NefMoto

Does anyone know what prog is available to read and write the Eeprom on ME7.5 specific 1,8T from 2002-2005.
I know there are some expensive programs to buy, but just need a small tool to fix this.
The problem is when we use the Emulator on this ecu, then sometimes the Eeprom change contents and car wont start again.

The way I fix it now is by taking out the Eeprom and read it in a chip reader before I start to use the emulator. If the Ecu then change the Eeprom contents and lock the Ecu i have to take out the Eeprom and reflash it again to have the car start. This is very unplesant when you are 20km from home in the middle of the night :-(.
I have Galetto, KWP2000+, VCDS and alot of other tools already but they cant fix that.

Thanks

There are two types of non-volatile memories in your ECU.

First is a 94050 so8 chip located in back of the pcb. In it are stored PIN code, the VIN of you car, adaptation chanels (the ones you modify with lemmiwinks), etc.

Second is a 29F800 flash memory chip with the software of your ecu. This is the one you can read with galletto (in bootmode) or KWP2000 by OBD and software never change its contents by itself.

Can you explain what emulator are you using and what are you trying to do?

Thanks for you reply.

I know about the chip in the ecu already.
I use Winols and the ols300 to emulate the 29F800 chip during tuning of the car. It is a known problem that when you use the emulator on specific the ME7.5.x ecu the Eeprom contents can change and lock the ecu. It will set a fault code that cannot be reset. Only possible way to correct this problem, other than buy a new ECU is to remove the Eeprom soic8 95040 from the backside of the ecu and read it before you use the emulator. in case the ecu lock you can always read back the Eeprom to what ever it was before, and it will run again. The problem is that you have to unsolder it every time, and that is not fun when this happens in the night far from home.
I could get the Alientech flash software, that one read the Eeprom also. But its expencive. I was hoping to find somthing to read and write the Eeprom without have to remove it from the print everytime.

Thanks

Are you getting "P0601 Internal Control Module Memory Check Sum Error" fault code? You can read eeprom by OBD port, I don't know if writing is allowed. I've never used vag k+can but this could be the tool you are look for. also, chiptuning in the middle of the night ??
 

Its not checksum error that I got. VagCom says somthing like ECU defect, and it cant be deleted.
I got a Dynapack 4000, but still the best dyno is the road and specially with a Huge turbo on the 1.8T where the boost is load depending. Boost is different on the road compared to on the dyno, and the roads are empty in the nights. much better when you have to look in the labtop when you drive, no sunlight reflection etc.etc.
I have heard about the k+can, maybe I should look into it again. I just thought that maybe somebody had a small simple tool to do it.

Thanks

You can easily read the eeprom contents with the KWP2000 protocol, but you can't write to them without doing some hard tricks.

I believe there is a settings stored in the eeprom that controls whether or not checksums are validated. There is a program called Unisettings that allows you to write to the adaptation channels stored in the eeprom, and it also implies that is supports disabling the checksum validations.

You can also read the eeprom with the KWP1281 protocol.

ktech, OLS300 isn't a cheap tool. I think EVC support should give you a solution to this problem.

No you are right. Ols 300 is not cheap, but a great tool :P
Until now I only have tried it on one type of car where it did not work. Its the Audi B5 1,8T with the Plcc44. That one really sucks with the OLS 300. Then I have to use the Dimsport emulator MET16 ;D

Thanks for the info on the KWP protocol.

Guys!

Does anyone now how to read/write EEPROM placed at the bottom of the ECU board thru Galletto or another programmer? Hardware and software listing are can help me to do this. But I didn't now what function of the two ICs placed at the bottom of ECU also.

(http://www.freeimagehosting.net/uploads/th.0dd15026c3.jpg) (http://www.freeimagehosting.net/image.php?0dd15026c3.jpg)



   

If you are referring to the 95040 eprom at bottom of pcb, it can be read with a kkl cable.

Do Galletto k-line interface have to use for reading EEPROM (replacement of kkl cable)?

That software can read EEPROM thru k-line?

Please provide more information.
Some description of XLS file will do me good too.

