edc15 immobilizer

Pages: 1 [2]

« previous next »

Author

Topic: edc15 immobilizer (Read 13704 times)

nihalot

Full Member

Karma: +40/-3
Offline

Offline

Posts: 116

	Re: edc15 immobilizer « Reply #15 on: October 17, 2016, 08:45:49 AM »

Quote from: prj on October 15, 2016, 09:52:25 AM

But who cares?

Me.

Quote from: nubcake on October 15, 2016, 01:29:53 PM

Well, his approach has at least one legit reason - learning c167 asm.

also, to learn what engineers at bosch thought when they designed this system.

Quote from: sjscirocco3 on October 14, 2016, 01:36:56 PM

I'm also interested in this.

What about ordering this one

https://www.aliexpress.com/item/Top-Rated-VAG-Drive-Box-OBD2-OBD2-IMMO-Deactivator-Activator-for-Bosch-EDC15-ME7-VAG-IMMO/32592032879.html?ws_ab_test=searchweb0_0,searchweb201602_4_10065_10056_10068_10055_10054_10069_10059_10078_10079_10073_10017_10080_10070_10082_10081_421_420_10060_10061_10052_10062_10053_10050_10051,searchweb201603_1&btsid=5f806a45-e44b-4c5e-854e-994480c71d42

and check how it works? There are also IMMO Emulators over K-Line

https://www.aliexpress.com/item/VAG-IMMO-Emulator-Free-Shipping/32294068109.html?ws_ab_test=searchweb0_0,searchweb201602_4_10065_10056_10068_10055_10054_10069_10059_10078_10079_10073_10017_10080_10070_10082_10081_421_420_10060_10061_10052_10062_10053_10050_10051,searchweb201603_1&btsid=5f806a45-e44b-4c5e-854e-994480c71d42

Only one little ATTiny onboard, algo could not be too hard.

If these could bring us further i will buy them for learning purposes. I can record the signals with CAN / K-Line logger or with LA / Oscilloscope if necessary.

Cheers

I think these work by turning immo off, not by emulating the key or the dashboard.
I logged the ram on my ecu and saw the area which contained ids 10 and 11(these are used for immo) Then you can trace which part of the program writes to these ram locations, and you will have the code for immo algo. I did this on the edc15.
let me know if you need any help..
regards


	Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU

H2Deetoo

Sr. Member

Karma: +26/-1
Offline

Offline

Posts: 256

	Re: edc15 immobilizer « Reply #16 on: October 19, 2016, 02:26:06 AM »

I am just curious about the following:

The cluster will send the correct 011h answer when it sees a valid transponder.
Does it actually use a value programmed in the transponder to generate the right response?
Or does it simply check if the transponder ID is stored in its list, and then generate the correct answer based on the other immo data (like CS, MAC, PIN, STATUS) ?

Rgs H2Deetoo


	Logged

nihalot

Full Member

Karma: +40/-3
Offline

Offline

Posts: 116

	Re: edc15 immobilizer « Reply #17 on: October 24, 2016, 09:48:36 PM »

Quote from: H2Deetoo on October 19, 2016, 02:26:06 AM

I don't know how the transponder is handled as i haven't disassembled the instrument cluster...
Does anyone have any info on the micronas chip in the instrument cluster? I would like to disassemble it's firmware...
Regards


	Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU

H2Deetoo

Sr. Member

Karma: +26/-1
Offline

Offline

Posts: 256

	Re: edc15 immobilizer « Reply #18 on: October 24, 2016, 11:06:53 PM »

Well, we know the transponder itself is not really needed, I mean the ecu can validate the correct answer only using its 6 bytes CS (and MAC and/or PIN perhaps).
So the rest is don't care as far as this immo challenge goes.

Rgs H2Deetoo


	Logged

Pages: 1 [2]

« previous next »

Jump to:

Navigation

Personal Tools

April 16, 2024, 03:25:31 AM

Welcome, Guest. Please login or register.
Did you miss your activation email?

Navigation

Personal Tools

Search