Pages: [1] 2
Author Topic: Immo 2 help - 24C02 Read  (Read 28391 times)
sean337
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 12


« on: February 28, 2013, 07:29:44 AM »

Looking for some help with a US 2.0 Beetle. Early 2000's model. I believe it is IMMO2, something has happened with the key so the car is starting and shutting off with the immo block and blinky light in dashboard. Can someone help me with the attached file? I would like to turn the immo off completely. I have dug around several forums, mostly I find people using files from other box codes that have been disabled. I don't want to change anything else in this file so any help would be appreciated! Thanks.
Logged
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #1 on: February 28, 2013, 09:15:16 AM »

Comparing the two files posted in this immo-off-thread, I can see that the file structure matches yours, and that the only values changed were 00C-00F (and again at the repeats at 06C-06F), but I have no clue why the new values were chosen.  

hopefully in addition to helping you immo this file off, we'll also hear about how it's done, and it can be included in the "understanding/retrofitting immobolizer" thread?

If you're a member of ecu connections then this post (whole thread really) may be helpful...

-sorry I couldn't be more helpful myself
-Cyril

edit to add some detail:
------------------------------------------------
Address 01: Engine Labels: 06A-906-018-AEG.lbl
Part No: 06A 906 018 JN
Component: 2.0l R4/2V MOTR AT V01
Coding: 00033
« Last Edit: February 28, 2013, 11:45:17 AM by cyril279 » Logged
jolidj
Full Member
***

Karma: +0/-3
Offline Offline

Posts: 54


« Reply #2 on: February 28, 2013, 10:04:53 AM »

you now type of ecu??
Logged
ddillenger
Moderator
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #3 on: February 28, 2013, 10:09:37 AM »

2000 beetle=5.92. I'll off your file shortly.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
sean337
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 12


« Reply #4 on: February 28, 2013, 10:59:22 AM »

Comparing the two files posted in this immo-off-thread, I can see that the file structure matches yours, and that the only values changed were 00C-00F (and again at the repeats at 06C-06F), but I have no clue why the new values were chosen. 

hopefully in addition to helping you immo this file off, we'll also hear about how it's done, and it can be included in the "understanding/retrofitting immobolizer" thread?

If you're a member of ecu connections then this post (whole thread really) may be helpful...

-sorry I couldn't be more helpful myself
-Cyril

Thanks Cyril, I actually read that thread on ECU connections. I spent a few hours looking around, comparing various files etc. I couldn't figure out what other people were using and why, so I decided to reach out over here and see what help I could find. I want to understand the changes so we can have a how-to posted on here like the ME7 guides.
Logged
jolidj
Full Member
***

Karma: +0/-3
Offline Offline

Posts: 54


« Reply #5 on: February 28, 2013, 11:01:07 AM »

try and report please .
Logged
ddillenger
Moderator
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #6 on: February 28, 2013, 11:04:24 AM »

I can certainly off it, but for older eeproms (yours included) I run it through software. I'd like to understand the rationale behind the changes as well, and will certainly add it to the sticky when it's made clear to me Smiley
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
sean337
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 12


« Reply #7 on: March 08, 2013, 02:24:10 PM »

Update with what I tried:

Looking through one of the threads cyril posted I found an orignal and an immo off file. So I compared the changes. Three were made and repeated. At 0C00, A0 went to 50, at 0E00 CF went to 20, and at 0F00 FB went to FC. These changes where repeated at 0C60, 0E60, and 0F60.

A0 to 50 is a simple inversion. A0 = 1010000 50 = 0101000
FB to FC is a simple increment FB = 251 Decimal FC = 252 Decimal

The question lies in the change of CF to 20
CF = 11001111 or 207 decimal, 20 = 00100000 or 32 decimal
It is almost an inversion with an increment as well.
1101111 invert to 0011000 = 30 subtract 1 from the first digit = 20 = 00100000

This is the only thing that made sense to me, so for my file instead of CF, I had 34
34 = 00110100 invert to 11001011 or CB, subtract from first digit to get BB or 10111011

So for my file I tried 50, BB and FC at the locations mentioned above. The car started right up and did not care about the immo issue with the dead key fob. Great, but I got a fault that returned with every key cycle for internal module error. Guessing a checksum issue. Can anyone help out here, I am assuming the one value which I was guessing at is incorrect and must be based on something else?
Logged
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #8 on: March 08, 2013, 05:11:05 PM »

glad to hear you're figuring it out

a0 to 50 is probably the immo-off change (for me7.1 and others it's 01 to 02 then correct the checksums), and both f and e columns are probably checksums for the row. I'm off to dinner or I'd try to work on it more, but I expect that the increment of the e and f bits together are a factor of the a0 to 50 difference, similar to this.
Logged
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #9 on: March 09, 2013, 06:10:38 AM »

I've found that the last two columns (of all rows) are = FFFF - sum(octets)
the rule works for the first twelve lines of both original files
(maybe more, I didn't check beyond the first six, which repeat at 60)

assuming that 50 is the immo-off value of 0C and 6C, then your off'd line should look like the "sean's 24c02 off" image below.

these findings don't match the immo off file provided in the thread linked earlier, which could suggest several things.
1, I have grossly oversimplified the immo off process for this chip
2, that second file of the other thread has checksum issues (with no feedback we don't know for sure)

Logged
nyet
Administrator
Hero Member
*****

Karma: +608/-168
Online Online

Posts: 12271


WWW
« Reply #10 on: March 09, 2013, 09:21:29 AM »

I've found that the last two columns (of all rows) are = FFFF - sum(octets)
the rule works for the first twelve lines of both original files

Maybe i'm missing something, but that is the definition of a checksum..
« Last Edit: March 09, 2013, 09:27:14 AM by ddillenger » Logged

ME7.1 tuning guide
ECUx Plot
ME7Sum checksum
Trim heatmap tool

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your ex
ddillenger
Moderator
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #11 on: March 09, 2013, 09:29:03 AM »

Maybe i'm missing something, but that is the definition of a checksum..


