edc17 any immo, experts here ?

[ecutuners]

I bought a immo off for edc17cp14 vag, it works perfectly, i send to the company flash and eeprom and they send me back just eeprom mod, they say they need the flash file to decrypt the immo, can anybody reverse this or find out how to decrypt another ecu same, files attached

[rm23]

Hi, how much did you pay? and who did it?

[elchip]

One of point is eeprom have check sum 100%

[javilette]

can you put orinal too

[k0mpresd]

so i removed tprot from your original flash file and wrote the flash and e2p OFF file to my spare edc17cp14 ecu.
ecu boots but does not boot correctly. communicates with canbus OK but vcds says dtcs not supported or a comm error occurred.
magic told me once the immo OFF is done the file can no longer be edited. must be true since only edit i made was the tprot patch to bypass otp.

[ecutuners]

You cant write the full flash file because of otp area , i already tried putting the immo off eeprom to an other edc17cp14 but car will not start there is dtc engine start blocked by immobilizer and key not recognised,they told me they decrypt eeprom with the data from otp area in flash

[jolidj]

solve this problem is a great thing ....

[maglaras]

flash and eeprom in this ecu as med 17 must make the flash and eeprom
if you make only eeprom the immo off did not work
i now that when you make this ecu immo off you have chek sum eeror
but you can close the dtc on ecu and you dont have problem

[gttuning]

Hi guys i have a virgin file for edc 17uo1.might help some one some day. never coded to car straight from the shelf. EDC17UO1 ECU NO.045 906 013AM BOSCH 0 281 016 733 MICRO SAK-TC1766

[maglaras]

this is virgine file for edc 17???????????????

[Meat-Head]

but car will not start there is dtc engine start blocked by immobilizer and key not recognised,they told me they decrypt eeprom with the data from otp area in flash

ON TOPIC:-

so your spare ecu can you copy what you can of the flash?

so if in OTP how did they get round it!

the working one is there any DTC in it is the engine light on?

[gttuning]

EDC17UO1 ECU NO.045 906 013AM BOSCH 0 281 016 733 MICRO SAK-TC1766 seat ibiza 1.4tdi 2010

[ecutuners]

ON TOPIC:-

so your spare ecu can you copy what you can of the flash?

so if in OTP how did they get round it!

the working one is there any DTC in it is the engine light on?

Hi mate yes i copied all data from flash that could be wrote, it makes no difference it still does not start, in the OTP area of flash there is immo data linked to the eeprom this is why the company needed the flash file to make the immo off, on the working ecu there 1 was dtc for Key not correctly coded and immo light flashes in the dash, i can remove the dtc for it no problem

[maglaras]

OTP you can not rite it
One
Time
Progrming
That is mine otp for thous that did not now this
the immo is only for the ecu that you make you can not but it in onother ecu because did not show the corect flash

[ecutuners]

EDC17UO1 ECU NO.045 906 013AM BOSCH 0 281 016 733 MICRO SAK-TC1766 seat ibiza 1.4tdi 2010

Thanks for the virgin files, did you read the ecu again after it was coded to the car ?

[gttuning]

yes will post in a min.

[gttuning]

this is the ecu coded to the car edc17uo1. seat 1.4tdi 2010

[Meat-Head]

*CONFUSED*

ON TOPIC:-

So you sent an ecu to an undisclosed company who managed to knobble the immo in the eeprom AND the OTP part of the flash.

you have copied what you can to a spare ecu and no start.

1) Processer memory?
2) Did they fit a new chip to it?
3) Can a second hand ecu be fitted to the 'orginal' car?

[ecutuners]

*CONFUSED*

ON TOPIC:-

So you sent an ecu to an undisclosed company who managed to knobble the immo in the eeprom AND the OTP part of the flash.

you have copied what you can to a spare ecu and no start.

1) Processer memory?
2) Did they fit a new chip to it?
3) Can a second hand ecu be fitted to the 'orginal' car?

no mate i only sent the ori flash and eeprom files to the company, they send back immo off eeprom file and car started and work 100% but key light flashes which is no problem

[jolidj]

if writte your beckup to another ecu the car dont start???

