Pages: [1]
Author Topic: help with cloning tuned simos18 - water damaged tuned ecu to new ecu.  (Read 2332 times)
Techguy
Full Member
***

Karma: +2/-10
Offline Offline

Posts: 54



Hey guys, i have a problem here. i have a tuned audi s3 8v with a flex fuel tuned simos18 ecu, the car drives great on this tune however the coolant sensor leaked water into the ecu and corroded some of the terminals. i bought a new simos18 ecu to replace the current one but when i attempt to clone the flash and eprom across, but it will not boot on the new ecu. i don't know if this is because mcuid or otp section or whatever. i have tried to immooff the eprom and flash files and transfer "which worked for med17 ecus" but this still does not work on simos18.

i asked a tuner to extract the maps section from the existing file, place it in a vr so i can flash it to the newer ecu, but it has noread in the file, and i don't know who originally tuned it otherwise i would of simply gone to them to reload the file.

does anyone have any ideas? short from taking the processor out of the ecu and transferring it into the new ecu. any ideas would be greatly appreciated. Thank you guys
Logged
prj
Hero Member
*****

Karma: +1072/-481
Offline Offline

Posts: 6037


« Reply #1 on: September 24, 2023, 12:24:37 AM »

Seems like ctrl+c ctrl+v repeatedly didn't work this time huh?

1. Read the flash, and the flash only from the old ECU.
2. Write the flash to the new ECU. Make sure the EEPROM of the new ECU is what came with the ECU. If you didn't save it you're fucked.
3. Read the flash again, this time from the new ECU.
4. Go here: https://tools.vehical.net/s18immo and immo off the flash you read from the new ECU.
5. Hopefully the new ECU is even remotely compatible, if it is, re-code the new ECU to match the old coding.

Or get ODIS with Geko access and perform an ECU swap, after which transfer the flash only.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
EanDem
Full Member
***

Karma: +8/-40
Offline Offline

Posts: 78


« Reply #2 on: September 24, 2023, 12:29:04 AM »

Hey guys, i have a problem here. i have a tuned audi s3 8v with a flex fuel tuned simos18 ecu, the car drives great on this tune however the coolant sensor leaked water into the ecu and corroded some of the terminals. i bought a new simos18 ecu to replace the current one but when i attempt to clone the flash and eprom across, but it will not boot on the new ecu. i don't know if this is because mcuid or otp section or whatever. i have tried to immooff the eprom and flash files and transfer "which worked for med17 ecus" but this still does not work on simos18.

i asked a tuner to extract the maps section from the existing file, place it in a vr so i can flash it to the newer ecu, but it has noread in the file, and i don't know who originally tuned it otherwise i would of simply gone to them to reload the file.

does anyone have any ideas? short from taking the processor out of the ecu and transferring it into the new ecu. any ideas would be greatly appreciated. Thank you guys


What you need here as key thing is have backup/read of CAL from old ecu. Rest well described already. 
Logged
prj
Hero Member
*****

Karma: +1072/-481
Offline Offline

Posts: 6037


« Reply #3 on: September 24, 2023, 01:15:19 PM »

What you need here as key thing is have backup/read of CAL from old ecu. Rest well described already. 
If he has real flex shit then it prolly has a patch in the ASW hence cal only might not be enough.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
kirukisu
Jr. Member
**

Karma: +1/-4
Offline Offline

Posts: 26


« Reply #4 on: September 28, 2023, 01:23:54 PM »

Hey guys, i have a problem here. i have a tuned audi s3 8v with a flex fuel tuned simos18 ecu, the car drives great on this tune however the coolant sensor leaked water into the ecu and corroded some of the terminals. i bought a new simos18 ecu to replace the current one but when i attempt to clone the flash and eprom across, but it will not boot on the new ecu. i don't know if this is because mcuid or otp section or whatever. i have tried to immooff the eprom and flash files and transfer "which worked for med17 ecus" but this still does not work on simos18.

i asked a tuner to extract the maps section from the existing file, place it in a vr so i can flash it to the newer ecu, but it has noread in the file, and i don't know who originally tuned it otherwise i would of simply gone to them to reload the file.

does anyone have any ideas? short from taking the processor out of the ecu and transferring it into the new ecu. any ideas would be greatly appreciated. Thank you guys


Give me ori ecu virtual read and normal read, i will remove "no read", hidden signature, ect.
Logged
Techguy
Full Member
***

Karma: +2/-10
Offline Offline

Posts: 54


« Reply #5 on: October 03, 2023, 12:13:33 AM »

Seems like ctrl+c ctrl+v repeatedly didn't work this time huh?

1. Read the flash, and the flash only from the old ECU.
2. Write the flash to the new ECU. Make sure the EEPROM of the new ECU is what came with the ECU. If you didn't save it you're fucked.
3. Read the flash again, this time from the new ECU.
4. Go here: https://tools.vehical.net/s18immo and immo off the flash you read from the new ECU.
5. Hopefully the new ECU is even remotely compatible, if it is, re-code the new ECU to match the old coding.

Or get ODIS with Geko access and perform an ECU swap, after which transfer the flash only.


