Pages: [1]
Author Topic: VW MK4 Golf / Jetta IMMO3 Cluster adaptation to ECU by editing EEPROM dump  (Read 20896 times)
ZeGecko
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 3



Greetings, I just wanted to put all this information together in one spot how to adapt the cluster to the ECU by editing the cluster's EEPROM dump in a hex editor for anyone in a similar situation as me.

Apparently VCDS / VAG-COM doesn't like to adapt some clusters to the ECU and will give you a System Not OK when hitting test and Channel 50 Not Available when attempting to save. Thanks to the fine people of this forum, I was able to manually adapt my cluster by editing the EEPROM dump in a hex editor, but the info is scattered all over in various replies, and I was not even aware of the IMMO key assuming that when they mentioned IMMO they just meant the IMMO ID, which allows you to actually set how many keys to be matched within VCDS, but the cluster will fail to add them because everything is not copacetic which just added to the confusion haha.

Check out turboat's tool which is a script capable of preforming the same thing for you:
http://nefariousmotorsports.com/forum/index.php?topic=6134.0title=

Big thanks to automan001 for pointing out where the SKC and IMMO Keys were located.
http://nefariousmotorsports.com/forum/index.php?topic=6161.msg57973#msg57973
http://nefariousmotorsports.com/forum/index.php?topic=6708.msg62068#msg62068

This was done on a VDO 1J0920926 cluster, but the location appears to be the same on a number of clusters just offset some. I am not responsible for anything that happens to your cluster. Any time you write to the EEPROM of the cluster you run the risk of bricking it thus rendering it unusable. You make these modifications and write the binary at your own risk. I would not follow this guide if you have a cluster made by Bosch because as I've read, they are a different beast entirely and if everything is not right you could easily brick your cluster. VDO clusters are more lenient, and you can make changes to the dump in a hex editor without having to worry about a checksum or encrypting it.

All screenshots were taken from a dump made available on here by ddillenger as I am paranoid and didn't want to put my cluster up here  Tongue

What you need:
VIN - ASCII and is easily spotted within the ascii editor panel from ECU EEPROM dump, or the first value in Extra field of VCDS 01-Engine, and is 17 bytes long.
IMMO ID - ASCII and is easily spotted within the ascii editor panel ECU EEPROM dump, or the second value in Extra field of VCDS 01-Engine, and is 14 bytes long.
SKC - Numeric, can usually be found at hex address 32 of ECU EEPROM dump and is 2 bytes long. Note that the two bytes are stored reversed in both cluster and ECU, so swap before converting to decimal.
IMMO Key - Numeric, can usually be found at hex address 34 directly after SKC of ECU EEPROM dump and is 7 bytes long.

If you have access to your original cluster you could always pull these needed values from the locations stated below and transcribe them into the replacement cluster for IMMO3 to IMMO3 swap.

1 byte would be two digits (or two nibbles) in a hex editor and are usually paired together. For ASCII values that is one character.

For reading the ECU see ddillenger's thread:
http://nefariousmotorsports.com/forum/index.php?topic=2973.0title=

For editing the cluster's EEPROM dump you may use your favorite hex editor. For pulling and writing the cluster's EEPROM, I had the most luck with VAG EEPROM Programmer using a dumb vag-com kkl cable, plus is capable of setting the mileage as well, but it wouldn't talk to my ECU. Be weary of where you obtain it because there are plenty of fakes out there which will just read garbage (not to mention may be a trojan). My antivirus (ZoneAlarm) did not flag it as a virus.

Be sure to make a back up of your cluster's EEPROM dump before you make any changes and do not modify this file!

IMMO ID is located at hex addresses A2 and is 14 bytes long, then repeated again at B0 and BE. This is stored in ASCII and can easily be spotted on the ASCII editor panel.



VIN is located at hex address D2 and is 17 bytes long. This is stored in ASCII and can be spotted in the ASCII editor as well.



The SKC is located at hex address CC and is 2 bytes long, then repeated again at CE and D0. The bytes are stored in reverse order like the ECU and are hexadecimal numeric values. But if you are adapting it from the decimal value, convert to hexadecimal then swap the two bytes. If your SKC is 1234, convert to hex which would be 04DC, then store DC04 in the eeprom binary. Or in the case of here, the SKC is 6969, which converted to hex would be 1B39, then stored as 391B.



The IMMO key is located at hex address 72 and is 7 bytes long, then repeated again at 7A and 82. These are hexadecimal numeric values and the ASCII representation will not make any sense.



