Hi chaps

Has anyone managed to clone one of these newer Audi Bosch ECU's?

Is it a similar case of OTP and encryption as the older med17's?

I think HexProg can bench read and write them, but was wondering what is involved in cloning the immo etc

Cheers

https://www.youtube.com/watch?v=1caaSttfMGY

 

Although that demo is with a MG1CS003

It says you dont answer PM's so dont even try, can you Immo off the MG1CS002? If so could you PM me ill get the bench read to you. not for free obviously.

i managed to clone a mg1 ecu for a audi sq5 ea389, i initially thought that the original ecu was faulty as it was getting cam and crank signals g40 g28 but no trigger output on coils meant no spark. i had purchased the same hw ecu with different software from a audi s4 b9 which also has the ea839 engine.

initially because there is no immo off technique currently for the mg1, i decided to activate the immo on odis online, then go into odis engineering and flash the sq5 frf to the ecu, updating it to sq5 from s4 b9.

while this method has worked previously on older ecus it failed on the mg1, i believe its because frf does not update everything in eprom data and this can cause issues with the flash,

anyway i turned on the reds,  no errors on obd scan or anything, immo and everything looked like it was working 100% but when i disconnected multiple plugs in the engine, i didn't get any open circuits so i knew new ecu was not actually working correctly.

at this point i figured i would attempt to clone ecu even though i knew otp section cannot be written to which would not allow the new clone to work however i went ahead cloning both eprom and flash from sq5 old ecu to the new ecu.

I then plugged in s4 b9 ecu with cloned sq5 sw and had seen checksum error "expected with otp" then i went back into odis-e and reflashed sq5 frf correcting otp with flash to generate correct checksum. this worked successfully and now new ecu is 100% programmed to vehicle without immo defeat. 

i hope this information helps someone, hopefully i plan on making a youtube video explaining it all alittle easier.

well i don't know what your doing wrong and i understand about the hardware security module, they have something similar in all the virtual clusters as well "she module" but what i did was clone the eprom and flash from one ecu to the other and then i was able to frf it to correct the checksum as the flash otp doesn't match the cloned flash writable section. i am aware that odis prevents frf flashing to ecus that have immo not authorized and previously whenever i need to recover a ecu , lets say med17 and the tuner attempted to flash via obd only to find they flashed a bad file and they didn't have a ori backed away, they can't go back in time and restore ori as the eprom/flash will be corrupt and the vr file will only have tuning section. in this case I search on the net for the same sw dump from a eprom/flash and because i know its not going to accept someone else's flash, i disable the immo in flash wfs5/wfs6 then i flash both eprom+flash to the corrupted ecu,. at this point the ecu will start the car but i want to restore original immo and not keep it in immo off state, so i then reflash original frf in odis and this restores immo and corrects checksum with otp and ecu is back to stock. "I've done this situation multiple times"  ... as long as immo is off or authorized, i can update with frf. also mg1 ecus, no one has immo off solution so i have no choice but to work with what i have. this s4 b9 ecu with completely different software is now running perfectly on the sq5, starts and drive's without issue after i cloned and frf it.

sorry correct.. i was also writing to another ecu that day with otp and got the two mixed up.....

this one does not have otp.... i could not find anyone who has solution for immo off on mg1.. please enlighten me...

but i have cloned without issue and then corrected with frf and the sq5 starts and runs perfectly.

my point of this wall of text is to just inform people that it is possible to change firmware to different vehicle s4-sq

---------- Write Full Backup Started ------------------------------


File loaded: vag_bosch_mg1cs002_spc5777_bench_fullbackup_33304b363030323007800012201703240a13ffffffaaaaaaffffffffffffffff_20220413113722.zip ( 5.28 MB )

