NefMoto

Hi I am new to this and have very little to none experience when it comes to command.
In these posts I shall list everything I have learned so far from this Forum and other user's such as ddillenger

Step 1 download ArgDub's software.
there are a few versions:
me7_95040 (page 1)
me7_95040_v1.31 (page 1)
ME7EEPROM (page 12)
and can be found here http://nefariousmotorsports.com/forum/index.php?topic=1168.0title= (http://nefariousmotorsports.com/forum/index.php?topic=1168.0title=)

Step 2 buy a cable
I am using a blue KKL cable. When you plug your cable in windows with find the drivers keep an eye on what COM port it installs under
 

Step 3 bench set-up:
You can make up a rig to work on the ECU out of the car you will need to do the following:
(http://i743.photobucket.com/albums/xx75/onsperformance/Ecupinout1.jpg) (http://s743.photobucket.com/user/onsperformance/media/Ecupinout1.jpg.html)
(http://i743.photobucket.com/albums/xx75/onsperformance/OBDportconnector.gif) (http://s743.photobucket.com/user/onsperformance/media/OBDportconnector.gif.html)
(http://i743.photobucket.com/albums/xx75/onsperformance/WiringDiagram.gif) (http://s743.photobucket.com/user/onsperformance/media/WiringDiagram.gif.html)

Or you can do it in the car over OBD you will be able to read the ECU but not write to it unless you open the ECU and ground pin 24

Step 4 you will need to put your ECU into bootmode:
In order to enter bootmode you will have to ground out pin24 on the ECU using the following procedure,
1. ecu power off
2. ground pin 24
3. power on ecu.
4. wait 2-3 seconds.  (some people say up to 10 seconds)
5. remove pin 24 ground
6. try to connect

Step 5  opening Command
click on your windows start menu and search cmd
Click on command it will open and you should see something a long these lines
C:\Users\your name>
drag and drop the downloaded file of your choice (most people say v1.31 works best) and it should look like this
C:\Usesrs\your name\Downloads\me7_95040.exe
now hit enter and you should see this
(http://i743.photobucket.com/albums/xx75/onsperformance/Screenshot2013-11-26211214.png) (http://s743.photobucket.com/user/onsperformance/media/Screenshot2013-11-26211214.png.html)

You will see a list of commands
in order to read your ecu you must remember what com port your cable installed to.

C:\Usesrs\Steven\Downloads\me7_95040 --bootmode -r -p 3 95040.bin

and to write

C:\Usesrs\Steven\Downloads\me7_95040 --bootmode -w -p 3 95040.bin

This is as far as I have got next to come will be how to turn the Immobiliser off and correct the check sum. I need to research that try it and then I will up date the thread. Also I hope to flash a new map onto my ECU and I will add that in the future as well

pin 24

(http://wiki.obdtuning.com/images/thumb/9/97/VAG_ME_7_Platine1.jpg/800px-VAG_ME_7_Platine1.jpg)

Part 2
Had a few problems trying to get into boot-mode today the best way I found to enter boot-mode was to power everything up but (Pin 3) and then ground out pin 24. Whilst pin 24 was grounded out I connected pin 3 to 12v after 3 seconds I removed the ground form pin 24 and the ECU went into boot mood.

(The reason I am doing this is because I am doing an engine conversion 1.8T in a Lupo. I was using the ECU loom as my bench loom I have been running out off time and had no choice but to fit the loom in the car. I fitted a plug on the wire going to pin 3 so I was able to unplug pin 3, switch the ignition on hold the ground wire on pin 24 whilst pin 24 was ground out I reconnected pin 3 after 3 seconds removed the ground from pin 24)

NOTICE WHEN I WAS UNABLE TO GET BOOT MODE WHILST THE ECU WAS ON THE CAR THE FUEL PUMP WOULD PRIME ANS THE SENSORS WOULD MAKE NOISES. WHEN THE ECU WENT INTO BOOT MODE THE FUEL PUMP DID NOT PRIME AND THE SENSORS MADE NO NOISES WHEN PIN3 WAS CONNECTED)

After reading the 95040.bin file I saved and edited the file. I saved the new file as immo.bin when trying to write the immo.bin file I was getting:
sending loader + MonitorCore Failed. I tried loads of times still the same problem. I found the solution was that the car battery was to low on voltage (11.2 volts) so I Put a battery charger on  got around (13.5 volts) retried and the sending loader + MonitorCore successfully launched.

Now for the next problum I was getting sending  EEPROM driver ...Fail <error=0x08>
The solution to this is I had to rename the immo.bin file to (95040.bin)

After that head ache I was getting initializing  registers ...Fail <error-0x01>
This is as far as I got lost the will to live for today!!!!!!!! As soon as I find a solution to this I will update.

Try playing with the baud rate.

Immo off is easy.. they are 3 different file's

UPDATE
Thanks to f1torrents I played with the baud rate today and got the file to load
(http://i743.photobucket.com/albums/xx75/onsperformance/Screenshot2013-11-28161520.png) (http://s743.photobucket.com/user/onsperformance/media/Screenshot2013-11-28161520.png.html)

I then tryed it on the car and no joy. Come on here and downloaded a file from the link below.
http://nefariousmotorsports.com/forum/index.php?topic=542.0 (http://nefariousmotorsports.com/forum/index.php?topic=542.0)

After writing the file this time around I noticed a difference in the screen shots
(http://i743.photobucket.com/albums/xx75/onsperformance/Screenshot2013-11-28191037.png) (http://s743.photobucket.com/user/onsperformance/media/Screenshot2013-11-28191037.png.html)

If you look in the last one it say's 'verifying file' I have not been able to test this on the car yet fingers crossed tomorrow it works.

