NefMoto

Hi everyone.

Would anyone know interchangeable the MED9.1 2.0 TFSi ECU’s are?

Here’s my scenario. I want to make a spare MED9.1 ECU, that I can use for testing both on the bench and in the car and keep my original ECU as a backup. I’m not worried about a perfect clone, quite happy with an IMMO-OFF spare that will start and run the car.

I cannot open my original ECU to BDM it. I can ODB read it as much as I like, but opening up the case is not an option.

Reading other threads on here, I think I can:

1)   Get a spare MED9.1 ECU
2)   Open the case and BDM-read everything (full read)
3)   Take the resulting BDM-read files and find/pay someone to IMMO-OFF them
4)   BDM write these files back to the ECU (full write)
5)   Then in theory, after the steps above, I have an IMMO-OFF ECU on the bench I could ODB write my original ECU’s .bin to. Or use BDM to do a partial write of just the .bin?

So my questions:

1)   Can the spare ECU come from any 2.0 TFSi motor of a similar year with a part code of XXX 907 115 (e.g. does it matter if the donor is VW, Audi, Seat, Skoda?)
2)   Would ODB / partial-BDM write of my original ECU’s .bin to the freshly prepared IMMO-OFF ECU overwrite the IMMO-OFF and take me back to square one?

Bear in mind I haven’t used BDM before or tried anything like this previously. Just an enthusiast. Be kind  :D

My original ECU details:

Audi S3 2.0TFSI 265HP 8P Model Year 2008

VCDS scan:
Monday,11,November,2013,13:02:26:53506
VCDS Version: Release 12.12.0 (x64)
Address 01: Engine
Control Module Part Number: 8P0 907 115 H
Component and/or Version: 2.0l R4/4V TFSI 0050
Software Coding: 01030003180F0060
Work Shop Code: WSC 06314

Advanced Identification
Serial number: AUX7Z0GNFNQ0NG
Identification: RB8-658
Revision: 5BH16---
Date: 13.11.07
Test stand number: 1360
Manufacturer number: 0129
Flash Status
Programming Attempts: 0
Successful Attempts: 0
Programming Status: 00000000
Required Conditions: 00000000
Software
A000
A4.8.6
Misc.
Hardware number: 8P0 907 115 B
Immo Challenge: AB 17 95 39

Bosch ECU Hardware ID: 0261S02342

The 2.0 TFSI MED9.1's are all the same at a hardware level. No worries there.

Once the immobilizer is defeated (need both the eeprom and flash) you are correct, the ecu is able to be benchflashed, or whatever else you want to do.

PM me when you're ready.

There is no need to defeat the immobilizer...
Just read and write the eeprom by BDM.

He says he is unable to open the ecu for any reason :P

Get the pin code of your car and the 2nd ECU, recode the 2nd ECU to your car.

All, thanks very much.


Yep, that's the constraint I have to work with.


I thought the pins codes were only applicable to the Immo 4A devices? After reading the Ross-Tech immobiliser wiki, I got the impression that later Immo 4B was not supported. But I'm guessing and also I don't have the pins to begin with :(

http://wiki.ross-tech.com/wiki/index.php/Immobilizer#Immobilizer_Generation_4


Sorry for all the noob questions but curious why you have to immo-defeat both the eeprom and the flash to start with? I'll try and explain what I mean.

1) Start with my eBay ECU
2) Extract the contents with BDM - eBay_ECU_eeprom.file and eBay_ECU_flash.file
3) Immobiliser Off - eBay_ECU_eeprom_immo_off.file and eBay_ECU_flash_immo_off.file
4) Write these back to the eBay ECU with BDM

Now the eBay ECU boots up and allows bench access etc. But since I would want to take the flash from my own car which I read with ODB (carA_ECU_flash.file) and load it on the eBay ECU via ODB, am I not just overwriting eBay_ECU_flash_immo_off.file with carA_ECU_flash.file which isn't Immobiliser Off and thus it won't work?

Or is it a case of the eBay ECU won't boot up without matching eBay_ECU_eeprom_immo_off.file and eBay_ECU_flash_immo_off.file to begin with, but then once it boots I can write whatever I want to it (carA_ECU_flash.file, carB_ECU_flash.file etc) over ODB and it's own internal subroutines do the housekeeping so subsequent reboots of eBay_ECU_eeprom_immo_off.file and carA_ECU_flash.file are fine to boot from?

Could I shortcut things at step 3 above by getting eBay_ECU_eeprom_immo_off.file and carA_ECU_flash_immo_off.file and BDM writing these to the eBay ECU instead? Or do the eeprom and flash files need to come from the same ECU before you can Immobiliser Off them? Some discussions here http://nefariousmotorsports.com/forum/index.php?topic=1068.420

Much appreciated and thanks for your patience. I appreciate you must be tired of explaining the same things over and over again...

You're going to have to modify your current file with the immo-off data contained at 6C00. If not, you can just do a data area write, which leaves that area intact.

As for why you need both the eeprom AND flash, that's just how most people do it.

dd is probably one of the most patient guys around when it comes to that.

In any case, I'm impressed enough with your work so far that I don't think it is too much to ask of us :)

Especially if you intend on making a nice writeup on everything MED9 you've learned :)

Thank you, that’s probably the nicest thing someone could have said  ;D

Good news, spare ECU is ordered and on it’s way from eBay. Should arrive midweek!

(it's part number 8P0 907 115 AE but should be suitable as per dd)

 :D

I was trying to explain to someone what I was trying to do with my ECU and realized it might be worth mentioning a few background concepts. If you’re reading this you probably know it already though! Feel free to comment, it would be nice to be as clear as possible ;D I haven’t mentioned K-Line since I’m concentrating on MED9.1

ODB read / write
This uses the KWP2000 protocol over CANBUS to communicate with the ECU. The ECU has to be booted up and working properly  to start with, plus this communication is protected with security access before you can request the ECU to read out the contents of the memory or write new data to the memory. There are several memory IC’s on the ECU circuit board, plus the memory inside the main microprocessor itself. ODB cannot access all of these memory contents. You don’t have to remove the ECU from the car or open up the casing, you can simply connect to the ODB diagnostic port in the car which is networked via CANBUS to all the various ECU’s in the car. Typically if you do remove the ECU from the car and try to access it on the bench using ODB, you can read but not write as the ECU cannot see the other immobiliser components (instrument cluster) and denies write access. Hence immobiliser defeat is necessary for ODB write bench access.

