Pages: 1 [2] 3 4
Author Topic: Extracting PIN from Cluster data ?  (Read 32799 times)
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #15 on: April 18, 2013, 08:16:15 AM »

glad to hear you're getting things sorted, and glad that it's an immo III vehicle.
(pin isn't stored in ECU for immo II)

06403 --> 03 19 in the 95040

I went back to see if I could find any pattern of the values in the cluster dump, and found it stored in decimal form[64 03] at E6, and ONLY at E6.

For immo III vehicles I'm accustomed to seeing it in hex form, low-high bits swapped, repeated three times, patterned in a cluster dump.

I didn't find [19 03] or [03 19] anywhere.

There is some serious variation to how the pin is stored in the cluster.
do you know if it's a bosch or vdo cluster?

Thanks for reporting back with your progress.
Logged
bjornhpersson
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #16 on: April 18, 2013, 08:24:36 AM »

Hi!

From the readouts in various software Im 99% sure its a Bosch Cluster. I havent yet pulled it out and cheched.

Thanks,

Bjorn
Logged
bjornhpersson
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #17 on: April 18, 2013, 11:51:23 AM »

Im sorry to tell you that the PIN 06403 didnt work i Vag Com. Wrong key.

Thats it for tonight.

Thanks!

Bjorn
Logged
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #18 on: April 18, 2013, 12:02:20 PM »

?? didn't work for you to log into either the ecu or the cluster?

if neither, then I'm concerned that you aren't entering the pin into the correct field. (it happens more often than you'd think)

ECU:
[Select]
[01 - engine]
[LOGIN - 11]
enter five digit pin into the LEFT field
[DO IT!]
...same as first twenty seconds of this video

CLUSTER:
[Select]
[17 - Instruments]
[LOGIN - 11]
enter five digit pin into the LEFT field
[DO IT!]
...same as first ten seconds of this video
« Last Edit: April 18, 2013, 12:24:49 PM by cyril279 » Logged
bjornhpersson
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #19 on: April 18, 2013, 10:44:57 PM »

Thank you!

I only tested the Cluster Login but yes into the left field. I'll try the ECU login asap.


Thanks,

Bjorn
Logged
bjornhpersson
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #20 on: April 18, 2013, 11:50:37 PM »

I tried the PIN in ECU login and it works Smiley ... not sure what use I have of it in my case but it proves that the extraction tools works just fine.

About the cluster make I have attached some pictures. My guess its a Bosch cluster. A strange thing is that the info in the Extra field has changed since my first efforts to try and learning keys. Im 99,99% sure that the first part of the info in the Extra field used to contain only 0-9 characters. It looks messed up now. I also went out to read out the bin from the Cluster again and when comparing the files in a hex editor some of the info has changed for sure.

See attached files. Sorry for complicating the original question but theese things tend to grow and with it the stubburnness to actually solve the problem.

Known facts so far:

The ECU PIN is 06403

The Cluster PIN is not 06403, 01010, 04112 or 39584


Update: I attached the screendump from VAG CAN Commander v2.5 and it suggested the PIN 39584. Not working either.


Thanks!

Bjorn
« Last Edit: April 18, 2013, 11:58:19 PM by bjornhpersson » Logged
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #21 on: April 19, 2013, 06:27:27 AM »

apparently your cluster is a color FIS? (very nice)
finding an 8e0 dump to compare it to wans't as quick or easy as I had hoped.
I've compared your two reads with an 8e0920930j dump that I found at a german site, and there seems to be information missing from your first read.

The J dump:
-also has [64 03] at E6, so finding the matching 06403 in the cluster dump was sheer coincidence. 
-also has the sequence of [10 10] in the same places as the bjorn dumps, so that affirms that 01010 or 04112 aren't valid as the pin.
-has the first nine digits of the vin starting at F7 (incomplete in both bjorn dumps), and then the full vin starting at 158 (incomplete in the second bjorn dump.

unless you have been writing an edited dump back to the cluster, I don't know why it would change on its own. (although I have read other posts about the perils of reading clusters with clone tools)
I don't advocate editing and re-writing the data to the cluster without verifying and understanding whether these cluster dumps are checksummed or not.  Everything else about the file visually appears normal. 