[Meat-Head]

no mate i only sent the ori flash and eeprom files to the company, they send back immo off eeprom file and car started and work 100% but key light flashes which is no problem

*PART CONFUSED*

so they used the flash data to figure out what to edit the eeprom to.

coping to a spare eeprom is a no go - hence this thread.

sorry not my mo - numbers - it is 'worth' - cost wise sending your spare ecufiles to them, see if somebody with a brain.exe like paul12345, smokey08 or premierd can work out something?

[ecutuners]

if writte your beckup to another ecu the car dont start???

No does not start it work only on that 1 ecu, this is what im asking help for to try unlock it or find out how its done

[ecutuners]

*PART CONFUSED*

so they used the flash data to figure out what to edit the eeprom to.

coping to a spare eeprom is a no go - hence this thread.

sorry not my mo - numbers - it is 'worth' - cost wise sending your spare ecufiles to them, see if somebody with a brain.exe like paul12345, smokey08 or premierd can work out something?

all files are in the first post, anybosy can share solution or work it out ill buy solution no problem

[Meat-Head]

No does not start it work only on that 1 ecu,

all files are in the first post, anybosy can share solution or work it out ill buy solution no problem

ON TOPIC:-

the processer has to be linked to the flash and eeprom - otherwise the other guys car would have started!

OK - sorry might be not pheasable

wait a month then call the company and ask if they can immo off one that has been remapped, just as easily/same price

to eliminate or include the map area?

no i'm going to jibber jabber else where see you later

[jolidj]

if you take your immo off ecu and this ecu you send to another same car are you sure that this car dont start??

[kevfield]

Where did you buy it from pal???

[gttuning]

its not gona be easy:banghead:

[H.Wessel]

if you take your immo off ecu and this ecu you send to another same car are you sure that this car dont start??

it doesn?t work cause part of the flash of this ecu is OTP, so you can not clone a edc17 to another ecu 1:1

[ecutuners]

ON TOPIC:-

the processer has to be linked to the flash and eeprom - otherwise the other guys car would have started!

OK - sorry might be not pheasable

wait a month then call the company and ask if they can immo off one that has been remapped, just as easily/same price

to eliminate or include the map area?

no i'm going to jibber jabber else where see you later

The map area is not needed I have remapped this ecu after immo off and all works fine, its the OTP area where the immo data is stored, we need a immo expert on this

[milkatrek]

Maybe checksum is in otp area thats why we cant clone? ;)

[ankara06]

You cant write the full flash file because of otp area , i already tried putting the immo off eeprom to an other edc17cp14 but car will not start there is dtc engine start blocked by immobilizer and key not recognised,they told me they decrypt eeprom with the data from otp area in flash


please send to me your second ecu dumps ..and your try files...(if you dont try write 1:1 your off eep)...btw : ecu labels is same ?

[ecutuners]

Checksum is no problem for this ecu if it was in OTP area we would not be able to remap it and dealer would not be able to update ;)

[MACKIE]

You cant write the full flash file because of otp area , i already tried putting the immo off eeprom to an other edc17cp14 but car will not start there is dtc engine start blocked by immobilizer and key not recognised,they told me they decrypt eeprom with the data from otp area in flash

Did you try to write only modified area to original eeprom content of another ECU?

Regards
Mackie

[Meat-Head]

we need a immo expert on this


LUPU get your arse in here NOW, thanks.

ON TOPIC:-

how much hassle is it for ANYmember to put a new chip on board and clone the entire flash and the OTP bit?

[ankara06]

yes ...did you try this ?


Did you try to write only modified area to original eeprom content of another ECU?

Regards
Mackie

[ankara06]

yes ...did you try this ?


Did you try to write only modified area to original eeprom content of another ECU?

Regards
Mackie

[ecutuners]

Yes I put the mod bytes into ori eeprom but still not work

[bearheroes]

did you put this ecu to another car to check that it is indeed immo off?

[k0mpresd]

here is an med17.5 flash + e2p + e2p OFF file. maybe it can help.

[ankara06]

Yes I put the mod bytes into ori eeprom but still not work

ecu labels hw and sw is same or different ?

[ecutuners]

ecu labels hw and sw is same or different ?

Yes ecu is exact same only diffenences are in otp area of flash,
Thanks to k0mpressed for his example also, the more examples we see the more chance we have of cracking this

[k0mpresd]

i really need solution for these as well. 225eu each is too much $$$$.

[Artilect]

What is the price for file service now (EDC17 immo off). Where is the best place to buy this service.