The ECU I am using is:
AUQ
06A 906 032 HN
0261207440
s/w 0001

Just to confirm this worked 100%

In the future you should modify your original EEPROM instead if using the generic IMMO off ones floating around.
They are useful if you are in a bind. But having the original file is always the best route to take.

Glad you got it working.

Hi

can someone turn the immo off in this file please

Thank you

hello welcome to the forum. your immo off are here.

Thank you

Worked a treat,   great forum

Hello,

does this program do any changes when writing ?
Because I wrote an EEProm File, read it out again and there are two values different ?

EDIT: All ok now :-)

How can i access the me7.5 immo chip using the soldering method/ as i dont have the Kline cable.

If you dont have the kit for desoldering the eeprom and reading it, your best bet is to buy a kline cable for $10.

Hi... on Reply #8 aRd asked to immo-off an attached file. Next post from jogtx16v provided new file with immo-off. Inspecting the files I saw there is only a change at offsets $12 and its backup at $22 (along with its corresponding checksums at $1e and $2e). Only changed bit 0 to 0 and bit 1 to 1 . Am I right?... only those two bits are needed to turn immo off? I'm going to do this on my ECU.

Yep, as documented here:
http://nefariousmotorsports.com/forum/index.php?topic=2973.msg36532#msg36532

Easiest way is using my tool:
http://nefariousmotorsports.com/forum/index.php?topic=6134.0title=

Not wanting to thread jack as the steps are great on this thread, however I get an error message " no echo from cable. ( error=0x07), and then program closes.
I wonder of turb's program will not have this issue? No idea what echo it's looking for as the Kline is a single line.
Anyway, I'm going to download it and see. I need to do more than just immo and vin on my ecu so I will need to learn a ton still but awesome site and helpful thread.
Thx.
Mike.

You still need to use argdub's tool to read/write the EEPROM, my tool just makes the editing stage easier. I suspect you are having driver issues, try posting up info on what cable/driver/os you are using on argdub's thread.

I wanted to sum up my experience with cloning Immobilizer and VIN data from one ecu to another.  I felt like I had to dig around a bit for this information, so I just wanted to summarize it all here in one post.

I started with a tuned ECU from GIAC and got another ECU as a spare to continue my tuning.  I disabled IMMO in the spare and tuned and ran it with immo off for a while.

I read the 95040 from both ecu's. I only wanted to clone over just the IMMO and VIN specific data in the eeprom.  Of course, I could have just wrote the eeporm from the GIAC ECU to the current one, but there was unisettings tweaks and who knows what GIAC writes to that file...  I just wanted the IMMO data.

Locations in file of data
VIN = 0xB5-0xB9, 0xD0-0xDB AND 0xC5-0xC9, 0xE0-0xEB
SKC = 0x32-0x33 AND 0x42-0x43. (To decode the skc: flip bytes, convert to dec, add leading zero)
IMMO Data (key data shared w/ cluster) = 0x34-0x3A AND 0x44-0x4A
IMMO ID = 0xDC, 0xF0-0xFC AND 0xEC, 0x100-x10C
IMMO ON/OFF=  0x12 AND 0x22 (01 on, 02 off)

I copied the data from each of these locations (using a hex editor) from my previous file to my new tuned file, immo flagged as on of course, checksummed the file and wrote it back to the 95040 on my tuned ecu.  Plugged the ecu back in and the my car fired right up.

Again, this is not new information, I just felt it was a bit scattered through threads and here it is all in one post.

Attached are:
1) screenshots from vcds showing vin and immo ids of both ecus
2) giac.bin is the source of my immo/vin data
3) custom.bin is the file I had been using with IMMO off while tuning
4) customAdapted.bin shows the adapted eeprom with the pertinent data merged from giac.bin
5) customAdapted(checksum).bin is the last file with the checksums corrected.

I am working on an eeprom editor/wizard in visualme7logger (uses me795040 to read and write) for an future release so you can do all this without even thinking about opening up a hex editor or command prompt.  :)  Of course you'll have to write your changes back to the ecu in bootmode.

sorry but, your PIN 24 its the same of ECU CONNECTOR PIN 24?. i didnt understand that.

nope

If the boot mode pin was on the ecu connector we wouldn't all be poking around inside our ecus with an earth probe. I like to think someone has checked!

so, we need to open ECU and solder one cable to FUKENBROKEN pin24.

that pin could be found at any pin of ecu connector?.

NO.

http://s4wiki.com/wiki/Bootmode

Are you sure?

so, i ask you...

how unitronic, apr, etc, do this job without pin 24?.

Boot mode isn't required to write the EEPROM.

Argdub only allows writing in bootmode to prevent his tool being used for car theft.

OK, so only i need step 3 connections to write eeprom?.

i need disable immo, do i need bootmode?.

Listen. You have been told, and told, and told. You must open the ecu and ground pin24. Asking over and over again will not change the answer.

Is it worth pruning this thread and adding a FAQ? Or writing a new one?

hi, me again.

sorry but anybody reply my asks.

yesterday i wrote 95040 eeprom with this tool, thanks.

Audi A4 RB4 cant read via OBD/ non bootmode.

ONLY READ IN BOOTMODE!.

My ecu:  8E0 909 018 A / 8E0 909 518 AT

hello, do please immo off

dude really ? Only 1 post and you are pleasing for immo off ? :(
At least do a search there is already a solution for you

because of this can not be helped? I only recently found out about this forum. so I figured out that you have to change 01 to 02 in line 010 i020 and recalculate the amount and nothing else to do. but after writing to the ecu not appears line scan, and immediately close com port.

I'm having trouble getting the DME to read. I grounded pin 24 then connected power to pin 3.

I've posted a screen shot of the error I get. I'm trying to flash delingers IMMO off.

