 BYTES in size (very, very small). It is stored on a small SOIC-8 chip on the ecu (labeled 950403, on me7.5 it's on the bottom of the board, me7.1 the top).

OK that's what I was investigating at the end of last week when my ThinkPad HD crashed.

I think I understand what you may be looking for, I sure hope we can find it. If I am correct, you are looking for a set of corresponding values in the 95040 (which I located on my spare ECU) that would handshake with the cluster to authorize a key to start the car.

Problem is, IMMO-2 doesn't include the ECU in the mix, and IMMO-3 may use a PIN to recognize the cluster, key transponder and ECU are part of the IMMO loop, but the validation is carried out with a random 4- or 5-digit value sent from the cluster to the ECU and ignition lock sensor that has to be returned to the cluster after being processed by an algorithm that should be identical in all three components. if the three values match (the cluster calculates a return vaule from the same random number it sends to the ECU and ignition lock, then the cluster green lights ignition.

The SKC may have the power to re-scramble that algorithm with every authorized installation as part if its runtime processes. If it does, then the needles we are searching for int he proverbial haystacks are not going to be consistent unless they are searched for in a working cluster eeprom and coordinating 95040 eeprom bin.

When I sent my OE ECU off to J.Fonz to rescue my SC install from the inadvertently applied Tiptroinc bin, I am afraid he may have altered my 95040 eeprom in the process. Or perhaps he didn't, and I will be able to pull it down from the ECU when it arrives later this week.

Hmm-it's commonplace for tuners to (for lack of a better word) "tag" the 95040, altering it's contents (even nefmoto does this) but I honestly can't see any of them doing something as irresponsible as erasing the immobilizer data. It's always a good idea to back up the eeprom prior to tuning just in case. When you get it back read it off, the procedure is outlined in argdub's thread (linked here).

Your assumption is correct, I'm looking for some insight into the relationship between the ecu and the cluster. A matching set would make life MUCH easier :)

Well suffice it to say that at least some magic beans are in the 95040. I flashed the Tip tuned ECU on my desk last week with the bin from my OE 3B0 907 551 DB and it will not start my car now because the IMMO has been triggered. I would have though the Galletto boot mode dump transplant would have made a clone of my OE ECU, but there is some secret sauce to sort out on the 95040 before it will let my horses run. ;)

That's the thing. Galletto, nefmoto, etc-all they do is copy the main flash eprom, not the 95040. That's your responsibility to make a backup of (It's not really made that clear). The poor me7.1.1 guys end up with cars that won't start all the time after flashing.

So my ThinkPad is back from the dead and better than ever with a new HD and a whole lot more streamlined instance of XP.

I pulled the bin from my spare ECU's 95040 and here it is as png file and a bin file:

And also attached are an edited version where I changed the PIN code from 06909 to 08508. I then took note that the ECU stores the vehicles VIN number and IMMO identification (14 digits) further down the hex starting at 00B5 (the VIN is segmented, starts with WVWRH, and continues at the 00D0 address with 63B54P151235) and stranger still each segment repeats itself in the same starting offset of the following line (00C5 and 00E0).

In the example I pulled from my spare, the IMMO identification starts at 00DC (V) and continues from 00F0 through 00FC. It too repeats itself on the same starting offset ont he line immediately below (00EC and 0100).

I hope I have described the offset addresses correctly, but if I haven't the pictures are worth a thousand pardons.

My problem now lies in the checksum getting messed up when I make the changes. I have loaded the new bin in the EEPROM, and VCDS throws an ECU EEPROM error. I reloaded the original bin to the EEPROM, and the ECU thinks my VIN and IMMO identification are the values from the spare ECU's donor chassis and cluster.

Is there any way to figure out how and where the checksums are in this tiny file? If I were to hazard a guess, I would say they are the last two or three bytes in each line, since the longer data words are getting segmented. Am I correct about this?

All you need to know is attached young grasshopper.

 ;D

I found a similar utility and it worked beautifully, but there is deeper voodoo to be solved apparently. VCDS now reads the correct VIN and Immo Identification in the Extra Field on scanning, I an have to assume that is a good thing. But the Immo is still actively locked. Something is not matching up.