Writing...
Checksum calculation, please wait...
Checksum already correct
Writing... Internal Flash
Skip sector 1 / 35
Skip sector 2 / 35
Skip sector 3 / 35
Skip sector 4 / 35
Skip sector 5 / 35
Erasing sector  6 / 35, address: 0x00040000, size: 256 KB
Erasing successful
Writing sector  6 / 35, address: 0x00040000, size: 256 KB
Writing successful.
Verifying sector  6 / 35, address: 0x00040000, size: 256 KB
Verify OK.
Erasing sector  7 / 35, address: 0x00080000, size: 256 KB
Erasing successful
Writing sector  7 / 35, address: 0x00080000, size: 256 KB
Writing successful.
Verifying sector  7 / 35, address: 0x00080000, size: 256 KB
<strong>Verify failed.</strong>
Erasing sector  7 / 35, address: 0x00080000, size: 256 KB
Erasing successful
Writing sector  7 / 35, address: 0x00080000, size: 256 KB
Writing successful.
Verifying sector  7 / 35, address: 0x00080000, size: 256 KB
Verify OK.
Erasing sector  8 / 35, address: 0x000C0000, size: 256 KB
Erasing successful
Writing sector  8 / 35, address: 0x000C0000, size: 256 KB
Writing successful.
Verifying sector  8 / 35, address: 0x000C0000, size: 256 KB
Verify OK.
Erasing sector  9 / 35, address: 0x00100000, size: 256 KB
Erasing successful
Writing sector  9 / 35, address: 0x00100000, size: 256 KB
Writing successful.
Verifying sector  9 / 35, address: 0x00100000, size: 256 KB
Verify OK.
Erasing sector 10 / 35, address: 0x00140000, size: 256 KB
Erasing successful
Writing sector 10 / 35, address: 0x00140000, size: 256 KB
Writing successful.
Verifying sector 10 / 35, address: 0x00140000, size: 256 KB
Verify OK.
Erasing sector 11 / 35, address: 0x00180000, size: 256 KB
Erasing successful
Writing sector 11 / 35, address: 0x00180000, size: 256 KB
Writing successful.
Verifying sector 11 / 35, address: 0x00180000, size: 256 KB
Verify OK.
Erasing sector 12 / 35, address: 0x001C0000, size: 256 KB
Erasing successful
Writing sector 12 / 35, address: 0x001C0000, size: 256 KB
Writing successful.
Verifying sector 12 / 35, address: 0x001C0000, size: 256 KB
Verify OK.
Erasing sector 13 / 35, address: 0x00200000, size: 256 KB
Erasing successful
Writing sector 13 / 35, address: 0x00200000, size: 256 KB
Writing successful.
Verifying sector 13 / 35, address: 0x00200000, size: 256 KB
Verify OK.
Erasing sector 14 / 35, address: 0x00240000, size: 256 KB
Erasing successful
Writing sector 14 / 35, address: 0x00240000, size: 256 KB
Writing successful.
Verifying sector 14 / 35, address: 0x00240000, size: 256 KB
Verify OK.
Erasing sector 15 / 35, address: 0x00280000, size: 256 KB
Erasing successful
Writing sector 15 / 35, address: 0x00280000, size: 256 KB
Writing successful.
Verifying sector 15 / 35, address: 0x00280000, size: 256 KB
Verify OK.
Erasing sector 16 / 35, address: 0x002C0000, size: 256 KB
Erasing successful
Writing sector 16 / 35, address: 0x002C0000, size: 256 KB
Writing successful.
Verifying sector 16 / 35, address: 0x002C0000, size: 256 KB
Verify OK.
Erasing sector 17 / 35, address: 0x00300000, size: 256 KB
Erasing successful
Writing sector 17 / 35, address: 0x00300000, size: 256 KB
Writing successful.
Verifying sector 17 / 35, address: 0x00300000, size: 256 KB
Verify OK.
Erasing sector 18 / 35, address: 0x00340000, size: 256 KB
Erasing successful
Writing sector 18 / 35, address: 0x00340000, size: 256 KB
Writing successful.
Verifying sector 18 / 35, address: 0x00340000, size: 256 KB
Verify OK.
Erasing sector 19 / 35, address: 0x00380000, size: 256 KB
Erasing successful
Writing sector 19 / 35, address: 0x00380000, size: 256 KB
Writing successful.
Verifying sector 19 / 35, address: 0x00380000, size: 256 KB
Verify OK.
Erasing sector 20 / 35, address: 0x003C0000, size: 256 KB
Erasing successful
Writing sector 20 / 35, address: 0x003C0000, size: 256 KB
Writing successful.
Verifying sector 20 / 35, address: 0x003C0000, size: 256 KB
Verify OK.
Erasing sector 21 / 35, address: 0x00400000, size: 256 KB
Erasing successful
Writing sector 21 / 35, address: 0x00400000, size: 256 KB
Writing successful.
Verifying sector 21 / 35, address: 0x00400000, size: 256 KB
Verify OK.
Erasing sector 22 / 35, address: 0x00440000, size: 256 KB
Erasing successful
Writing sector 22 / 35, address: 0x00440000, size: 256 KB
Writing successful.
Verifying sector 22 / 35, address: 0x00440000, size: 256 KB
Verify OK.
Erasing sector 23 / 35, address: 0x00480000, size: 256 KB
Erasing successful
Writing sector 23 / 35, address: 0x00480000, size: 256 KB
Writing successful.
Verifying sector 23 / 35, address: 0x00480000, size: 256 KB
Verify OK.
Erasing sector 24 / 35, address: 0x004C0000, size: 256 KB
Erasing successful
Writing sector 24 / 35, address: 0x004C0000, size: 256 KB
Writing successful.
Verifying sector 24 / 35, address: 0x004C0000, size: 256 KB
Verify OK.
Erasing sector 25 / 35, address: 0x00500000, size: 256 KB
Erasing successful
Writing sector 25 / 35, address: 0x00500000, size: 256 KB
Writing successful.
Verifying sector 25 / 35, address: 0x00500000, size: 256 KB
Verify OK.
Skip sector 26 / 35, CRC of sector in the file and in the flash is the same
Skip sector 27 / 35, CRC of sector in the file and in the flash is the same
Skip sector 28 / 35, CRC of sector in the file and in the flash is the same
Erasing sector 29 / 35, address: 0x00600000, size: 256 KB
Erasing successful
Writing sector 29 / 35, address: 0x00600000, size: 256 KB
Writing successful.
Verifying sector 29 / 35, address: 0x00600000, size: 256 KB
Verify OK.
Erasing sector 30 / 35, address: 0x00640000, size: 256 KB
Erasing successful
Writing sector 30 / 35, address: 0x00640000, size: 256 KB
Writing successful.
Verifying sector 30 / 35, address: 0x00640000, size: 256 KB
Verify OK.
Erasing sector 31 / 35, address: 0x00680000, size: 256 KB
Erasing successful
Writing sector 31 / 35, address: 0x00680000, size: 256 KB
Writing successful.
Verifying sector 31 / 35, address: 0x00680000, size: 256 KB
Verify OK.
Erasing sector 32 / 35, address: 0x006C0000, size: 256 KB
Erasing successful
Writing sector 32 / 35, address: 0x006C0000, size: 256 KB
Writing successful.
Verifying sector 32 / 35, address: 0x006C0000, size: 256 KB
Verify OK.
Skip sector 33 / 35, CRC of sector in the file and in the flash is the same
Skip sector 34 / 35, CRC of sector in the file and in the flash is the same
Erasing sector 35 / 35, address: 0x00780000, size: 256 KB
Erasing successful
Writing sector 35 / 35, address: 0x00780000, size: 256 KB
Writing successful.
Verifying sector 35 / 35, address: 0x00780000, size: 256 KB
Verify OK.

