VAG Bosch ME9.1: How to read EEPROM content

[d2mike]

Hi DK,

can you please tell me how to read the eeprom of a VAG Bosch ME9.1 engine ecu?

What tools are able to?
I already tried VAGdashCAN ... but w/o success.

Thanks.

Cheers,
d2mike

[technic]

BDM or AVDI. The latter won't always give you full content, though.

Sent from my HTC Desire S using Tapatalk 2

[d2mike]

BDM or AVDI. The latter won't always give you full content, though.

Sent from my HTC Desire S using Tapatalk 2

Is there no other software?
What chip is inside ME9.1?

[exe123]

AFAIK AVDI cannot read the eeprom. It will just give you PIN and CS bytes.
Via BDM you will get the content of the 95080/95160 but it is crypted on some versions.

[d2mike]

AFAIK AVDI cannot read the eeprom. It will just give you PIN and CS bytes.
Via BDM you will get the content of the 95080/95160 but it is crypted on some versions.

Ok, thanks.
So no other chance?

[technic]

No other tool that I'm aware of. But with CS bytes you should be able to clone the ecu if that's what you are after. Note that the seventh CS byte sometimes is not available in the ecu.

Sent from my HTC Desire S using Tapatalk 2

[k0mpresd]

bdm or use a programmer.

[d2mike]

Hi mates,

I have the bdm file here.
Are you able read/extract the immobilizer data out of it?

Cheers,
d2mike

[d2mike]

Ok, I have another idea.
The background is, that I have to restore a full immobilizer system (Audi A4 B7, MY 2005, Immo4c)

Actually, if I give the dashboard a new identity (with all relevant immobilizer data) it must be possible to retrieve these data over the normal VCDS ecu learning procedure, right?

Perform login -> wait 2 mins -> Adaption -> Channel 50 -> and so on

What do you think? Is it working?

Cheers,
d2mike

[d2mike]

Any ideas/suggestions, mates?
Thanks in advanced.

Cheers,
d2mike

[digitaltech]

Any ideas/suggestions, mates?
Thanks in advanced.

Cheers,
d2mike

Well technically, then key matching. What was the underlying issue ? Old ECU died ?

[IDispatch]

MED9.1 has inside 95xxx EEPROM. You can read it with any EEPROM programmer or BDM. But this EEPROM is useless because you cannot do anything with it - the most important data (PIN/CS) are encrypted, and the encryption is individual for each engine control unit.
The solution is to read the EEPROM by OBDII (e.g. with the mentioned AVDI) - this will read PIN and CS
Then read Dashbard and get from there the PIN and CS.
Then there are two possibilities - adapt the engine to the dashboard (as far as I know only AVDI can do this - you will need PIN and CS for it). The other possibility is to adapt the dashboard to the ECU, but once again you need to change PIN/CS/MAC of the dashboard (adaptation on channel 50 is not working at all on this model).


And finally you should pay attention that for the power class - if the replacement MED9 is from other engine type the power class should be adapted too - first need to find the power class of the engine control unit (as far as I know only AVDI can do it) and then to modify in the dashboard.

[d2mike]

Thanks mate.
The login and power class from engine ecu I already have ;)
I just want to transfer the immobilizer data from the dashboard to the engine ecu and this should work imho via adaption channel 50.

[exe123]

Thanks mate.
The login and power class from engine ecu I already have ;)
I just want to transfer the immobilizer data from the dashboard to the engine ecu and this should work imho via adaption channel 50.

That's depending on the ecu. Some MED9 deny learning via channel 50.

[d2mike]

That's depending on the ecu. Some MED9 deny learning via channel 50.

Ok, can you verify it via the part number?

[exe123]

Send full bdm readout. I can also extract pin and cs from that.

[d2mike]

Send full bdm readout. I can also extract pin and cs from that.

Would be great, thanks.
BDM dump attached.

I haven't read the dump, so hopefully it's complete.

[exe123]

Would be great, thanks.
BDM dump attached.

I haven't read the dump, so hopefully it's complete.

Yes, everything is inside. Will send you the data later.

[d2mike]

Yes, everything is inside. Will send you the data later.

Thank you so much. You are the BEST! :-)

[pocinas]

Hi There. I have problem as well with this ecu model.

Some person flash map via obd using MPPS v16 and on flash proces was freezing,after wait few minutes dissconnected interface. Ecu off course now is stopped communicate with any interface via obd.

Customer give me ecu to rebuild flash on ecu.
I found on forum BDM read/backup matching flash version, and i wroted on banch only flash.
After this i connected Break cable to pins ecu, then i read ID on Kess, read map, i read on banch using MPPS v18 (dont like use on day but i have it) and all without any issue, all looks like ecu back to life.

Than i back ecu customer and he call me later on, engine cant start, (nothing flash/blink on dash about immo).


Any idea what can be heappends, what the issue is, and how sort out problem..
I presume data on Eeprom is corupted, or must be something like sum control between flash = eeprom

Any helps

[morgano]

Hi There. I have problem as well with this ecu model.

Some person flash map via obd using MPPS v16 and on flash proces was freezing,after wait few minutes dissconnected interface. Ecu off course now is stopped communicate with any interface via obd.

Customer give me ecu to rebuild flash on ecu.
I found on forum BDM read/backup matching flash version, and i wroted on banch only flash.
After this i connected Break cable to pins ecu, then i read ID on Kess, read map, i read on banch using MPPS v18 (dont like use on day but i have it) and all without any issue, all looks like ecu back to life.

Than i back ecu customer and he call me later on, engine cant start, (nothing flash/blink on dash about immo).


Any idea what can be heappends, what the issue is, and how sort out problem..
I presume data on Eeprom is corupted, or must be something like sum control between flash = eeprom

Any helps

Your problem is that you cannot crossflash one ecu with other ecu flash.

If you can put your hands in the original reading before they tried to flash a mod to the ecu you can be saved.

[pocinas]

The problem is we dont have any Oryginal backup. Only read is ktag with stage 2 map which is data corrupted, because some amator before try flash dont know what via MPPS v16, so who knows maybe some eeprom as well is broken.
Customer buy car some time ago with stage 2 and now he want popn bang and something else, but amator before not have luck and dont know how recover ecu to life.

And for my knowlage previous guy (amator) the lost any backup what he made, so we dont have nothing above my read via ktag

So first i tried recover ecu to base (stock/genuine map) then we will process update to stage 2.



But from time my post to this time now is more info.

We finally back car to stock, engine is running on stock map but when we made any mod and flash ecu, they car after this doesnt want run, and any diagnostic tool saying checksum error in eeprom i think was.
Me personaly and my guy from Tune file was mega Sourprise for this fact, so we thinking someone else do Patch on eeprom. So now we are try collect some more info for this issue