Virgin eeprom dump attached. Writing this to the eeprom will allow you to complete adaptation of the immobilizer as though the ecu were new from the dealer.

dd: a request: can you edit your OP to reflect another case.. i.e. i want to tune my immo-enabled ecu and preserve the immo (and immo-enabled ECU main flash)

If i understood your pm right: nefmoto is VERY picky about flashing cars with immo enabled. 1) it wont work on a bench 2) it is timing sensitive etc.

So your advice seems to be: back up the eeprom, and overwrite it with immo-off. Tune car (flash reflash etc etc). When done, restore the eeprom, re-enabling the immo.

or, alternately, use a virgin eeprom image (assuming you have one or can generate one), and readapt the ECU

Does this sound right?

My experience has been removing the ecu from the car, defeating the immobilizer, flashing it, and re-installing it is usually the best way to avoid drama. My 2001, and 2002 are both VERY finicky about flashing in the car-sometimes taking 5-6 minutes to complete a flash, failing multiple sectors, restarts, etc. On the bench, They flash in a consistent 3:00 without fail.

If you want to keep your immobilizer active (keep in mind this is only possible if you are using a flash from an immobilizer equipped car-flashing an m or l-box bin will bypass all immobilizer functions), my advice is to back up the 95040, defeat the immobilizer, flash it, then restore the original 95040 (or use the virgin dump I've attached 2 posts down and complete adaptation as though it were a new ecu).

Backing up the eeprom prior to flashing, then restoring it also has the added benefit of not having it tagged with "nefmto" (not that it matters, but I don't like anything modifying an immo-equipped 95040 for many reasons)

I really hope Tony returns (more than that, I hope he's ok) and approves a subforum for immobilizer/cluster posts. I think with all the questions, it would be beneficial.

This sounds like a promising idea. Just put this on the 95040 in the ECU and connect to car, run VCDS IMMO adaptation as if ECU were new? Hopefully that process can be done without the 7-digit SKC...

Josh emailed me earlier this evening that my manual transmission ECU is on its way back. He had to make a whole new definition file, so I am going to be sending my SCAudi.com buddies to talk to him now when they want more WHP.  8)

(http://i45.tinypic.com/25qxap2.jpg)

Thanks Dazq. This worked brilliantly. No IMMO block on my IMMO-3 equipped Passat once I put this on the 95040. Worth noting, I did no changes to this file, loaded as you have posted it here. Had the same effect as IMMO defeat, VCDS says IMMO not active.

UPDATE:

I ran into something earlier today I thought I'd share. If it happened to me, it could happen to you.
Allroad owners(and BEL a6 owners as well), pay attention.

Prerequisites:

You've read this thread and understand how to pull your eeprom data.
You have a hex editor

The immo-off files in this thread won't work on the me7.1.1 allroads. If you flash one, you'll get a
p1640, EEPROM error. The only option here is to off your own file. You need to get out your trusty hex
editor, and browse to locations 12 and 22. The values in these locations will be 01, indicating an
active immobilizer. Change these to 02, and you have off'd your file. Chances are you're doing this on a used ecu, now is the time to correct the vin if you'd like. It's location in the eeprom dump is obvious. When you've finished modifying the file, correct the checksums (for simplicity's sake I have attached the tool to do so. Big thanks to the creator, and 360trev for re-writing it.) Flash the off'd file, and you're good to go.

This next part is for those of you that have either:

A: Had APR flash your ecu and turn it into a brick
B: Flashed a file with a bad checksum

If either of the above has occurred chances are you have ended up with p0601, memory checksum error,
and been unable to clear it. No amount of flashing in the world will solve this, the code is stored in
the eeprom, not the main flash. Pull the eeprom bin, and whip out your trusty hex editor. Browse to
offset 1c.

(http://i45.tinypic.com/2czwork.jpg)

If you have the previously mentioned DTC chances are the value stored in this location (and
right below it in 2c) will be 01, or 33. You need to change these values back to 00 to clear this code.
Afterwards, correct your checksums and flash your fixed file back to the ecu. p0601 will be gone.

Usage instructions for 95040sum:

1. Save the exe into your user directory (C:\Documents and Settings\usernamehere)
2. Place your eeprom bin into the same folder
3. Open up a CMD line, and type: 95040sum (name of your eeprom).bin (desired name of corrected file).bin
4. Click enter

Example:

95040sum eeprom.bin fixed.bin

The checksum corrector, and an IMMO off'd bin compatible with ME7.1.1 is attached.