Thanks.

What you see in the image is kwp1281 protocol or vag mode protocol. I've included the used commands to a easier understanding. VIN and immo data was edited out.

Galletto has a uprocessor inside so it only works with galletto software whereas kkl is a dumb interfase, a rs232 to kline level translator.

Im not a pro by any means or anything.I have a ME7.5 bin file i read out from a ecu that fits 2002-2005 audi a4/s4  USA vehicles.The file is stock,about 1mb. Could post if any is interested.used galletto to read it out form ecu on a bench.

Hello ktech, i have one eeprom for the me7.5 that has the checksum verification disabled as well as the immo turned off. it works fine for ecus like the 06A 906 032 DL, KP, LG, HF and maybe others.   it also has the VIN number erased too.

For the read/write i use a soic8 pomona clip. Way better than the 3M that i just throw to the trash.

I didnt found the way to post the eeprom file so if you want to try it, send me a message with your email.

Vagdashcom and vag K+can commander will suit your needs.

why not just buy like a gq-3x for $80usd with the soic8 adapter? i have one. works perfect. it takes 2 minutes to desolder and resolder.

The point was to find a tool that could work in the middle of nowhere far away from the soldering iron when running the emulator in the middle of the night.
Hope you follow me :D
I already got what suggest, and did it alot. and after 5 times removal it does not look that good anymore.

Hello!
I have same problems with eeprom and the checksum verification, can sombody help me to turn off the checksum validation on the attached dump?
It's from audi RS4_2,7TT
thanks a lot

Did you try it out to see if it solved the problem by turning off the checksum verification??

Unfortunately I don't know how to turn off the verification at the moment.

I think there is a byte in the serial eeprom to enable and disable checksum verification. I don't remember where it is though. I will try to have a look for it later.

Tony

Could it be possible that you fantastic flash tool could be expanded to read and write the eeprom also?

I've gone through the serial EEPROM reading protocol in KWP1281 and KWP2000. The problem with implementing it is that half of the pages in the serial EEPROM are not allowed to be read or written. I assume VAG did this to prevent hacking the data on this EEPROM.

if I remember correctly reading the 32 bytes that contain login code isn't allowed, but whole eeprom is copied to ram where reading is posible. You can read part of eeprom and search the ram to find the copy location, then you can read the missing parts.

That's also the way Lemmiwinks is doing it. Searches the copy of the eeprom in the ram and
then writes the changed adaptation channels into the ram copy. When turning off ignition,
the changes are written back into the eeprom. But I'm not shure if you could update all
locations in the eeprom in this way or if it only works for certain locations like adaptation
chans.
A method to read and write the complete eeprom is to load your own r/w functions into
the ram and link in this code into the message handler. Then you can send your own
diagnostic messages which call your code in the ram and do the reading/writing without
any limitations.

Hello friends,

is there now a cheap tool out to read and write the 8 pin seriel eeprom from the me 7 ecu that works good ???

i need one to test !!

i listend that is possible to read write with a normal KKL Cable !!

maybe someone knows more !!??

king regards dobermann

At the moment the only way to read the entire serial eeprom in it's raw format is to read it using an SOIC 8 adapter and hooking that up to an eeprom reader.

I used a willem eeprom programmer and an SOIC 8 adapter to read mine.

You don't have to remove the serial eeprom chip from the circuit board to read it, you can just clip the SOIC 8 test clip onto the serial eeprom.

I haven't looked at the chip yet, even though my ECU is sitting here.  Are you talking about something like a Pomona 5250?  I know some of you guys are great at removing the chips, but I tend to make a bit of a mess sometimes.  This would prove much easier for me.

Yup, the Pomona 5250 would work.

argdub, do you happen to know the command for write_ram?

Which protocol KWP1281 or KWP2000?

The docs in the communication protocol sub forum should contain all this info.

KWP1281. Found it. I missed the textfile in the protocol subfoum.
Thanks.

