Pages: [1] 2 3 ... 6
Author Topic: Understanding/retrofitting immobilizer (Updated for Allroad owners/DEATH CODE)  (Read 169519 times)
ddillenger
Moderator
Hero Member
*****

Karma: +637/-21
Offline Offline

Posts: 5640



I don't mean to over simplify this, but I'm going into this with the assumption that you, the reader, have 0 prior knowledge of the subject.

For those of you that don't know, the immobilizer is a passive anti theft system used in various VAG (Volkswagen Audi Group) vehicles over the years. The ross-tech wiki

http://wiki.ross-tech.com/wiki/index.php/Immobilizer

has some very good information. This guide is designed for those who need information above and beyond what is offered there.

First things first. Do you have an immobilizer? If you own a north american b5 s4, or c5 a6<2001, the answer is no. The only reason you would want to keep reading is if you
1: have to work with an ecu that does have an immobilizer, 2: want to use a flash from a car that originally had an immobilizer, or 3: wish to retrofit an immobilizer to your car.

The immobilizer data isn't stored on the flash memory chip. Instead it is stored on a seperate chip in the ecu known as the 95040, and is 512 bytes in size. All me7 ecu's have one (later 7.1.1 ecu's use a different chip, but I'll go into that some other time) and it's used for adaptation settings as well as the immobilizer data. When you write a new bin to it, you will clear your adaptations. Lemmiwinks hacks beware.

Part 1. You bought a used ecu that has an immobilizer and want to install it into a car that doesn't.

Simply flashing a bin from a car that didn't have the immobilizer referenced in the programming (any North american s4) will disable checking, allowing you to run a mismatched ecu. If you do this the contents of the 95040 are irrelevant. Any used ecu that came from a vehicle containing an immobilizer must be flashed in bootmode initially as attempting to flash over obd will result in nefmoto reporting "security access rejected", or "conditions not met". In addition, the large connector has a different guide pin. Simply snap it off (carefully!) in order to install it in your vehicle.

Part 2. You want to use a bin from an immo equipped car on a car that didn't come with an immobilizer.

Say you want to use an rs4 bin. Doing so will result in your car starting briefly and then dying, and may be accompanied by a DTC stating "engine start blocked by immobilizer". This condition isn't covered by the ross-tech wiki. The solution to this is to write the 95040 with a bin that has been modified so as to disable the immobilizer. Argdub's tool is great for doing so.

http://nefariousmotorsports.com/forum/index.php?topic=1168.0title=

You should do this prior to flashing the ecu, as once you do nefmoto will no longer be able to connect, as the ecu will report "security access rejected" until the 95040 has the proper pertinent data. A immo-off bin is attached.

Part 3

You want to retrofit your North American S4 with an immobilizer.

This requires several things. The first is a bin that references the immobilizer (or an immo equipped ecu), along with a 95040 bin containing the SKC you want to use. For simplicity's sake lets say the rs4 k-box, and the 95040 bin attached here, although any a6 bin from 01-02 will also work. The second is an instrument cluster from an immo2 equipped car. Ideally it would be best if you got a cluster that matched the ecu, but this isn't always possible. If your cluster and ecu aren't a matched set, you will have to adapt them so that they match.

http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_Immobilizer_Swapping_(Instrument_Cluster)

You can retrieve the SKC (secret key code) from the ecu by reading off the 95040. This code is required to login with VCDS in order to adapt the rfid chip in the key. Basically you're giving the key permission to start the car. If the rfid chip doesn't match the ecu, even if the ignition turns the car won't run. If you open the bin you read from the 95040 with a hex editor, the SKC is a 5 digit code and is located at 0x32, and 0x33. The format is as follows:

Digit 1=0
Digits 2-5 are bits 32 and 33 reversed and converted to decimal. EXAMPLE: Bit 32 is b5 and Bit 33 is 15. Since the format is to put bit 33 before bit 32 we end up with 15b5. Convert that to decimal and we get 5557. Ad a zero in front and our SKC is 05557. I suppose you could change the SKC to whatever you wanted (then convert it to hex and change bits 32 and 33 to reflect the new value), but remember, anytime you make changes you need to update the checksum. An explanation is available in the thread containing argdub's tool I linked to earlier.



Now your ecu and cluster should match, and we have the SKC. Every car I've seen thus far has had the RFID receiver coil around the ignition lock cylinder, but you might want to ensure your's does. If not, you will need to install one. A picture of what I'm referring to is attached below.



Next is adapting the keys. First, take your key apart. There is a philips screw beneath the audi emblem on the back. Remove the screw, pull the battery/remote section off and gently pry the key apart. It has a spring inside, so be careful. Buy a blank key for an immo3 equipped car (2001 a6) and insert the RFID chip (glass cylinder)



into your existing key. Now we can finish the adaptation. Again, the ross-tech wiki is very handy. The login code is your SKC.

http://wiki.ross-tech.com/wiki/index.php/Immobilizer_III_Key_Matching_(Cluster)

If all goes as planned, you now have a working immobilizer in your NA s4.

