Pages: [1]
Author Topic: 6hp19 a8d3 immo Reversing  (Read 4060 times)
Yur1i123rus
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 18


« on: September 21, 2025, 09:23:51 AM »

Has anyone disabled the immobilizer on a 6hp19? I read the data from the flash memory by connecting directly to the connector using the pcm flash program. Can I rely on the med9.1 addressing inside the mpc562? I couldn't find the a2l on the 6hp anywhere. Or maybe there were factory versions without an immobilizer on the second-type hydraulic unit?
Logged
Yur1i123rus
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 18


« Reply #1 on: September 24, 2025, 06:12:51 AM »

I uploaded the file to ida pro. If I find the immobilizer data, will the cross-references lead me to the immobilizer function? Or maybe you can tell me what else might lead me to the immobilizer?
I've definitely seen at least one s4b5 with a 6hp19a where the immobilizer was disabled in the TCU.
Logged
BlackT
Hero Member
*****

Karma: +81/-42
Offline Offline

Posts: 1509



« Reply #2 on: September 24, 2025, 11:57:25 AM »

First version of 6hp19 does not have immo, also allversion that come on B7 does not have immo
But mehatronic are not the same, also crossflashing is not posible
Logged
fastboatster
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 85


« Reply #3 on: September 27, 2025, 06:37:56 PM »

I uploaded the file to ida pro. If I find the immobilizer data, will the cross-references lead me to the immobilizer function? Or maybe you can tell me what else might lead me to the immobilizer?
I've definitely seen at least one s4b5 with a 6hp19a where the immobilizer was disabled in the TCU.
doesn't it have code compression enabled in some code sections? does IDA deal with it or you're decompressing yourself?
Logged
BlackT
Hero Member
*****

Karma: +81/-42
Offline Offline

Posts: 1509



« Reply #4 on: September 29, 2025, 12:37:40 AM »

Sorry, but I never get hand of any flash from TCU. I don't even know how to change shift maps
Logged
Yur1i123rus
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 18


« Reply #5 on: October 03, 2025, 01:27:43 PM »

Sorry, but I never get hand of any flash from TCU. I don't even know how to change shift maps

I unpacked it manually. It looks like the immobilizer data is in an accessible format, and there are two conditional jumps. At first, I thought that by replacing one of them with an unconditional jump, I could bypass the immobilizer, but it's not that simple. Unfortunately, I have limited knowledge, and I don't have the A2L for this TCU to load the file correctly in IDA Pro. However, I have high hopes that something will work out.
Logged
Yur1i123rus
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 18


« Reply #6 on: October 03, 2025, 01:35:44 PM »

Here is my tcu dump from an Audi A8D3 2007
Logged
fastboatster
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 85


« Reply #7 on: October 04, 2025, 01:46:19 PM »

Here is my tcu dump from an Audi A8D3 2007
It does look like it's compressed (has several BOSCH AE/EWG TC19.11 MPC562 CC_ON BS1002041270H00138 BDM_RBWERKBSBB1002) (meaning that the code is stored in the compressed form inside the TCU and then decompressed online as it gets executed). In your screenshots, you have some string bytes disassembled as code, I don't know if that's something you wanted to do intentionally or IDA did it on its own.
Maybe you're right about immo routines, and they might be in the section with no compression near BSBB1002BOSCH TC19.11 MPC562 CC_OFF BB1002041270H00157BDM_RBWERKDEVELOPSERIES_BDM_RBWERKCHANGED_FROM_DEVELOP_TO_SERIES, but they're probably called from somewhere in the compressed section(s)
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.015 seconds with 15 queries. (Pretty URLs adds 0s, 0q)