Examples of tools
•   MPPS
•   Galletto

BDM read / write
This uses the JTAG physical connection that is found on most ECU circuit boards, but to get to this JTAG connector, you’ll need to remove the ECU from the car and open up the case (which is normally sealed with anti-tamper bolts and some kind of security girdle making it pretty obvious that you cracked it open). This JTAG physical port gives you access to all the IC’s on the board (it’s there for test and programming on the assembly line after all) and the ECU doesn’t have to be up and working. It doesn’t use KWP2000 or CANBUS, but rather connects directly to the components on the circuit board. No security access to worry about either, since you are going in at such a low level that the OS on the ECU hasn't even started up yet! You’ll need some kind of frame or jig with spring-loaded pins to press up against the solder pads on the circuit board or solder on some kind of header yourself.
http://en.wikipedia.org/wiki/Background_Debug_Mode_interface
http://en.wikipedia.org/wiki/Joint_Test_Action_Group

Examples of tools
•   BDM100


Since the JTAG connection physically connects to all the IC’s on the circuit board, you’d use BDM to read and write the memory that can’t be accessed with ODB. If your ECU is in a sorry state and won’t even boot up and start communicating over ODB, then BDM is what you’d use to refresh the contents of the memory IC’s on the PCB by writing directly to them. If you have a second-hand ECU like I’ll be getting, without any corresponding immobiliser components, BDM is your friend.

My BDM arrived and I installed it last night. It’s a second-hand clone from eBay so I didn’t have high expectations and was a bit wary of what software I might inadvertently be installing! However, I found a fairly neat solution (I think). I installed a product called Oracle VM VirtualBox and then loaded a copy of Windows XP SP3 as the guest virtual machine. Then I installed the BDM in the Windows XP3 virtual machine and it seems happy enough, plus it’s boxed off in its own little environment where it can’t get up to any mischief  ::)

So I have a couple of questions. I can see that you can either do a Single File (which I assume is a full read of everything it possible can into one big file) or alternatively Advanced (individual files for External Flash, MPC5xx Flash, Serial E2Prom)

What are these various memories (External Flash, MPC5xx Flash, Serial E2Prom ) and what’s typically contained within them?

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8246)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8248)

Basano,
I'm just beginning my journey down the MED9.1 path... could you possibly post a link to the BDM tool you bought?  did it come with the spring loaded header thingy to actually use on the ECU?

Thanks!

Excellent!

I'm glad to hear there's more interest in this ;D

This is the BDM I ended up with:

http://www.ebay.co.uk/itm/BDM100-ECU-Tuning-programmer-ECU-Reader-flasher-BDM-100-/151018490383?pt=UK_Diagnostic_Tools_Equipment&hash=item2329674a0f

It did come with CMD software which seemed incomplete but at least had the drivers. Google will also find CMD 1255 software you can download which is what I did.

Don't ask me how the three little PCB's supplied with it are meant to fit, they don't even connect to the ribbon cable! (wrong gender) and there's definately no spring loaded pins ??? I'm going to try and make a spring loaded adapter myself using something like these:

http://uk.farnell.com/harwin/s25-212/receptacle-2-54mm-wire-wrap/dp/9960279   
http://uk.farnell.com/harwin/p25-0123/probe-pointed-2-54mm-pitch/dp/9960210

There's also some information on the bosch pinout here:

http://www.jtagtest.com/pinouts
http://www.tek-tronics.co.uk/BDM100.pdf

Had a mixup with the spare ECU I ordered, it arrived tonight. Correct part number as advertised but the small print on the label said MED17.5 :( Ooops. So that one has been relisted on eBay and another ECU ordered and I've checked the photo of the label carefully this time (MED9.1).

Cool! Just ordered one! i saw in the long MED9 thread someone recommended this: http://www.ebay.com/itm/BDM100-ECU-spring-loaded-probe-adapter-12-position-/250430088180?pt=Motors_Automotive_Tools&hash=item3a4ecbe3f4&vxp=mtr so i ordered one of those as well.  Looks like the Bosch pinout is 14 pins, but i'd bet 2 pins probably aren't used. 

The BDM frames on ebay come with the pogo pin adapters that work well with the chinese BDMs. That's what I did!

I use the chinese BDM all the time. This is coming from someone who owns a real one-lol

You will have to solder the pins in place.
Just a heads up.

Thanks! What's the rationale behind the soldering?

Spent a bit of time looking at the pinouts (as much as I could without physically having the ECU and BDM frame in front of me) and wrote it up here:

http://nefariousmotorsports.com/forum/index.php?topic=5024.0title=

But curious about the soldering as it looks like the spring loaded pins have worked in the past?

It's those spring loaded pins that need to be soldered to the little green board.
You just get several boards with the BDM stand and a bag of the spring pins.
It's up to you at assemble them.

Ah, gotcha. (sorry, I though you'd meant some soldering on the ECU PCB itself)

That's fine if it comes flat pack. I should be able to solder the spring pins onto the BDM PCB's.

Thanks

Hi all,

Spare ECU arrived on Friday ;D (this time around it really was an MED9.1 thank goodness). It also still had the connectors and an inch of wiring harness attached which is nice since I can reuse them a bit later.

Some pictures attached so you can see what I'm talking about (login to see the photos).

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8305;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8307;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8309;image)

I began by removing the shear bolts that hold the clamps in place around the connectors. I drilled out the bolts, starting with a 2mm drill bit and working up (in hindsight, I may have been better off using a hacksaw to cut a slot in the bolt head and using a screwdriver since I had to use some gas pliers and eventually a screw extractor to get the stumps out). Clamps off and then the locking slides on the connectors can be moved and the connectors come off.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8311;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8313;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8315;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8317;image)


Good grief man, but how painful is it to open these things!!!

I took it slowly and carefully, but even so... I first heated the ECU in the oven at 60 degrees celsius for 10 minutes (I reckoned this was safe enough since the engine bay probably approaches this on a hot summers day). Then I used a broad spatula to lever up the sides. I weighed things up and chose to use a spatula instead of a screwdriver since I wanted to apply the pressure along the whole side, not just at a single point like a screwdriver. The spatula didn't leave any marks on the casing either which was neat and tidy.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8319;image)

As I levered up each side, I inserted a flat bit of metal in each corner to keep it up. A knife blade did it nicely for me. Then once I had all four corners raised, I could slip a knife into the gap and run it down gently, slitting the silicon. I didn't push the blade in very deep in case I nicked the PCB and components.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8321;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8323;image)

It was still tricky since the PCB inside was sticking to both the top and bottom cases (silicon). But a bit of patience and gentle pressure meant I eventually got the case off as you can see.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8325;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8327;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8329;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8331;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8333;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8335;image)

Question - when you re-assemble it, do you put a bit more thermal compound on? That's the white stuff you can see. Also, do you put any new silicon on? It could get pretty messy...

