NefMoto

I have an rs4 8D0907551F here which was previously mapped by a tuner and I want to get a backup of the file as it has recently been rebuilt and I would like to map this car for a friend. Ecu is in the car with the instrument cluster and it starts.

I have tried nefmoto I can read the ecu info etc but when I select read flash I get the following:

12/Feb/2013 07:03:39.836: LOG: User Prompt - Title: Confirm Full Read ECU Flash Memory Message: If you are ready to read, confirm the following things:
1) You have loaded a valid memory layout for the ECU.
2) The engine is not running.
Note: Some non-standard flash memory chips may prevent reading the flash memory.

Click OK to confirm, otherwise Cancel. Result: OK
12/Feb/2013 07:03:39.837: USER: Disabling Windows sleep mode.
12/Feb/2013 07:03:39.860: USER: Reading ECU flash memory.
12/Feb/2013 07:03:39.892: LOG: Reading ECU identification option: 0x9C
12/Feb/2013 07:03:39.896: LOG: Sent message with service ID ReadECUIdentification
12/Feb/2013 07:03:39.942: LOG: Received message with service ID: ReadECUIdentificationPositiveResponse
12/Feb/2013 07:03:39.944: LOG: Read ECU identification option: 0x9C
12/Feb/2013 07:03:39.945: LOG: Successfully read ECU identification information
12/Feb/2013 07:03:39.951: USER: ECU reports programming session preconditions have been met.
12/Feb/2013 07:03:39.952: USER: Negotiating communication timings.
12/Feb/2013 07:03:39.953: LOG: Reading current communication timings.
12/Feb/2013 07:03:39.955: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:40.002: LOG: Received message with service ID: AccessTimingParametersPositiveResponse
12/Feb/2013 07:03:40.004: LOG: Set timing parameters to new values.
12/Feb/2013 07:03:40.005: LOG: Setting communication timing to defaults.
12/Feb/2013 07:03:40.059: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:40.098: LOG: Received message with service ID: AccessTimingParametersPositiveResponse
12/Feb/2013 07:03:40.099: LOG: Reading current communication timings.
12/Feb/2013 07:03:40.163: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:40.204: LOG: Received message with service ID: AccessTimingParametersPositiveResponse
12/Feb/2013 07:03:40.206: USER: Successfully changed to new communication timings.
12/Feb/2013 07:03:40.208: USER: Requesting security access.
12/Feb/2013 07:03:40.239: LOG: Sent message with service ID SecurityAccess
12/Feb/2013 07:03:40.280: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.281: LOG: Received negative response for service ID: SecurityAccess, with response code: GeneralReject
12/Feb/2013 07:03:40.284: USER: ECU reports that security access request was rejected.
12/Feb/2013 07:03:40.287: LOG: Starting ProgrammingSession diagnostic session with 124800 baud rate.
12/Feb/2013 07:03:40.288: USER: Starting diagnostic session.
12/Feb/2013 07:03:40.319: LOG: Sent message with service ID StartDiagnosticSession
12/Feb/2013 07:03:40.362: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.363: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.402: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.403: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.442: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.443: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.482: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.483: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.522: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.523: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.556: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.557: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.596: LOG: Received message with service ID: NegativeResponse
12/Feb/2013 07:03:40.597: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
12/Feb/2013 07:03:40.634: LOG: Received message with service ID: StartDiagnosticSessionPositiveResponse
12/Feb/2013 07:03:40.636: LOG: Setting communication timings to defaults.
12/Feb/2013 07:03:40.637: LOG: Set timing parameters to defaults.
12/Feb/2013 07:03:40.638: LOG: Changed diagnostic session type to: ProgrammingSession
12/Feb/2013 07:03:40.639: LOG: ECU requesting specific baud rate: 124800
12/Feb/2013 07:03:40.640: USER: Successfully started diagnostic session.
12/Feb/2013 07:03:40.641: USER: Negotiating communication timings.
12/Feb/2013 07:03:40.642: LOG: Reading current communication timings.
12/Feb/2013 07:03:40.693: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:40.696: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 0 of 9 bytes.
12/Feb/2013 07:03:40.697: LOG: Expected: 07 83 02 32 28 6E 14 0A 72
12/Feb/2013 07:03:40.698: LOG: Read:     F0 F0 81 99 94 FF 8A 85 F9
12/Feb/2013 07:03:40.699: LOG: Clearing remaining expected echo bytes.
12/Feb/2013 07:03:42.704: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:42.705: LOG: Flushing 9 bytes from receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:42.706: LOG: Message received no replies.
12/Feb/2013 07:03:42.707: LOG: Resending message. Send attempts: 2
12/Feb/2013 07:03:42.757: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:42.760: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 0 of 9 bytes.
12/Feb/2013 07:03:42.761: LOG: Expected: 07 83 02 32 28 6E 14 0A 72
12/Feb/2013 07:03:42.762: LOG: Read:     F0 F0 81 99 94 FF 8A 85 F9
12/Feb/2013 07:03:42.763: LOG: Clearing remaining expected echo bytes.
12/Feb/2013 07:03:44.768: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:44.769: LOG: Flushing 9 bytes from receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:44.770: LOG: Message received no replies.
12/Feb/2013 07:03:44.771: LOG: Resending message. Send attempts: 3
12/Feb/2013 07:03:44.821: LOG: Sent message with service ID AccessTimingParameters
12/Feb/2013 07:03:44.824: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 0 of 9 bytes.
12/Feb/2013 07:03:44.825: LOG: Expected: 07 83 02 32 28 6E 14 0A 72
12/Feb/2013 07:03:44.826: LOG: Read:     F0 F0 81 99 94 FF 8A 85 F9
12/Feb/2013 07:03:44.827: LOG: Clearing remaining expected echo bytes.
12/Feb/2013 07:03:46.832: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:46.833: LOG: Flushing 9 bytes from receive buffer due to P1 ECU response inter byte time out.
12/Feb/2013 07:03:46.834: LOG: Message received no replies.
12/Feb/2013 07:03:46.835: LOG: Failed to send message 3 times, message send failed.
12/Feb/2013 07:03:46.836: LOG: Did not receive any replies to message.
12/Feb/2013 07:03:46.842: USER: Reading ECU flash memory failed.
12/Feb/2013 07:03:47.347: LOG: Sent message with service ID TesterPresent
12/Feb/2013 07:03:47.350: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 0 of 4 bytes.
12/Feb/2013 07:03:47.351: LOG: Expected: 02 3E 01 41
12/Feb/2013 07:03:47.352: LOG: Read:     81 BF C0 C0
12/Feb/2013 07:03:47.353: LOG: Clearing remaining expected echo bytes.
12/Feb/2013 07:03:47.608: LOG: User Prompt - Title: Reading ECU Flash Memory Complete Message: Reading ECU flash memory failed. Result: OK
12/Feb/2013 07:03:47.610: USER: 100% complete.

