|
H2Deetoo
|
 |
« on: December 08, 2015, 09:19:15 AM »
|
|
|
Hi guys,
I have bought a spare EDC17CP14 ecu and a clone Galletto just to experiment and learn about this.
All ecu information you can find in attachment.
I opened the ecu, connected the bootpin to GND using 1kohm resistor and connected Galletto.
The ecu was recognized just fine but when pressing "Read All" I got an error:
ERROR UNLOCK PASSWORD READ - TRY TOOL TRICORE PASSWORD TPROT V08
When I pressed "Read Flash" and "Read Eeprom" it did read the files (see attached).
Question 1) What is the difference between the button "Read All" and the buttons read flash/eeprom ?
Question 2) Are the flash + eeprom files read correct?
Then I decided to unlock TPROT using Galletto, it has a special option for that.
When I tried that I got another error:
ERROR TPROT - For this new ECU we have no password at this time - Work in progress
Question 3) Can somebody explain me what this TPROT exactly is, what it does, how to deal with it?
Thank you for any info on these subjects.
Regards,
H2Deetoo
|
|
|
|
|
Logged
|
|
|
|
|
H2Deetoo
|
|
« Reply #1 on: December 08, 2015, 09:21:18 AM »
|
|
|
Some more info
|
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #2 on: December 08, 2015, 11:00:32 AM »
|
|
|
TPROT=Tuner PROTection. It prevents flashing unsigned files to the ecu.
This is only relevant over OBD. You can boot flash whatever you want. There is however a PASSWORD required on many ecus. It would appear your (cloned) tool doesn't have access on this one.
|
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
|
k0mpresd
|
|
« Reply #3 on: December 08, 2015, 11:11:21 AM »
|
|
|
his file is tp20 though. problem is tool is junk.
|
|
|
|
|
Logged
|
|
|
|
|
H2Deetoo
|
|
« Reply #4 on: December 08, 2015, 11:48:36 AM »
|
|
|
Thank you for your answers, but what I don't understand is why only button "Read All" fails but the buttons "Read Int Flash" and "Read Eeprom" do work and seem to produce a valid file.
(I know that if I simply read using OBD then the first 75% of the file is just empty, but these file seem to contain data.)
@k0mpresd, What do you mean with "his file is tp20 though" ?
Rgs H2Deetoo
|
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #5 on: December 08, 2015, 01:10:24 PM »
|
|
|
his file is tp20 though. problem is tool is junk.
I didn't download his file. Just a generic reply.
@k0mpresd, What do you mean with "his file is tp20 though" ?
Rgs H2Deetoo
The version of tuner protection. |
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
|
overspeed
|
|
« Reply #6 on: December 09, 2015, 07:43:18 AM »
|
|
|
MEDC17 (diesel and Petrol ECU) after TProt8 (nivel of protection implemented by Bosch) start demanding a password to processor go to bootmode, if you don´t know the password it can´t be booted
Fgtech can read Tprot8/10, you shall disarm bootstrap, change some wires and it would read.
For some ECU they can´t read password.
After FGtech read succesfully the password you must made boot conections again and it will work (the password is saved in a file in galetto folder).
strange it asked you the password, but cound read... when you press "read all" it will read processor (internal memory), external (eeprom or other if exist) and make one large file, reading as individual is the same, but dont´give you a larger file with all data
|
|
|
|
|
Logged
|
|
|
|
|
H2Deetoo
|
|
« Reply #7 on: December 09, 2015, 01:49:54 PM »
|
|
|
So TPROT protection == this password you are referring to ?
|
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #8 on: December 09, 2015, 02:34:57 PM »
|
|
|
So TPROT protection == this password you are referring to ?
No. Re-read my reply. |
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
|
H2Deetoo
|
|
« Reply #9 on: December 10, 2015, 01:51:26 AM »
|
|
|
>TPROT=Tuner PROTection. It prevents flashing unsigned files to the ecu. This is only relevant over OBD. Ok, I think I understand this. So this TPROT feature can simply be enabled to act as a write disabler? Is there a way to bypass TPROT once it is enabled? (I know putting tricore ecu in bootmode will allow writing...) >There is however a PASSWORD required on many ecus. It would appear your (cloned) tool doesn't have access on this one. In what situations is this PASSWORD needed? I mean, when in bootmode in can read/write this ecu without issuing any password. Sorry for being a n00b on this subject, that's why I am asking it here  Rgs H2Deetoo |
|
|
|
|
Logged
|
|
|
|
|
ddillenger
|
|
« Reply #10 on: December 10, 2015, 08:53:59 AM »
|
|
|
>TPROT=Tuner PROTection. It prevents flashing unsigned files to the ecu. This is only relevant over OBD. Ok, I think I understand this. So this TPROT feature can simply be enabled to act as a write disabler? Is there a way to bypass TPROT once it is enabled? (I know putting tricore ecu in bootmode will allow writing...) >There is however a PASSWORD required on many ecus. It would appear your (cloned) tool doesn't have access on this one. In what situations is this PASSWORD needed? I mean, when in bootmode in can read/write this ecu without issuing any password. Sorry for being a n00b on this subject, that's why I am asking it here Rgs H2Deetoo If the ecu requires a password, you can neither read nor write it in bootmode without it. As for the tuner protection, you can patch it with a bootmode write, then flash over OBD as normal. Not really worth it. Chances are your fgtech is going to make a mess out of OBD flashing, and these aren't as simple as EDC16 where you can just replace the eeprom or flash if corrupted. There are keys stored in the OTP sectors that must match. |
|
|
|
|
Logged
|
Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!
Email/Google chat:
DDillenger84(at)gmail(dot)com
Email>PM
|
|
|
Geremia
Jr. Member
Karma: +11/-10
 Offline
Posts: 27
|
|
« Reply #11 on: December 11, 2015, 01:32:16 PM »
|
|
|
TPROT= bosch libraries for security related stuff, called by bootloader or main aplication or whatever. They reside in OTP sector along with keys. Since you can't rewrite OTP sector, people can't patch tprot directly, instead they patch code that calls tprot functions ("tprot-off").
PASSWORD= Tricore password to unlock read/write protection. One sector is OTP, all the others can be read/write in bootmode if only you have the password to temporary unlock the global protection.
pwd read plugin/tool/whatever= tricore password is usually stored in flash, there are some tricks to dump it while ecu booted in normal mode (boot from internal flash).
|
|
|
|
|
Logged
|
|
|
|
|