I'm truly glad this is a spare ECU since I would be pretty nervous to try this first time on my own ECU. Maybe you get better with practice, but the whole experience needed quite a lot of brute force.

BDM frame should arrive this week and and I'll go about setting it up when it does.

To get the bolts off:

Take an angle grinder, make a cut in each bolt.
Take a hot air blower, heat them up, until you can use a normal flat-head screwdriver to undo them.
Much faster than what you are doing :P

I would not bother with the white compound.

Yes, the method prj suggested works good, I would also recommend to do it that way.

Only difference is I use a dremel with a small cutting wheel.
Makes for a sharp groove and allows a tight fit with the flat-head blade, so no slipping and ruining of tools.

On the last MK6 GTI I did the bolts could be unscrewed right away, no heat needed.
Those bolts are stupid shit, totally useless.

Thanks guys,

BDM will arrive this afternoon, so will try and assemble it (understand I'll have to solder the pogo pins myself).

Remember the connectors and inch of wiring harness? I used those and made my bench harness.

With a bit of trepidation I plugged in my VCDS and scanned the ECU - it lives! Looks a bit frankenstein - lying there on the table all exposed with VCDS plugged in. Lots and lots of fault codes (obviously since it's not plugged in).

To answer another question I saw raised, the freeze frame data in the fault codes had the mileage, even though there's no cluster or anything else attached. So it must be remembering this mileage somewhere.

Thanks for the info on mileage! I was asking about that in the med9.1 thread. I'm still curious if it keeps track of the mileage in the ecu though. I guess it does unless it reads the mileage from the cluster for freeze frame data (unlikely). If you can post your bdm read of your spare and the mileage in freeze frame maybe I can find the location of the mileage.

Thanks!

Some pictures of the setup I’ve put together.

Bench harness to connect ODB tools to ECU. I used the connector that came with the ECU to build it. The DB9 connector lets me tap into the CAN BUS wires to monitor the traffic. The little PCB is my general purpose sniffer / ECU simulator tool ;D The other cable is a male to female ODB connector again with the CAN BUS wired to a DB9 connector. Really handy when plugging ODB tools into the car and monitoring what they are doing.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8362;image)

ECU powered up and connected to VCDS.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8364;image)

It’s alive!

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8366;image)

BDM100 clone tool, ODB clone flash tool and BDM frame. Still need to assemble the BDM frame :( never enough time. What is the point of the little PCB’s that come with the BDM100 clone ??? They look utterly useless.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8368;image)

Frame comes flat packed and you need to put it together yourself.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8370;image)

Spring loaded pins, have to be soldered to the little PCB.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8372;image)

Hoping to get BDM done soon so I can move ahead and get an immo-off file next.

Every day, a few more little steps.

well i finally got my spare ecu and managed to bdm read the whole thing. i also flashed it with the eeprom ad flash from a full BDM read of a GOFL R ecu i found on the interwebs.  not a bad sunday night! now i have to take the plunge and actually pull my ecu!

side note for OP (or anyone) - have you been able to find any immo off info?  seems it's possible, but no one wants to divulge publcly.  would be really nice to just immo off the spare ECU and not have to open my original  (risking damage).

-Jordan

FYI for ayone iterested. i used a propane torch to loose up all the sealant ad "securty" glue. you have to be careful wth it, but it allows for very directed heat (and works quickly)

It is possible, but the first person to publicly divulge it will likely be drawn and quartered.

Is it really that complex, or are people just hoarding the info? The fact that people don't want to share really makes me want to find out, then share lol

its not terribly difficult, however there is a certain level of lively hood involved, and med9 is still a profitable platform for many professional tuning firms.  These solutions are not freely available for some time likely.


Ill gladly give you the immo off solution for your golf R,  but you must tell me where you live :P

I guarantee no other person that posts on this forum can turn the immo off by altering the eeprom contents only, which means that they don't understand how it works and uses the copy and paste method.

I see your guarentee, and raise you Rarak.

I am a copy/paster fwiw.

Hi all,

Looks like it was a productive weekend :)

I made some progress myself.

I soldered the spring loaded pogo pins to the PCB. If you have a look at the photo, what I’ve done is use a few pieces of veroboard to hold the pins straight and parallel whilst I soldered them. I didn’t solder the pins to the veroboard, the veroboard has regular holes at a pitch of 2.54mm and just makes the pins stand up nice and straight.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8393;image)

My soldering skills are average on the whole but I was happy enough with the result.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8395;image)

BDM frame assembled and ready to read

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8397;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8399;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8401;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8403;image)

BDM read is working!

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8405;image)

Attached are the files I’ve retrieved so far.

Full CMD read (read_ecu)
Read of flash (read_M58BW016xB)
Read of serial e2prom (read_Serial_ E2Prom)
Log from CMD tool (CMD_1255.txt)
VCDS log (Log-WAUZZZ8P97A168790.txt)
ODB clone flash tool read (8P0907115K.Bin)

The VCDS log also has the freeze frame data and mileage, for the chap who wanted to look into that :)

BDM read of flash and ODB read of flash are identical, which was expected (two different ways of getting the same data).

Thanks for the comments on the immobiliser off. That’s exactly where I am now  ;D

So to avoid treading on anyone’s toes or inadvertently upsetting anyone, what’s the etiquette for requesting or paying a member of this forum for immobiliser off files  ???

I can understand that the member would probably not want their work published for all and sundry to reverse. I respect that. But in the months to come, as I progress I would probably want to post my bins for comment? Especially when I get stuck. If the immobiliser off solution is modifications to both e2prom and flash, would it still be OK to post the flash for review (but not the e2prom)? Would that be OK with people?

This is what I’m trying to do. Remember I’m constrained in that I can’t open my own original ECU to BDM read it. I can ODB read it as many times as I wish though.

Where I am now:
spare_ecu[spare_e2prom + spare_flash]

Where I want to be (I think):
spare_ecu[spare_e2prom_immo_off + my_own_flash_immo_off]

Secondly, what else is in the e2prom apart from the immobiliser data? I’m making a big assumption that I can just plug this spare ECU into my car with the changes described above. I'm sure I'll need to check and adjust the long coding, but what about any adaptions or other settings?