For some reason I edited your post rather than replying-lol

I fixed it. Sorry about that.

Anyway, each line is checksum'd just like immo-3, that part I'm clear on. It's the changes required for the immo-off that I'm hazy on. If PRJ is right and otocheck just substitutes a new file, comparing the changes is fruitless, so I haven't bothered. I'm hoping if this thread stays active someone will chime in.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #12 on: March 09, 2013, 10:15:40 AM »

Maybe i'm missing something, but that is the definition of a checksum..


you're the VET here NYE, so I am probably the one that's missing something

I'm under the impression that checksums are subject to the coding that calculates them.
the checksums for 24c02 are calculated differently than those for the 95040.
therefore I didn't recognize ffff-sum(octets) as any global definition of a checksum.

the checksums for 95040 are ifferent for each line, skipping the backup page.
starting with line 10.  ffff-sum(octets)
line 20 fffe-sum(octets)  [or something like that]

there was a better description in another thread, prolly the argdub-tool thread, but I don't know the technical side of it at all, only that the checksums for 95040 are not ffff - sum(octets) for all rows, as it seems to be in this 24c02.

« Last Edit: March 09, 2013, 07:11:45 PM by cyril279 » Logged
ddillenger
Moderator
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #13 on: March 09, 2013, 10:20:10 AM »

I just meant the format of the checksums is similar, as in each line sum'd individually. Here's the checksum guide for immo-3.

ME7 EEPROM Checksum-Guide
=========================

The ME7 EEPROM contains 512 bytes and is divided into 32 pages with 16 bytes per page.
In the ME7 code you will find a table with 32 entries that contains one descriptor word for
each eeprom page. The index into this table is the eeprom pagenumber (00..31).

The descriptor word is a bitmask, the following bits are relevant for the checksum calculation:
 bit 0 = checksumPresent(CS)   1 -> page has checksum,  0 -> page has no checksum.
 bit 6 = cksumBit(CB)          this bit is subtracted from the pageNumber to get the
                               same checksum in backup page as in original page.
 bit 7 = backupPage(BP)        1 -> page has a backup page.

Here is how the eeprom page info table looks like:
PAGE   DESCR-WORD  -> CHECKSUM-BITS
-----------------------------------
00      FF18       ->    --
01      0017       ->   (CS)
02      0117       ->   (CS)
03      0207       ->   (CS)
04      0307       ->   (CS)
05      0437       ->   (CS)
06      0533       ->   (CS)
07      06B7       ->   (CS) (BP)
08      06F7       ->   (CS) (BP) (CB)
09      07B3       ->   (CS) (BP)
10      07F3       ->   (CS) (BP) (CB)
11      08B7       ->   (CS) (BP)
12      08F7       ->   (CS) (BP) (CB)
13      09B3       ->   (CS) (BP)
14      09F3       ->   (CS) (BP) (CB)
15      0AB3       ->   (CS) (BP)
16      0AF3       ->   (CS) (BP) (CB)
17      0B32       ->    --
18      0B10       ->    --                           
19      0B10       ->    --                           
20      0B10       ->    --                           
21      0C37       ->   (CS)
22      0D33       ->   (CS)
23      0E33       ->   (CS)
24      0F33       ->   (CS)
25      1033       ->   (CS)
26      1133       ->   (CS)
27      1233       ->   (CS)
28      1235       ->   (CS)
29      1235       ->   (CS)
30      13B7       ->   (CS) (BP)
31      13F7       ->   (CS) (BP) (CB)

If the checksumBit(CS) is set for a page, this page has a checksum.
Calculate the checksum as follows:
- sum up the first 14 bytes of the eeprom page in a 16bit variable.
- add the page number to the sum.
- if the checksumBit(CB) is set, subtract 1 from the sum.
- negate the sum (this is not the same as complement!).
- store the resulting value in the last two bytes of the eeprom page,
  first the low-byte, then the high-byte.

Disclaimer: this information was collected to the best of one's knowledge, but I won't give
any guarantees for the correctness of my information. If you find any errors, please correct.
Have fun, mki
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
sean337
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 12


« Reply #14 on: March 09, 2013, 11:46:46 AM »

thanks everyone, cyril i came to same conclusions last night after you linked me to that me7 thread. I worked all of them out by hand and found the slight difference in the one untested file.

ddilenger I can confirm that the AO to 50 change takes care of the immo blocked start even if the checksums aren't correct. I will have to test the checksums now. I have already fixed the car I was playing with, perhaps we can check this on a bench ECU I think I have a spare somewhere.

Logged
Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.044 seconds with 16 queries. (Pretty URLs adds 0.001s, 0q)