Pages: 1 [2] 3
Author Topic: Help to read this chipped 4B0 906 018 CH  (Read 26724 times)
kls
Full Member
***

Karma: +12/-0
Offline Offline

Posts: 97


« Reply #15 on: June 28, 2011, 07:31:03 PM »

The Atmel chip on the board may detect boot mode and disable the flash or it may detect a sequential address read and disable the flash. In both cases I believe it would only disable reading for that one session, a power cycle should allow the ECU to boot again.

So you can try a read in boot mode and see what it does, I suspect you'll just get garbage in the file, but you never know. I have one hardware encryption board that just does pass through, it seems the encryption code was never added to it.
Logged
Dobermann
Full Member
***

Karma: +7/-0
Offline Offline

Posts: 80


« Reply #16 on: June 29, 2011, 03:10:45 AM »

hello

i cant understand why you cant read the flash !! my optican read it without problems !!

the only problem is to write !!

you cant !!!!


you must desolder the chip from the base copy  !! its easy than you can read and write !!

I can share why I can't read the flash:

     1. Contrary to what you may think, I'm quite handicapped when it comes to computers!

     2. I own a VCDS and a ebay  409.1 kkl cable from ebay, not an optican.

I was told if I desolder the chip to read that it would probably be encrypted and look like garbage. Hey I'm all ears for suggestions, but you may have to spell it out a little more clear. Why would optican be able to read it out, and not nefmoto software?

Just for the record, if I do get this read I plan on posting it. I bought it used, I don't plan to name the company and it's my ECU. So when the gentlemen in the earlier post stated that it would "disable" the flash, what did he mean?






hello i dont know why optican reads it !!!

i had this problem by myselfe with this base copy shit !!


looks like MTM or ABT

i had this on audi s3 8l year 2000

to read the software is possible but write is impossible !!

what did you do now Huh

did you desolder the chip from the base copy Huh

you can solder this chip on the ori base !! desolder the complete shit of base copy !!

it works !! i have done many of this ecu
Logged
rob.mwpropane
Sr. Member
****

Karma: +32/-0
Offline Offline

Posts: 370


WWW
« Reply #17 on: June 30, 2011, 02:49:46 AM »


I have not done a thing to the ECU yet, I'm trying to find some time. I don't plan to desolder it, I've changed my mind on that. If anything I'll just re-sell it at some point. I hope I'll get some in the next couple days. If I remeber correct, optican isn't cheap. Are you using a clone by chance? If so, where did you purchase it?  ;DThank you for the advice, I will have to look into that route after my first read, which most likely will in fact be "shit".
Logged

This has nothing to do with cars but you can see my glorifying job at,

www.MWPropane.com
Dobermann
Full Member
***

Karma: +7/-0
Offline Offline

Posts: 80


« Reply #18 on: June 30, 2011, 08:21:00 AM »


I have not done a thing to the ECU yet, I'm trying to find some time. I don't plan to desolder it, I've changed my mind on that. If anything I'll just re-sell it at some point. I hope I'll get some in the next couple days. If I remeber correct, optican isn't cheap. Are you using a clone by chance? If so, where did you purchase it?  ;DThank you for the advice, I will have to look into that route after my first read, which most likely will in fact be "shit".


hi

if you dont want to desolder you cant read/write the ecu !!

i think there is no optican clone !!


i have a genuine optican dual master system !! this tool is expensive !! 4500 for the master version !! but i think its a very good tool !!!

did you try it with a MPPS ?? maybe this tool will do it !!

you can send this ecu to me and i can read it for you if you want !!


king regards
Logged
phila_dot
Hero Member
*****

Karma: +173/-11
Offline Offline

Posts: 1709


« Reply #19 on: June 30, 2011, 09:33:59 AM »

Pull a good bin off chipped ECU, sell chipped ECU, flashed tuned bin to stock ECU.
Logged
rob.mwpropane
Sr. Member
****

Karma: +32/-0
Offline Offline

Posts: 370


WWW
« Reply #20 on: July 01, 2011, 05:06:09 PM »

Well this is what it says when I try to read it on the bench:

ECU reports programming session preconditions have been met.
Negotiating communication timings.
Successfully changed to new communication timings.
Requesting security access.
ECU reports that security access request was rejected.
Starting diagnostic session.
Disconnecting because no response was received for the Tester Present message.
Disconnected
100% complete.
Validating memory layout failed.
Restoring Windows sleep mode.

This is what it says in the car:

Requesting security access.
Security access granted.
Validating flash memory starts at 0x00800000 and ends at 0x00900000.
Memory layout is valid.
Starting to read data block.
Calculating flash checksum to determine if reading is necessary for range: 0x00800000 to 0x00810000
Flash checksum does not match, reading flash data is necessary.
Requesting upload from ECU for address range 0x00800000 to 0x0080FFFF.
Request upload from ECU succeeded.
Starting data transfer.
1% complete.
2% complete.
3% complete.
4% complete.
5% complete.
6% complete.
Data transfer failed.
100% complete.
Reading ECU flash memory failed. Huh Huh

I'm assuming that nefmoto can not read this, but I switched over to my stock ECU, and couldnt read that in the car either? What the heck am I doing wrong? It validates memory layout, but only gets to about 6% done and then fails on both chipped and stock ECU's. I'm at a loss, but after all attempts I'm still able to start the car with both ECU's. Embarrassed
Logged

This has nothing to do with cars but you can see my glorifying job at,

www.MWPropane.com
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #21 on: July 01, 2011, 06:15:55 PM »

indeed, nefmoto will not do benchreads (yet)

Tony .... when will this be possible, please Huh

For the meantime, try it with kwp2000+ on the bench.

