NefMoto

I'm trying to read the flash from a 1.8T AUQ Ecu (06A906032HN) but keep getting bounced with 'Disconnecting because no response was received for the Tester Present message.' This is using one of the blue ebay leads, which works perfectly with my 2.7T. I can talk to the ECU using VCDS, so I think this is an issue with nefmoto or with the ECU.

nefmoto does connect, eventually, after many tries using slow init, I once managed to get it to read ECU info, but have never managed to get read flash to work. Should I build a bench flashing harness and get a boot mode lead?

The relevant section of the logs is as follows:
11/Mar/2014 01:38:54.985: LOG: Received message with service ID AccessTimingParametersPositiveResponse
11/Mar/2014 01:38:54.991: USER: Successfully changed to new communication timings.
11/Mar/2014 01:38:54.999: USER: Requesting security access.
11/Mar/2014 01:38:55.029: LOG: Sent message with service ID SecurityAccess
11/Mar/2014 01:38:55.063: LOG: Received message with service ID NegativeResponse
11/Mar/2014 01:38:55.073: LOG: Received negative response for service ID: SecurityAccess, with response code: ServiceNotSupported
11/Mar/2014 01:38:55.082: USER: ECU reports that security access is not supported.
11/Mar/2014 01:38:55.092: LOG: Starting diagnostic session type: ProgrammingSession
11/Mar/2014 01:38:55.107: USER: Starting diagnostic session.
11/Mar/2014 01:38:55.141: LOG: Sent message with service ID StartDiagnosticSession
11/Mar/2014 01:38:55.173: LOG: Received message with service ID NegativeResponse
11/Mar/2014 01:38:55.180: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
11/Mar/2014 01:38:55.213: LOG: Received message with service ID NegativeResponse
11/Mar/2014 01:38:55.219: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
11/Mar/2014 01:38:55.253: LOG: Received message with service ID NegativeResponse
11/Mar/2014 01:38:55.259: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
11/Mar/2014 01:38:55.293: LOG: Received message with service ID NegativeResponse
11/Mar/2014 01:38:55.299: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
11/Mar/2014 01:38:55.333: LOG: Received message with service ID NegativeResponse
11/Mar/2014 01:38:55.340: LOG: Received negative response for service ID: StartDiagnosticSession, with response code: RequestCorrectlyReceived_ResponsePending
11/Mar/2014 01:39:05.155: LOG: Sent message with service ID TesterPresent
11/Mar/2014 01:39:05.256: LOG: Message received no replies.
11/Mar/2014 01:39:05.265: LOG: Resending message. Send attempts: 2
11/Mar/2014 01:39:05.299: LOG: Sent message with service ID TesterPresent
11/Mar/2014 01:39:05.400: LOG: Message received no replies.
11/Mar/2014 01:39:05.411: LOG: Resending message. Send attempts: 3
11/Mar/2014 01:39:05.440: LOG: Sent message with service ID TesterPresent
11/Mar/2014 01:39:05.543: LOG: Message received no replies.
11/Mar/2014 01:39:05.554: LOG: Failed to send message 3 times, message send failed.
11/Mar/2014 01:39:05.566: USER: Disconnecting because no response was received for the Tester Present message.
11/Mar/2014 01:39:05.577: USER: Disconnected
11/Mar/2014 01:39:05.669: USER: Reading ECU flash memory failed.
11/Mar/2014 01:39:05.736: LOG: Closing FTDI device.

Tried pulling the cluster fuse?

I tried unplugging the clusters entirely, nefmoto would not connect at all.

May have to bench flash.

Tried it again on the bench this evening, it now seems to be bombing due to the imobiliser - is it normal not to be able to read a flash if the ecu hasnt authenticated the imobiliser?

ECU reports programming session preconditions have not been met.
Reasons preconditions failed:
-Immobilizer not authenticated
Continuing despite programming session preconditions not being met.
Negotiating communication timings.
Successfully changed to new communication timings.
Requesting security access.
ECU reports that security access is not supported.
Starting diagnostic session.
Unable to properly start diagnostic session, attempting to continue with current undefined session.
This can occur if the security lockout is running, or the engine is running. Please turn off the ignition and retry if this continues to fail.
Negotiating communication timings.
Too many consecutive unsolicited messages from ECU, disconnecting.

Yes!

Have to delete Immo before bench flashing works. Use Argdub's tool. Good practice for boot mode too. 

Thanks stuklr, that was about to be my next question. Do I need a galletto cable for boot mode flashing, or can I use a normal blue KKL?

Galletto is a cable and program for reading/writing full files in boot mode. You really should have one if you are doing any flashing as a safety net for failed flashes. Its a PITA to make work, but Ddillenger posted an edited copy of the software on here which is easier to understand. You will still need a cable.

To delete the immo your regular blue cable works just fine. Just go under the immo section of the forum and look at ARGdub's tool for writing the 95040 eeprom to remove immo function. I like to save the original immo file, then flash a delete on for tuning. Thei I can restore immo function later if I choose to do so.

http://nefariousmotorsports.com/forum/index.php?topic=3088.0title=

Great, many thanks to both you guys for your advice, I feel bad for being such a dumb noob!

Gotta start somewhere. Once you get it done the first time, then it gets easier.

so glad I found this... I was wondering what the deal was...I was getting the same authentication error and had no idea why. lol

Several weeks, many long nights in the workshop and a few weeks working in the US, I've finally had time to take another look at this problem.

I'm trying to read the flash (with the intention of writing different flash onto it later) from a 4B0906018DC ECU, using a bench flashing cable, bench PSU and either a blue KKL lead or a genuine rosstech lead.

Following the above discussion, Ive attempted an immo off (UK ecu so comes with immo), please see the attached logfile for writing/reading back the eeprom, and the attached bin for my attempt at the immo off. Please can someone take a look and let me know if I've done this correctly? I've set the bytes at positions 12 and 22 to 02 and used the checksum tool to fix the checksum.

I then powercycled the ECU and tried to do a read flash, this is with the rosstech lead, but I have the same issue with blue lead (full log file attached):
ECU reports programming session preconditions have been met.
Negotiating communication timings.
Successfully changed to new communication timings.
Requesting security access.
ECU reports that security access is not supported.
Starting diagnostic session.
Disconnecting because no response was received for the Tester Present message.
Disconnected
Reading ECU flash memory failed.


Any help or suggestions is much appreciated!

I just went through all this grief trying to read a 2001 TT 1.8 180ps ARY engine today.

I used a genuine Ross-Tech cable, and tried slow-init.

This worked, and it negotiated itself to the KWP1xxx protocol version. This caused the Buad rate to be set automatically to quite a high number. At this baud rate it threw the same error as you are getting with the tester present message.

Then, before clicking on read map, I changed the baud to minimum. After that it worked fine, albeit taking 20 minutes to download 1 megabyte of data!

The map looks good in WinOLS, although I've not managed to verify the checksum yet.

Did you manage to get it to read on the bench, or in the car?

Since the posts above I've been able to read/write the flash in the car using my ross-tech lead, but not on the bench.

I'm a newbie so I've not tried bench-flashing yet, just over OBD using a Ross-tech cable and the Nefmoto flash tool!

Solved this one, powered up pin 121 on the ECU plug and its all working happily :)

What does pin 121 do?

I powered pin 121 on my spare ECU, didn't make any difference for me regarding the immobiliser

You dont need to power pin 121 to read the immo :)