Once you have added these values to the dump, you may write the dump to the cluster's EEPROM. After doing so, either disconnect power for a few minutes, or go back into 19-CAN Gateway and write the soft coding again. Then VCDS / VAG-COM shouldn't complain when matching your keys to the cluster on Channel 21.

For futureproofing in case for whatever reason imgur decides to no longer allow outside linking as photobucket did, this is the album with all the info and images:
https://imgur.com/a/Yw2U1A4


Out of curiosity I had a look at all the IMMO3 dumps in ddillenger's file and for the most part they are all in the same location. The following appear to be in the same location as stated above:
1J0920806
1J0920826
1J0920926
1J0920946
1J5920806
1J5920826
1J5920846
1J5920946

There was only one MK4 IMMO3 dump which ended in a 7 and that one was offset by 3E.
On the 1J0920927 dump the SKC is located at hex address E0, EE, and FC. SKC is located at hex address 10A, 10C, and 10E. VIN is located at hex address 110. And IMMO Key is located at hex address B0, B8, and C0.
« Last Edit: May 20, 2018, 12:25:20 PM by ZeGecko » Logged
ZeGecko
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 3



This is just extra info from when I was stuck on the IMMO key, and was actually looking to see if it were possible to get the key fob data from the ECU. Unfortionately they are not stored in the ECU, so if you are swapping a cluster because your original cluster died like me this will not help you. I can not verify this as I wasn't able to find any info online so take this with a grain of salt unless someone can confirm, these are just patterns which stuck out to me as I was attempting to match my keys and going through various cluster dumps. And feel free to correct me if I'm wrong.

The number of keys matched to the cluster is stored at hex address 8A and is one byte long, then repeated again at addresses 8B and 8C.


The first nibble represents how many keys have successfully been matched to the cluster, and the second nibble represents how many keys are to be matched. If the first and second nibble don't match, then the cluster will automatically go into matching mode and the immobilizer light will flash. I believe the first nibble at hex address 8D, 8E, and 8F are how many keys left to match. When all keys are matched the value is always 0, but when the cluster was waiting to match a key the value was 1. The second nibble is always the same (it is usually always 6). Note: I did not attempt to match keys by editing these values, so do not attempt unless you are willing to risk bricking.


The key fob data is 8 bytes long, but it appears that the first 4 bytes and the last 4 bytes are offset. The first key has the first 4 bytes stored at hex address 20, then the second 4 bytes at address 40.


This is repeated for each additional key. The second key would be stored at hex address 24 and 44. The third would be 28 and 48. Fourth at 2C and 4C. Fifth at 30 and 50. Sixth at 34 and 54. Seventh at 38 and 48. And eighth at 3C and 5C.

Logged
elektronik13
Full Member
***

Karma: +10/-36
Offline Offline

Posts: 204



Greetings, I just wanted to put all this information together in one spot how to adapt the cluster to the ECU by editing the cluster's EEPROM dump in a hex editor for anyone in a similar situation as me.

Apparently VCDS / VAG-COM doesn't like to adapt some clusters to the ECU and will give you a System Not OK when hitting test and Channel 50 Not Available when attempting to save. Thanks to the fine people of this forum, I was able to manually adapt my cluster by editing the EEPROM dump in a hex editor, but the info is scattered all over in various replies, and I was not even aware of the IMMO key assuming that when they mentioned IMMO they just meant the IMMO ID, which allows you to actually set how many keys to be matched within VCDS, but the cluster will fail to add them because everything is not copacetic which just added to the confusion haha.

Check out turboat's tool which is a script capable of preforming the same thing for you:
http://nefariousmotorsports.com/forum/index.php?topic=6134.0title=

Big thanks to automan001 for pointing out where the SKC and IMMO Keys were located.
http://nefariousmotorsports.com/forum/index.php?topic=6161.msg57973#msg57973
http://nefariousmotorsports.com/forum/index.php?topic=6708.msg62068#msg62068

This was done on a VDO 1J0920926 cluster, but the location appears to be the same on a number of clusters just offset some. I am not responsible for anything that happens to your cluster. Any time you write to the EEPROM of the cluster you run the risk of bricking it thus rendering it unusable. You make these modifications and write the binary at your own risk. I would not follow this guide if you have a cluster made by Bosch because as I've read, they are a different beast entirely and if everything is not right you could easily brick your cluster. VDO clusters are more lenient, and you can make changes to the dump in a hex editor without having to worry about a checksum or encrypting it.