It's a ME 7.1.1 out of a 2.7T A6

(http://i62.tinypic.com/vxgaae.jpg)

Probably hasn't gone into boot mode, try counting to 8 or 10 not 5. You should be able to read in obd mode anyway, no need to bootmode (read an a6 2.7t in the car in obd mode today)

No luck. The DME is on the bench. I'm using a Galletto 1260 cable with the K line connector it comes with. I can't read in OBD either. I don't know what I'm doing wrong. I have the DME at 13.5v it's drawing about 0.25A. I kept pin 24 grounded for about 15 seconds after applying power to pin 3.

(http://i60.tinypic.com/2eyi7uw.jpg)

Fifteen seconds is a bit long. Try five to ten. You will get it eventually. Remember if you can connect with Nefmoto, then it isn't in bootmode... Get it connected to Nef on the bench to ensure your rig is working, then try bootmode.

Here is some help from Turboat: http://nefariousmotorsports.com/forum/index.php?topic=6134.msg57169#msg57169

Try his tool to immo off your file. It is possible something went wrong with your attempt.

As for the com port closing, not sure about that. Flashing the 95040 shouldn't have any effect on communications after the fact. All I can say is try and try again...

Great write up, thanks

Is the Vin, immo etc always at the same address in the bin file?

Would like to be able to do the immo off easyer as i struggle at the moment.

Thanks

From what I've seen so far, yes the data is always in the same place, the only differences is the pages that don't have checksums calculated are sometimes different, but this will not affect an immo off.

If you are struggling, try 95040tool.

Thanks again, i will try both but i'd prefer to hex edit the immo off as i find that way easyer.

Using a hex editor is definitely better as you get a decent view of the file and can spot if its an odd one or corrupt input data, but I tend to use a tool because Im too lazy to calculate checksums manually and it works about 98% of the time :)

Ah didn't think about the checksums, take it the me7 checker won't correct it?

Be careful here! A big source of confusion is that there are two images on the ECU -- flash (motronic EFI program) and the eeprom (adaptations, immo, coding, etc)!

Well, technically, a third is the boot code, but let's not go there.

If you are just fliping the immo bits you only have to +1/-1 from the checksum, so thats easy, if you change other stuff in the eeprom then you need to fix the checksum. Luckily there is a checksum tool around for the eeprom too, or use 95040tool.

Ok, thanks for that, may just use the 95040 tool to save more work later on...

Hello this is my first post.. Im reading on the forum for some time. Im trying to do something with ME7EEPROM, im using a VCDS cable set in dumb mode and a custom rig. I can log in with vcds but cant get anything with me7eeprom... Im always getting an error "initiating communication ... FAIL. (Error=0x21007)"
Im trying to read an ecm from audi a4 AMB 8e0909518af.
Can anyone help me please

So I will start with a noob question here.....

I am getting ready to go open source type of stuff and step away from using Maestro.

I have a spare ecu.

I assume if I were to clone my immo data on my current ecu, and flash it to the new one (spare) and use the openly available HS file the immo should work fine?

Correct.

My next assumption is that IMMO2 cannot be adapted onto an IMMO3 ecu? Or am I getting these confused here?

Glad there is a place I can ask semi stupid questions because certain things do not absorb......LOL

hey guys, im struggling here....i cannot get 95040.exe to connect to comports? my vag tacho is in usb port 2 (port 2 hub 4) but no matter the baud rate i cannot get the comport to open. any ideas?

Look in device manager under serial ports and see what your cable is identified as, like 'com1'. Not related to the physical USB port it's plugged into (although plugging in a different one may lead it to pick a different com port no)

My ross tech cable is only showing up as a USB
I uninstalled the dtivers and went ftdi port 2 but it keeps giving me the error that 0x07 and I cant change the baud i command it and it stays 10400 snd that speed isn't selectable for the port :(

Have you installed the vcp rosstech driver? Apparently that will work with a genuine lead.

thanks for the speedy reply i just revised the Use your vcds cables or what have you and i will definately be trying this tonight in doing so is there any risk to bricking my cable if i try and use vcds after reverting to vcp or should i just go vcp everytime i wish to use it as me7_950404.exe
again i really appreciate all the help and i am scraping by on alot of stuff i would not have been able to do without you nef gods!!

There shouldn't be a risk of bricking the rosstech lead of you're using the rosstech drivers, but I never managed to get them working myself (although others have). For the sake of $10 is personally just buy a blue kkl lead!

I have a all blue kkl lead its installed as a serial port but won't get recognized by either nef or vcds or me7. I also have another cable came with my galetto its a eobd cable nef acknowledges its there and when i moved the mouse cursor over the cable it says its a 232r chip but it won't initialize. I have successfully flashed with the ross tech via nef. I also ordered a new blue kkl cable with ftdi and 232r in the title. Its a lil frustrating to be honest :(

Ok vcp drivers installed and same thing

Have you checked in Device Manager; Universal Serial Bus Controllers; Ross-Tech Direct USB Interface; that the Load VCP checkbox is checked?  (Under Advanced tab)

yes i confirmed it is checked i also have tried it on a different computer should i try the ftdi VCp drivers instead of ross techs ?

Well the ftdi VCp does not work either Arrrgh
Slow initi in nef tries but won't connect is it really a timing guess for each ecu ?
so far i have tried with ross tech usb drivers vcp drivers from ross tech and ftdi. and nothing, it detects the com port and after that gives me the same error the e07 and baud rate wont change aswell its always 10400.
also i have tried to get nef to read the ecu i am thinking this is a way to tell you that you are actually in boot mode and at any baud rate it still wont connect.
if i open vcds it will recognize the cable and that i am linked to the car so i am pretty sure my rig is working i am at a loss here i have also tried my other 2 cables to no avail.
any help would be greatly appreciated i also have the "load in vcp drivers" selected on the usb drivers
this is a 2001 audi allroad me7.1 ecu that i need to defeat the immo because i am doing a 2.7t swap into my a4 and the car came with no keys or cluster :(

Any nef gods around
Well I got a new cable confirmed its a 232r ftdi and still no joy :(
I checked and my new cable will connect to my b6a4 ecu in the car. So it must be my redneck rig power supply or ecu is bad

Well pulled my first 95040.bin :)

I would like to thank all of the poeple for the tuto..grace it to you I managed to put my first immo off and write on the ecu... ;D...ty guys....sorry for my poor english i am better with french....