Keep in mind this is a work in progress. Any questions, post! Suggestions? PM me.
« Last Edit: March 31, 2013, 08:42:04 PM by ddillenger » Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
aef
Hero Member
*****

Karma: +69/-46
Online Online

Posts: 1566


« Reply #1 on: December 27, 2012, 03:47:45 AM »

great writeup!

The informations regarding the SKC were new to me.

Thank you sir  Smiley
Logged
vtraudt
Sr. Member
****

Karma: +4/-7
Offline Offline

Posts: 377


WWW
« Reply #2 on: January 01, 2013, 07:26:36 PM »

May I suggest another scenario:
Installing Immo3 ECU into another Immo3 car (in my case: swapping ECU between two 2002 Audi Allroad 6 spd).

a) Just flash the 4Z7 907 551 L stock ECU with an S4 (non immo) tune from this forum list
b) Make stock ECU work on other car (beyond my current skill level (newbie); would need someone to walk me through step by step)
Logged

2002 Allroad 2.7T 6spd stage 2
1998 A4 1.8T 5spd stage 3
1996 A4 2.8 auto stock
ddillenger
Moderator
Hero Member
*****

Karma: +637/-21
Offline Offline

Posts: 5640


« Reply #3 on: January 01, 2013, 07:36:52 PM »

(read NOTE at bottom)

As long as you currently have the car, and the immobilizer is functioning, you can just use nefmoto to write an m-box bin to the ecu. Then it's irrelevant what is on the immo eeprom, as the m-box doesn't reference the immo in the software.

This becomes more complicated if all you have is an ecu, as in order to flash (via obd without bootmode) you need the ecu to be installed and adapted to/in the car.

So, if the car is currently running, just flash an m-box (or l-box for tips) to the allroad ecu. At this point the ecu will run whatever car it's installed in.

NOTE: make sure you have a me7.1 ecu, not 7.1.1. If you put an m-box bin on a 7.1.1 ecu, it won't work.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
c00teriyf
Newbie
*

Karma: +4/-0
Offline Offline

Posts: 22


« Reply #4 on: January 06, 2013, 05:16:06 PM »

What I am trying to do is Part 2.

Quote
Part 2. You want to use a bin from an immo equipped car on a car that didn't come with an immobilizer.

Say you want to use an rs4 bin. Doing so will result in your car starting briefly and then dying, and may be accompanied by a DTC stating "engine start blocked by immobilizer". This condition isn't covered by the ross-tech wiki. The solution to this is to write the 95040 with a bin that has been modified so as to disable the immobilizer. Argdub's tool is great for doing so.

http://nefariousmotorsports.com/forum/index.php?topic=1168.0title=

You should do this prior to flashing the ecu, as once you do nefmoto will no longer be able to connect, as the ecu will report "security access rejected" until the 95040 has the proper pertinent data. A immo-off bin is attached.

I just want to be sure I am understanding this correct. This is for a 4.2 V8. The file I am trying to write to my ECU has a immobilizer. Current ECU does not. I will use argdub's tool and load your 'no immo' bin. After that, I will flash my ecu using the regular nefmoto tool with the file I want (with immobilizer) and this will defeat it
« Last Edit: January 06, 2013, 05:18:54 PM by c00teriyf » Logged
ddillenger
Moderator
Hero Member
*****

Karma: +637/-21
Offline Offline

Posts: 5640


« Reply #5 on: January 06, 2013, 06:53:45 PM »

YES! Just in case, here's another immo-off bin.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
julex
Hero Member
*****

Karma: +78/-4
Offline Offline

Posts: 923


« Reply #6 on: January 11, 2013, 08:48:33 AM »

I would love to run say RS4 bin in my allroad but I am too heavily invested in S4 M-box (logging variables, NLS, etc, etc) to make a switch... now if there was a magical switch that we could flip and make M-box immo aware... I wouldn't be surprised if it was possible as euro S4s do have immo stuff...
Logged
vdubnation
Turboman
Global Moderator
Sr. Member
*****

Karma: +49/-2
Offline Offline

Posts: 433


« Reply #7 on: January 22, 2013, 01:26:39 PM »

What ecu's did 95040 come on all me7 anyothers ?
Logged
ddillenger
Moderator
Hero Member
*****

Karma: +637/-21
Offline Offline

Posts: 5640


« Reply #8 on: January 22, 2013, 01:36:32 PM »

I honestly don't know. I know there were some me7's with other ic's, but I haven't really dug into it that much. This is a work in progress, I'll keep it updated.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
infinkc
Full Member
***

Karma: +6/-1
Offline Offline

Posts: 94


« Reply #9 on: February 08, 2013, 10:41:30 AM »

nice post, ive always wanted to add the immo into a NA s4, i had a post about it long ago here, but it didnt gain too much traction.

