You must be able to read this in boot mode on the bench.
And the ECU must communicate on the bench.

Running it in car will make no difference.

alright, took everything apart and put it together again, now I can read out the flash in boot mode 100% match. That means emu > connection is working as intended

Still no response trying to connect on the bench though, going to code it into test mode and try.

Coding the ECU as test model is done in the eeprom, you have to change some data values:
in pages 1 and 2 you will find  69,C1, and A5, replace these by 8E,5A, and D2,
then update the checksums of both pages. I believe you (or other experienced users)
can manage this without more detailed instructions (and the noob's anyway shouldn't
do).

I do not know what could be changed by setting to test model besides the following:
 - the data checksum results will be ignored by the ECU,
 - you can start a programming session even if the ECU is locked for some time after
   sending a wrong security key,
 - you can download data to the flash without ciphering and compressing.

On ME7.5 images, when you have started a programming session (85) and
are requesting ecuIdentification with param 9B, the last string you get has 5 characters.
If the last character of this string shows a '*', this indicates your ECU is coded as test model. I think this is not done for ME7.1 images.

Be aware: this results from code reading and simulations, not yet tested by me on real hardware.

Finally got to test it in the car!

First time i cycled on the ignition everything was fine, connected to it, communicated and read out fault codes NP. Then I cleared the codes(had one million codes from operating at the bench), read them out again and one code popped up: P0600

Then the cooling fans turned on and the ECU stopped communicating. Im i have a feeling something doesnt add up with the 95040.

I did read out the junkyard eeprom and defeated immo + coded it to test model, then flashed it back in and verfied it.

Should I use a blank immo off .bin instead?

Without lo/hi byte swap or did you manufacture adapter boards?

any chance this will emerge as a turnkey solution?

Alternately, I have a spare ecu that already has a ribbon cable connector on it.

Can you take some pictures of your setup? I'm hoping I can adapt it to my ECU.

Did you enhance the plugin to work directly while updating a single map/value or do you have to upload the whole binary to emulator when doing updates? (as I recall you explained it last time)

What do you use in the eeproms? Matching bin, immo off XXX bin?