It does not cost a arm or leg that interface...

Logged
rob.mwpropane
Sr. Member
****

Karma: +32/-0
Offline Offline

Posts: 370


WWW
« Reply #22 on: July 11, 2011, 06:44:22 PM »

Ok so now I've got a galletto cable. The software says boot mode for 29f800BB, but as you can see in the previous pictures (if you looked!) that the chip inside my ecu is a 29f800BT. Will this cause a problem? Does that have a different memory layout? Thanks for everybody's help, I'm pretty close to either a total failure, or total success. Either way it's been a real learning experience. Thanks to everybody for their help. Lots of people have pm'ed me and what not pointing me in the right direction. Great site, good people...
Logged

This has nothing to do with cars but you can see my glorifying job at,

www.MWPropane.com
vwaudiguy
Hero Member
*****

Karma: +53/-37
Offline Offline

Posts: 2024



« Reply #23 on: July 11, 2011, 06:58:12 PM »

Check both VW and Audi for their options. There have been a time or two where I had to use a different manufacturer to get the correct chip layout. I don't remember whether BB and BT are interchangeable, but remember seeing reference to this somewhere on this forum..Maybe search?
Logged

"If you have a chinese turbo, that you are worried is going to blow up when you floor it, then LOL."
rob.mwpropane
Sr. Member
****

Karma: +32/-0
Offline Offline

Posts: 370


WWW
« Reply #24 on: July 11, 2011, 07:36:23 PM »

So I did search...duh!! Thank you for the suggestion. This is what I found posted by Tony:

Quote
The validate memory layout operation validates the start and end addresses of the memory layout. It does not validate the sector sizes, because you can't do that without erasing the flash memory.

The 800BB and 800BT memory layouts only differ in where the "boot blocks" are located. The BB layout has small sectors at the bottom, and the BT layout has small sectors at the top.

The difference between the BB and BT layouts only matter for the purpose of erasing flash. Flash memory chips can only erase entire memory sectors. When reading the flash memory, the sector layout makes no difference.

So I'm going to assume that to read I could just use the 29f800bb to read!! Will try Tuesday or Wednesday when I have some more time. Thanks!
« Last Edit: September 14, 2011, 03:31:17 PM by Tony@NefMoto » Logged

This has nothing to do with cars but you can see my glorifying job at,

www.MWPropane.com
kls
Full Member
***

Karma: +12/-0
Offline Offline

Posts: 97


« Reply #25 on: July 11, 2011, 07:56:12 PM »

Its not an issue at all with Gelletto, read away!

I am really looking forward to the results as I received a similar type board today and I plan to read the flash on it. Mine is a little different in that the flash chip is socketed and the PAL has the part # sanded off. There is also a glop of epoxy covering a bunch of the pins. I already traced the connections and have determined the following on mine:

6 data lines are remapped via PCB traces and not the PAL
6 address lines are processed/rerouted by the PAL
1 additional address line is processed but not rerouted
CE# and OE# are also connected to the PAL
based off the Vcc input and the fact that the PAL has 20 pins I am sure its the same as yours - a 16V8

I can't help but wonder if I will be able to just dump the flash through the PCB in boot mode, it seems like they would have protected against that but based on the address lines monitored it may not be possible to stop it. They are not monitoring the boot pin (DQ4) at all with the PAL.
If they were looking for a read to start at zero I was just going to start the boot mode dump and then plug the flash in hot a second later.

I would have tried reading it in boot mode already but the unit needs to be plugged into an ECU so I need to order some header pins and solder them into a spare ECU.


« Last Edit: July 11, 2011, 08:33:25 PM by kls » Logged
rob.mwpropane
Sr. Member
****

Karma: +32/-0
Offline Offline

Posts: 370


WWW
« Reply #26 on: July 12, 2011, 03:04:36 AM »

Well, I planned to do this to get into boot:

http://nefariousmotorsports.com/forum/index.php/topic,104.0.html

As soon as I find time! Hopefully later today, but with it being a BT and not BB I think the above thread should work for me? Wish me luck Grin
Logged

This has nothing to do with cars but you can see my glorifying job at,

www.MWPropane.com
kls
Full Member
***

Karma: +12/-0
Offline Offline

Posts: 97


« Reply #27 on: July 12, 2011, 12:18:44 PM »

There are many alternate boot points, I haven't ever had pin 3 of the eeprom work for me though. There are valid points to enter boot mode on the flash chip, the ram chip, the CPU and at least one test point on the bottom of the PCB.
Logged
rob.mwpropane
Sr. Member
****

Karma: +32/-0
Offline Offline

Posts: 370


WWW
« Reply #28 on: July 12, 2011, 12:43:28 PM »

There are many alternate boot points, I haven't ever had pin 3 of the eeprom work for me though. There are valid points to enter boot mode on the flash chip, the ram chip, the CPU and at least one test point on the bottom of the PCB.

No sir, I was going to go for pin 27 on ram like in the picture at the top of that thread...
Logged

This has nothing to do with cars but you can see my glorifying job at,

www.MWPropane.com
rob.mwpropane
Sr. Member
****

Karma: +32/-0
Offline Offline

Posts: 370


WWW
« Reply #29 on: July 12, 2011, 02:59:39 PM »

Ok, just an update. I got everything hooked up right.... just to find out I didn't  install the drivers correctly and then researched to find galletto works better on xp.... damn vista. Oh well, I guess it has to wait for this weekend... unless someone has driver to get gilletto to work on vista? If not, no big deal, just have  to wait Undecided
Logged

This has nothing to do with cars but you can see my glorifying job at,

www.MWPropane.com
Pages: 1 [2] 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.023 seconds with 18 queries. (Pretty URLs adds 0s, 0q)