NefMoto > Technical > Cluster and Immobilizer (Moderator: ddillenger) > EDC17cp14 Immo Defeat or Clone Solution?
Pages: [1]
« previous next »
Author Topic: EDC17cp14 Immo Defeat or Clone Solution?  (Read 13363 times)
dbreeze
Jr. Member
**

Karma: +9/-0
Offline Offline

Posts: 41
« on: June 22, 2016, 12:52:28 PM »
Anyone have any insight for a solution to immo defeat EDC17cp14 tricore ECUs? Or if it is possible to just clone from one to another?

I have a flash dump (I'm pretty sure...) from a 03L 906 022 KT (Jetta TDI) using MPPS but that's about as far as I could get. I know bootmode is needed on these for a full read but couldn't tell exactly what tool I should be using to read/write to it.

Any info would be great, thanks!
« Last Edit: June 22, 2016, 12:55:40 PM by dbreeze » Logged
H2Deetoo
Sr. Member
****

Karma: +26/-1
Offline Offline

Posts: 257
« Reply #1 on: June 23, 2016, 01:21:06 AM »
Hi,


Both solutions are possible.
1a) You can disable immo by changing a byte in eeprom (and correct checksums)
1b) You can also disable immo in flash, no checksum fix needed, but this could leave a message on cluster I it seems

2) You can also change the immo data in an EDC17, so "clone" it sort of. This immo data is crypted and again checksums must be corrected.

For all solutions there are tools available which can do this.


Regards,
H2Deetoo
Logged
yxx499
Full Member
***

Karma: +4/-10
Offline Offline

Posts: 106
« Reply #2 on: June 23, 2016, 01:58:32 AM »
Firstly you cannot use MPPS at this job i think... Maybe original works, but china clone no way, at EDC17..

Better use KTAG or FG-Tech to make a backup (flash + EEPROM+ MPC)

Then you can search something to make immo off + chksum or pay someone. There are a lot of websites/ persons who can make immo.
Logged
dbreeze
Jr. Member
**

Karma: +9/-0
Offline Offline

Posts: 41
« Reply #3 on: July 13, 2016, 06:51:46 AM »
I picked up Galletto 4 and have a full read (Bootmode) of both the original and replacement ECUs. When I go to try to flash (Bootmode) the original ECU's files to the replacement one, I just get errors in Galletto saying that the OTP area cannot be written (I knew this previously) and it will not continue. What am I doing wrong?

When I try to flash each piece individually:

- Internal Flash: gives some error about checksums not being supported and won't continue with the flashing procedure
- External Flash: also gives an error about checksums not being supported and won't flash
- Eeprom: flashes perfectly fine and verified by re-reading the ECU

Any ideas? I'm looking to either Immo defeat the replacement ECU or clone from the original. I just seem to be hung up on writing back to them.

Thanks in advance!

Edit: And if I were to give up trying to recode it, would I be able / just need to swap the MCU between the two ECUs? I have access to the equipment to properly do so, just want to see if that will work in the end.
« Last Edit: July 13, 2016, 06:59:03 AM by dbreeze » Logged
H2Deetoo
Sr. Member
****

Karma: +26/-1
Offline Offline

Posts: 257
« Reply #4 on: July 15, 2016, 01:34:49 AM »
You need to leave the original flash (or original OTP area) as it is, and patch your eeprom so it matches this unique OTP data.
For this you need specialized tools.


Rgs H2Deetoo
Logged
dbreeze
Jr. Member
**

Karma: +9/-0
Offline Offline

Posts: 41
« Reply #5 on: August 05, 2016, 09:05:06 AM »
Ah, figured it out finally. After connecting to the ECU with Galletto 4 it displays the hex addresses for the OTP areas (2 in this case at least). I copied those areas from the replacement ECU and overwrote them in the file from the original ECU. Flashed perfectly fine.