Warning! Checksum not calculated
Writing... Internal EEPROM
Skip sector 1 / 8, CRC of sector in the file and in the flash is the same
Erasing sector 2 / 8, address: 0x00010000, size: 64 KB
Erasing successful
Writing sector 2 / 8, address: 0x00010000, size: 64 KB
Writing successful.
Verifying sector 2 / 8, address: 0x00010000, size: 64 KB
Verify OK.
Erasing sector 3 / 8, address: 0x00020000, size: 64 KB
Erasing successful
Writing sector 3 / 8, address: 0x00020000, size: 64 KB
Writing successful.
Verifying sector 3 / 8, address: 0x00020000, size: 64 KB
Verify OK.
Erasing sector 4 / 8, address: 0x00030000, size: 64 KB
Erasing successful
Writing sector 4 / 8, address: 0x00030000, size: 64 KB
Writing successful.
Verifying sector 4 / 8, address: 0x00030000, size: 64 KB
Verify OK.
Erasing sector 5 / 8, address: 0x00040000, size: 64 KB
Erasing successful
Writing sector 5 / 8, address: 0x00040000, size: 64 KB
Writing successful.
Verifying sector 5 / 8, address: 0x00040000, size: 64 KB
Verify OK.
Erasing sector 6 / 8, address: 0x00050000, size: 64 KB
Erasing successful
Writing sector 6 / 8, address: 0x00050000, size: 64 KB
Writing successful.
Verifying sector 6 / 8, address: 0x00050000, size: 64 KB
Verify OK.
Erasing sector 7 / 8, address: 0x00060000, size: 64 KB
Erasing successful
Writing sector 7 / 8, address: 0x00060000, size: 64 KB
Writing successful.
Verifying sector 7 / 8, address: 0x00060000, size: 64 KB
Verify OK.
Erasing sector 8 / 8, address: 0x00070000, size: 64 KB
Erasing successful
Writing sector 8 / 8, address: 0x00070000, size: 64 KB
Writing successful.
Verifying sector 8 / 8, address: 0x00070000, size: 64 KB
Verify OK.