I know these are really basic questions  :-\ but I'm asking them to learn and putting them here so others can read the information as well.

Much appreciated.

You've put in some good effort, I'll set you up.

@Basano :

Check Your e-mail.

applauded  ;)

This is exactly why it took so long for me to get ME7 info. It was easy to find people who wanted to sell me info, almost impossible to find people who were ok with me giving away info they sold me.

So I took the more difficult route, and only talked to people willing to tell me things they were ok with me publishing.

In the long run, I'm glad I did it the hard way and that I told the fuckheads to eat a dick.

Haha I like your style!!

Thanks you all


email sent (yesterday)


Thank you very much! Please check your email. It will be a couple of days before I can try anything, but will give feedback as soon as I am able.


So true ;D That's why I've brought it up now, at the beginning. Like anyone else, I can always buy a tune. But what am I or anyone else going to learn from that really (although maybe you just want a tune). This way's more fun and ultimately satisfying for me personally. I've learnt loads already (the seed-keys and xor obfuscation (http://nefariousmotorsports.com/forum/index.php?topic=4983.0title=) for example) and found that to be pretty interesting. I shared it and hope that others found it interesting as well. I might never manage to do anything decent tunewise, but will have a lot of fun trying.

I was looking at the serial eeprom and wondering what else it contained (apart from the obvious VIN) ??? Spotted that the last 2048 bytes are a mirror image of the first 2048 bytes.

Then I got a bit distracted and realised just what this post (http://nefariousmotorsports.com/forum/index.php?topic=1068.msg23507#msg23507) was trying to explain about checksums in the serial eeproms :D Interesting read.

However my own assumption is that the pages in my example are 32 bytes in size and the last 2 bytes are the checksum. The checksum is calculated by adding the first 30 bytes together and then negating the sum.

Example 1
(0x01 + 0x03 + 0xDC + 0x9D + 0x56 + 0x20 + 0x04 + 0xDD + 0xBE +
 0x01 + 0x05 + 0x6F + 0xB1 + 0x48 + 0xD7 + 0xB3 + 0xE8 + 0xF5 +
 0x2D + 0x13 + 0x9E + 0xBC + 0x09 + 0x6A + 0x52 + 0x52 + 0x02 +
 0x1C + 0x03 + 0x09) = 0x0B42

0x0B42 = 0000 1011 0100 0010

Negate this (flip the ones and zeros)

0000 1011 0100 0010
1111 0100 1011 1101

1111 0100 1011 1101 = 0xF4BD (last two bytes)


Example 2
(0x05 + 0x03 + 0x38 + 0x50 + 0x30 + 0x39 + 0x30 + 0x37 + 0x31 +
 0x31 + 0x35 + 0x42 + 0x20 + 0x20 + 0x20 + 0x20 + 0x20 + 0x20 +
 0x00 + 0x00 + 0x00 + 0x00 + 0x00 + 0x00 + 0x00 + 0x00 + 0x00 +
 0x00 + 0x00 + 0x00) = 0x02F9

0x02F9 = 0000 0010 1111 1001
Negate this (flip the ones and zeros)

0000 0010 1111 1001
1111 1101 0000 0110

1111 1101 0000 0110 = 0xFD06 (last two bytes)

Picture shows what I'm trying to explain!

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8432;image)

There is a LOT of information and answers in this forum. If I look at some of the queries I posted, I'm cringing because they are the same questions everyone asks time and again, and they've already been answered! Sorry guys :(

So i took the plunge and removed my ECU.  i BDM read everything, then drove a couple miles, ad re-read.  to my suprise, data DID change after driving.  i haven't dug in yet to find out what change, but as far as i can tell, the mileage is not stored as i'd expect.  this may not even be what's changing.  It could be time or something like that.

On a side note.  i'm a bit worried about posting the full read siince it shows my VIN.  my car is still under warranty.  anyone have any thoughts on that?

Thanks!

screw it! i'm attaching the pre-drive and post-drive versions of my read.  both flash and eeprom have changes after drive.

BTW - the clone worked beautifully! I actually cloned my stock ECU, then drove the car a few miles on the clone, the re-read the clone.

there are a LOAD of differences.  I really am totally lost as to what these changes are.  MOST seem to be incremented by 1, the checksums updated where applicable, but theres also some section that are just wildly different.  mileage was 17,856 pre-drive and 17,857 post-drive.  i can't find data that looks like this ANYWHERE.

thanks for any help!

Hi oldcarguy85,

Thanks for posting the readouts! I was interested in this as well. I’ve taken a look and I see what you mean.

A few differences in the flash, but very small ones (increment/decrement by 1). This chap saw something similar (http://nefariousmotorsports.com/forum/index.php?topic=5366.0title=) as well.

The big changes are in the e2prom though? Lots of changes (which affect the checksum bytes like I discovered in my post above :) so that was handy)

Do you have any fault codes set? I’m guessing now, but I’m think these are the kinds of things that could be in the e2prom:

fault codes?
mileage?
date/time?
driving cycle readiness / test results?

Especially if you just drove a mile, the various tests might not have finished. But I'm taking a stab in the dark.

The changes in the e2p are most likely the adaptation channels.
The car learning values as it is starting from 0 when the battery is removed, or a new flash.

I got a bit further with my spare ecu. If you recall, I had this:

spare_ecu[spare_e2prom + spare_flash]

Another member contributed an immobiliser off version of the files (big thank you for that!):

spare_ecu[spare_e2prom_immo_off + spare_flash _immo_off]

But since I wanted an ECU that contained the maps from my own car, I combined the spare_flash_immo_off and my_own_flash to create an immo off version of my own flash. As dd posted earlier, I used a hex editor and copied the data at 0x6C00 -> 0x6FFF from the immo off file to my own flash file, overwriting that section of data in my own flash:

spare_flash _immo_off –> (from 0x6C00 to 0x6FFF) -> my_own_flash_immo_off

Then I wrote this to the ECU with BDM. In CMD I imported the flash and e2prom into a single file and wrote this file down to the ECU:

spare_ecu[spare_e2prom_immo_off + my_own_flash_immo_off]

I’m able to VCDS it on the bench and the part number now matches my own original ECU :)

I also checked this:

Immobiliser Status in VCDS
01 - Engine > Adaptation - 10 > Channel 91

0 = Immobilizer not matched (NEW)
1 = Immobilizer disabled
4 = Immobilizer matched (System OK)

My status was 1

I haven’t been able to put this spare ECU in the car yet. We are having very bad weather and it is always raining at the moment. When it lets up, I’ll swap it over and post the result.

