cyril279
Full Member
Karma: +12/-2
 Offline
Posts: 140
|
 |
« Reply #15 on: March 09, 2013, 01:16:48 PM »
|
|
|
You worked them out by hand? you're way cooler than me, I made excel do the work.
I'm certainly glad it's working out for you, please let us know if the checksum correction gets rid of the "internal module error"
|
|
|
|
|
Logged
|
|
|
|
|
aef
|
|
« Reply #16 on: March 10, 2013, 02:05:18 PM »
|
|
|
|
|
|
|
|
Logged
|
|
|
|
|
|
c11rgd
Newbie
Karma: +0/-0
Offline
Posts: 9
|
|
« Reply #18 on: February 04, 2014, 05:10:31 AM »
|
|
|
Great thread. i just have a few Q's
1. How do i know if a ECU is Immo 1, 2 or 3?
2. Are we saying that we have to reduce the value in 000C to 50 or by 50? as the example of A0 is a double of 50.
3. Do we have to modify the checksum in the last two columns and back up pages?
4. In the eeprom i have noticed it has the ECU number, now if i was to clone the eeprom chip and solder to another ECU of corresponding numberical digits, would i have to modify the flash in that ECU to tie up with the eeprom.
I have Immo Universal decoder 3.2
in that software for all Bosch M3.8.x eeproms it has two options, version 1 and 2
And for both it calculates the immo off differently , i believe for 1 it sets 000C to 50 and 000E to 9E
Which doesnt make sense to me
so i would prefere to do the calculation manually in a hex editor. as descibed above.
|
|
|
|
« Last Edit: February 04, 2014, 05:13:05 AM by c11rgd »
|
Logged
|
|
|
|
reset
Newbie
Karma: +2/-0
Offline
Posts: 17
|
|
« Reply #19 on: November 02, 2015, 07:07:56 PM »
|
|
|
Here's a new one:
99.5 jetta, I'll assume ME 3.8, part number 06A906018BH
I knew this one would be an odd bird when I saw the Soft coding = 00000
Instead of A0, it has F0 at 0x0C for the immo byte
(F0h = 11110000b)
Checksum bytes = 29 FA (FA29h)
What I tried (correcting the checksum each time):
Change F0 to 50 (checksum becomes FAC9)
Sometimes in edc15 for example you will see 33, sometimes it is F3. Changing to 60 turns off immo in both cases, so maybe that bit needs to say 50h regardless of what the original value is
Well, that didn't work,
so figured maybe it was the 50 decrement not the value that makes the difference, so
Change F0 to A0 (F0 - 50 = A0)
Didn't work either
then reading this thread again, maybe it's the reverse bitmask, so we'll try
the inverse mask of F0 = 0F (11110000 vs 00001111)
Didn't work either.
Next try inverting ONLY the first 4 bits so (F0 change to 00 and cksum becomes FB19)
that didn't work either.
Every time VCDS adaptations block 91 says 4, not 1 like it does when immo = off
Anyone know how to shut off the immo in this ecu?
Another interesting thought. A0h/2 = 50h so maybe F0h/2 = 78h is the answer... what I will try next. (edit- that didn't work either)
|
|
|
|
« Last Edit: November 03, 2015, 09:55:17 AM by reset »
|
Logged
|
|
|
|
|
eliotroyano
|
|
« Reply #20 on: November 03, 2015, 05:05:36 AM »
|
|
|
I notice that M38x & M592 immo & it checksumm calculations are based in sums, according to the info I have collected. I checked with some ECUs and worked everytime quite good. In general I have done by substract 50h to make immo off and correct checksumm by adding 50h too.
|
|
|
|
« Last Edit: November 03, 2015, 05:20:52 AM by eliotroyano »
|
Logged
|
|
|
|
|
eliotroyano
|
|
« Reply #21 on: November 03, 2015, 05:06:28 AM »
|
|
|
Looking for some help with a US 2.0 Beetle. Early 2000's model. I believe it is IMMO2, something has happened with the key so the car is starting and shutting off with the immo block and blinky light in dashboard. Can someone help me with the attached file? I would like to turn the immo off completely. I have dug around several forums, mostly I find people using files from other box codes that have been disabled. I don't want to change anything else in this file so any help would be appreciated! Thanks.
Take a look. |
|
|
|
« Last Edit: November 03, 2015, 05:21:18 AM by eliotroyano »
|
Logged
|
|
|
|
reset
Newbie
Karma: +2/-0
Offline
Posts: 17
|
|
« Reply #22 on: November 03, 2015, 11:08:00 AM »
|
|
|
In general I have done by substract 50h to make immo off and correct checksumm by adding 50h too.