The areas were both $3FFF long:

0x10000 -> 0x13FFF

and

0x14000 -> 0x17FFF
Logged
brayson
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 8
« Reply #6 on: June 09, 2018, 01:14:06 AM »
Quote from: dbreeze on August 05, 2016, 09:05:06 AM
Ah, figured it out finally. After connecting to the ECU with Galletto 4 it displays the hex addresses for the OTP areas (2 in this case at least). I copied those areas from the replacement ECU and overwrote them in the file from the original ECU. Flashed perfectly fine.

The areas were both $3FFF long:

0x10000 -> 0x13FFF

and

0x14000 -> 0x17FFF


Hi Dbreeze, would it be possible for you to share the before and after.

Just to clarify what you have done.

Copied original EEPROM with OTP in.

Made a copy of the NEW eeprom with OTP in.

Transferred the OTP address section

0x10000 - 0x13FFF & 0x14000 - 0x17FFF

From the new ECU eeprom to the old ECU EEPROM

Then flashed the old ECU (with modded OTP) onto the new ECU?

Also on the back of this was this just in the EEPROM section not touching the flash as i thought some of these come with immo informatoin in the flash too?

Cheers.
« Last Edit: June 09, 2018, 01:16:16 AM by brayson » Logged
prj
Hero Member
*****

Karma: +1072/-480
Offline Offline

Posts: 6035
« Reply #7 on: June 09, 2018, 01:51:45 AM »
On VAG if you just copy everything but the OTP over the EEPROM won't match the OTP and it won't work. Need some modifications.
BMW you can do this...
Logged
PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
PK79
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 3
« Reply #8 on: September 19, 2018, 04:36:22 AM »
Hello.
I recently tried to clone a MED17.2 from a Mini R56. I read out all (Internal flash and eeprom) with Galletto. When writing to the new (used) dme/ecu I could write the eeprom, but when writing the Internal Flash it stops at 4% giving me an error. I guess this is because of the otp sections? Is there a workaround for this? The car starts and runs with only the eeprom reflashed, but is giving a dtc; coding not ok.
Anyone out there who can point me in the right direction? I see you pasted in the old otp lines into the hex, but I can not find the right adress when opening the file in HxD.
Please help me Smiley   
Logged
younes
Newbie
*

Karma: +0/-11
Offline Offline

Posts: 8
« Reply #9 on: September 19, 2018, 04:37:56 AM »
Hi mate,

Contact me in Skype: El Moukhtari-Engineering or elmo-engineering

Br
Logged
prj
Hero Member
*****

Karma: +1072/-480
Offline Offline

Posts: 6035
« Reply #10 on: September 19, 2018, 08:41:58 AM »
Because you use shitty clone tools.
Logged
PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
PK79
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 3
« Reply #11 on: September 19, 2018, 09:27:29 AM »
Quote from: prj on September 19, 2018, 08:41:58 AM
Because you use shitty clone tools.
 

Sorry for being a beginner then.  I'm truly sorry that you have to go through the process of watching someone use a shitty clone tool... By the way, that is not the fault.
Logged
prj
Hero Member
*****

Karma: +1072/-480
Offline Offline

Posts: 6035
« Reply #12 on: September 19, 2018, 11:35:56 AM »
Quote from: PK79 on September 19, 2018, 09:27:29 AM
 

Sorry for being a beginner then.  I'm truly sorry that you have to go through the process of watching someone use a shitty clone tool... By the way, that is not the fault.
It is. Proper tools skip writing OTP.
If you are a beginner you have no business with MEDC17 in the first place.
Logged
PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
PK79
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 3
« Reply #13 on: September 19, 2018, 11:45:32 AM »
 
Quote from: prj on September 19, 2018, 11:35:56 AM
It is. Proper tools skip writing OTP.
If you are a beginner you have no business with MEDC17 in the first place.

You are a really nice dude aren't you?  I'm getting help from a guy without the need to be rude, so I guess I'll be good.
Logged
Pages: [1]
  Print  
« previous next »
 
Jump to:  

Navigation
Personal Tools
  • November 24, 2024, 04:52:29 PM
  • Welcome, Guest. Please login or register.
    Did you miss your activation email?

    Login with username, password and session length
Search
 
Advanced Search
About Disclaimer
All Rights Reserved 2010 Nefarious Motosports
Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.022 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)