Attached is my_own_flash_immo_off. I checked with the member about posting this and it’s OK.

He he I Can  ;D And not only in med9.1 also in MED17 and EDC17  ;D

Not really relevant unless you are willing to provide documentation.

Found a very good description of the eprom contents in the FDEF. Unsuprisingly in the section named:

FU EEP_CONF 5.150.0 EEPROM-Layout on page 4529

Screenshot attached, but all the detail is in the FDEF.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8554;image)

Can you post your BDM software for me? I need to reinstall and can't find my old whatnot :(

Thanks!

Done!

Finally finished off the spare ECU and installed it in the car.

The ECU in the car is located in the area by the windscreen wipers. To reach it I had to remove the wipers and plastic trim and then I could reach the ECU.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8595;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8597;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8599;image)

Removed the security bolts. It wasn’t any easier this time :( I tried cutting a groove with a hacksaw blade, but the groove ended up v-shaped and the screwdriver kept slipping out. Then I tried a screw extractor which snapped off in the head of the security bolt! Eventually I drilled the heads off, got the clamp out and removed the stumps with gas pliers.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8601;image)

Spare ECU back in and secured with some shiny new button screws.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8603;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8605;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=8607;image)

If you remember, this spare ECU has a copy of my own 2048kb flash, but the serial e2prom of the donor. I did two things whilst I had it on the bench.

1)   Checked the long coding
2)   Reset all the adaptation channels. From the Ross-Tech site “Channel 00 is a special case.  Performing a [Save] to Channel 00 resets all adaptation values to their original factory defaults”

The car started up and is working fine. No fault codes or any other visible signs that I’m using an immo-off ECU. I don’t have any dashboard lights or messages in the cluster. The only clue I could spot is in the advanced reading from VCDS. It no longer has an Immo Challenge.

Before:
Advanced Identification
    Serial number: AUX7Z0GNFNQ0NG
    Identification: RB8-658
    Revision: 5BH16---
    Date: 13.11.07
    Test stand number: 1360
    Manufacturer number: 0129
Flash Status
    Programming Attempts: 0
    Successful Attempts: 0
    Programming Status: 00000000
    Required Conditions: 00000000
Software
    A000
    A4.8.6
Misc.
    Hardware number: 8P0 907 115 B
    Immo Challenge: AB 17 95 39


After:
Advanced Identification
     Serial number: AUX7Z0G1FN80UJ
     Identification: BPG-810
     Revision: 5BH16---
     Date: 01.02.07
     Test stand number: 1849
     Manufacturer number: 0762
Flash Status
     Programming Attempts: 0
     Successful Attempts: 0
     Programming Status: 00000000
     Required Conditions: 00000000
Software
     A000
     A4.8.6
Misc.
     Hardware number: 8P0 907 115 B

Good work :) I'm glad that it worked :)

There is absolutely no need to put the connector cage back in. Just bin it.

Looking through the file and playing around with BDM / VCDS , this is what I seem to find up to now

0x007 & 0x012 : Production Date
0x085 & 0x0C5 : VIN number followed by serial number (2 times)
0x122 : Software revision
0x142 : Hardware number
0x18E & 0x1AE : Engine Coding
0x289 & 0x2A9 : Programming Attempts
0x28A & 0x2AA : Succesfull Flashes
0x295 & 0x2B5 : Seems to roll back an equal amount as my Programming Attemps go up. (inverse?)
0x296 & 0x2B6 : Same as above for succesfull Flashes

Concerning Checksumms : I found that 0x0080 - 0x00BF is 32 bytes, so sum of 30 bytes and checksumm is the last 2 bytes. Same in some other places.

Hope this helps some people, still trying to find more info, as i'm looking for a possible Immo-switch, SKC data, PIN, .... anything really.

Is the entry from 0x6C00 -> 0x6FFF applicable for all MED9.1 ECUs; i.e., can I replace the same in my MED9.1 ECU to defeat the immo?
epy

All early 2.0 ecus, yes. Not the golfR or the later models.

Very good, thank you. I have a spare 115G MED9.1 ECU, BDM100, and a bench stand on the way, so I will definitely try this now that you have confirmed it is correct.

epy

OK, got my spare ECU and BDM equipment in and also pulled my ECU out of my car. I read all the files off of both ECU's. The ECU from my car has been tuned using Maestro, and it will not open in WinOLS (is there a way to open it?). Here are the files.

Opening your (insert commercial tuner name here) file in winOLS is a grey area. While you fine tuned it, there is a lot more to the base file, code, etc, that Tapp intentionally doesn't include.

If you understand the ethical implications, and aren't bothered by IP concerns and really want to look at it, you can read it from the ecu, then import it into winOLS. Don't expect it to necessarily be the same version you're working on though. Commercial tuners are lazy and tend to use the same base on multiple vehicles even if it's not ideal. Also, don't try to modify it in any way, and disregard any checksum related errors.

Keep in mind, the fact that you're here already means you're lumped in with the rest of us thieves and impostors (if you listen to the peanut gallery).

If you've done this, and still can't open it (winOLS cannot open this file because it is already modified), then search for NOREAD with a hex editor and remove it (fill it with FF's). Then you will be able to open it.

Good news. I don't feel too bad about trying to read it, and am a little surprised that I can't read a Maestro file because I am the one that tuned it using Maestro. It isn't like I am trying to read what some other tuner did, unless you count dual personalities :)

Anywho, can you do me a solid and immo off the ebay read that I pulled? I am excited to keep learning and trying to work on the ME9 ECU. This thing is pretty damn cool.

Now I just need to get my car back together (the engine is sitting behind me right now).

epy

(http://i1073.photobucket.com/albums/w381/ericpaulyoung/348736F1-26CD-4EE2-B39A-07AF75293076_zpsyrhqwwmf.jpg) (http://s1073.photobucket.com/user/ericpaulyoung/media/348736F1-26CD-4EE2-B39A-07AF75293076_zpsyrhqwwmf.jpg.html)

Sure. Can you email it all to me? Can't DL right now.

You got mail :)

Also check out Lar's excellent program for e2p checksums and immo off:

http://nefariousmotorsports.com/forum/index.php?topic=5833.msg54763#msg54763

Nice. I will check it out.

EPY

Opening these MED9 boxes are not for the faint of heart or impatient types.  I bent the bottom of the case to shit and it made me bleed my blood.  Damn you MED9 ecu!  Damn You!  You've embarrassed me.

