Hello,

Has anyone deactivated the rsa check from this file?

Even if i put the ecu in TEST mode by changing the bytes from the eeprom and also the codewrods from
flash i get the death code bytes when doing changes outside the maps area after 2 3 days.

I have corrected the checksum with 4 different tools but nothings seems to make the correct rsa key for this version...

I used winols, Cmd, Ktag, Map3d,

I did not try the me7sum but for example if i add the als nls code here in 2 days the car will through 2 x AA bytes in the second and third page inside the eeprom and car will not start..I assume this comes from the rsa cause car runs perfeclty under all cases.

the NLS code that has been floating around is bad and overwrites RAM used by the RSA code. ECUfix disables RSA completely, which, IMO, is the wrong approach.

I have no intention of doing that in ME7Sum since that is supporting bad practice and bad code.

Get the NLS fixed.

So where is the bug on that one? Is there something wrong with any Register in the code or the 384ff0 is a bad address for the function counter?

Thank you for the answer and which would be a tested address space for the rsa equiped ecus?


As for the RSA deactivation, Since i do not own the ecufix after some research i did with IDA pro in various files with rsa, a quick way to deactivate it would be to search for the following hexstring :

c1 47 fc 10 00 8d eb 98 60 db 00 xx xx xx xx (word_fd9x.x, locret_8xxxxx in most cases)

replace the xx with db 00 db 00 and the first jump is off

The xx xx xx xx bytes do also include the memory address of the next jump that you will need to disable so if you load the file in ida pro you will quickly find out the next address.However if you search for the 8b db 00 xx xx xx xx after the first jump you will most likely find the second one.

I checked this in 3 sw versions Me7.5 (polo - seat leon - audi a4 ) and found that it was the same procedure.

so assuming that ecufix disables the rsa completly that way, even if i use the same address ecu will not lock down or ?

try 0x386000

Anyway  I was told there are other issues in this NLS code... I'd probably ditch it until it is fixed or you know enough to fix all the problems in it yourself.

What NLS code are you talking about? Are you refering to this  http://www.nefariousmotorsports.com/wiki/index.php/Adding_anti-lag_launch_control_and_no-lift_shift ?

yes but after some days happened the same again with 386000 unfortunatly...in order to inject though i wrote my own tool but maybe there is a bug on that aswell...will check it soon enough.

i also had the rsa disabled (andy`s way) but i do not think that this was the problem.... i will use the launch.exe from the forum and cross check with my tool first.