Noob Question: Why do you need to enter Boot mode to simply read the 95040?

I read mine (and saved the Bin) in order to get the SKU simply by using the following command line:

me7_95040.exe --OBD -r -p 4 95040.bin

I successfully retrieved the SKU in order to login to VCDS and adapt a second key for the car (2004 C5 S-line, BEL).

You don't need to enter boot mode to read the 95040 on most ecus. I have read various 1.8t and an aza 2.7t ecu without needing to bootmode, but some people report major issues reading in obd and have to bootmode, don't know why.

Need help with this harness grr.

(http://s17.postimg.org/sw77zf3cr/mk4_flash.jpg) (http://postimg.org/image/sw77zf3cr/)
where do the L-line go?

You don't need the L line.

thanks TURBOAT 

Hi!

Readed ok with Galletto cable without bootmode.

Now i tried to write:

me7 --bootmode -wp1 95040.bin
ver: 1.31
com port: 1
baudrate: 10400
opening COM1..........OK
Starting boot_mode .... FAIL .... no response from ecu (error=0x07)
Closing COM1


Three times bootmode - grounded pin 24 with Galletto and Blue KKL cable and baudrate 57600, same result.

Any help?

Update:

Battery voltage was 12.6V, raised up to 13.6V and success BUT!

Opening COM1........ unable to set comport cfg settings. (error=0x01)

Now what?

Sorry to bring up an old thread but I am just about to embark on my first CMD attempt as well as an IMMO off. I was directed to this site on another forum and so far everything I have read is pretty interesting. I am blown away by the amount of technical information here.

Anyways, I am wondering which side of the OBD plug are the pinouts shown from? I know the ECM is shown as if looking at the plug but am confused about the OBD plug. Do I count the pins if I were looking at the plug on the wire in side or as if I was looking at the pins as we do with the ECM? Any help would be greatly appreciated. Thanks.
 

The pinout above is on the ECU socket, if you look closely into the ECU you can see the numbers on the pins

Thanks for the response. I've got the ecu side figured out but it's the KKL cable I am questioning. I don't know where pin #1 is. Is it top left if looking at the pins or top left on the wire side of the plug? Sorry if I am not explaining myself well. I hope I am being clear lol.

Ok, so I'm not sure if I mentioned it or not but I am the ultimate NOOB when it comes to CMD. I am doing my best to learn by reading all I can here and watching some youtube vids. I decided to just try and read the eprom over the OBD port in the car (not trying to get into bootmode) just to get a feel for the program. I've attached a screenshot showing my result. If someone would be so kind and maybe help walk me through this I would be truly greatful. I am doing my best not to just ask for the IMMO off. I would like to learn how to edit it myself but haven't a clue where to start. If I am not mistaken, it is trying to access the ecu in bootmode? The way I understand things is that you don't have to be in bootmode to read the ecu over the OBD. Am I incorrect?

(http://i1280.photobucket.com/albums/a497/teck09/Capture_zpspxuwyf98.jpg) (http://s1280.photobucket.com/user/teck09/media/Capture_zpspxuwyf98.jpg.html)

So I tried again this time trying to get the ecu into boot mode. I grounded pin 24, turned on the ignition, waited 3 secs or so then removed ground from pin 24. Same result as the screen shot above. I then tried the same process using every baud rate option, still no dice. Tried leaving the ground on pin 24 longer, no dice. I know its grounding because the fuel pump doesn't prime and the sensors don't make noise as noted by the OP on page one. Once I pull the ground from pin 24 the are audible noises from sensors in the engine bay but I cannot seem to get the ecu into boot mode. At this point I am completely stumped (as if it was possible to be more confused than I already am) and don't know what to do. If starting another thread would be beneficial someone just say so. I don't want to clutter the board more than necessary.

The pictures are both sockets. Imagine that as the OBD socket on your car not your cable.

Thank you. Your explanation is a lot easier to understand than the way I was trying to describe it.

I don't think I mentioned why I needed to do this and hopefully it helps someone similar to myself in the future. I have 2001 VR6 Jetta that was misfiring on cylinder #1. After much troubleshooting it turned out to be the injector driver in the ecu. I purchased a used ecu from the same model car thinking much like Hondas that the ecus are interchangeable. Obviously that isn't the case which after many local quotes of $150+ for an IMMO off led me here. Having no CMD experience the task seemd daunting but this site was a huge help. I documented in posts above about not being able to read the ecu over the in car OBD port. After making a jumper harness and getting boot mode on the bench here are my results.

I was able to read and save the 95040.bin off of the bad ecu which matches the cluster and key

(http://i1280.photobucket.com/albums/a497/teck09/Capture1_zpsdgydwxqf.jpg) (http://s1280.photobucket.com/user/teck09/media/Capture1_zpsdgydwxqf.jpg.html)

Initially I couldn't get it to write but after switching the baud rate I was able to write the 95040.bin from the bad ecu to the new to me used one

(http://i1280.photobucket.com/albums/a497/teck09/Capture2_zpslfqjmieq.jpg) (http://s1280.photobucket.com/user/teck09/media/Capture2_zpslfqjmieq.jpg.html)

At this point I was elated but cautiously optimistic about it working in the car. I am happy to report that it did. It fired right up with no misfire. These are prob baby steps for most but I am pretty proud of myself lol. Just thought I would share and thank everyone on this topic and forum who takes the time to post and create a library of information that can be used by NOOBS like me.