Good thing it was a spare ecu.

Wait till you try to open MED17 or BMW F series.

OMG

Even VAG MED17 are a pain..... , be extra ultra super careful opening a MED17  :o

I have 3 of them here from "slips" opening them with several resistors torn off the board!

If you think that's a pain then try opening EDC17CP45.

Best to put a dirty big hole in the back of those!

How are you plugging that big, dirty hole Rick?

Just a footnote to mention that I actually did manage to retrieve the e2p contents without having to crack open my original ECU and BDM-read it.

At the start of this thread, I wanted to make a spare ECU so that I could learn and practice, but still have my original ECU to fall back upon should I mess things up. To clone the ECU though, I learnt you needed both the e2p and flash and whilst I could read out the flash over ODB2, I could never get the e2p contents without opening the ECU and using BDM to read it. I didn’t really want to open up my original ECU, so in the end I settled for making an immo-off ECU as described in the thread.

However, the e2p is mirrored in the RAM (http://nefariousmotorsports.com/forum/index.php?topic=6159.0title=) as well and so you can indirectly get the contents of the e2p by reading out the RAM.  I used a little RAM logger made from an Arduino and SparkFun CANBUS shield and read out RAM locations 0x7F8000 to 0x807FF0 using KWP2000 commands 0x2C (DynamicallyDefineLocalIdentifier) and 0x21 (ReadDataByLocalIdentifier). Just loop until you’ve read the whole range of addresses. Reading the RAM works both in the car and on the bench.

Once you’ve got the printout of the RAM and made it look nice and tidy in a hex file, you can open it in a hex editor and search for the VIN. If you don’t know the VIN, just look for the first few letters since they all start with that anyway. The VIN appears in a few places but if you see it repeated with a few bytes between instances then you are in the right region. This helps narrow down the general location of the RAM mirror.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13327;image)

Now have a look at this generic e2p screenshot and you’ll see it’s made up of blocks (01 03, 02 04, 03 04, 04 03 etc). Each of those is a block number and marks the start of a series of bytes that make up a block. The blocks are described in the FR in section EEP_CONF 5.150.0 EEPROM-Layout if you are curious.

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13329;image)

If you look at the RAM dump, you’ll see the very same blocks

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13331;image)

Using a hex editor, simply copy each block from the RAM dump file to a generic e2p file, overwriting the e2p contents with the RAM dump contents.  If you see a block repeated in the e2p, that’s not an error. Some blocks have two physical copies for redundancy. Just work though the e2p file, making sure each block in the generic e2p hex file is overwritten with the same block number from the RAM dump file.

Copy block 01 03 from the RAM dump file

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13333;image)

Paste block 01 03 into the generic e2p file

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13335;image)

The e2p file itself is duplicated – the second half is a copy of the first half. So when you get halfway through, you can simply copy the first half (0x000 to 0x7FF) and paste it over the second half (0x800 to 0xFFF).

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13337;image)

Now that you have an e2p file that’s a faithful representation of the e2p, you can check it using
Lar’s great tool (http://nefariousmotorsports.com/forum/index.php?topic=5833.msg54763#msg54763)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13339;image)

If you BDM-write this new e2p file down to your spare eBay ECU, along with the flash you read out via ODB2, then you will have a working immo on clone of your ECU!

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13341;image)

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13343;image)

One thing to mention is that the first 64 bytes of the e2p file is not in fact in the RAM mirror and so can’t be read out and copied across. As far as I can work out, it’s just a date and a hardware/software number and doesn’t seem to interfere with the immobiliser. Certainly I now have my immobiliser switched back on in my spare ECU and my un-opened original tucked safely away 

(http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=5418.0;attach=13345;image)

I'll make a clone of a MED9.1 (1k0907115) ECU to another MED9.1 ECU (8E0910115) is this possible over BDM? Or only with ECUs ***907115 ?

Regards

Yes.

Long story short my clone BDM bricked my ECU and need to find a replacement, which isn't a big deal really. The problem lies in the immobilizer. I was attempting to pull the PIN with the BDM, so obviously I do not have the PIN for my car. Is there someone willing to perform an immo defeat for me if I send them an ECU + $$ + shipping costs covered?

Sorry for the thread hijack, I just need help to get my wife's car back up and going.

I'll do it, just cover the shipping. Email me for my address.

Thanks DD!
Sounds like another member has an ECU already immo defeated that they can sell to me if I can't recover my current one. I might just take them up on the offer anyway so I have a spare and don't need to worry about programming my other key. Coincidentally trying to extract the PIN is what caused all this problem in the first place lol.
If that doesn't work out I will email you and get something set up.

I have a few dozen MED9's kicking around. If you want one immo off, lmk. Figure 75 bucks shipped.

I have my first med9 Ecu here.
I am using galletto eu cl*ne to bdm read this thing.

after 10 minutes reading the flash the software freezes.

I tried it with 14 and 12v and xp mode on my win7 64.

any hints?

I managed it to full read this ecu by accident.
I were not able to read it again and i dont know why is reads this one time.

I tried a different pc with xp but had no success.
I measured 12,3volt at the needles while the software shows 12,7.

The progress bar does crazy things.

 :-\

old bump, one of the best threads ive read in awhile,anyone willing to stage 1+ a me9 for me $

i can provide a spare ecu, going at it blindly now with a china mpps... it wont read.... "imo off?"?

anyways thanks for anyone willing to take the time to point this way or such is appreciated


R.I.P..... DAZ   :(

update: finally got mpps to dump my me9..... turned out to be a win7/xp issue and low voltage byt the time it was almost read

anyone willing to immo off a ecu for me? or help guide if  its possible with only mpps? dont mind compensating

You can't immo off over OBD. EEPROM needs written via BDM.

Ok thanks. I got confused by some bad info

i could use the immo off med9.1 info if you ever found it, via flash or even hex values

i ended up with a bdm100 bench tool, works great...  yeah v12 mpps is worthless, heard v16 is fully R/W over obd

Great thread, I almost have myself spare immo off ECU but need some info.  I was able to bdm an immobilizer off eeprom onto my ECU but forgot to also put an immobilizer off flash onto it before putting it back into the car.  Since I did not modify the flash, it of course gave me SAFE in the display and did not run when I tried it.

I tried to mpps it with an immobilizer off flash but now I can't read or write with mpps (clone v13) .

Anyone know if using mpps should be possible when the ECU displays safe? 