All screenshots were taken from a dump made available on here by ddillenger as I am paranoid and didn't want to put my cluster up here  Tongue

What you need:
VIN - ASCII and is easily spotted within the ascii editor portion, or the first value in Extra of VCDS.
IMMO ID - ASCII and is easily spotted within the ascii editor portion, or the second value in Extra of VCDS.
SKC - Numeric, can usually be found at hex address 32 of ECU EEPROM dump and is 2 bytes long.
IMMO Key - Numeric, can usually be found at hex address 34 directly after SKC of ECU EEPROM dump and is 7 bytes long.

1 byte would be two digits in a hex editor and are usually paired together.

For reading the ECU see ddillenger's thread:
http://nefariousmotorsports.com/forum/index.php?topic=2973.0title=

For editing the cluster's EEPROM dump you may use your favorite hex editor. For pulling and writing the cluster's EEPROM, I had the most luck with VAG EEPROM Programmer using a dumb vag-com kkl cable, plus is capable of setting the mileage as well, but it wouldn't talk to my ECU. Be weary of where you obtain it because there are plenty of fakes out there which will just read garbage (not to mention may be a trojan). My antivirus (ZoneAlarm) did not flag it as a virus.

IMMO ID is located at hex addresses A2 and is 14 bytes long, then repeated again at B0 and BE. This is stored in ASCII and can easily be spotted on the ASCII editor portion.



VIN is located at hex address D2 and is 17 bytes long. This is stored in ASCII and can be spotted in the ASCII editor as well.



The SKC is located at hex address CC and is 2 bytes long, then repeated again at CE and D0. The bytes are stored in reverse order like the ECU and are hexadecimal numeric values. But if you are adapting it from the decimal value, convert to hexadecimal then swap the two bytes. If your SKC is 1234, convert to hex which would be 04DC, then store DC04 in the eeprom binary. Or in the case of here, the SKC is 6969, which converted to hex would be 1B39, then stored as 391B.



The IMMO key is located at hex address 72 and is 7 bytes long, then repeated again at 7A and 82. These are hexadecimal numeric values and the ASCII representation will not make any sense.



Once you have added these values to the dump, you may write the dump to the cluster's EEPROM. After doing so, either disconnect power for a few minutes, or go back into 19-CAN Gateway and write the soft coding again. Then VCDS / VAG-COM shouldn't complain when matching your keys to the cluster on Channel 21.

For futureproofing in case for whatever reason imgur decides to no longer allow outside linking as photobucket did, this is the album with all the info and images:
https://imgur.com/a/Yw2U1A4


Out of curiosity I had a look at all the IMMO3 dumps in ddillenger's file and for the most part they are all in the same location. The following appear to be in the same location as stated above:
1J0920806
1J0920826
1J0920926
1J0920946
1J5920806
1J5920826
1J5920846
1J5920946

There was only one MK4 IMMO3 dump which ended in a 7 and that one was offset by 3E.
On the 1J0920927 dump the SKC is located at hex address E0, EE, and FC. SKC is located at hex address 10A, 10C, and 10E. VIN is located at hex address 110. And IMMO Key is located at hex address B0, B8, and C0.

not everything is true
Logged
ZeGecko
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 3



not everything is true

Haha I figured I would foul something up. If you could point me to what is incorrect and I would be more than happy to fix. A lot of what I've stated was from what I gathered from various other posts not mentioned here and on other forums so I could have been misinformed, or misunderstood (as with the whole IMMO ID and Key thing).
Logged
beaver2424
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 4


« Reply #4 on: September 17, 2022, 02:20:09 PM »

Greetings, I just wanted to put all this information together in one spot how to adapt the cluster to the ECU by editing the cluster's EEPROM dump in a hex editor for anyone in a similar situation as me.

Apparently VCDS / VAG-COM doesn't like to adapt some clusters to the ECU and will give you a System Not OK when hitting test and Channel 50 Not Available when attempting to save. Thanks to the fine people of this forum, I was able to manually adapt my cluster by editing the EEPROM dump in a hex editor, but the info is scattered all over in various replies, and I was not even aware of the IMMO key assuming that when they mentioned IMMO they just meant the IMMO ID, which allows you to actually set how many keys to be matched within VCDS, but the cluster will fail to add them because everything is not copacetic which just added to the confusion haha.