Thanks again.

-Ryan

Well done! You should feel proud. I was pretty elated to clone my ECU too. It isn't much in the scheme of things, but look at the result. You have a working car again for the cost of a used ECU! That is awesome when you think about it...

Exactly. Only prob now is the ecu was out of an automatic and is searching for the auto trans leaving me with a CEL lol. Next stop, coding.........

It workd  ;D But how do i make the hazard warning lights stop?

What car? Which ECU?

A4 1.8t bosh me7.5

Are you using proper ECU for your car?
Does it have proper communication with other modules on CAN?

If the key matches the cluster, you won't have any hazard lights.

If the key does NOT match, welcome to hell.

Only option is to adapt it all.

You can pretty easily open the cluster up and desolder the light, or slip a piece of plastic over it, on many of the clusters I have done.


A word of advice. I spent 17 hours or so trying to get this program to work using a variety of cables, including a true hex can vcds cable, a real vag tacho cable, a fake vag tacho cable, chinese vag k can, chinese vag commander, and probably a couple others. NONE of them worked for boot mode, best I could do was the real licensed VCDS Hex Can cable was able to read in OBD mode.

I also tried on Windows 7 and Xp. In the end, the blue KKL cable with the horseshoe looking emblem and the CE sticker under it is what worked for me, easily using Vista Driver CDM 2.04.15 WHQL drivers I got off this site. So if you're having issues, I suggest just buy the 9 dollar with shipping cable, or find somebody to borrow from. Because nothing else worked for me.

And on the B6 and up that display SAFE on the cluster, as well as non stop hazard lights? Lot of desoldering there :P

Lol I had fun with that

So i guess there is not an easy option like cutting a cable from the cluster?  :-\

There is an easy option - just use it as it is supposed to work in stock form (proper instrument cluster/ECU combo, working CAN communication between all modules, immobilizer activated in ECU, ECU paired with instrument cluster, keys adapted to instrument cluster). I would say B6 is still quite easy to work/hack with. The newer the car the problems are greater.

Ok, so i have extracted the login key from the 95040 bin, and i have a kkl 409.1 cable. Thouft about vds lite, but its 100$. is there any free software that i can use to pair the cluster?

I am not sure if VCDS Lite would be even able to do it (normal VCDS for sure will).

Ii tried with vcds lite, but i doesnt fint the instrument cluster, even scanned for all possible addresses.  Is this because of the immo off or have i broken something when replacing it?  ???

VCDS should still be able to talk to the cluster, even with a immo off.

Hi!
Im new here.Anyway I have one question,has someone fiqured out hot do defeat motronid med9.1 immo?

HUGE Thanks to you for making this program!! used in conjunction with ArgDubs program, and about 55 tries to figure out everything... We have Engine Start and !
 8) ;D
ME7.1.1  551r

hi, sorry to bring up an old post i try this via obd and have no issues, but when i try to connect in boot mode i get

starting boot mode ....fail .... no echo from cable

the port settings correct and its working in obd mode

any help would be great thanks

got it to work, my KKL cable had a pin not connecting properly
my procedure with 409.1 me7.5

(http://s24.postimg.org/d4wxjnp4x/me7_5_procedure.jpg) (http://postimg.org/image/d4wxjnp4x/)

Just popped back on the site. Can not believe all the responses to my thread.
I'm currently doing a bam Quattro conversion in a mk1 caddy. I want to tune this time as well so when I figure it out I will do a thread on that.

Nice guide! Still great if anyone could turn off the immo in the bin.

Here's your file Immo Off and checksums corrected (thanks to the tools here). Should be ready to flash. I'm kind of excited there was something I could do to help someone on this site. Mostly everyone here is decades ahead of my knowledge!

Many thanks! I did figure out how to use the eepromtool and turn the immo off and correct the checksum at the same time. (Actually I don't know how the checksum could be wrong and I thinking this may have something to do with the immo having become activated on my own car with my own keys..).

Now I'm facing the problem of that I can't read the 95040 chip anymore after attempting to ground pin 24...  :-[

Why isn't there anywhere any info on where to ground pin 24?!

I used Ecupinout figure and made a wire from from blue pin 1 ground on the connector to the pin 24 (second pin from bottom left, opposite the circle on the chip). Turned ignition on (+ using an extra battery supply), waited 20 secs, took off the ground, tried to write to the chip with the latest tool (v.1.31):
c:\me7_95040 --bootmode -w -p 1 95040off.bin

Except... it didn't doesn't work. Repeated the steps. Still no boot mode and no connection.

Now I can't even read the freakin chip anymore.

Find the nearest good ground pin on the ECU itself.

c:\me7_95040 --bootmode -w -p 1 95040off.bin

On my Me7.1 ecu I had ground pins 1+2, constant power on pins 21+62, grounded pin 24 on chip for 2-3 seconds while powering pin 3. Worked good but not on my Me7.1.1 ecu. For it I had to switch power on both pins 3+21, constant power on pin 62. Hope this helps.

Thanks, I did look for a pinout to the ECU chip without success. So I connected the other end of the wire with a tool to the chassis.

Still nothing. I keep getting the same error messages in the cmd screen as the peeps before me on this thread:
starting boot mode.. fail. no response from ecu. error 0x07

Here is a fig of the setup with the ECU removed and wire connected, which I believe should be correct.

The things that worries me is that I haven't been able to read the ECU since I pulled the original 95040.bin out. How do you check if the ECU is still ok?

Thanks. Good to know the ground pins. Did you use a separate power supply and a jig?