Can't redo a BDM flash  because  I ripped a couple of the jtag pads off on accident being cheap using my home brew adapter instead of using a BDM frame.  My soldering skills need improvement.

Thanks for whatever info you can share.

Bdm or mpps v16 clone works

Is this a Audi? Otherwise you'll need to fix the bdm or med9 ecu's are like $50 on eBay

Yep, Audi A3 8p BPY.  What's the difference with Audi?

A3 works fine with MPPS.

Audi are nazi's when it comes to flashing you need mpps v16

Ask them then, my bpg won't flash or come close with v13 only read after a few attempts

Thanks.  I knew I could read with MPPS since I did that with the original ECU.  Never tried writing until after the BDM.  Can't read or write now.  Assuming it has something to do with the immobilizer "SAFE" message. Was hoping someone knows if this is the issue.

Thanks for the help.  Guess ill be needing v16 regardless.

BPG is an A4 engine. It's widely accepted that MPPS doesn't like the A4. V13 works perfectly with ANY EA113 A3.

Good to know that v13 should work if all else is okay.   Guess ill try bench flashing it. Otherwise my soldering practice awaits.

Dude Mpps works fine on A3, but before desolder just BDM.

I think from here on out, we should differentiate between v13 and v16, rather than just saying "MPPS". In my experience there are some big differences between the two.

This would be ideal but as I stated, I ripped off a couple of jtag pads so I can't BDM.  Soldering is to repair the pads so I can BDM.  Waiting on a BDM frame now and trying to repair but already got another ECU on the way from eBay.  I may have fried this one with broken PCB traces since v13 mpps can't even find the ECU now.

Great thread this. Well done to the OP and all the contributors.
It's very interesting reading and it has certainly switched me over from wanting to pay Revo to wanting to 're-calibrate' my ECU myself.

I have been playing with Subaru ECU since 1999 and have probably re-calibrated most of their various iterations over the years.
3 different Subaru cars of my own, plus friends and friends of friends. Some of which are tracked, driven the Nurburgring and also been over the Alps twice.
This has involved EPROM bench flashing early 1994-1996 ECU, through to Laptop live mapping 2001> and 2005> DBW and even aftermarket ECU.
Hence why I didn't really want to spend £££ at Revo on my Cupra, if I could learn about the MED9.1.

I think I will be getting myself an Ebay MED9.1 and a BDM in order to preserve my standard ECU.
I have already read out the Flash (via MPPS-clone) and started creating myself an XDF file.

I use WinOLS and various different mappacks I have located, but I hate the WinOLS look/feel hence I am creating a TunerPro XDF for all the maps I need to be interested in (and will filter out those I don't need to know about).

Just one question, will an 8P0907115 (Audi) & 1K0907115 (Golf) MED9.1 be the same and the 1P0907115 in the SEAT Leon Cupra ?
Does the 'C' or 'X' on the end of the P/N also have any effect, if my plan is to Clone.

Keep up the good work guy's, this forum is a god send.........

The letter at the ends make a huge difference. The Audi A4 defs are wildly different and no maps will line up. Your Cupra ECU will line up quite well with any K04 based 115L/T/H ECUs. 115B/C/Q are K03 based and won't line up well.

The Cupra (K04) is 1P0907115'C', and my image lines up well with : http://nefariousmotorsports.com/forum/index.php?topic=8607.0 plus a couple of others I have found. Although I am creating an XDF.

But not so well to the 1P0907115'H' : http://nefariousmotorsports.com/forum/index.php?topic=7685.0title=

A quick google would suggest the 'H' is from a BWA engined 2.0TFSi FR and the 'C' is from the BWJ engine 2.0TFSI Cupra.

If the hardware is the same can I use an 'H' as a clone for a 'C' E2PROM/Flash image.

Apologies, again differences in the part #s.

8P0907115H is from the BHZ S3

If I take a full MPPS read of my ECU and then flash this into another (spare) ECU via MPPS connected to my car, will this generate a clone. Or will the immobiliser prevent the ECU from communicating. Hence the need for a Bench/BDM flash.

I understand that the immobiliser data is at 6C00 - 6FFF, which appears to be within my MPPS image. But I guess if the car wont boot the ECU due to immobiliser/key disparity then a bench flash is the only option.

cheers

1. You can't flash the ECU if IMMO is not authenticated.
2. You can't flash 0x0000 through 0x20000 over OBD. Nothing below 0x20000 will get written.

Guy's, I was aiming to source myself an MED9.1 ECU 1P0907115 to clone but have realised that my ECU has a 'C' on the end and is 1P0907115C. These seem to be a lot rarer and hence more expensive.

Does the lack of C or even an H (instead) make any difference if I am aiming to clone the original 1P0907115C over to the other ECU  ?

Do I need to ensure I use the same hardware P/N 0261S02337 ?

At the prices I am currently seeing for the 'C' version with hardware P/N 0261S02337, it may just be worth stumping up for a fire and forget remap from a reputable local(ish) tuner.

I've used MED9.1 TFSI ECUs from different cars with no issues. As long as you flash in the complete flash + EEPROM via BDM it'll be fine.

Can I just clarify a few things please as there is a lot of information spread over a few threads and some isn't well explained.

1) In order to make a backup of your MED9.1 ECU you need to do a full BDM read ( both eeprom and flash)
2) In order to Clone your MED9.1 ECU you need to copy the full BDM from the original onto your other MED9.1 ECU
3) To make an MED9.1 ECU run on your car which doesn't have your EEPROM reading then it must be De-immo'd
4) To run your original flash on another ECU which has been de-immo'd then you need to copy the flash section 6C00-6FFF from the other ecu flash into your original flash if you BDM the ECU, if you use MPPS then you can just copy the original flash onto the other ecu as MPPS will not write sections 0x00000-0x20000.
5) MPPS will read the complete Flash (not eeprom) including 06C00-06FFF but will not write back 0x00000-0x20000
5) Running an Audi A4 8e0907115 EEPROM on anything other than an A4 will cause the FANS to run constantly
6) You can flash your full BDM to an Audi A4 MED9.1
7) In order to read the ECU via MPPS the Immo must be correct and authenticated or the ecu De-immo'd

Now I have a couple of questions.

1) The immo data at 6C00-6FFF is that matched to the IMMO data in the eeprom, so if I change the VIN number and soft coding of the EEPROM the dash Immo light flashes and the car starts/stops , without the original 6c00-6fff data how can you match the 2?

2) If MPPS doesn't flash over the 0x00000-0x20000 sections does that mean you can flash say 8p0907115h onto a 8p0907115k and the car will start ok as the immo data at 6c00 isn't affected?

