First time posting here...

I'm looking into deleting the immobilizer on a 2011 Audi A8 8HP55 (Audi calls this transmission the AL551) since I haven't found anyone that can do this for me. These TCUs use a Renesas SH72549 / R5F72549R which the datasheet isn't published but the SH7254R is. I've attempted to disassemble some PCMflash dumps I found online (I don't have PCMflash or module 82 yet) but I have no idea how the immobilizer works let alone Renesas disassembly code. I've done about as much as I can learn via google and chatGPT so I could use some help... All I've been able to find is some can bus IDs, such as OBD_01 at 0x00044750; and a couple functions such as at 0x000259dc where the VBR is updated to 0x000200F0. Numerous other functions update On-chip RAM locations, but it's very hard to follow.

The latest idea I had was to compare the dump from the Audi with a Dodge/Chrysler as they do NOT have an immobilizer. Problem is I probably need the Funktionsrahmen or Damos for this TCU to at least point me in the right direction but I can't find it.

I guess I'm asking for what you guys think I should do. I need the immobilizer and component protection removed from the ASW due to using this transmission with an aftermarket ECU. I have the Audi Kmatrix (DBC file) which I plan to use in order to make a canbus bridge. The DBC file doesn't explicitly mention how the WFS5 immobilizer is implemented nor mention any signals transmitted over CAN 2.0 so I assume it's being done over UDS or K-line perhaps. From my research, BCM2 and the TCU communicate with one another regarding the immobilizer but from sniffing the drivetrain traffic on my 2014 A6 (same transmission probably different software ver), I don't see anything sent via UDS.

Side note, the DQ380/381 and DQ500 also use the same microcontroller, so if anyone has experience with them maybe the immobilizer implementation is similar?

Lastly, any information on what the difference between the frf files (0x200000 length, I think these are flashed with ODIS) and EEPROM (0x20000 length) and FLASH/MAPS (0x2800000 length) files would be appreciated.. I assume EEPROM is just according to datasheet 0'80100000 to 0'8011FFFF but no idea where MAP files would be in physically. During my attempted analysis I've tried adjusting the start address to a few locations to no avail. I will say the frf files contains the canbus IDs previously mentioned.

Thanks for the quick reply! Yeah I'm mechanically inclined not so much with electronics. I have logged my A6 and the torque calculations should be pretty straight forward, lots of time, but straight forward since I have the DBC file. The reason I'm using this transmission is that it's a transaxle with pretty unique layout. I have successfully matted the 6-speed manual version of it to an LS for use in my A4 already, see attached. Now I want the automatic from my A6 lol..


I don't follow what you mean "in the cal" you mean like adaptation values. What I can gather, the checksum and class are part of the WFS5 so I'm not sure how these can be accessed otherwise. As I said, I have logged traffic and don't see anything this isn't in my DBC file. There are some extended frame messages in the DBC that I have no logged traffic on thus far. For example, SKey_Getriebe_01_Req 0x17fc0277, which the only comment is "Request of the Service Key2 Function" but I was thinking this was seed key for UDS flashing, maybe I'm wrong here.

Forgive my ignorance here please, but could you tell me the location in DATA section or where I can find documentation that labels a switch "evaluate immobilizer." This is all new to me and I'm trying to learn jargon and various other things along the way.

I believe Maxxecu has the capabilities I need, as that is what CANTCU suggests using for their BMW 8HP canbus bridge they sell.

I'm not looking for a free lunch here. I didn't even know such parameters existed in the OEM descriptor files which is I why I'm asking for help, so thank you I appreciate it! The file I'm working off of and disassembled a few things on is attached. If there's a way to attach Ghidra projects, then I can attach that too but there's not much done there.

The DBC file I found and confirmed the IDs are correct for my C7 A6 is here if you wanna take a look: https://raw.githubusercontent.com/rusefi/rusefi_documentation/master/OEM-Docs/VAG/B8_Q5_D4_C7_MLB.dbc

Could you at least point me to the source for where I could purchase the OEM descriptor file for the AL551 TCU???

Easiest solution for you would be a MaxxECU for the LS engine and a Dodge gearbox with corresponding mechatronic unit since that will be wahts possible to run with Maxx ECU directly.

Other way would be an 8HP45 (or better 70) with the BMW xdrive ATC and a CanTCU for street, or Turbolamik for Drag/Drift useage.

BMW 8HP Gen 1 & 2 will ignore immo once they are virginzed. Maybe that also works for VAG.

Update. Bought an A2L+Hex (AL551 hybrid is only one around apparently) and a few FRs and I don’t see a switch to bypass WFS unless I’m overlooking something. I was able to get the TCU to communicate via CCP using a Kvaser Leaf but could only dump CAL (0x180000 to 0x200000) and RAM memory address 0x600000 to 0x680000 is available for upload / download. Surprisingly seed/key is not required to do this. Unfortunately the immobilizer function that triggers all the WFS logic is located at 0x7DE2C (at it is least for 4h1927158AD 1006). I’ve checked various PCMflash maps dumps and they are most likely 0x160000 to 0x3DFFFF from what I can tell (think it depends on software). I’m relatively new to VAG ECU/TCU files but the FRF for my 1006 SW contains the ASW which I believe can only be flashed with ODIS, right?

Maybe I’ll try looking into UDS next… The AL551 does connect using VW_Flash using the DQ380 UDS protocol.

PCMflash Module 82 got the job done. Full read and write with checksum correction. Haven't tested as my plans have changed but pretty sure this will disable immobilizer.