If you are using me7.1 there is a simple open pad pair you can short.

http://s4wiki.com/wiki/Boot_mode
(http://s4wiki.com/images/thumb/0/00/ME7.1-bootmode-info.png/548px-ME7.1-bootmode-info.png)

If you have a ohmmeter handy you can verify that one of those pads goes to pin24, the other to ground.

Thanks, yes it is indeed an ME7.1 and I've looked at the fig of the S4wiki. So if I understand correctly there are two options either a) to ground pin 24 the chip or b) connect (=short) the two pads that I've circled on the fig?

Forgot the fig.

That latter one is for a different ECU.

It's still the same ECU to which I've just added a red circle. That is, it's not the s4wiki for the ME7.1.1.

I used a bench harness made from the instructions at beginning of this post and use a car battery for power supply. I'm sure I'm as new to this as you, took a few tries to get things to work even just to open a command line.

Oh, no it is ME7.1 but you circled the wrong set.

It is the square set to the right.

...

Thanks! I need to try this as an alternative. Just to be 100% sure I've marked the two pads with a green line.

F.y.i. For some reason my ME7.1 does not look identical to the other's I've seen, even if the cover says it one.

Well, trying to put a (temp) wire between the pads didn't solve it. The pads are about 1 mm in diameter and too small with my skills and eyes to get them to stick.

Next problem. How do you verify the ECU EEPROM is still OK?

How would a temp wire work? You have to disconnect it a few seconds after you power up the ECU.


Bootmode :P

Or you could desolder the flash, program it (or a new one) in a chip programmer, and solder it back.

But that is pretty damn silly; you shouldn't be doing ANYTHING without a known good way to safely bench flash your ECU in bootmode. Period.

You don't even need a temp wire, just get something metal with a roundish/flatish tip to bridge the pads while powering up the ECU. If it is too flat (say, a flat head screwdriver tip), it is hard to keep the tip level and have a good contact to both pads.

I find the tip of a cigarette lighter 12v plug works great.

Well, two wires actually with stripped ends and loosely fastened together for quick release.

Yeah, that would have been ease peasy. I thought what was needed was a bridge or staple in between the pads. Anyway, it's even more f*d up now as the underlying thin metal pads on the board became detached when heated with the soldering iron tip.

If the ECU still is ok, I should be able to check this by connecting with VCDS and check the engine menu - and - by re-reading the 95040 chip with ME7_95040?

That will only work if the flash isn't corrupted.


If the flash is corrupted, that will only work in bootmode.

Ok. Thus, it's absolutely necessary to get the chip in boot mode. Either by a) successfully grounding pin 24 or b) finding a service to recover the (piece of s*) ECU.

A quick google shows e.g. a company called ecuflash (http://www.ecuflash.co/ecu-recovery/). I have no idea if they are any good or their what kind of prices they have.

If you don't have a reliable way to do bootmode yourself, don't bother doing ANY tuning.

It is your fallback if something goes wrong.

Also, you should always have at least one known working ECU as a spare with you. Preferably in the car somewhere so you don't get stranded ...

Well, I'm not really attempting to tune the ECU and haven't done so earlier, but to get the IMMO3 system OFF. Ever since the IMMO system got activated the car doesn't start.

Checked the one in UK and based on that found a lot of local ECU tuning firms. Problem is that most don't even respond to inquiries or even know how to do it. So far the price for turning the IMMO OFF has been 500 - 600 euro.

So instead I just found a temporary solution, which is using an IMMO deactivation box (e.g. VAG Drive Box OBD2 IMMO Deactivator for Bosch EDC15/ME7. Just costs a 10 euro at Aliexpress). :) The downside is that shipping takes for ever.

hy guys i try to read a ecu me7.1.1 for immo off but i have a error code 0x4e01 anyone have an solution for this code ???? sorry im not very good in english...

Hi, where in 24c20.bin (256b) file is SKC ?  0x10-0x11 & 0x70-0x71 and flip bytes , convert to dec ?

No one ? chip is now desoldered.

location
(https://lh3.googleusercontent.com/DesByL9c3R7WHr7i4a5fzWEaacaLsPke5_2LJhkFMs_xgTMfthh4gSH2VT7ERWtWejVQM5ykOxCDEw=w1920-h1080-no)

now gone

(https://lh3.googleusercontent.com/ayqPun7R8ufx3lSzlK-CLc3GZ5lZQbIQ6OrvVkMUGrBMYtXKn_qM8CrOyPxXAWU60kT8-g7Ca95NPA=w1920-h1080-no)

I'm waiting for eeprom programer.

So im having a bit of an issue getting my ecu into bootmode. I think it worked the last couple of times but i get the same initializing registers failure that OP had. Here are some screenshots.

I successfully read the eeprom and downloaded. file attached. this should be a virgin file to my knowledge.

(https://c1.staticflickr.com/1/539/30901052803_2b6c055362_o.png)

I tried a couple times to get the ecu into bootmode by grounding pin 24 then powering up the ecu but that didnt work. the last time where i was successful here was with the ecu already powered up then i grounded pin 24.

(https://c2.staticflickr.com/6/5604/30901052813_2b7335f3bc_o.png)

any ideas? I made a bench harness to use but it would not communicate with the ecu at all so i ended up using a friends car to read the eeprom. Maybe that has something to do with it? cable is a blue kkl from ebay.

So im starting to wonder if this ecu has an immobilizer in the first place? VCDS readout with no "extra info" field. adaption channel 91=4
(https://c1.staticflickr.com/1/719/31621983831_0703c2a42a_o.jpg)


EEPROM readout: (32&33 show "FF")
(https://c1.staticflickr.com/1/337/31700257706_53007e021f_o.png)

ground pin 24, power on ecu, count one... two... remove 24 pin and then hit enter in your command
Try different baud rated, this should do the job.

Check adaption channel 91 for immo related information with vcds

Every single wideband 1.8t ECU i've bootmoded I've had to use a 10k resistor on the boot pin during the WHOLE process.