Big thanks to K0mpresd for allowing me to bounce Idea's off of him throughout this. Appreciate it.

Thanks for the info about the code.

The attached immo-off has worked for me on four different ME7.1.1 ECUs.  All running 4Z907551R or N software.  Also worked on a 551S but I had other issues ('programming not finished' error) so can't vouch for consistency.  The ME7.1.1 uses a 5p08c3 rather than 95040, but 95040 file does work given that half of the 5p08c3 isn't used.  Another option...

I can't for the life of me find the thread the file was originally posted in, but credit to whomever modified it to begin with.

I flashed every immo-off file I had. Every time, the ecu coding field was all 0's, wouldn't allow changes, and was stuck with the eeprom error code. I finally just Off'd my own bin (don't ask me why I didn't do this to begin with, I just got in the habit of flashing a universal off) and cleared the death code and all was well. The immo-off bin I attached is the one I created, I filled the vin and immo-id portions with placeholders and corrected the sums.

In any event, I'm not unfamiliar with the Immobilizer, but this threw me for a loop. I figured why not update the thread as it seems more and more me7.1.1's are being tuned.

:)

Your way is more correct, immo (sorry, bad pun).

Oh, just remembered, the file I posted will require that cruise be recoded.

Try my immo-off next time, It should work without any additional coding. I pulled it from an R-box that read out as S, and modified it accordingly. My goal with this thread is a one stop shop for all me7 Immobilizer research. As such, I'd love feedback on ways to make it better, along with results!

why would you not use the original bin each time? using a "universal" file is such a bad idea. it will get you in trouble one day. and i think that day was yesterday. it takes about 5 seconds to modify the original bin.

When you're right, you're right. But to be honest, I'm glad I did run into this. Had I not, I couldn't have written this up. It was a bit frustrating, I'll give you that. :)

24c02 Immo & checksums
(https://dl.dropbox.com/u/17128887/deathcode/24c02_off_zps9216f180.png)

Great info friend. But does this apply to all M382, M383 and M592 Immo II ecus????

I don't have the answer to that, this is just an illustration of the patterns of usage that I've seen thus far that have worked.  trial and feedback is the best way to know for certain.

the image was generated to give pictoral reference to the structure of the 95040.
If i've crossed up a few details, please let me know, and I'll fix them.
cheers

(http://i83.photobucket.com/albums/j318/Cyril279/95050_explained_zpsa3d0abec.png)

I have next situation I bought a spare used ME 7.5.10 ECU and I don't have its pin code, I know my original pin code from the ECU I have now on the car. If I install the spare ECU in the car and try to start - the immo will come on . In this particular case is it possible to read over OBD not in bootmode the content of 95040 chip with ArgDub tool ME7_95040 in order to decode the pin from the spare ECU

In other words:

Has somebody succeeded to read the content of 95040 chip with ArgDub tool ME7_95040 over the OBD port from an ECU not matched with the cluster?

esilviu,
This is a relatively small board, whose members take the time to read through most if not all of the threads.
Posting the same question in different locations within one hour will not help the amount or quality of feedback that you receive.

Post once, give the board some time to respond, and in the meantime, enter "site:nefariousmotorsports.com [your question]" into google for the best results.

I appreciate the specific nature of your question, but most questions about eeprom-over-OBD using argdubs' tool, end in "bench-and-bootmode it"

-Cyril

Thanks for you fast reply :(

Next 7 bytes after pin code (0x34-0x3A & copy in 0x44-0x4A) is a immo key which links cluster with ecu.  
In example above it's 69 D9 38 E6 D3 B2 71. When cluster is bind, same key is stored in the cluster. To make cluster linked with ECU you just need to make these byte sequences equal. Read from cluster and write into ecu without any adaptation. Or read from ecu and write into cluster, but then you will need to rebind your keys ;) This is very helpful when you try to bind incompatible cluster and ecu or you constantly get an immo error. Instead of just immo off this is better solution.

So, as I have an Euro S4(from Portugal), if I want to have a spare ECU I have to choose one 8D907551 ECU or one from S4wiki list with the same type of transmission, then flash a M-box file to disable IMMO with galletto and after that reflash the same M-box file with nefmoto to clear "Error is P0601- Internal Control Module - Memory Checksum error." DTC.
Last step should be Cluster and Engine recode.