I have read the Eeprom of M383 & M592 (both KW1281) ECUs using Monoscan with great sucess. I also can read RAM too. But I was unable to write it. About the SOIC8 clip I have a Pomona one but reading the eeprom was a bit tricky. I could read a M592 ECU that I have been testing, but M383 doesn't allow at all. I tryied with ECU powered too without luck.

Hi eliotroyano,

Could you specify what kind of thing this is : 'monoscan'

Where you able to read-out the complete content of the eeprom and flashrom ?

I'm highly interested in this .

Any extra info is greatly appreciated !

Thanks,

PvL

Hi PVL. Friend here is the software I was talking about .... http://sites.google.com/site/monoscanen/functions (http://sites.google.com/site/monoscanen/functions).
It is free but you need to register it.

@ eliotroyano :

My friend, thank you VERY VERY much for this great find. I will have a look to it, asap
and report back.

Hopefully the author also implements writing of eeproms within time. That would be
really great.

I'm going to test this software asap.

Cheers,

PvL

Hello there any news about dissabling the checksums?

The ME7 prevents reading and writing certain regions of the eeprom. Monoscan does not allow you to get at those regions. The regions that can't be read or written include where the immobilizer data is stored.

Successfully tested on M3.82 and M3.83 ecu's !

Hope to do a complete log asap, to get a serialnumber from the programmer.

Brilliant software !

Cheers,

PvL

hello folks !!!


i tryed to read my ecu eeprom from my seat leon with vag k+can commader

i get the file with 512 byte and the login is to find too

but i think the dump file is not complete or corupted

please have a look on my readed file and tell me what you think !!

i can read and write this file in ecu an car makes no problem

It's not complete

1st line is missing for a start.

yes that was my thinking too !!

i think the start adress is not right !!

did someone know the right start adress from the eeprom m95040 ??

i think there is the error !!


i read in manual that autodetect muss be deactivatet and the start adress musst set manuel !!

Not only first line is missing...
There are some lines missing in middle and wrong lines at tail of dump.
Because this software read not an EEprom itself but only RAM-mirror part of eeprom.
 

yes right ir read part of eeprom !!

its not the complete file !!

but immo can deactivatet and activatet and the pin code is in the read to find !!!

i dont know maybe can the full file be read with the right start adress of eeprom !!

i read and write this file in ecu and car start without problems ??

is there a tool that read the full file ( full data) the file sice is ok from my read

I have been around this loop with my own Leon. You can't read the complete EE via OBD2 however you try. Bosch have deliberately disabled that ability on ME7.5.

Did you read through here http://nefariousmotorsports.com/forum/index.php/topic,300.0.html ?

You *can* read out the SKC which might be good enough, but for Immo defeat you need to physically connect a programmer to the 95040 to read / write.

Just want to inform you all, that it is indeed possible.
Tho we need to invest in a tool.

My own experience tells me that VAG ECU TOOL works (cheap vagdashcom clone)

I've read with success, full eeproms from ME7.5.x with it.

When writing it back, on the workbench (benchflashcable) it doesn't play.
Perhaps it's the active immo, blocking it...  ?

Cheers,

PvL

hello

yes a friend tell me that this tool should work !! i need only to read and save !! i chipped many cars but i never had problems with cheskumm error !! i will only have the org eeprom from the ecu for security !!



i know a tool that can read and write the me7.5 ecu eeprom its from frieling racing

i think it is possible to read and write but we need the right tool !!

If you read out over OBD the dump will contain areas that are incorrect (the protected pages read as 00).

Compare the EEPROM dump you get using an OBD tool with this http://nefariousmotorsports.com/forum/index.php/topic,542.0.html

See if the overall structure looks right. I'm guessing it wont.

When you program the file you dumped back using OBD, it appears to work because the same protected pages are unwritable so you don't overwrite with 00's.

yes i belive this !! i have many eeprom dumps read with beeprog !!

in the postet eeprom dump is the immo off !!

i know that in my readed dump some data is missing !! i compared it with full readed dump !!

but immo off is possible i tryed !! and the skc is stored !!

but many data is missing !!

the frieling racing tool read the eeprom complete !! but i dont know how they do it !!

king regards Dobermann

i 

ktech if I can...

