|
rob.mwpropane
|
 |
« on: June 05, 2011, 12:58:39 PM »
|
|
|
Hi, I have a chipped ECU sitting on my table. Finally I thought, I can see what is changed, compare to stock. Well I opened it up and to my dismay here's what I found:
2001 A4 1.8t
4B0 906 018 CH
Image_4064 is one I pulled from a listing on Audizine and is not the actual underside of my chip, however I'm assuming they look identical. If any one has any info on this it'd be great. If I need to desolder the eeprom to read ok, but what is the other chip for? I don't want to try something for nothing. Thanks, took me a while to post pics, but they should all work.
|
|
|
|
« Last Edit: June 05, 2011, 02:46:38 PM by rob.mwpropane »
|
Logged
|
This has nothing to do with cars but you can see my glorifying job at, www.MWPropane.com |
|
|
carlossus
Sr. Member
Karma: +38/-0
 Offline
Posts: 394
Leon Curpa Stg1+
|
|
« Reply #1 on: June 05, 2011, 03:12:36 PM »
|
|
|
I think the chip on the underside is for simple encryption. Probably swapping address lines. If you read the flash IC it'll probably be scrambled but if you read the module as a whole with a suitable reader it should read out like a normal flash because that's how the MCU has to read it.
|
|
|
|
|
Logged
|
|
|
|
|
|
|
rob.mwpropane
|
|
« Reply #3 on: June 05, 2011, 08:08:37 PM »
|
|
|
So I had a simplified thought, and it would be nice to get some feed back- is there/could there be anything preventing me from reading it in boot mode? I mean, I saw the extra hardware and got startled, but would boot mode work on this monstrosity? I'm sorry to sound so scattered, but I have read nothing on here, or elsewhere about this particular setup. I have read of certain companies implementing device s to change the code if its trying to be read, but never any facts or pictures, just talk. I just want to get it right.  |
|
|
|
|
Logged
|
This has nothing to do with cars but you can see my glorifying job at, www.MWPropane.com |
|
|
|
phila_dot
|
|
« Reply #4 on: June 06, 2011, 12:15:06 AM »
|
|
|
You have already tried NefMoto, Galletto, etc...?
|
|
|
|
|
Logged
|
|
|
|
|
rob.mwpropane
|
|
« Reply #5 on: June 06, 2011, 02:25:20 AM »
|
|
|
You have already tried NefMoto, Galletto, etc...?
No sir, I saw diifferent hardware and stopped there. I would love to bench flash with nefmoto, I have to wait for the cable to come in the mail, and wanted everyone's opinion on the hardware. If you can tell, I'm not exactly computer savvy, but times are changing. Time to get with the program, I saw the extra chip and just figured it would lock me out somehow? I have Read Tony's post somewhere that said boot mode should bypass anything a company may put to block from reading, I just didn't expect all of that! |
|
|
|
|
Logged
|
This has nothing to do with cars but you can see my glorifying job at, www.MWPropane.com |
|
|
|
rob.mwpropane
|
|
« Reply #6 on: June 07, 2011, 03:27:32 PM »
|
|
|
OK- so just an update, I am going to try nefmoto and bench flashing. I don't believe it will work but I did get news there is a way to do it from a gentlemen on another site. Quote: "29f800 has got 19 Adress pins, 15 Data pinsand one CE(CHip enable) pin. So you need a microcontroller with at least 35 I/O pins. Therefore I would take a seeeduino mega or arduino mega developement board. The trick is to set first adress with atmeg, read it and then toggle chip select. after that, the memory in the addidional chip on your board is cleared and cant remeber the last read out. after that you can read the second adress with again toggeling CE after that. Normal Programmers read straight through, so it is recognized by the additional chip. With this method your chip cant recognize anything, because e cant remember the last adress." Thought this may be interesting for some. Looks like I have some reading to do. The more I learn, it's obvious, the less I know...  |
|
|
|
|
Logged
|
This has nothing to do with cars but you can see my glorifying job at, www.MWPropane.com |
|
|
qshipsmn
Newbie
Karma: +0/-0
Offline
Posts: 2
|
|
« Reply #7 on: June 13, 2011, 05:23:34 PM »
|
|
|
FYI- That ATMEL PLD is a commercial grade part. The temp range is only 0 to +70 degree C. Sure hope whoever designed this didn't expect things to work when it's COLD out.
|
|
|
|
|
Logged
|
|
|
|
|
rob.mwpropane
|
|
« Reply #8 on: June 16, 2011, 07:15:54 PM »
|
|
|
FYI- That ATMEL PLD is a commercial grade part. The temp range is only 0 to +70 degree C. Sure hope whoever designed this didn't expect things to work when it's COLD out.
