Pages: [1] 2 3
Author Topic: Immo 3 defeat  (Read 29605 times)
Giantmidget
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 19


« on: July 19, 2011, 10:34:02 AM »

Hi guys,

I have a 2004 A4 1.8T BEX manual

The cluster packed up , so i bought a second hand one knowing that  it will need reprogramming.I took the car to the Audi dealer near me about a hour later he called me and said they could not do it they cant get the nessessary codes,while telling me this he throws in that a new cluster is the best option,so i left and towed the car to a well known machanic here.

He reckoned that we could do a immo 3 defeat and then it would not matter what cluster is in the car it will start even without one.So he took the ECU out and desoldered the 95040 eeprom,he put it in his programmer read the file in hex code saved it as bin file.He called someone who emailed him the bin file which he then dumped on the eeprom ,soldered it back on and put the ecu back.The car would not start at all just swings the motor.I decided to do some of my own digging and saw that you only needed to change 4 values.and you could use winhex,i took the printed document to him and he changed the values in his hex editor.The car started but only for two seconds again,i then remembered that we did the change to the modified file from his friend and not from the original file.I downloaded Winhex and took it to him and installed it on his laptop and that is as far as we got.If anybody here can be of help it would be great,i just want to know do i just compute hash 16 bit then modify and save the file or what,or does the car change the values again when plugged in
Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #1 on: July 20, 2011, 07:15:35 PM »

Hi,

Firstly, get a vagcom-log to see what codes are thrown.

Secondly, i suspect there are some essential bytes not correctly setted.

Can you ask your mechanic to give you the read-out of your ecu's eepromchip?
Before he did anything to it ? And please post it up, right here, as a zip or rar-file.

I'll have a look to it.

PvL
Logged
Giantmidget
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 19


« Reply #2 on: July 21, 2011, 02:59:35 AM »

Hi,

Firstly, get a vagcom-log to see what codes are thrown.

Secondly, i suspect there are some essential bytes not correctly setted.

Can you ask your mechanic to give you the read-out of your ecu's eepromchip?
Before he did anything to it ? And please post it up, right here, as a zip or rar-file.

I'll have a look to it.

PvL

Thanks Pvl

Here is my original EEprom file form the 95040

If you can help me i will owe you a case of beer

Regards

Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #3 on: July 21, 2011, 03:42:20 AM »

Hah, Deal ! Smiley

First get me the real dump Wink

The file you've posted contains no useable or processable info.

Please doubleclick the screenshot i've made for you, to have a look..  I was expecting something different Wink

Please ask your mechanic to give you the correct readed-out file,
and post it over here.

Thanks,

PvL
« Last Edit: July 21, 2011, 03:45:44 AM by pvl » Logged
Giantmidget
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 19


« Reply #4 on: July 21, 2011, 05:52:19 AM »

Ok

The mechanic is using a MEC programmer to read the chip he desolders the 95040 then he puts it in the programer and reads the data,and this is the data that he read.

Should the data from the 9540 look different?
Maybe he should use a different program to read the data from the chip then.
I know he is reading it as 16bit
Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #5 on: July 21, 2011, 07:20:54 AM »

Hello giantmidget,

I get the feeling your 'mechanic' isn't on-par with the stuff he is trying to do.

Let's recap : the 95040-dump you've sended, looks like a config-file of his programmer,
                   and has nothing to do with the real data which is normally stored in this
                   eeprom.

It's nice that he has 'a' MEC-programmer, but can you also tell me, if it supports the 95040 chip (http://datasheets.pl/S/ST/ST95020.pdf) ? a programmer-type or a check in the software
he received with the actual programmer would be a good thing to start with. Don't get me wrong, i'm ruling-out the possibility that the programmer did not read it correctly, and for
some kind or reason dumped a config-file of the programmer itselfe into the file it created on his pc...  Otherwise i cannot tell you why the content is totally wrong.

You also sayed, that he sended off this file to a guy, and they modified it, and sended back the modified file. Can you ask your mechanic to also give your that file, and please post that also over here ? As i'm very interested to see what the content of that file is.
In other words : they had to tell your mechanic, that he was doing something wrong with his programmer, or did something wrong while saveing the content to disk of your eprom.

Is your original 95040-chip OVERWRITTEN by your mechanic ? or did you used a new chip ?

All these questions are quite critical. I'll explain later. This to prevent further errors, and get you a proper file to write-back.

Don't worry, i'll get you the dump you need, but first i want some answers, as i'm getting the feeling a terrible mistake was made by your 'mechanic'.....   But that depends on the answer and the 'modified' dump he got from his email-friend.

I get the feeling he wrongly saved your original dump of the 95040, and therefore you are in some problems now. All chips which are then send to you, will fail, if specific procedures are not followed. Please post the dump that he writed back to your chip and soldered back, that ran for 4 seconds.

Thanks,

PvL.