This guy   Cheesy Cheesy Cheesy, yes copy and paste didn't work.. why didn't I think of that. Cheesy  So I'll break down what I have done already.
usually I would do a bench read with flex of simos18/med17 or any other otp ecu and decrypt eprom data mcuid etc via immo17 eprom editor/aark and transfer that vin,cs,mac,pk into the new ecu and or immooff the ecu depending on the situation.

but this is no normal situation. the car is flex fuel tuned for e85 with a flex fuel sensor. so putting ori/vr on the ecu won't help me in any way.

on top of that I can't find a 8v0906259j variant ecu, so instead I got a mk7 gti ecu, benched it, immooff the ecu, then did a bench obd mode which allows flex to flash any frf file you have, provided immo is off, once done, I flashed the 259j frf and the ecu became a 259j variant. so I can definitely get change any simos18 variant regardless of brand or powerclass. I then rebenched, immo off and tested it on the car and the car did start but being ori, didn't run right due to being an untuned file.

anyhow back to the tuned file.

I have tried multiple ways to resolve this issue.   I tried immooff the file, both in aark and immo17. I’ve tried copying the cal area into a vr and flashing via obd, once flex applies the unlock patch. I’ve bench flashed the ecu 100x with different ideas and configurations,

I’ve tried to checksum the file in the flash area but the otp is part of the checksum so no good there.  I decided that I will send the file to a file service so he can extract the cal area and put it in a vr checksum so it can work, he said it was locked,

so I opened the file, and with hexcmp I pulled out the 3 hidden signatures in the flash, I noticed the flash title was 259j but the actual file was 259b_0006 so I believe the tuner is using the one golf r mk7 file and just renaming the id to whatever car its going onto.

As it wouldn’t match the vr 259j, but its 95% identical to the 259b_0006 except for parts in the tuning area. So with my vr 259b_0006, I went into winols, added signatures to an ori, then found what those signatures looked like, while it’s clever at hiding its self looking like a part of the tune, its only 1 digit up or down in a map camouflage.

So I was looking for those signatures and replaced them with the ori file into the tuned file. “none where in maps area”.

I could then open it on winols 4, without the noread error.

They made me a file and I flashed it but again it didn’t work. I noticed that the tuning area appears to be data obfuscation and I believe that somehow the checksum/vin/powerclass has something to do with unlocking it in a running environment.

Now I did find a solution, as per prj advice, I used a combination of immo17 eprom editor and aark, extracted the eprom data and placed it in the new mcuid allowing cloning, then I left the flash unedited and flashed it and the car started up but went into immobilizer active.

At this point I was happy to see the only issue I have is immobilizer, as the multiple flashes prior showed me that the flash/eprom would lock or not boot in some way, I can usually tell when the engine code in the software id via obd changes from cjx to cnt or the ecu would be offline in the gateway but you could still get into the ecu and see that the software id isn't coming up.

I then pulled out my trusty odis, went online and attempted a "service immobilizer", I’ve done this process for many people many times, very familiar with it as i use odis everyday. But it failed. I believe maybe due to powerclass or vin or tune its self, who knows.

So at this point I pulled the flash back with the updated otp area in the flash file and immooff via immo17 and reflashed and now the car is successfully running again.

The only issue is now I can’t add keys nor do any immobilizer stuff as it will break the ecu immooff.
Also as I wanted to add a virtual cluster to the vehicle being it’s a base model and I’ve installed maybe 70+ virtual clusters but recently Audi/vw blocked programming used clusters recently "6 weeks ago" for me, so I’ve done a swap with a donor car, cluster + kessy + bdm + key + updated dsg to new vin/pk/mac/cs. But again wrong vin in ecu.

I need to find a way to correct this properly, does the data obfuscation have some vin verification process. The second I change 1 digit in the eprom for vin, the car won’t start. Even with the flash immo off,  As long as I have the edited eprom file with updated mcuid +  immooff flash file with new otp information the car will run. Any ideas. I’m exhausted at this point. Sorry for the long essay but I’ve tried 100 different ways prior to even my first post here.  Huh
Logged
prj
Hero Member
*****

Karma: +1072/-481
Offline Offline

Posts: 6037


« Reply #6 on: October 03, 2023, 06:15:31 AM »

Your immo off is tied to VIN. Since you didn't want to buy the correct solution the first time, just change your VIN and pay twice.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
Techguy
Full Member
***

Karma: +2/-10
Offline Offline

Posts: 54


« Reply #7 on: October 03, 2023, 10:51:27 PM »

Your immo off is tied to VIN. Since you didn't want to buy the correct solution the first time, just change your VIN and pay twice.

Hi, I would hate to say you’re wrong because you have helped me a lot so far and I’m grateful but unfortunately you’re wrong in this situation. when you immo off the flash file in any of the 3 different methods = aark, immooff17 or your suggested vehical it only wants the flash file to apply the immo off patch. It does not require the eprom and when I make the vin change in the eprom in either aark or immooff17 eprom editor, it only changes the bytes in the eprom file.

So regardless of me uploading the flash file to vehical/immooff or aark. no vin changes apply. they just simply patch the file against the otp area of the donor ecu and that part you where right about. reading the flash back after writing it so the otp area is updated made the difference for immooff to work on the donor ecu.

but now I need to edit the eprom to update the vin. any changes to the eprom vin information instantly stops the ecu from booting. this is my problem now.

also aark gives you unlimited immooff and immo17+vehical allows you to do free changes as long as the mcuid remains the same, so once I patch the file the first time, I don't get charged anymore for additional changes.

The only issue is vin editing in the eprom. this is where I’m stuck.

any ideas anyone?
 
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.028 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)