The 2.0 TFSI MED9.1's are all the same at a hardware level. No worries there.

Once the immobilizer is defeated (need both the eeprom and flash) you are correct, the ecu is able to be benchflashed, or whatever else you want to do.

PM me when you're ready.

He says he is unable to open the ecu for any reason

All, thanks very much.


Yep, that's the constraint I have to work with.


I thought the pins codes were only applicable to the Immo 4A devices? After reading the Ross-Tech immobiliser wiki, I got the impression that later Immo 4B was not supported. But I'm guessing and also I don't have the pins to begin with

http://wiki.ross-tech.com/wiki/index.php/Immobilizer#Immobilizer_Generation_4


Sorry for all the noob questions but curious why you have to immo-defeat both the eeprom and the flash to start with? I'll try and explain what I mean.

1) Start with my eBay ECU
2) Extract the contents with BDM - eBay_ECU_eeprom.file and eBay_ECU_flash.file
3) Immobiliser Off - eBay_ECU_eeprom_immo_off.file and eBay_ECU_flash_immo_off.file
4) Write these back to the eBay ECU with BDM

Now the eBay ECU boots up and allows bench access etc. But since I would want to take the flash from my own car which I read with ODB (carA_ECU_flash.file) and load it on the eBay ECU via ODB, am I not just overwriting eBay_ECU_flash_immo_off.file with carA_ECU_flash.file which isn't Immobiliser Off and thus it won't work?

Or is it a case of the eBay ECU won't boot up without matching eBay_ECU_eeprom_immo_off.file and eBay_ECU_flash_immo_off.file to begin with, but then once it boots I can write whatever I want to it (carA_ECU_flash.file, carB_ECU_flash.file etc) over ODB and it's own internal subroutines do the housekeeping so subsequent reboots of eBay_ECU_eeprom_immo_off.file and carA_ECU_flash.file are fine to boot from?

Could I shortcut things at step 3 above by getting eBay_ECU_eeprom_immo_off.file and carA_ECU_flash_immo_off.file and BDM writing these to the eBay ECU instead? Or do the eeprom and flash files need to come from the same ECU before you can Immobiliser Off them? Some discussions here http://nefariousmotorsports.com/forum/index.php?topic=1068.420

Much appreciated and thanks for your patience. I appreciate you must be tired of explaining the same things over and over again...

dd is probably one of the most patient guys around when it comes to that.

In any case, I'm impressed enough with your work so far that I don't think it is too much to ask of us

Especially if you intend on making a nice writeup on everything MED9 you've learned

I was trying to explain to someone what I was trying to do with my ECU and realized it might be worth mentioning a few background concepts. If you’re reading this you probably know it already though! Feel free to comment, it would be nice to be as clear as possible I haven’t mentioned K-Line since I’m concentrating on MED9.1

ODB read / write
This uses the KWP2000 protocol over CANBUS to communicate with the ECU. The ECU has to be booted up and working properly  to start with, plus this communication is protected with security access before you can request the ECU to read out the contents of the memory or write new data to the memory. There are several memory IC’s on the ECU circuit board, plus the memory inside the main microprocessor itself. ODB cannot access all of these memory contents. You don’t have to remove the ECU from the car or open up the casing, you can simply connect to the ODB diagnostic port in the car which is networked via CANBUS to all the various ECU’s in the car. Typically if you do remove the ECU from the car and try to access it on the bench using ODB, you can read but not write as the ECU cannot see the other immobiliser components (instrument cluster) and denies write access. Hence immobiliser defeat is necessary for ODB write bench access.

Examples of tools
•   MPPS
•   Galletto

BDM read / write
This uses the JTAG physical connection that is found on most ECU circuit boards, but to get to this JTAG connector, you’ll need to remove the ECU from the car and open up the case (which is normally sealed with anti-tamper bolts and some kind of security girdle making it pretty obvious that you cracked it open). This JTAG physical port gives you access to all the IC’s on the board (it’s there for test and programming on the assembly line after all) and the ECU doesn’t have to be up and working. It doesn’t use KWP2000 or CANBUS, but rather connects directly to the components on the circuit board. No security access to worry about either, since you are going in at such a low level that the OS on the ECU hasn't even started up yet! You’ll need some kind of frame or jig with spring-loaded pins to press up against the solder pads on the circuit board or solder on some kind of header yourself.
http://en.wikipedia.org/wiki/Background_Debug_Mode_interface
http://en.wikipedia.org/wiki/Joint_Test_Action_Group

Examples of tools
•   BDM100


Since the JTAG connection physically connects to all the IC’s on the circuit board, you’d use BDM to read and write the memory that can’t be accessed with ODB. If your ECU is in a sorry state and won’t even boot up and start communicating over ODB, then BDM is what you’d use to refresh the contents of the memory IC’s on the PCB by writing directly to them. If you have a second-hand ECU like I’ll be getting, without any corresponding immobiliser components, BDM is your friend.

Basano,
I'm just beginning my journey down the MED9.1 path... could you possibly post a link to the BDM tool you bought?  did it come with the spring loaded header thingy to actually use on the ECU?

Thanks!

Cool! Just ordered one! i saw in the long MED9 thread someone recommended this: http://www.ebay.com/itm/BDM100-ECU-spring-loaded-probe-adapter-12-position-/250430088180?pt=Motors_Automotive_Tools&hash=item3a4ecbe3f4&vxp=mtr so i ordered one of those as well.  Looks like the Bosch pinout is 14 pins, but i'd bet 2 pins probably aren't used.