I have soldered a switch on the ecu for boot mode and I can confirm that it does get into boot mode as when it is held for 5-10 seconds when ignition is switched on nefmoto can no longer get a read on it but galletto says boot mode inactive.

What else can I try to read the file off it? I don't dabble too much into euro ecus so don't stock much equipment for them really.

Could it be the previous tuner has done somethiing (more than likely) so that flash cannot be read? nothing has been soldered/desolder on the ecu.

Have you tried it with pulled dash- and radiofuse?
Tried it on the bench with less voltage?

Please try argdubs 94050 tool to see if bootmode is working.

Boot mode has to be done on bench, forget it in the car, you will never get through the cluster.
Pulling fuses, forget it, won't work.

Damn it, I'll see if I can get a hold of the ecu harness to make a bench rig. I have the powersource already PS-9KX 13.8 volt regulated supply.

So is it because the tuner has applied some form of encryption that I cannot get read using nefmoto?

I just checked and I am unable to get it into bootmode on the car as nefmoto does not connect in "boot mode"

The problem is not the ECU, it's the cluster. Forget boot moding anything with Euro immo cluster in car.

Nefmoto wont work because of the NOREAD tag?

No, because seed key was changed it seems.

NOREAD only keeps you from opening the file with winOLS.

If you want to open the file once you get it, just load it into a hex editor, search for any instances of NOREAD in ascii, and FF them out. Then, open with winOLS.

NOREAD keeps MPPS from pulling the file thatswhy i thought nefmoto flasher behaves this way.

Back to topic

It does not keep it from pulling the file, just keeps you from saving it. Open process memory and search for NOREAD.
If that no longer works, it is possible to hook the cable driver ...

Right, i remember to bypass this and copy the image from the memory somehow.
And there is the noread hack mpps.exe

But Nefmoto Software didnt care about noread tag, right?

I don't think nefmoto cares. But in this case seed key was changed.

Nefmoto doesn't care one bit about noread. I have read files from ecu's and been unable to open them with winOLS, had to change the NOREAD tag.

Got it to read using a spare harness on the bench in boot mode.

So now I have a backup of the original can I just flash a stock file and be able to flash over obd with the ecu in the car? or will I have to remove the immobiliser as well? I did a search but this wasn't as clear.

If you want to flash on the bench, you will need to disable immobilizer. PRJ has repeatedly said that flashing earlier cars via obd doesn't work so well, so I would assume you can't flash via OBD (at least reliably). Make a backup of the eeprom, then disable the immobilizer, flash your file, and finally flash the original eeprom data back to the ecu, thus preserving your immobilizer functions. (I'd wait until the tune was dialed in first, that way you don't have to disable the immo before every write).

On another note, I'd love it if you could get me the .bin from your cluster. The software required to do so is in a sticky entitled "Bench flash s4 gauges with vag com" or something similar in the immobilizer/cluster section. If you get a chance, post it (and the matching eeprom) in the cluster dumps section!

Is it this thread?

http://nefariousmotorsports.com/forum/index.php?topic=3205.0

does vag commander read the 95040 as well?

You don't if you use a proper tool.

Yes, it does. I've read my ecu and cluster with this tool & it works well.

cluster file and eeprom are posted in the cluster dumps.

O.K I need a little clarifcation sorry for asking this again, If I disable the immo in the 95040 will I then be able to flash over obd?

No, you will not be able to flash over obd (from what I've read, the cluster will kill communication). Removing the immobilizer allows you to flash on the bench.

I am trying to flash a different file onto this ecu I have disabled the immo in the 95040 but I still cannot flash with nefmoto on the bench. What am I doing wrong?

Connecting to address 0x01.
Slow init succeeded.
Switching to KWP2000 session.
Connected
Disabling Windows sleep mode.
Writing ECU flash memory.
ECU reports programming session preconditions have not been met.
Reasons preconditions failed:
-Immobilizer not authenticated
Stopping because programming session preconditions have not been met.
Negotiating communication timings.
Successfully changed to new communication timings.
Requesting security access.
ECU reports that security access request was rejected.
Starting diagnostic session.
Unable to properly start diagnostic session, attempting to continue with current undefined session.
This can occur if the security lockout is running, or the engine is running. Please turn off the ignition and retry if this continues to fail.
Negotiating communication timings.
Too many consecutive unsolicited messages from ECU, disconnecting.
Disconnecting...
Disconnecting because no response was received for the Stop Communication message.
Disconnected
Writing ECU flash memory failed.
100% complete.
Restoring Windows sleep mode.

never mind I forgot to change a couple of bytes to disable immo in the 95040. sorted now.