It did not work that way in my case. Instead of A0h the immo byte is F0h in the weird eep file. Subtracting 50h (so the immo byte = A0) the adaptation channel 91 still = 4. If the immo was off, adaptation channel 91 would = 1 Even changing immo byte to 50h does not work. So here's what did not work so far: 1) Change immo byte to 50h 2) Change immo byte to A0h (subtract 50h from original value) 3) Change immo byte to inverse bits (F0 = 11110000 change to 0F = 00001111) 4) Change only high bytes to inverse (F0 =11110000 change to 00) 5) divide by 2 (F0/2 = 78) 6) divide only 'F" by 2 (F0-> 70) So for this particular ecu, there must be some (as of yet unknown) value that makes it immo off. |
|
|
|
|
Logged
|
|
|
|
reset
Newbie
Karma: +2/-0
Offline
Posts: 17
|
|
« Reply #23 on: November 03, 2015, 11:11:05 AM »
|
|
|
Take a look.
that file is correct |
|
|
|
|
Logged
|
|
|
|
|
eliotroyano
|
|
« Reply #24 on: November 03, 2015, 11:21:56 AM »
|
|
|
Here's a new one:
99.5 jetta, I'll assume ME 3.8, part number 06A906018BH
I knew this one would be an odd bird when I saw the Soft coding = 00000
Instead of A0, it has F0 at 0x0C for the immo byte
(F0h = 11110000b)
Checksum bytes = 29 FA (FA29h)
What I tried (correcting the checksum each time):
Change F0 to 50 (checksum becomes FAC9)
Sometimes in edc15 for example you will see 33, sometimes it is F3. Changing to 60 turns off immo in both cases, so maybe that bit needs to say 50h regardless of what the original value is
Well, that didn't work,
so figured maybe it was the 50 decrement not the value that makes the difference, so
Change F0 to A0 (F0 - 50 = A0)
Didn't work either
then reading this thread again, maybe it's the reverse bitmask, so we'll try
the inverse mask of F0 = 0F (11110000 vs 00001111)
Didn't work either.
Next try inverting ONLY the first 4 bits so (F0 change to 00 and cksum becomes FB19)
that didn't work either.
Every time VCDS adaptations block 91 says 4, not 1 like it does when immo = off
Anyone know how to shut off the immo in this ecu?
Another interesting thought. A0h/2 = 50h so maybe F0h/2 = 78h is the answer... what I will try next. (edit- that didn't work either)
That is a weird dump. Soft coding is 0000. DTCs are FF FF ........ seems like was manipulated before. What DTCs do you have? Can you read it again directly from ECU in car? |
|
|
|
« Last Edit: November 03, 2015, 11:28:03 AM by eliotroyano »
|
Logged
|
|
|
|
reset
Newbie
Karma: +2/-0
Offline
Posts: 17
|
|
« Reply #25 on: November 03, 2015, 01:02:08 PM »
|
|
|
That is a weird dump. Soft coding is 0000. DTCs are FF FF ........ seems like was manipulated before. What DTCs do you have? Can you read it again directly from ECU in car?
Don't have the car unfortunately. Agreed, it is a very strange dump. Not quite sure what to do with it. immo byte should be A0 and not F0 VCDS says soft coding 00000 is correct for that particular ecu. manual transmission with brake electronics I think it was. |
|
|
|
|
Logged
|
|
|
|
reset
Newbie
Karma: +2/-0
Offline
Posts: 17
|
|
« Reply #26 on: November 03, 2015, 01:59:38 PM »
|
|
|
I just wrote a complete eeprom from a different 5.9.2 ecu, with known immo off. Verified the first 5 bytes sequence is the same so it should be compatible.
ECU boots up in vcds, but STILL 4 in channel 91
I give up on this one. Something's just not standard.
|
|
|
|
|
Logged
|
|
|
|
reset
Newbie
Karma: +2/-0
Offline
Posts: 17
|
|
« Reply #27 on: December 23, 2015, 03:33:59 PM »
|
|
|
Ended up using an FA box. (06A906019FA) it's the same make/model/year except it has cruise while the weird ones do not have cruise.
It looks like the 2 part numbers with the weird "F0" immo value are:
06A906018BH
06A906018BJ
there may be others
I would love to figure this one out.
|
|
|
|
|
Logged
|
|
|
|
|