That will never work.

That may work for the eeprom, but that literally grounds out a line to the flash that will corrupt ALL flash read/writes.

Do not do that, do not tell others to do that.

All of this is voodoo crap that doesn't mean anything - people are associating random acts with success and making them hard and fast rules. Not a good thing.

The boot pin is SAMPLED ON BOOT. Period.

Every single anyband ecu I've booted did not need a resistor. I don't leave it connected longer than 2-3 sec. during boot up either. Maybe it's a UK thing?  ;D

Nah I've never used a resistor on 1.8t widebands. They're probably the easiest ECUs I've worked on.

i did, all it says is "4"

4 is adapted.
1 is off



Sent from my iPhone using Tapatalk

If you are having difficulty getting it into bootmode, I suggest making a simple push button ground for the pin. That way it is easy to try different intervals of grounding on bootup.

I used a seizer probe to hook onto pin 24, wired it through a momentary switch to an alligator clip. Works great. I've always had success with a five second ground on my 032HS ECU, but my 518AK needed at least eight seconds. Keep trying...

I had tried 2/3/4/5/6/7/8 seconds without success.  Putting it to ground the entire time kept it in bootmode.  Removing it drops it from boot.  I can video it if you want.  3 ECUs all with the same story.

I remember clear as day because the first time I bricked it I was panicking, had tried the method as documented (3 seconds during boot) and it never worked.  The first time I put the resistor to it and kept it there, it worked. 

You can't R/W the flash if you keep Pin 24 grounded on a 29F800. For the simple reason that Pin 24 is A0.
Also, once the MCU is in boot, that's it. Until the uploaded program reboots it, it will stay in boot. If the behavior you see is any different then you have a problem in your toolchain or hardware.

Tell you what, flash an ECU with the bootmode pin grounded the whole time, and watch what happens.

Ok this is my first time playing with ECU.  i am using k+can commander 1.4 with FT232RQ
ECU is "4B0 906 018 CG" 1.8T AWT, on a bench
I am using this CMD program and reading EEPROM was successful, then i open it with hex editor and change this immo values to 02

(http://i83.photobucket.com/albums/j318/Cyril279/95050_explained_zpsa3d0abec.png)

Put ECU in boot mode and try to upload new eeprom data
The program shows that upload is succsessful, but it can not read EEPROM data

after thet i put ECU in OBD mode, and it connect to ECU but cant read EEPROM...


So i tried to upload original .bin file and got same error
But, the difference is after I put ECU in OBD mode i can read EEPROM successfully.

What I am missing?

In attachment the 95040.bin is original file and other id immo off

good news party people,
Today i use this tool from bootom http://nefariousmotorsports.com/forum/index.php?topic=2973.15
95040sum.exe

The upload process has same error, can't verify EEPROM write. But after puting ECU in OBD mode i can read EEPROM.
VCDS showing VIN number that i set, no EEPROM DTC, and nefmoto can read flash file from ECU. 

So i think i made it  ::)

Thanks for the update, glad you got it sorted!

You are welcome but I must say thank you and all other guys on this forum for yours work and detail instruction

hey guys,

Pretty sure this is my first post., But i just say the group here and the info is awesome.  Read tone of post and hows and here is my experience.

Building a bench flashing using bit and pieces of a car..........Check
Getting a cheap ebay cable with the proper chip........

hey guys,  don't know what happened in the previous post.?

Pretty sure this is my first post., But i just have to say the group here and the info is awesome.  Read tons of post and hows to and here and this is my experience with a 2.7T A6 AUTO ECU.  (i have never done this until now)

Building a bench flashing using bits and pieces of a car..........                                 Check
Getting a cheap ebay cable with the proper chip........                                          Check
Testing the above with VCDS lite                                                                       Check
Trying to use Nefmoto, only to find IMMO ECU                                                      Check
Learning how to bootmode a ECU using the 2 pads with a screwdriver                      Check
Reading Modifying and Writing a new 90540.bin  in command prompt                        Check
Being able to access said ECU with no immo                                                        Check

I agree with a Veterans here.,  Read and Read and Read some more  All the info and software required is here.

Cheers                         

me7.5 8e0 909 518 f 1.8t a4 b6 2002 amb. both ecu have the same hardware numbers

im trying to get a second ecu to work so i can play around on it and keep my stock one safe incase the smoke comes out.
i finally got to read the 95040 chip on ecu(2) and pulled the bin file off of it and was able read and save it on my computer, so i pulled the stock ecu(1) out and did the same.
i got it to write to ecu(2) with ecu(1)'s program then shut it down and powered it back up to read and check the file, everything looks good to me, but my immobilizer does not like ecu(2).

any idea what i am doing wrong?
is there a way to specify what bin file is written to the ecu other than dropping it where the command prompt puts it in a read?
i saw in one thread that you can't rename the file or it wont be recognized, is that correct?

btw experiance level one day.

How are you reading/writing the eeprom to the ecu? Have you read back the eeprom from ecu(2) to verify it has changed.

In general there is no reason why you cannot rename or move the bin file, you just need to specify the path when you write it back

im using argdub's tool in boot mode 19200baud as it doesn't seem to respond in obd(for read). im going to give it another shot here shortly, when checking the write i only checked the changed immo settings that i had messed around with, im going to compare the key this time.

in one of onsperformance's replies he said that he was having a eeprom communication error and changing the file name back from immo.bin to 95040.bin let it run.
i'd like to lable the file itself, right now i just have them in separate folders.

I don't think I'm using the current argdub tool, but I had no issues reading a bin and writing it to tmp.bin and 032mj.bin yesterday. Make sure you don't switch focus away from the terminal where you are doing the read/write, that was consistently breaking it for me.

ill have to try that then. it works! car now starts right up and passes immo. i'm not sure if it was keeping cmd prompt on top or if i had the wrong file on there.

thank you for your input.

