Pages: 1 [2]
Author Topic: Kess v2 and K-tag  (Read 12799 times)
cherry
Full Member
***

Karma: +24/-2
Offline Offline

Posts: 246


« Reply #15 on: February 25, 2018, 04:01:14 AM »

It´s possible to create a obd-unlock container with mpps for touareg/phaeton CP04/CP14, release note was only "More types of FRF/SGO added to OBD unlock file function" but in amt-board was some more information. But you always need a sgo for it first from which it is done.
Logged
prj
Hero Member
*****

Karma: +915/-426
Offline Offline

Posts: 5836


« Reply #16 on: February 25, 2018, 06:37:52 AM »

It´s possible to create a obd-unlock container with mpps for touareg/phaeton CP04/CP14, release note was only "More types of FRF/SGO added to OBD unlock file function" but in amt-board was some more information. But you always need a sgo for it first from which it is done.
Yes, possible to create container, but are you sure there is an actual RSA bypass protocol on K-Line? TP2.0 and UDS no problem of course.
The fact that you create a SGO with TPROT patched is nothing special, if you flash that SGO with the factory tool the ECU still won't boot, because the RSA is not corrected inside (and not possible to correct, as the private keys are not leaked). So apart from creating a patched file, you still need the tool to actually have a protocol that has a way to bypass the RSA check at the end of the flash.
« Last Edit: February 25, 2018, 06:39:43 AM by prj » Logged

PM's will not be answered, so don't even try.
Log your car properly.
cherry
Full Member
***

Karma: +24/-2
Offline Offline

Posts: 246


« Reply #17 on: February 25, 2018, 07:29:24 AM »

To clarify that, with MPPS you can create "mpps-containers" and "obdunlock-containers" from sgo/frf, also sgo/frf -> bin is available for nearly all MEDC17. Only these containers are flashable with mpps, sgo/frf direct is not possible. This can only be done from sgo/frf, not from bin-file. So if you do not have sgo/frf you cannot use obdunlock, the way with full bin-file similar kess is not possible. He did it this way for safety that nobody can use possibly faulty bin-files from somewhere. Sure a disadvantage, but for most MEDC17 is a sgo/frf available. For these CP04/CP14 are both option available standard container and obdunlock container and there is no hint in k-line container option that obdunlock is not supported. He also posted that these EDC17CP14 k-line is tested, so i assume it should work. Time intensive obdunlock is always done with standard file, after that you can write partial file (also newest MEDC17), so flashing new file to already unlocked MEDC17 needs only short time, no need to make a full flash including unlock every time. There are pro and contra for every tool for sure.
Logged
prj
Hero Member
*****

Karma: +915/-426
Offline Offline

Posts: 5836


« Reply #18 on: February 25, 2018, 05:11:24 PM »

All the container stuff is totally irrelevant and useless from flashing standpoint.
Whether it is done with some fancy useless stuff or you take an unpacked bin file and patch the TPROT yourself makes no difference from a protocol perspective whatsoever.

The important part is the protocol. Either they have RSA workaround protocol for K-line or they don't. After you get the RSA workaround write in with your TPROT offed original file then of course you can write cal area.
You can write cal area on all MEDC17, nothing special here.

I think you don't understand much about how this works Smiley
So far I've not seen any tool have RSA bypass via KWP2000, but maybe MPPS has it. It's just about crashing the bootloader after all, probably quite similar to TP2.0
Logged

PM's will not be answered, so don't even try.
Log your car properly.
cherry
Full Member
***

Karma: +24/-2
Offline Offline

Posts: 246


« Reply #19 on: October 25, 2019, 10:06:03 AM »

All the container stuff is totally irrelevant and useless from flashing standpoint.
Whether it is done with some fancy useless stuff or you take an unpacked bin file and patch the TPROT yourself makes no difference from a protocol perspective whatsoever.

The important part is the protocol. Either they have RSA workaround protocol for K-line or they don't. After you get the RSA workaround write in with your TPROT offed original file then of course you can write cal area.
You can write cal area on all MEDC17, nothing special here.

I think you don't understand much about how this works Smiley
So far I've not seen any tool have RSA bypass via KWP2000, but maybe MPPS has it. It's just about crashing the bootloader after all, probably quite similar to TP2.0

Old topic, but i want to clarify that MPPS RSA bypass is 100% working for K-Line ecu. First time will write about 20min, then you can write calibration only as usual. And no advanced checksum calculation needed anymore, so no need to "patch" in boot / bench before. Untill now i do not know any other tool which is able to do it. Btw you need a good charger, had a constant 80A current while writing with fan on full speed...
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12233


WWW
« Reply #20 on: October 25, 2019, 10:22:37 AM »

had a constant 80A current

I'm assuming that is a typo.
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
cherry
Full Member
***

Karma: +24/-2
Offline Offline

Posts: 246


« Reply #21 on: October 25, 2019, 10:26:36 AM »

I'm assuming that is a typo.

No misstyping. 80A during whole 20min flash. There was also brand new battery inside, so all this power was needed for car and most likely running fan about 50A. My 70A charger was at the end, so i connected another 25A charger.
Logged
Pages: 1 [2]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.018 seconds with 16 queries. (Pretty URLs adds 0s, 0q)