Check out turboat's tool which is a script capable of preforming the same thing for you:
http://nefariousmotorsports.com/forum/index.php?topic=6134.0title=

Big thanks to automan001 for pointing out where the SKC and IMMO Keys were located.
http://nefariousmotorsports.com/forum/index.php?topic=6161.msg57973#msg57973
http://nefariousmotorsports.com/forum/index.php?topic=6708.msg62068#msg62068

This was done on a VDO 1J0920926 cluster, but the location appears to be the same on a number of clusters just offset some. I am not responsible for anything that happens to your cluster. Any time you write to the EEPROM of the cluster you run the risk of bricking it thus rendering it unusable. You make these modifications and write the binary at your own risk. I would not follow this guide if you have a cluster made by Bosch because as I've read, they are a different beast entirely and if everything is not right you could easily brick your cluster. VDO clusters are more lenient, and you can make changes to the dump in a hex editor without having to worry about a checksum or encrypting it.

All screenshots were taken from a dump made available on here by ddillenger as I am paranoid and didn't want to put my cluster up here  Tongue

What you need:
VIN - ASCII and is easily spotted within the ascii editor panel from ECU EEPROM dump, or the first value in Extra field of VCDS 01-Engine, and is 17 bytes long.
IMMO ID - ASCII and is easily spotted within the ascii editor panel ECU EEPROM dump, or the second value in Extra field of VCDS 01-Engine, and is 14 bytes long.
SKC - Numeric, can usually be found at hex address 32 of ECU EEPROM dump and is 2 bytes long. Note that the two bytes are stored reversed in both cluster and ECU, so swap before converting to decimal.
IMMO Key - Numeric, can usually be found at hex address 34 directly after SKC of ECU EEPROM dump and is 7 bytes long.

If you have access to your original cluster you could always pull these needed values from the locations stated below and transcribe them into the replacement cluster for IMMO3 to IMMO3 swap.

1 byte would be two digits (or two nibbles) in a hex editor and are usually paired together. For ASCII values that is one character.

For reading the ECU see ddillenger's thread:
http://nefariousmotorsports.com/forum/index.php?topic=2973.0title=

For editing the cluster's EEPROM dump you may use your favorite hex editor. For pulling and writing the cluster's EEPROM, I had the most luck with VAG EEPROM Programmer using a dumb vag-com kkl cable, plus is capable of setting the mileage as well, but it wouldn't talk to my ECU. Be weary of where you obtain it because there are plenty of fakes out there which will just read garbage (not to mention may be a trojan). My antivirus (ZoneAlarm) did not flag it as a virus.

Be sure to make a back up of your cluster's EEPROM dump before you make any changes and do not modify this file!

IMMO ID is located at hex addresses A2 and is 14 bytes long, then repeated again at B0 and BE. This is stored in ASCII and can easily be spotted on the ASCII editor panel.



VIN is located at hex address D2 and is 17 bytes long. This is stored in ASCII and can be spotted in the ASCII editor as well.



The SKC is located at hex address CC and is 2 bytes long, then repeated again at CE and D0. The bytes are stored in reverse order like the ECU and are hexadecimal numeric values. But if you are adapting it from the decimal value, convert to hexadecimal then swap the two bytes. If your SKC is 1234, convert to hex which would be 04DC, then store DC04 in the eeprom binary. Or in the case of here, the SKC is 6969, which converted to hex would be 1B39, then stored as 391B.



The IMMO key is located at hex address 72 and is 7 bytes long, then repeated again at 7A and 82. These are hexadecimal numeric values and the ASCII representation will not make any sense.



Once you have added these values to the dump, you may write the dump to the cluster's EEPROM. After doing so, either disconnect power for a few minutes, or go back into 19-CAN Gateway and write the soft coding again. Then VCDS / VAG-COM shouldn't complain when matching your keys to the cluster on Channel 21.

For futureproofing in case for whatever reason imgur decides to no longer allow outside linking as photobucket did, this is the album with all the info and images:
https://imgur.com/a/Yw2U1A4


Out of curiosity I had a look at all the IMMO3 dumps in ddillenger's file and for the most part they are all in the same location. The following appear to be in the same location as stated above:
1J0920806
1J0920826
1J0920926
1J0920946
1J5920806
1J5920826
1J5920846
1J5920946

There was only one MK4 IMMO3 dump which ended in a 7 and that one was offset by 3E.
On the 1J0920927 dump the SKC is located at hex address E0, EE, and FC. SKC is located at hex address 10A, 10C, and 10E. VIN is located at hex address 110. And IMMO Key is located at hex address B0, B8, and C0.


Just used this today with vag eeprom programmer to pull both old cluster dump and new (used) cluster dump. Then I compared and edited in hxd editor following your detailed steps! Worked like a charm! Thank you!
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.035 seconds with 16 queries. (Pretty URLs adds 0s, 0q)