I wonder what chip on say an a6 cluster holds the immo info, and wonder if that can be programmed to the na s4 cluster so you dont have to change it.


I would think the guys running the rs4 cluster would benefit from this info as they can simply switch to an rs4 code and utilize the immo.
Logged

ddillenger
Moderator
Hero Member
*****

Karma: +637/-21
Offline Offline

Posts: 5640


« Reply #10 on: February 08, 2013, 11:09:26 AM »

Well, I can tell you the immobilizer data is stored on the eprom that stores everything else-mileage, adaptations, etc. If you erase that eprom, the car won't start any longer, and you'll have a blinking immobilizer light. I'm trying to get my hands on a spare immo-cluster to hack into, but so far no luck.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
keithwbloom
Jr. Member
**

Karma: +0/-1
Offline Offline

Posts: 43


« Reply #11 on: February 11, 2013, 02:17:10 PM »

According to Bentley service manual, all MY2001 and up Audi and VW chassis in NA had IMMO generation III, excepting the following:
  • B6 Passat (MY2006 and up) IMMO generation IV
  • MkV Golf, GTI, Jetta, Eos and Rabbit (MY2006 and up) IMMO generation IV
  • Phaeton MY2007 IMMO generation IV
  • New Beetle MY2007 IMMO generation IV

  • Audi A8/S8 (MY2004 and up) IMMO generation IV
  • Audi A4/S4 (MY2005 and up) IMMO generation IV
  • Audi A6/S6 (MY2005 and up) IMMO generation IV
  • Audi A3 (MY2006 and up) IMMO generation IV
  • Audi Q7 (MY2006 and up) IMMO generation IV

Prior to MY2001, the only Audi equipped with IMMO (generation III) was the 2000 A8/S8. The MY1998-MY2000 A4/S4/A6/S6/TTs had no IMMO systems.

I am going to post the reference table when I can get a screen grab. I have been rebuilding my XP laptop this weekend after crashing the HD Thursday.

If this is accurate, and the generation corresponds with the IMMO version, e.g. generation III is IMMO-3 or IMMO-III, then recoding a replacement ECU to work with existing IMMO-3 cluster requires a secure one-day-only 7-digit pin from the WIN2 system in the dealer service department.

I likes it very much that the first tune I received from J.Fonz was coded with IMMO deleted. Saved me a huge amount of headache.

Or perhaps I am overly intimidated by this.

 Undecided
« Last Edit: February 11, 2013, 03:18:25 PM by keithwbloom » Logged
keithwbloom
Jr. Member
**

Karma: +0/-1
Offline Offline

Posts: 43


« Reply #12 on: February 11, 2013, 03:21:31 PM »

I'm trying to get my hands on a spare immo-cluster to hack into, but so far no luck.

I have a couple of IMMO-3 clusters laying about. I can send you hex dumps from all of them if that helps. The IMMO serial number is a 14 digit value stored on the cluster's EEPROM. the IMMO serial number is not the same as the IMMO PIN or the SKC. The cluster EEPROM also stores the Vehicle VIN, and as you noted above, the mileage as well as a number of adaptations.

Just as there are developing ECU tuning whizzes in residence on this site and others, there are similar sites with dedicated cadres of cluster tinkerers, veterans that can look at cluster hex dumps and rewrite whatever is needed to adapt. It was was my original speculation that perhaps there was a similar, abbreviated hexidecimal stack within the ECU that corresponds with this cluster EEPROM on IMMO-3 equipped cars, allowing for the two to handshake and let authorized users start the card successfully. In reading a bit more about the depth of the ECU bin files, and the 95040 EEPROM, I am very disoriented at this point as to where the critical info on an IMMO-3 ECU would be stored.
« Last Edit: February 11, 2013, 03:31:34 PM by keithwbloom » Logged
ddillenger
Moderator
Hero Member
*****

Karma: +637/-21
Offline Offline

Posts: 5640


« Reply #13 on: February 11, 2013, 03:37:09 PM »

Do you have matching ecu's for any of the clusters? It would be great if I could get the ecu eeprom dumps as well!

If you don't have the ability to pull the bins, LMK. I'd be willing to do it/ship the cluster back (or buy it if the price were right-bad LCD not an issue).
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
keithwbloom
Jr. Member
**

Karma: +0/-1
Offline Offline

Posts: 43


« Reply #14 on: February 11, 2013, 05:58:45 PM »

I have the OE ECU bin from my car 3B0 907 551 DB and the VDO FIS cluster dump from the same. They are attached.

I have a copy of VAG Tacho and a working cluster bench harness, so I can pull my original V6 MFA cluster dump if it would be of value.

If you want a primer on reading cluster hex values, you might try polo-mk3 on ukpassats.co.uk. He seems to know where all the Easter eggs lie.





Logged
Pages: [1] 2 3 ... 6
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.027 seconds with 16 queries. (Pretty URLs adds 0s, 0q)