I got a bit further with my spare ecu. If you recall, I had this:

spare_ecu[spare_e2prom + spare_flash]

Another member contributed an immobiliser off version of the files (big thank you for that!):

spare_ecu[spare_e2prom_immo_off + spare_flash _immo_off]

But since I wanted an ECU that contained the maps from my own car, I combined the spare_flash_immo_off and my_own_flash to create an immo off version of my own flash. As dd posted earlier, I used a hex editor and copied the data at 0x6C00 -> 0x6FFF from the immo off file to my own flash file, overwriting that section of data in my own flash:

spare_flash _immo_off –> (from 0x6C00 to 0x6FFF) -> my_own_flash_immo_off

Then I wrote this to the ECU with BDM. In CMD I imported the flash and e2prom into a single file and wrote this file down to the ECU:

spare_ecu[spare_e2prom_immo_off + my_own_flash_immo_off]

I’m able to VCDS it on the bench and the part number now matches my own original ECU

I also checked this:

Immobiliser Status in VCDS
01 - Engine > Adaptation - 10 > Channel 91

0 = Immobilizer not matched (NEW)
1 = Immobilizer disabled
4 = Immobilizer matched (System OK)

My status was 1

I haven’t been able to put this spare ECU in the car yet. We are having very bad weather and it is always raining at the moment. When it lets up, I’ll swap it over and post the result.

Attached is my_own_flash_immo_off. I checked with the member about posting this and it’s OK.

Not really relevant unless you are willing to provide documentation.

Can you post your BDM software for me? I need to reinstall and can't find my old whatnot

Thanks!

Finally finished off the spare ECU and installed it in the car.

The ECU in the car is located in the area by the windscreen wipers. To reach it I had to remove the wipers and plastic trim and then I could reach the ECU.







Removed the security bolts. It wasn’t any easier this time I tried cutting a groove with a hacksaw blade, but the groove ended up v-shaped and the screwdriver kept slipping out. Then I tried a screw extractor which snapped off in the head of the security bolt! Eventually I drilled the heads off, got the clamp out and removed the stumps with gas pliers.



Spare ECU back in and secured with some shiny new button screws.







If you remember, this spare ECU has a copy of my own 2048kb flash, but the serial e2prom of the donor. I did two things whilst I had it on the bench.

1)   Checked the long coding
2)   Reset all the adaptation channels. From the Ross-Tech site “Channel 00 is a special case.  Performing a [Save] to Channel 00 resets all adaptation values to their original factory defaults”

The car started up and is working fine. No fault codes or any other visible signs that I’m using an immo-off ECU. I don’t have any dashboard lights or messages in the cluster. The only clue I could spot is in the advanced reading from VCDS. It no longer has an Immo Challenge.

Before:
Advanced Identification
    Serial number: AUX7Z0GNFNQ0NG
    Identification: RB8-658
    Revision: 5BH16---
    Date: 13.11.07
    Test stand number: 1360
    Manufacturer number: 0129
Flash Status
    Programming Attempts: 0
    Successful Attempts: 0
    Programming Status: 00000000
    Required Conditions: 00000000
Software
    A000
    A4.8.6
Misc.
    Hardware number: 8P0 907 115 B
    Immo Challenge: AB 17 95 39


After:
Advanced Identification
     Serial number: AUX7Z0G1FN80UJ
     Identification: BPG-810
     Revision: 5BH16---
     Date: 01.02.07
     Test stand number: 1849
     Manufacturer number: 0762
Flash Status
     Programming Attempts: 0
     Successful Attempts: 0
     Programming Status: 00000000
     Required Conditions: 00000000
Software
     A000
     A4.8.6
Misc.
     Hardware number: 8P0 907 115 B

There is absolutely no need to put the connector cage back in. Just bin it.

Is the entry from 0x6C00 -> 0x6FFF applicable for all MED9.1 ECUs; i.e., can I replace the same in my MED9.1 ECU to defeat the immo?
epy

Very good, thank you. I have a spare 115G MED9.1 ECU, BDM100, and a bench stand on the way, so I will definitely try this now that you have confirmed it is correct.

epy