1. for OLS300 use separate ecu only for tuning and oryginal ecu take with You on rear sitz.
2. I go down few time eeprom but NEVER when I put button RESET when software reload
3. for any and firstly custom tuning dont go road - You kill people around runing car about 200-220km/h faster then rest.
4. Cars with big turbo need long run on 4,5gear. Its much handy on stationary dyno You see any minimal change for + or for - Yours work - You dont saw this on road
5. on statnionary dyno You can use headphones to hear knocking (of course on road too ;-))

Regards.

you are right !! i tryed this tool now !! today i read out the eeprom from my seat leon cupra R with success !!


it is the full data from the m95040 eeprom !!


i can post if someone will see the result !!

tomorrow i will try to wright in ecu !!

i hope it works !!

Can you post a link to the adapter?

hello friends

here is a dump from a seat leon 1.8T 180 ps year 2005

readed by obd ecu tool !! this eeprom dump is ok !!

the programm worked good i have testet some cars between 2000 and 2005 me7.5

edc15 worked too !!

Are you able to write back though? Do you have a link to where you picked up this tool?

what about the APR tool, it saves the file as an IMM, but it opens with any hexeditor and appears to have the full dump.
http://www.goapr.com/support/immobilizer.html
had to dig out the old serial port though.

(note that this timed out when in the car, but read from the bench)

i have this soft !!! i will try if it works !!! witch cable is used ?? normal KKL i think ??

I used an old serial vag-com generic cable.
I have not tried to write yet with this software though.
But it did appear to read.

Hey ta, what do you mean by "timed out". Also, from reading that link it does not look like it will write unless it see's APR code either in the eeprom or the 800bb?

hello i tryed the apr soft !!

read is possible but the data from the apr file is not useable !! it is a APR Code inside the data !!

this tool is for read the immo data and write this data back into APR ECU

my ecu tool read/write the eeporm complete i tryed it on my cupra R

the apr tool is good for clear the DTC data in the eeprom !!

i had 2 DTCs in the eeprom !! with the apr soft you can read and cear it !!

did someone know exactly what data is in the eeprom stored ???

i know many about it but not all !!

PIN code is inside
WSC
DTCs (Trouble code area)
adaptions
checksumm

the eeprom changed the data if i drive a round !!

i read it again and some data is changed !!







 

At 0x0112 - 0x0115 a four byte seed value (pseudo random number) is stored.
This is updated and written to the EEPROM at each startup of the ecu.
It gets used during authentication with the immobilizer.

I bought a cable of VAG K+CAN Commander 3.6 to read the PIN code of IMMO 3 in ECU, 06A 906 032HA. However, a technician tell me that the software may make my eeprom of ME7.5 corrupted even during reading the eeprom mode. Is it true? I also buy a brand new ME7.5, 06A 906 032QJ, which I want to newly install in my car for backup and start tuning the old ECU, I need to read the pin code in old ECU then adapt the new ECU into my car.
Should I trust the techinican or the VAG K+CAN Commander 3.6? I think only reading the ECU may not cause any bad damage to EEPROM, but I am not sure. Please kindly advise your opinion.

Hi,

"I bought a cable of VAG K+CAN Commander 3.6 to read the PIN code of IMMO 3 in ECU, 06A 906 032HA. However, a technician tell me that the software may make my eeprom of ME7.5 corrupted even during reading the eeprom mode. Is it true?"

I find it very hard to believe a 'technician' which isn't furthermore defined as of which background he has, and knowledge of your specific ecu, to believe.

Especially the tech-support from chinese clone-cable-sellers. Not to mix-up with the
real product-seller of the vag commander (http://www.abritus72.com).

In the meantime the product has evolved to version 7.1, so there was some development
and bugfixing going on (http://www.abritus72.com/vagcommander71.html)

According to the web, all versions have bugs. Thats normal for this kinda product. It is
very special and has functions, normal vag workshops cannot do to the range of cars.
Therefore, you always run a risk.

In your situation, you've obtained a cloned product (i will try to also get my hands on one, to test the functionality). So therefore you firstly have to check-out functionality on the workbench with a SPARE ecu.

