Cloning IS possible but only in boot mode.
And again, you can't just straight clone the data across, and as far as I know there's no commercial tool that supports this. Much easier to just code-patch for Immo off, emulate Immo, adapt Immo, or use one of the commercial tools that can edit Immo data than a full clone.
H2DeeToo posted the full details already, but since people don't seem to read -
Simos has a few cloning protections:
* The chip ID is stored in OTP flash memory and compared in many places, so you can't easily change the chip ID with a patch (there is a trick to this but then you run into some other issues).
* The chip ID is used to derive the encryption key for the DFlash protected channels.
* The chip ID is used to derive an HW ID value which is stored in a DFlash channel.
* The DFlash channels are also protected by several layers of CRC16, including CRC incorporating hidden ("nonce") material specific to the ECU.
To fully clone an S18, you would need to:
Read the full flash and DFlash from the donor ECU, decrypt all of the protected DFlash channels using the donor ECU's HW ID, fix the HW ID channel, re-encrypt the DFlash channels using the target ECU's HW ID, and then recalculate all DFlash checksums using the new encrypted data and the new CRC nonce.
With how many easier ways Immo and flash counter can be changed, there is not much point.