I don't know how else to direct you Bjorn, I did read somewhere that some of these clusters only contain some data used for calculating the pin, but not the pin itself.

best of luck, let us know what you figure out if you get it sorted.
-Cyril



Logged
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #22 on: April 19, 2013, 07:06:01 AM »

http://forums.fourtitude.com/showthread.php?5191107-Bosch-RB4-instrument-cluster-reset-to-quot-virgin-new-quot-state&p=69989614&viewfull=1#post69989614

http://www.esatinc.ca/Immobilizer/The_PIN_or_SKC_in_the_VW_and_Audi_Immobilizer.pdf

whether on this site or others, the more I read about the bosch encrypted clusters, the more I'm finding that they don't play well with cheap clone tools, even if they're only being read.
« Last Edit: April 19, 2013, 07:16:04 AM by cyril279 » Logged
ddillenger
Moderator
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #23 on: April 19, 2013, 09:01:04 AM »

Even reading an rb4/crypto cluster with a clone tool damages the checksum blocks and causes a DEF error. You have been warned.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
bjornhpersson
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #24 on: April 20, 2013, 06:33:18 AM »

Thanks guys!

I certainly have been warned and I appreciate both the warnings and the other help from you.

As stated in the first message I bought the car in this condition and I think the cluster might have been damaged to start with. The car was bought from an auction site and the description stated "key cannot be programmed with the car". Possibly some workshop has already tried to do this with good or bad tools. I bought it with the target to replace the cluster if it cannot be saved.

From this point I have a couple of options.

Replacing the cluster with a used one  (I will need the PIN along with the cluster)
Replacing the data with a working flash (desoldering the flash ?)
Bring the car to an Audi workshop and let them do all the work. (expensive and my project dies)
Kill the Immobiliser part in the ECU (out of my knowledge)

This will be a new thread for sure but replacing the data in the existing cluster will be the most fun I think Smiley .. Second best choice is to modify the ECU to ignore the Key issue.

The car still starts for a few seconds so even if I have messed up the cluster further my guess is that it still works as bad or good as before ?

Any bright ideas ?  Smiley

And also - can we for sure say that getting the PIN out of a RB4 encrypted (this one is encrypted ?) cluster is impossible ? If yes, any used cluster from the junkyard is a bad idea if the PIN is missing.



Thanks,

Bjorn
Logged
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #25 on: April 20, 2013, 09:56:10 AM »

From this point I have a couple of options.

Replacing the cluster with a used one  (I will need the PIN along with the cluster)
Replacing the data with a working flash (desoldering the flash ?)
Bring the car to an Audi workshop and let them do all the work. (expensive and my project dies)
Kill the Immobiliser part in the ECU (out of my knowledge)

defeating the immobilizer is the easiest way around the immo issue. by developing a bench setup and reading your 95040, you've already accomplished the toughest parts of the job.  read the "understanding/retrofitting-immobilizer" sticky for more details.

...can we for sure say that getting the PIN out of a RB4 encrypted (this one is encrypted ?) cluster is impossible ? If yes, any used cluster from the junkyard is a bad idea if the PIN is missing.

I wouldn't say impossible. PM Kompressd or NYET or PRJ (all of nefmoto) or put an add in the services wanted section.
maybe also PM JETTA ,97 (of TDIclub Forum)
you need someone who's comfortable with clusters, and may end up having to desolder and read it with a programmer.
Logged
ddillenger
Moderator
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #26 on: April 20, 2013, 09:59:22 AM »

F1torrents is the guy you want to talk to. He has the real deal cluster tools and can do rb4.

However, I'd just defeat the immobilizer and remove the LED. It's really not that hard.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
bjornhpersson
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 21


« Reply #27 on: April 20, 2013, 11:01:06 AM »

OK, thanks guys!

ddillinger - would you recommend trying the binfile from http://nefariousmotorsports.com/forum/index.php?topic=3319.0title= ?

I might give it a try.


Bjorn
Logged
ddillenger
Moderator
Hero Member
*****

Karma: +641/-21
Offline Offline

Posts: 5640


« Reply #28 on: April 20, 2013, 11:02:19 AM »

OK, thanks guys!

ddillinger - would you recommend trying the binfile from http://nefariousmotorsports.com/forum/index.php?topic=3319.0title= ?

I might give it a try.


Bjorn

Just post your read, someone here will turn it off for you.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
cyril279
Full Member
***

Karma: +12/-2
Offline Offline

Posts: 140


« Reply #29 on: April 20, 2013, 04:25:46 PM »

OK, thanks guys!

ddillinger - would you recommend trying the binfile from http://nefariousmotorsports.com/forum/index.php?topic=3319.0title= ?

I might give it a try.


Bjorn

it's always better to off your own 95040.bin, which you posted on the first page.
attached is the off version.
Logged
Pages: 1 [2] 3 4
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.024 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)