Build a benchflash-cable, or buy one, and connect the vagcommander clone to it, to see if it
is able to connect and read-out correctly the eeprom. If you need help with this, p.m. me, and i'l get you going.

Post pics and screenshots over here, so all can benefit from your efford.

Don't worry for the moment, as you have the spare-ecu to test on. DO NOT start with
your current WORKING car's ecu to test on. As you may risk the thing the 'technician' said, and corrupt something.

I love to minimise risk and maximise stability. Always be sure, you do stuff on cars, with a fully charged battery, a battery-charger hooked-up to it, chargeing it, and disconnect the radiator's fan's connectors to minimise drain when they suddenly kick-in (this is possible).

Cheers,

PvL

Hello

just for info !!

i have the vag commander 3.6 too

that tool reads NOT the full eeprom !! some data is missing !!

you can only get the pin code and the immo on/off

you can not clone a ecu with this readed file !!

and only with reading you can not damage a ecu for sure !! and is something go wrong by writing a me7 ecu the ecu can be repaired thats no problem  !!

the most problem is error in the flash file checksumm error !! than you have a error in the eeprom but its no problem too to repair !!

best regards !!

Yes, I got my login code of ECU through bench harness with k-line.

Thanks everybody.

hello


i tryed it too with benchflashing !! it will not work !! reading no problem !!! but on bench write is not possible  !!

i dont know why !!!!

maybe somethink blocks the writing process !!

but reading is always working !!

over OBD i can write it back into serial eeprom !!

maybe someone knows more about that !!!

best regards

Hello

maybe i know why write will not work on benchflashing with the ecu tool

if the the ecu tool write into the ram and not direkt into eeprom 95040 the data will only write back into the eeprom if the ignition is turn off !! but we can not simulate ignition off with benchflashing !!

what happen if the ecu is pluged in the car and i turn off the ignition !! did the ecu have 12V or not ??? maybe the ecu have 12 volt but on a another pin !!

did someone know ???

maybe we get it to work on benchflashig !! ??

best regards 

Completely wrong.

Please explain why?

That is correct, if your ecu tool writes only into RAM, it's not updated in the EEPROM before
turning off the ignition.

You can simulate ignition off on the bench.


The ecu is connected to battery terminal 30 (Klemme 30) on some pins (e.g. pin 62),
these have always +12V, even when turning off the ignition.
Then there is pin 3, connected to terminal 15 (Klemme 15), which has only +12V
while ignition is on.
You can simulate ignition on and off on the bench if you connect pin 3 via a switch
to the power supply while connecting the other supply pins directly to the power supply:
Keep the switch open, then turn on the power supply -> same as connecting battery in car.
Turn on the switch -> ignition on
Turn off the switch -> ignition off (ecu still will run for some time until turning off itself)

Setzi is correct!

I'll try again sometime soon but I remember trying everything possible and ME7 will not write to the eeprom on the bench. Does it just fine in any car.

this is not wrong !! im sure !!

the tool writes only in ram and if i turn off ignition if the ecu is pluged in than will ram write back into eeprom 95040 !!

that is the trick with benchflashing !! we musst simulate ignition on/off

i will try this !! and report !!

ok i hope i understand right !!

i have a ready benshflashing cable !! i must test if on the pin 3 from the ecu are 12+

than i must make a switch with pin 3 from the ecu to give on pin 3 12+ and if i turn of the switch on pin 3 0 volt

that simulate ignition on/off ???

im right ???

i can open my cable and make a switch on pin 3 from ecu !! easy to say i must write into ram and if ask me the software turn ignition off i must switch off pin 3 !!!

thats it !!

are you sure it is pin 3 from the ecu ???

please look at the pic

No, it is not pin3 for the ECU connector from your picture!
It is pin3  for the connector metioned here:
http://www.nefariousmotorsports.com/wiki/index.php/ECU_Bench_Flashing

The ignition is on terminal 15 as I stated previously.
So for the connector on your picture temrinal 15 (ignition) is "T1-Pin 15"
and terminal 30 (battery) is on "T1-Pin 27".