Glad you got it sorted :)

Usually I'm the person who figure it out himself. However...

Long story short. Bought cheap Chinese KKL 409.1 cable with CH340 inside. Didnt work.

Swapped CH340 chip with FT232RL chip (connected FT232 modules TX and RX to a CH340's TX and RX pads, chip is removed of course), more progress yet still not working.

With CH340 couldnt get cable echo, now with FT232 cannot get response from ECU (0x07). Doesnt matter bootmode or OBD.

Have 3 years of electronics engineering background so I know how to solder and stuff.

Power for ecu comes from 14V 3A PSU.
All the wires are connected correctly.

I think I had 07 the other day, power up the ecu before plugging in the cable to the odb port fixed it I think.

jogtx16v how do you do immo off? TIA

Use this tool to immo off :)
http://nefariousmotorsports.com/forum/index.php?topic=6134.0title= (http://nefariousmotorsports.com/forum/index.php?topic=6134.0title=)

Hello,

I have managed to get everything communicating with each other, but the pic of which pin to ground doesn't match the circuit board inside my ECM.

I've attached a pic of the label on my ECM. Any assistance on how to get this one into boot mode would be great!

Thanks!

BUMP BUMP

Any assistance with this issue would be great!

Thank you

Friend it is a M592 ECU, it is an old ECU like the M383 ones!!!

So, how do I go about getting it into boot mode to remove the immobilizer?

Just take out the 24C02 serial eeprom to Immo OFF content.
(https://ibb.co/nwvyhbj)

The picture you attached is not showing.

I have followed the instructions at the beginning of this forum, and can get my cable and software to communicate with the ECU. However, I cannot get it into boot mode to allow me to Read/Write the EEPROM.

How do I do this on my version of the ECU? The circuit board is different than the one posted in the beginning of the forum.

Thanks again!!!

Hi
i can read the file ok , but maybe i am being dumb. i can't find the location of the file once read

C:\Users\Steve>C:\Users\Steve\Desktop\new\me7_95040.exe --bootmode -r -p5 95040.bin
Ver: 1.31
Com Port: 5
Baud Rate: 10400
Opening COM5 ... OK
Starting Boot_mode ... uC identification response = 0xC5 (C167 derivatives) ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Initializing registers ... ... OK
Sending EEPROM driver ... OK
Searching Chip_Select pin ... P4.7
Configuring SPI Interface ... OK
Checking EEPROM status ... 0x00F0 ... OK
Reading EEPROM ... OK
File saved
Closing COM5


.exe file is in a folder on the desktop called new , saved file does not appear in there

Many thanks for the help
Steve

i don't see anything wrong with what you're doing...

try moving the "new" folder to another location "c:\new" perhaps (not on your desktop)
try a different filename?
maybe it's a windows thing?  ???

Opinions will be different here, but I chose to put the me7eeprom.exe file directly into my C: drive, (I am the administrator of my laptop) on windows open FILE EXPLORER and then on the left side of the screen there is a drive called -Local Disc (C:)- In here is where my me7eeprom.exe file is located. after that all I do is open Comand Prompt and typeme7eeprom.exe into the DIR. (I renamed me7eeprom.exe to immo.exe on my laptop as its shorter to type and im lazy. Run the program as you did and it will save your 95040.bin file to the C: drive as well. I linked what I do below hope it helps.

Microsoft Windows [Version 10.0.18362.720]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>cd..

C:\Windows>cd..

C:\>immo.exe
ME7_EEPROM v1.40

Allows to program ME7 ECU's EEPROM.
This software needs a dumb serial to k-line cable for connection with the ecu.

Usage: me7EEPROM [-p <comport>] [-b <baudrate>] [--OBD | --bootmode <mem_type>] [--CSpin Px.x] [-r | -w | -s] [<file name>]
 -p, --comport  COMPORT    Set COMPORT.
 -b, --baudrate BAUDRATE   Set BAUDRATE, default: 10400.
                           Allowed baud rates: 9600, 10400, 19200, 57600.
     --OBD                 Use this option to read the EEPROM over OBD port.
                           Currently, only read is supported in OBD mode.
     --bootmode MEM_TYPE   Use this option to program the EEPROM in boot mode.
                           Allowed memory types: [95040 | 95080 | 95160 | 95P08].
 -r, --read                Read EEPROM contents and save it to file.
 -w, --write               Write a file to EEPROM.
 -s, --screen              Displays EEPROM contents on the screen.
     --CSpin               Set the CPU chip select (CS) output. eg: P4.7
                           The following table shows all available ports with
                           its corresponding physical address.
                              Port   PortReg   DirControlReg
                              P2     0xFFC0    0xFFC2
                              P3     0xFFC4    0xFFC6
                              P4     0xFFC8    0xFFCA
                              P6     0xFFCC    0xFFCE
                              P7     0xFFD0    0xFFD2
                              P8     0xFFD4    0xFFD6
     --help                Display this help and exit.

Usage example:
   Read EEPROM over OBD port:         $ ME7_EEPROM --OBD -r -p 1 95040.bin
   Print EEPROM contents to srcreen:  $ ME7_EEPROM --OBD -p1 --screen
   Write file to EEPROM in bootmode:  $ ME7_EEPROM --bootmode 95040 -wp1 95040.bin

It's free for hobby use.
This software is provided "as is", with NO WARRANTY.
email: agv.tuning@gmail.com

C:\>immo.exe --OBD -r -p 4 95040.bin
ME7_EEPROM v1.40
COM: 4, Baud Rate: 10400
Opening COM4 ... Unable to open comport. (error=0x20201)
Closing COM4

silly to put stuff in the root directory. You have a user directory. Use it.