3) referring to point 7 above, if the eeprom has the correct immo data or de-immo'd but the flash the wrong 06C00-06FFF will this also stop it being flashed? Does it get the authentication from the eeprom or a combination of both?

Thank you for your summed up list!

Do you mean MPPS or OBDFlashing in general? What about Galletto V5x? Will it effect 0x00000-0x20000?

Am i able to flash via obd on the bench or do i need the whole immo stuff including dash?

Hi guys, Thanks for the great write up so far!

I have a few questions regarding which data a full BDM contains.

1)I read my ECU with MPPS and I got a 2.048kB file wich is my flash.
Before I start messing with this file, I wanted to have a full backup in case something goes wrong.

2) Asked a friend with BDM to make me a full read wich resulted in a file with 788kB.
Which kind of data contains this full read? I still don't have the 4kB from e2p (which whould be IMMO)

So, in case something goes wrong is enough to have this full read or do I need to read something more?

Shouldn't a full read include flash+e2p??

thanks in advance

He's read it with BDM100 and it's dumped it into a Dimsport "backup" file. If you post it here, I can extract your flash and EEPROM for you.

yes the back up file is only about 800kb..

Thanks for the prompt reply guys!
Good to know that I have a complete backup file...
I thought something was wrong because the size of the flash alone is bigger than the backup file.
Here goes what I got...

I took a look with Ols, but I couldn´t figure it out how to extract some info from it. Even the addresses seemed a bit odd!

CAn anyone explain please the EEProm and how it cross checks the immo data at 6c00

I installed a spare ecu with just the immo off on the eeprom. Car starts and drives fine even the software is different version. However , if I try and change the VIn or softcoding to match the original it either activates the immo ( even though its deimmod) or the car goes into some sort of limp where by it wont rev above 3000rpm...

I'm guessing some data in 6c00-6fff of the flash has to be matched as well but how?

Cheers..

Odd, I can't seem to export that data. Was it done using CMD?

I am not sure what type of tool he used.
But if you tried with BDM100 and it's not working that means it could have been done with a different tool?

BDM100 uses an old cracked version of Dimsport / CMD. I tried with both. Usually a full MPC (inc EEP) is 821KB.

Thanks for your effort gman86! He used indeed a CMD version. Is it possible that it only contains the flash memory?

Soo I'm not sure if i should just start a new thread, but I'm assuming since all 2.0fsi ecu are the same that the 3.6fsi will bee the same.
I am going to make a spare ecu for a new project and figured id ask before buying a random part number off ebay

I want to prepare a spare ECU and i idn’t really want to open up my original ECU, so it isn`t possible to make a clone.

I read e² and flash by BDM from ebay ECU an try ECU swap (http://wiki.ross-tech.com/wiki/index.php/Immobilizer_IV_ECU_Swapping).

If i try to login (12665), VCDS shows an error: ECU send no seed. It drives me crazy. What is the problem?

Set IMMO off: car starts all fine.

And what about the situation if I have the original ecu 8P0907115K (a3 quattro), I will buy BDM, I will read flash and e2prom. I will buy a second spare ecu, but I will want it to have a number, for example 8P0907115B, because kp is available and "k" is not available. I will program the backup code 8P0907115B, and e2prom with ecu orginał, does it have a chance to work? Will it be necessary to do immo-off for backup?
I apologize if I write inaccurately - I am using a translator.
greetings

TFSI MED9.1's are HW identical. I've yet to find one that won't work when BDM a flash and EEPROM backup onto

Hoping someone may be able to answer a question or two I have regarding this point. I actually just purchased a spare MED9.1 from a 2.0TFSI A4, (admittedly not the same numbers posted) ecu to make a spare with, for the same reasons as Basano. So far I've done a BDM read of the spare, and a read of the flash from the MK5 GTI i'd like to make a spare from - its a DSG model 1K0907115J.

In order to avoid the above issue with the A4 EEPROM causing issues when used in conjunction with a different flash can anyone confirm if using a immo off'd 1K0907115H e2p with an immo off'd 1K0907115J should be ok?

I don't have a can shield and probably lack the skills to write the code for it at this moment otherwise I would be keen on doing it that way by grabbing the RAM.  ;D ;D

If you are able to BMD´d that ECUs why not just clone (flash + serial eeproms) your OEM ECU to the spare one??? You will have an ECU just like your original one avoiding many compatibility issues.

For a couple of reasons really - the main one being that its actually my brothers car, he uses it daily and its a similar situation to Basano not wanting to crack the original ecu open. So if I can have a de-immobilised spare using the correct flash that would be sufficient. Maybe I should look into doing what Basano did with the can shield and arduino.

I also feel it's not a bad idea to find out about what is or isn't compatible for future reference in case something was to go really wrong.

Lol, these cars are old these days. There is no risk by opening, bdm read and sealing it.

Agreed, they are old so please forgive me for being massively behind. I understand it's no big deal if you've done it many times before, i'd just like to produce a known working spare before I crack open the one that is currently in use. I was being lazy and hoping someone might have known about the compatibility and could share the info. Worst case i'll just test it myself  :)

Even if you scratch the board near the edge with a cutter while opening the bdm will work and you can do a full backup.
But its easy, just take your time and nice tools.

Only way to kill it is the bdm itself if you mix the right pins and 12v will be on a wrong pin.

reseal it for waterproof and thats it.

In my experience never need to scratch. Just take a hot air gun und heat the part where it is sealed. I think you`ll find your own (best) way.....maybee a mix of both methods?! ;)

Sorry to bump this thread but it's very helpful and wanted to ask a quick question for clarification which is related.
I'm a noob so please be gentle, I've read about the a4 ecu keeping the fans running and that the med9.1 ecu's are identical HW wise etc.

I'm planning to bdm a spare ecu for my a4 with the S3 eeprom and flash as I've fitted a k04 turbo - didn't have the S3 kp file to just compare and amend the values as a base map on the BUL file that I have got the kp file for. I have changed the flash on the BUL file for an uprated hpfp but planned to learn using the S3 vs a4 comparisons in the file as a start (I've read through the med9.1 beginner thread but found the problem of either having the kp file (or not in the case of the S3) and being at the mercy of somebody else's translation or using the German full definition file and having everything and getting overwhelmed)

Thanks and sorry for the long reply

First of all what is the part number of your original ECU? Then am I to understand that you are panning to flash the software from an Audi S3? What is its part number?