Am I correct?

I think you must change 1 or 2 bytes for that error.

You don't need to reflash to clear P0601 unless you currently have the code. Just make sure you never flash a file with bad checksums, and you'll never have to concern yourself with P0601. People make a big deal out of it, when it's not.

I only think that because off this
and on  Part 1. you said that it must be flashed in bootmode.

besides that, Cluster and Engine recode will be necessary, right?

best regards

The s4 wiki should be changed to say if you have P0601 bootmode flashing will not clear it. If you don't have it, then don't worry.

Ok, I am waiting my "new" ECU to come, then I leave here my feedback
 
many thanks

So i have a 2001 a6 manual with immobilizer. From what i read if i under stand correctly if i flash with a m-box tune ill be good to go correct? or am i reading it wrong lol.

You read correctly.

Thanks

Any chance that this tool will ever be updated to deal with 95160 2kb bin's?

It already has. Read the entire thread about it :)

I was looking everywhere last night to see if there was a thread on it but I came up short witch is why I posted. I tried using the tools I did find and all I get is the following:

<sub>C:\Users\*****\Desktop\New folder>95040sum.exe 95160.bin 95160off.bin
EEPROM 95040 Checksum calculator 1.01

■ Opening '95160.bin' file
■ Getting length of '95160.bin' file
■ Allocating buffer of 2048 bytes
■ Reading file to buffer
■ Validating size correct 2048=2048
■ Closing file

file must be 512 bytes</sub>

or

<sub>C:\Users\*****\Desktop\New folder>"95040 Checksum Calc..exe" 95160.bin 95160off.bin
EEPROM 95040 Checksum calculator 1.0

Error executing program:
EEPROM file must be 512 bytes in size. Yours is: 2048 long.</sub>

I was not able to see any special instructions or another tool posted anywhere for 95160's. Was it integrated with something else? I kinda feel like an idiot here. I really don't want to pester others but could ya point me in the right direction?


*** Update - the math finally clicked and I IMMO off'ed my EEPROM manually fixed the check-sums so this is no longer a worry. But it would be nice to know if I ever need to play with the SKC.

Hi folks

Apologies if I hijack but I have a spare ME7.1.1 ECU that I want to match to my IMMO3 cluster.  There are however two issues that I need to overcome:

1. IMMO3 has been disabled in the EPROM
2. It has an AMD tune on it

Now I wish to keep my existing keys and re-enable IMMO3 whilst, if, and its a big if, keeping the tune.  

I have an ME7.1.1 bench harness, FTDI CABLE, registered VCDS, Galletto and VAG-Commander 2.5 all working and have no issues with getting the ME7.1.1 ECUs I own into boot mode.

Please correct me if I am wrong - As my keys are matched to the existing cluster in my vehicle I cannot update my cluster VIN and IMMO ID but instead would need to replace the immo id and VIN numbers in the IMMO3 off EPROM contents?   I'm however guessing that the AMD tune will be tied somehow to some content in the immo3 bin and hence altering to match my cluster will likely prevent me from using the AMD tune?  


Thoughts?

EDIT: I just pulled the immo3 bin from the ME7.1.1 AMD tune ECU and it essential appears to have been 'blanked'.  Rather than set it to the re-matching mode (and hence risk losing info that the AMD tune may 'hook' onto) would it be possible to just dump in my VIN, IMMO ID and a new PIN?

Hello folks.

I am new here and looking for advice. I have an Allroad Japan spec 2.7T 7.1.1 BES engine code, bin number is 4Z7907551Q.

I will be removing this engine to go in a B5.5 Passat. Originally I had planned on fitting and then having immob portion re-adapted to Passat cluster.

It seems however that my 4Z7907551Q bin is not supported, or I should say has not been tuned yet on Nefmoto. Would my correct route be to flash the ECU while currently in the Allroad with a bin file that doesn't require Immob?

Please go easy as I am new and willing to learn, also very willing to try and give back to the platform with finidings...

i have the BIN file that I read today if that is of any help?

Regards,
Barry

Few observations on eeproms:
- 512kb Immo3 eeproms seem to always start 20 20 20 20 20
- the R32 1024kb eeprom posted by n1cky starts 30 30 30 30 30
- Immo2 eeproms seem to always start 12 68 30 [14/17]
- The 14/17 indicates how many blocks of FF padding there are in the middle of the bin, 14 has pages 10-16 padded with FF, 17 has pages 12-14 padded with FF.

