that great news. I'm planning to do this swap soon for my c7 S6. recently they have changed the approval process to remove TCU IMMO via ODIS so I have been trying to research alternative methods.

That's pretty cool if you are getting somewhere disassembling that shitty SHA CPU that's in the AL55x TCUs... I would actually need someone to help me with some stuff in that kind of architecture and CPU sometime.

Thanks! I used the SH2A language in Ghidra and while it disassembled and cross referenced numerous functions, I still have something I’m missing. Reason I say is because some functions and data that I know which are used are not cross referenced. I don’t have a great understanding of this processor in general but having an A2L helps quite a bit—another problem is it’s from the gen 2 AL551 while my TCU is a gen 1. Most of the function implementations are similar enough I can search for common constants or instructions and find them to work backwards but some are very different.

There’s also numerous H’FFF80000 addresses in the Gen 2 TCU that they use for flags which are not documented for example so it’s a struggle to sift my way through them. With that being said, if you have something specific, I am willing to share because now at this point this this is a hobby for me. I planned to take on this project making a canbus bridge to make the AL551 standalone compatible but now Maxxecu has pretty much already done this from what Natanael has told me. Beta stage for the AL551 for now. They accomplished this by flashing their custom dodge TCU firmware onto the Audi TCU.

I patched the 4G1927158A 1006 Software on my personal 2014 Audi A6 and flashed with PCMflash module 82. Checksums were updated and car runs and drive fine. Of course the immobilizer is already paired on this TCU to the ECU so it’s not definitive but at least it still functions. I’m planning on testing this weekend to replay the CAN traffic from my A6 back to my D4 A8 TCU to see if it flags the immobilizer DTC.

If it lets me shift out of park then I think it will I wired up the EGS already. The trace is just going to be with ignition on and foot on brake which normally allows shifting to neutral in my A6. Or I’ll check the On-chip ram address for shift lock release or I think there’s one for ready to start (can’t remember exact name at the moment.)