So I realize that lemmi and unisettings read/write/save to addresses 0x90 and 0xA0 of the eeprom (not sure why those two addy's are identical as well as the next 2-3 pairs). There are always people trying to defeat the immo and get their skc's to code keys and such. Why can't these programs be re-directed to read/write 0x12/0x22 and 0x33/0x34 and recalc checksums if needed? What would I even use to see the command order/structure/process of these programs, and is it encrypted?

I wasn't aware of this..there so many "vag something" programs floating around the net and on e-bay they all kind of merge together in my mind at times hehe. I just figured something could be easily written and use cables I currently have. Do you know If I need a specific cable or will it work with generic interfaces? It also looks like there are a few different types around along with different software versions.

Funnily enough I tried the exact same thing yesterday, on a bench flash. I thought it had worked as, like you it said the immo was off but it obviously wasn't as nefmoto still said there was still security. Did you try the k+can while the ecu was in the car?

So coming back to my original question..Is it possible to just modify an existing program (lemmi/unisettings) to get it to do what is needed?

Jason, that is my understanding of how it works, too, but Is it only those areas (one that lemmi looks at) of the eeprom that are written to ram? I saw a post a while back about a guy who looked at the file Unisettings saved and realized the two end values showed up in the file looking at it with a hex editor..The last two values. He changed those and loaded the file and saw changes in req boost and something else..This is what got me thinking how much of the eeprom is stored in ram?