I don't plan on putting it in the car, I'm hoping to read it in boot mode and send it on its way if the damn cable ever gets here. Good info though, thanks. |
|
|
|
|
Logged
|
This has nothing to do with cars but you can see my glorifying job at, www.MWPropane.com |
|
|
kls
Full Member
Karma: +12/-0
Offline
Posts: 97
|
|
« Reply #9 on: June 27, 2011, 03:05:42 PM »
|
|
|
Any update on this? The only encryption board I have messed with detected boot mode and disabled the flash. I bypassed that detection and was then able to read the flash no problem. The boot mode detection was done using a PIC microcontroller, the board also had a PLD on it but it appears to be straight through and unused. Yours is most likely used and if whoever programmed was smart will detect sequential reads and disable the flash. It may also only accept a certain start address for the first read and not work if you start at zero, such as a boot mode read does.
|
|
|
|
|
Logged
|
|
|
|
|
pvl
|
|
« Reply #10 on: June 28, 2011, 04:05:49 AM »
|
|
|
@ rob.mwpropane :
Do you have a KWP2000+ ecu flasher interface ?
If so, there might be a way to get the flash readed out.
Cheers,
PvL
|
|
|
|
|
Logged
|
|
|
|
Dobermann
Full Member
Karma: +7/-0
Offline
Posts: 80
|
|
« Reply #11 on: June 28, 2011, 02:50:58 PM »
|
|
|
hello
i cant understand why you cant read the flash !! my optican read it without problems !!
the only problem is to write !!
you cant !!!!
you must desolder the chip from the base copy !! its easy than you can read and write !!
|
|
|
|
|
Logged
|
|
|
|
|
rob.mwpropane
|
|
« Reply #12 on: June 28, 2011, 06:58:25 PM »
|
|
|
@ rob.mwpropane :
Do you have a KWP2000+ ecu flasher interface ?
If so, there might be a way to get the flash readed out.
Cheers,
I just bought a 409.1 cable off eBay and was going to try reading in boot mode with nefmoto software. I got the one Tony suggested. I'm waiting for some jumper wires to attempt it.
PvL
|
|
|
|
|
Logged
|
This has nothing to do with cars but you can see my glorifying job at, www.MWPropane.com |
|
|
|
rob.mwpropane
|
|
« Reply #13 on: June 28, 2011, 07:04:38 PM »
|
|
|
Any update on this? The only encryption board I have messed with detected boot mode and disabled the flash. I bypassed that detection and was then able to read the flash no problem. The boot mode detection was done using a PIC microcontroller, the board also had a PLD on it but it appears to be straight through and unused. Yours is most likely used and if whoever programmed was smart will detect sequential reads and disable the flash. It may also only accept a certain start address for the first read and not work if you start at zero, such as a boot mode read does.
Well I hope that they were not smart enough, it was flashed in 06, date on the outside. I was going to try nefmoto/bench to try to read. Thoughts? What is the worst that could happen? |
|
|
|
|
Logged
|
This has nothing to do with cars but you can see my glorifying job at, www.MWPropane.com |
|
|
|
rob.mwpropane
|
|
« Reply #14 on: June 28, 2011, 07:23:43 PM »
|
|
|
hello
i cant understand why you cant read the flash !! my optican read it without problems !!
the only problem is to write !!
you cant !!!!
you must desolder the chip from the base copy !! its easy than you can read and write !!
I can share why I can't read the flash: 1. Contrary to what you may think, I'm quite handicapped when it comes to computers! 2. I own a VCDS and a ebay 409.1 kkl cable from ebay, not an optican. I was told if I desolder the chip to read that it would probably be encrypted and look like garbage. Hey I'm all ears for suggestions, but you may have to spell it out a little more clear. Why would optican be able to read it out, and not nefmoto software? Just for the record, if I do get this read I plan on posting it. I bought it used, I don't plan to name the company and it's my ECU. So when the gentlemen in the earlier post stated that it would "disable" the flash, what did he mean? |
|
|
|
|
Logged
|
This has nothing to do with cars but you can see my glorifying job at, www.MWPropane.com |
|
|
|