EDIT: This may be BS - I've just looked at an eeprom for a 551R (euro a6 2.7t) and it starts 12 68 30 17, has different non-checksummed padding blocks to a standard immo3, but has the normal immo3 data (SKC, cluster code, vin, etc).

hi, firstly I would like to thank everyone for all their hard work.  I just found this forum.

im swapping a 2.7t APB into a 2000 facelift 40v D2 a8.  also going 6 speed

the a8 uses immo3, and from what ive read I need to get an 01.5+ a6/allroad immo3 2.7t ecu.

ive also gathered the immo 3 systems need the ecu, key and cluster to all play nice together.  but also read conflicting info that the ecu immo could be defeated and car still start.  the keys and cluster are all original a8 items.

so I need to pull the immo 3 info and get it onto my ecu. correct?

not looking to be spoon fed (work on the road = plenty of nights to read/research),  just need  a gentle kick in the right direction

In your case, I'd just run the M-box and leave the immobilizer off. It'd be the easiest way.

so, if I get the  immo off in the ecu, itll start with just key and cluster?

if so woooohooooo :)

Correct.

last Q, so if itll run w/ immo OFF in the ecu, do I need a disabled immo3 2.7t ecu or a non immo willwork?

This might have been asked before but can you ever go back to the original binary dump from an ECU with immobilizer enabled?

For example, flashing a M/L bin to a 2001 Allroad and than going back to the original ME7.1 file? TIA. Cheers!

Do you mean change the flash bin, then write an immo-on EEPROM back on? So you still have a working immo, but have a different map?

If so, yes, provided the bin supports immo (m-box does not)

Yes, that's exactly what I meant.

What if I don't backup and write the immo-on EEPROM back? Would the original EEPROM be lost forever after flashing with a m-box?

Thanks!

Edit: I downloaded the EEPROM and was able to find the SKC, this is after loading a L-box into the ECU's flash memory. And so I think the eeprom will always be there unless it's overwritten.

Is that were the immo on/off is on all ME7 ecu's

I want to be able to hex edit the immo off as i find that way easyer

Thanks

this could help me with mine. WIll it allow it to then run as a pair? I have paired the keys to the dash, but not dash to ecu
http://nefariousmotorsports.com/forum/index.php?topic=6807.0title=

Iirc you need the skc, immo Id and cluster code to be matched between the cluster and ecu.

My 1.8t would not pair, despite putting in the skc, so I just cloned the data, after which I could match keys (they need to be new transponders). in your case I would clone the data from the cluster into the ecu, as it's easy to correct the checksum in the ecu.

which bit of the data do i need to extract to clone into ecu?

That's the bit I'm stuck with
I'm using the Virgin_95040_053.bin file and this included file.

I cannot sus which bit of the dash info to clone into the esquare

I have an issue i hope you can help me out with.
I bought a 2003 Audi A4 1.8T last week, the owner told me some locksmith had started the process to program a new remote to the vehicle but he ended up de-programming the Immobilizer.

I have VCDS and was able to program the remote, but not the Immo (No SKC)
I turn on the car and it stays on for about a second, then the flashing key comes on the cluster.

Your instructions are amazing. I know i need to obtain the SKC to program the Immo but I just dont know how to read the 95040  off the ECU. I have an idea of how to do it, but not exactly.

I also came to a stop when i didn't know the ECU had to be on BOOT mode.

How do i accomplish BOOT mode?

Thanks in Advance Sir!

You can use Argdubs tool to read the 95040; but the ECU will need to be in bootmode to WRITE the modified file.

Bootmode is covered in here a million times, on the 1.8t you'll likely need a 10k resistor, a wiring harness, female OBD adaptor.  Bootmode and flash the edited 95040 with Argdubs tool.

And yes, you cannot flash if it's not in bootmode.

Thank you Sir!
Something like this?
http://www.audizine.com/forum/showthread.php/445065-how-to-build-a-bench-flash-boot-mode-harness-for-your-me7-ecu ;D

Does this mean all BEL Allroads (I've got an '04 BEL) are me7.1.1? If NOT, how do I find out? Or does it matter if I only need to read (not flash) to get the SKC?