Writing successful.
Detecting unlock...
ECU status: LOCKED

 ---------- Write Full Backup Finished ( Time: 00:15:52 )

who said anything about selling anything to me, all i said prior is if you have information that can help people on this forum with the mg1, maybe its nice to share so the world isn't at your knees 

i don't need your help, i didn't ask for it, my only intention was to let everyone else know there is another way out to resolve mg1.

I replaced my sq5 mg1 ecu with a s4 mg1 ecu from ebay, I did this because i couldn't find a second hand sq5 ecu and both ecu's hw part no are the same, I knew there would be a bunch of errors as the software on these ecu's is different, and they are looking for other modules/other software to communicate with, which i knew would happen but i had hope, i then went online with odis, serviced immo in ecu., once ecu was unlocked, i would be able to frf flash the ecu via odis-e to correct sw, so i frf the ecu to sq5 software however even though it said that it was successful and no errors on obd when i did a vcds scan, the car still didn't start, i disconnected multiple sensors in the engine and the ecu would not detect the open circuit, this told me the ecu is not functioning even though i could go into it via vcds and see no errors,  at this stage i was hoping i managed to update immo data correctly so then i cloned old ecu to new ecu via bench with eprom+flash and then the ecu had an error, which i corrected with a frf update on top of the cloned eprom+flash, then finally the car started and ran perfectly with the new ecu and no errors and best yet, immo enabled! which i prefer over immo disabled. i made a video of the process which i will be posting on youtube to help those who don't have enough information about the mg1 ecu.

this information is simply for those who get stuck on the mg1 and don't know how to resolve it on a audi. nothing to do with you grumpy pants! just trying to help people sheesh
that's what forum communities are all about. i understand your hesitation to help people, you possibly get asked all the time to help with little to no benefit in return, but not all of us are bad.

all i can say is i hope this benefits someone one day, as i noticed the sale of second hand mg1 ecus on ebay being excessive for a new vehicle. peace out 

i know you hate hearing that you may be wrong once in a while  but your wrong.

if you clone ecu, you cannot adapt because ecu has corrupted clone which does not match the hsm or something like that because after i had cloned it, it wouldn't communicate correctly. only after i had re frf after cloning did it fix the issue. this is what happened in my experience.