Pages: [1]
Author Topic: MED9.1 - read SKC for making a second key  (Read 1102 times)
jules13
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 2


« on: July 16, 2025, 06:43:25 AM »

Hi,

I've just bought a used EOS, year 2006, came with only 1 key.
In the past I managed to get the SKC for a second key on my Audi TT mk1 (immo2),
but for this car using VagTacho v5 I get the error: Wrong seed-key (picture attached)

I've read the forum and understand that the eeprom for a Med9.1 could be encrypted.
What could I do to get the SKC? maybe there's other tools? I'm at hobby level, trying to do some things myself.

Or can I get it from the ECU dump?
I've got the bin, read it with MPPS, loaded it in VagTacho, posting the info below, also from VCDS with cluster info maybe there's some clue.

I've also used eeprom tool 2.1.1 from the forum posted by a member, but it seems it's for checksum and some protection on reading ecu.

 





Logged
elias
Full Member
***

Karma: +21/-3
Offline Offline

Posts: 76


« Reply #1 on: July 16, 2025, 10:20:16 AM »

Easiest way would be to desolder the EEPROM and read it out using a EEPROM reader. Then you can decrypt the immo using the med9sum tool which you could find here on nefmoto
Logged
jules13
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 2


« Reply #2 on: July 17, 2025, 02:20:09 AM »

Easiest way would be to desolder the EEPROM and read it out using a EEPROM reader. Then you can decrypt the immo using the med9sum tool which you could find here on nefmoto
I was hoping for a non-invasive solution, using OBD, would that be possible?
I thinking this is a very usual ECU/Immo old enough to have an easy way of working with it.

I have already had a look at Med9Sum but thought it was doing checksums. Does it retreive PIN also?

Was looking also on VAGdashCAN, do you know if it gets the PIN on MED9.1 whrough OBD?

« Last Edit: July 17, 2025, 04:26:38 AM by jules13 » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 1.962 seconds with 16 queries. (Pretty URLs adds 0s, 0q)