Hey guys,

So, I've been reading around the forums here, and I've been doing research on my ECU for a few weeks.

My car is an 09 VW Rabbit - 2.5L - Engine Code: CBUA

I thought originally that the ECU was a Bosch ME7.1.1, but I came to find out (thanks to the folks at GolfMKV and Jeff Atwood at UM) that there were several ECU's used in the MKV 2.5L's.

Apparently, the MY09 model has the ME17.5 ECU, with a security exploit that was fixed with the MY2010+ models.  Flipping through major tuning companies has revealed that there are companies that offer 09 2.5L tuning through the OBD port, however, since this is apparently the unicorn of ECU's, none of the tools that I've looked for list the 2.5L as an ME17.5 CAN, they just list it as a ME7.1.1 K/CAN, which is a pity, seeing as I don't have a K-Line. 

So, my next step was to start looking at trying to program the ECU myself to tell it to dump the memory for me.  I looked at the VAG Seed-Key Response Algorithm via CAN Bus post here on NefMoto, but it's looking like the read algorithm (Seed + dec. 70,000) and the write algorithm (Seed <<5 XOR 0xFB DB 5D BD [or whatever it was, I don't have that right in front of me at the moment]) is unfortunately not the same algorithm used for the ME17.5's...

So, after trying and failing many times, going through 3 different cables and an unimaginable number of programs to try and do this, I just want to know:

What tool/software would I need to read/write this ECU?  I'm really at a loss, and I don't have the time to go through .NET API documentation for interfacing with serial COM ports, as I work 60 miles away from home and most of my time is eaten up by work/commuting. 

Any help would be greatly appreciated!

Worth noting: If it ends up that I need to yank the ECU and bench flash it, so be it, but I'd much rather be able to do it through the OBD port.  I've thought about getting Unitronic's UniConnect cable and reverse engineering the program, but, like I said before, I don't have much free time to take on a project of that caliber.

Edit: Also, if anyone knows what ECU's are similar to the ME17.5, that' d be a great bit of information as well.  I have an MPPS cable, VAG K+CAN Commander cable, OBDLink SX Cable (just for logging), and access to a Genuine Ross-Tech Hex/CAN cable

Define "Access" and then define "protocol".

I haven't had the pleasure to encounter an ME17.5 because they don't seem to be common where I live, but are often used in Brazil.
So I haven't been able to test anything myself which leaves me with some unknowns:

- what seed/key algo is used for readng? The +12233 used for MEDC17 or the xor 5FBD5DBDh for ME7x ?
- Are interesting address ranges blocked or readable?
- Is there any known way to read immo by OBD?

>Original KESS can do (did a few).
This uses the Bosch service mode bench solution like KTM?
Or does KESS use standard TP20 to read?


Rgs H2Deetoo

1.Seed should be common as on other vag cars. Not 100% sure though but even if it isn't finding the algo is easy..
2.Address ranges can be unlocked easily from a certain array so RMBA can have access to those ranges, usually needs boot/bench read for that.
3.Once you unlock the range you can see everything ( Even immo vars ) .

One definition that is missing is if the ecu is tp20 or uds

Yes, live in Brazil... not a regular car here... there is some few here...

it use the same old protocol for MED17.5 (265 I guess)...so it´s TP20 for sure...

Got it all working now!

Yes it is TP20 but level 3 seedkey is +79153 (13531h).
I was able to read crypted immo in ram using standard TP20 and MCUID using CCP protocol so I was able to decrypt the immo
(Ecu was TPROT_V03.00.00)


Regards,
H2Deetoo