I just want to get the SKC ("PIN" to login with VCDS) to pair new keys. Only got 1 when I bought the car and the stealership wants way too much for a new key. Got a deal on some blanks & remotes (on e-bay) as well as new ID48 chips (from Germany not the ones from China). From what I gathered I need the NefMoto software and a cable to just dump the bin (off the ECU or the EEPROM?) to find the SKC. I guess I'm a little confused as I thought the 95040 is the EEPROM... I don't think I need to worry about flashing or bootmode, just read. Also on another thread it looks like the HEX-NET is not able to be used to read the bin, correct?

I've spent a good part of the day reading various things that got me here and I've read thru this thread as well as a few others (on this forum). I think I understand, but definitely want to make sure before I mess it up. FWIW the ECU has an MTM chip (I'm guessing that only matters for a tune not getting the SKC).

Thanks for the help!

All allroad or A6 BEL (US anyway?) are ME7.1.1.  May not be ST10, but are 7.1.1

The 95040 (actually most likely a 5p08c3) is indeed the EEPROM -- not the main flash.  It's been quite a while, but I don't recall having any issues reading using ARGDUB's tool (BEL A6).

So do I need ARGDUB's tool & the NefMoto software? Or can it be just one or the other (ie can I read what I need with just the NefMoto software and/or is ARGDUB's tool stand-alone [I think it is])? Sorry if I seem dense, but this is a "new" realm for me and it may take a bit for it to all make sense to me. I just didn't want to pay Audi $200+ for extra/spare keys :(

Thanks for the help!

ARGDUB's tool to read the EEPROM (writing is via bootmode or test clip or desolder), the NefMoto software to read and write the flash (but doesn't sound like that's your goal at this point).  A fair number of people use Vag K+ Commander to pair keys.  There's a copy of v2.5 here, about half way down the page:  http://nefariousmotorsports.com/forum/index.php?topic=3155.0

Thanks! As I was reading more yesterday I think I finally got a good idea of how to proceed. I'll look at the Vag K+ Commander and see how that looks. Either way looks like I need a different cable as from what I understand the HEX-NET (even with usb attached) can't/doesn't do dumb mode :( I appreciate the help and pointing me to other options!  Thanks!

Edit: Used ARGDUB's tool to dump EEPROM (using a basic e-bay US made cable) & TURBOAT's 95040 Tool (http://nefariousmotorsports.com/forum/index.php?topic=6134.0) to extract the info (instead of trying to find & extract it myself in a hex editor). With the SKC I just programmed with my HEX-NET.  Again thanks for the help getting me pointed in the right direction and getting my head around what I needed to do. :)

A little research has yielded me no results on this, but where in the flash does the software reference the eeprom for immo? If the ECU is a non immo ECU (2000 MY) and you flash an immo bin on it, why is it immobilized? The new flash must reference the immo somewhere and therefore should be able to be corrected in the flash. The upside to this is not having to screw with the 95040 and not having to pull the ECU for bootmode. So anyone know how to modify the flash bin to eliminate the immo reference?

hi guys. looking for help to wake up my touareg 1.
I'm starting a thread here:
http://nefariousmotorsports.com/forum/index.php?topic=13927.0title=

may you know if this procedure is the same procedure for me7.5 ecu with changing variables in hex for death code avoidance p0601  4b0906018da me 7.5 ? or the immo similar i have used eeprom prog tool and it kicks a p0601 after laying in a box put up for awhile any and all knowledge is appreciated....

My 04 A6 s-line came with AA software and I want to flash it with the 551r software. So, if I'm understanding this correctly, I don't HAVE to disable immo in order to just flash a 551r file as long as the ecu is in the car and currently has a working immo. Is this correct?
It's it also correct that it might be safer to disable immo before flashing a 551r and making changes, then reactivating it after I'm done with all of my adjustments?
I don't really have a need for the immo, so I wouldn't be heartbroken to just have it off permanently. Just wanting to make sure I have this right before doing anything. Thanks.


Edit: Nevermind, I found the answer on here. I can flash the 551R bin without disabling the immobilizer while the ecu is in the car.

Ok, I can't quite get a read on this. What needs to be done to not get the flashing key in the dash on an immo2 car with a non-Immo tune. In this case, ME7.1 allroad with mbox flash. I need new keys and don't want to have to spend money on transponders, and obviously don't want the dash light.