I did read my eeprom sucessfully last night with vag commander 2.5 and the blue ebay cable.

Now i have to learn where to find my SKC lol

would you be so kind to post a picture of that cable over here ?

Is it a generic KKL vagcom donglecable, or a SPECIFIC v2.5 vag k-can commander cable ?

Thanks,

PvL

I've got vag+commander 1.6 and if you log into the engine management page it shows the SKC code for you in a seperate box. Does 2.5 not do the same?

Also I tried last night to use the Immo off option on vag commander but this was on a bench. It seems to change the hex ok, and seemed to write back ok, but when you remove pin 3 to simulate the ignition off/on it looses the setting so I guess it doesn't work. But then I have no way of checking anyway as my keys are coded to the ecu anyway!

so update

i tryed to write the eeporm on bench with simulating the ingintion off

i make a switch on pin 3 on the ecu cable  !!!

i write the file and switch off pin 3 for simulate but for the moment it will not work !!

i dont know why !! in the netxt weeks i will make some tests !!

it must be possible to write the eeprom !! by obd it works without problem !!!

maybe someone knows more about this problem !!

best regards

ps: maybe my cable is the problem !!

i looked what pins are conectet !!

pin 21 is not conectet in my cable !! that must have 12V it is for the immobilizer

i will check that !!!

12 Volt must be on pin 3 pin 21 pin 62 and only pin 3 must be turn off for simulating ignition on/off

Have you turn off the immo on bench successfully with Vag K+CAN Commander?

vag comander will not work on bench !!! i tryed it !! immo off work over OBD but the vag commander read not the full file from the m95040

what software for KKL shoud i use to read eeprom?

bringing this up because ... only read or also writing with the Pomona 5250 Adaptor without removing the eeprom from the board??

Write is usually possible.

I will try ...

I have to this damn problem! Any solution?

Sorry for bringing this up again ....

Since the ignition on/off simulation via a switch wasn't successful I wanted to ask if the situation would change with using an direct VAG ECu cable for ME7.x.x? Would it then be the same reading as via OBD?

Hello, apologies for flying in from left field. I spent the day looking at eeprom data,
specifically for ME7.8. I found some patterns that might be of interest (or might not).
I checked the quoted file above and it seemed to match the pattern, specifically for
the last 2 bytes of each line. Here's the findings:

The first 14 bytes are data, the last 2 bytes seem to be checksums (sort of).

Definition: alpha = row_addr -> right shifted by 1 position
Example: if row address starts at 140h, then alpha = 14h

Rule 1:
======
If 14 data bytes are all 00h:

byte_15 = FF - alpha + 1
byte_16 = FF

Example:

start addr
   1A0             00 00 00 00 00 00 00 00 00 00 00 00 00 00 E6 FF
alpha = row_addr -> right shifted by 1 position = 1A0h - > 1Ah
Byte_15 = FF - 1A + 1 = E6h

Rule 2
======
Row has data

Definition:
sum14 = sum of row's first 14 bytes
sum14_2c = 2's complement of sum14, then only use lower 3 bytes
End definition...

Last 2 bytes:
byte_15 = lower_2_digits(sum14_2c) - alpha
byte_16(high nibble) = F
byte_16(low nibble) = upper_digit(sum14_2c)

Example:

row_addr                14 data bytes                         Byte_15  Byte_16
--------   ----------------------------------------- ------    ------ 
010         05 01 01 00 84 1C 00 00 00 00 69 C1 00 A5   89        FD

alpha = row_addr -> right shifted by 1 position = 010h -> 01h
sum14 = sum of row's first 14 bytes = 276h
sum14_2c = 2's complement of sum14 -> only use lower 3 bytes = FD8A -> D8Ah

byte_15 = lower_2_digits(sum14_2c) - alpha = 8A - 01 = 89h
byte_16(high nibble) = F
byte_16(low nibble) = upper_digit(sum14_2c) = D

Unknowns:
========
None of this seems to apply to first 16 bytes of eeprom.
Apparently a whole row of FFh is ok

That's it :).