« Last Edit: July 21, 2011, 07:24:03 AM by pvl » Logged
Giantmidget
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 19


« Reply #6 on: July 22, 2011, 12:52:57 AM »

Hi Pvl,

Thanks for the info:

Contained here are the bin files:

Logged
Giantmidget
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 19


« Reply #7 on: July 22, 2011, 12:54:31 AM »

Sorry rest of files here:

These are tall the available files


Regards
Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #8 on: July 22, 2011, 03:18:49 AM »

Well....  at last some useable/processable stuff this time.

I think this should fix 2 things. You now have a proper original file back, and a
proper off-file.

Check the content of the archive i made. Also added a picture what my software says
about the modded first file..  But it will not report checksum-problems !!!!

Load my files up beside your 3 'original' files, and compare..  you'll see where things
go wrong Wink

Your mechanics-friend better get some extra tools for this kinda stuff..  The hint is in the pic Wink

And for the record..  always keep the original read-out saved. It might me of use, later-on Wink

If my off-file does not work, please also report over here, and we'll take another approach.

Have fun reprogramming and soldering ! Good luck.

Cheers,

PvL
Logged
Giantmidget
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 19


« Reply #9 on: July 22, 2011, 06:16:12 AM »

Hi Pvl,

Dumped your immo file , fan on car came on instantly then every couple of seconds.
Car only swings does not fire up at all.
Vcds does not want to read the car at all.

Just a question if the immo is defeated ,then it would not be neccessary to reprogram cluster or would it , the cam bus t the cluster is giving problems.

Regards

Gmidget
Logged
Giantmidget
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 19


« Reply #10 on: July 22, 2011, 07:17:28 AM »

VSDS
Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #11 on: July 22, 2011, 07:49:05 AM »

Hi,

Abouth the rest of the eeprom-content i cannot judge, because there are no tools which i am aware, that do the complete checksum-checking of the immo-eeprom. Therefore i think
this is a bit trickey with your current (perhaps wrongly) read-out dump.

Before commenceing starting, i would stress to firstly hook-up vcds, and see if communication is possible. Ifso, then you may try to start the engine. Ifnot, no reason to start, cause the ecu ain't working/responding.

I always check my ecu's on the workbench if they are able to communicate (before i stick them into any car). Untill now, no dead ones encountered here, so i guess my tools work correctly. I have the blue vagcom KKL-dongle to check them out with. And made myselfe a benchflash cable (also useable to do vagcom-communications with). This benchflashcable would be very handy for your mechanic or yourselfe to check-out your ecu before you put it back into your car..

Is your ecu in any other way 'modified' (chipped/not standard) ?

Next file i'm including is a virgin immo-off chip. Please write that to the chip, and VERIFY
with the programmer, the written content matches the buffered content on the pc.

Then solder it back, and if you can, do a bench-test on the ecu. It shall respond with vagcom 100%. Or your ecu is damaged. It's hard to diagnose like this, what is all happening over there, and putting the finger onto the wrong item. I hope you understand.

Vagcom cannot communicate with channel 1, your log says. Good one, you've posted this. It tells you, that the immo-chip is not correct, or that something is wrong with it.

Have a try with the added eeprom, and let me know.

Before you even think of starting the engine, hook up vcds, and see if you can communicate with the ecu and this dump programmed into the eeprom. I think the immobiliser will still kick-in, but now you can PAIR your ecu with the NEW clock again Wink

But really we want channel 01 responding again in vagcom (vcds)..  no matter what codes it throws..  it's a beginning.

PvL
Logged
pvl
Sr. Member
****

Karma: +32/-1
Offline Offline

Posts: 350


« Reply #12 on: July 22, 2011, 07:51:53 AM »

b.t.w. the mechanic didn't solder the chip wrongly orientated back, did he ? then you'll
FRY the 95040, but the ecu, if shutted down quickly is still o.k. You only need a new
(programmed) chip.

Let me know how things evolve over there...

Cheers,

PvL
Logged
Giantmidget
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 19


« Reply #13 on: July 23, 2011, 11:44:01 AM »

   
Hi,
 
No i watched him and the chip was soldered on correctly , we checked the data three times to make sure the data was programmed correctly.
 
I will try the virgin dump on Monday hopefully i will succeed.
 
i can not thank you enough for the info that you have provided me with thus far ,it has been a great help.
 
Just  a question does the cluster matter in the immo defeated mode? , i have the correct cluster a BoschRB4 900N ,but will a 900H also work under the defeated mode.

Regards
Logged
RaraK
Hero Member
*****

Karma: +58/-2
Offline Offline

Posts: 537


« Reply #14 on: July 25, 2011, 10:34:08 AM »

Did you fix this, the checksum is incorrect in the "fixed" file last posted, i do not know if i looked at the proper one which is assumed to be fixed.  If not post i will checksum whole file for you.
Logged
Pages: [1] 2 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.022 seconds with 16 queries. (Pretty URLs adds 0.001s, 0q)