BR

[banabana]

here is another an med17.5.5 flash + e2p + e2p OFF file. maybe it can help

[explode82]

and very complicated thing to what I'm understanding reading this topic

[tomtom0785]

hi guys,...

So thanks for sharing this, first.
Here are a few thoughts of mine after looking all those files you posted,....
problem is that the files are from 3 different ECU Types. But the changes seem to be quite similar,...

Also figured out already where the checksum of EEPROM stands (on which adresses) problem is now to calculate it correctly.

I don't think you need to have the flash for it - i think it's more a problem of incorrect checksum when write modified Bytes into different car, because of different VIN - which also belongs to the data block for the checksum.

I would give it a try to take the full 3 Blocks including the VIN from Immo off File and have a look what happen in another car ( if VIN Mismatch in ECU and Instrument causes trouble even if immo is disabled)

maybe someone of the old immo guru's can teach us how to calculate checksum correctly,....

[banabana]

I believe that the Modified only in eeprom

[chriskross]

yes they need eeprom and OTP area, then you can modify CS and PIN.

but i am sure the guys who really has the solution will never write it here for free ;)

[kire106ka]

I read somewhere there is no physical OTP sectors on the flash and register keep lock that area so there is a way to owerwhrite that area someone will figure out soon
that moment will come i'am shure about it.

[Meat-Head]

I don't think you need to have the flash for it - i think it's more a problem of incorrect checksum when write modified Bytes into different car, because of different VIN - which also belongs to the data block for the checksum.

I would give it a try to take the full 3 Blocks including the VIN from Immo off File and have a look what happen in another car ( if VIN Mismatch in ECU and Instrument causes trouble even if immo is disabled)

.


*CONFUSED*

ON TOPIC:-

so if we LEECHED these files - flash and eeprom and removed the immo unit (clocks) and uploaded to an identical ecu would the engine start?

Those who have immo off units does the engine light go out or stay on?

[robelago]

Hi, I just immo get a 206 with an ecu code me7.4.4
Bosch 0261 207 664, I start to wonder, but air conditioning is not working, someone will dump to work from already thank you very much

[tomtom0785]

hmm -maybe it's true, but an other thing which is true that some specialistst already provide OTP recovery Service for this ECU's.
And I am not sure if the Flash is necessary - or it's only a trick to keep people believing that it is such hard work,.... :-)

I looked a lot of damos files, but wasn't able to find something about relation of checksum from Flash to EEPROM - wo we will find out.

i gave some files for comparing to an IT Specialist - maybe he can figure out a correct CRC calculation for EEPROM then we will see what is true,.....

[TECH]

I have one MED 17.5.2 with immo off , no immo light!
It is very easy to be true that the solution is only at the eeprom. I have compare the eeprom before and after , they have change too many things!

[jolidj]

you dont like to post the solution??

[banabana]

I have one MED 17.5.2 with immo off , no immo light!
It is very easy to be true that the solution is only at the eeprom. I have compare the eeprom before and after , they have change too many things!
Maybe Share information that you have.Help in finding a solution

[TECH]

I said that I don't think that the solution is only at the eeprom!!!
I have no solution, I have a MED 9.5.2 with immo off , I have pay for this(can sare if it is helpful) . They asked for me flash and eeprom and they change only the eeprom. First time I post them only eeprom but they told me they can don anything without the flash!

[banabana]

I said that I don't think that the solution is only at the eeprom!!!
I have no solution, I have a MED 9.5.2 with immo off , I have pay for this(can sare if it is helpful) . They asked for me flash and eeprom and they change only the eeprom. First time I post them only eeprom but they told me they can don anything without the flash!
This also happened with me (I expect to be the only solution in eeprom)
If possible Share the possibility that helps (Before and after eeprom)

[Meat-Head]

ON TOPIC:-

Sorry i'm to stupid to go any further with this, but perhaps somebody with a brain could look at this, see if these programmes just edit the dump or use some kind of calucation - look at the bottom edc15 and ec16 immo off

if somebody can take apart the file see if there any user names we can stalk in there?



(http://www.abritus72.com/download.html)www.Abritus72.com (http://www.abritus72.com/download.html)
(http://www.abritus72.com/download.html)

[mit]

here is an med17.5 flash + e2p + e2p OFF file. maybe it can help.

Are you sure u named the right file immo off ?

[tomtom0785]

ON TOPIC:-

Sorry i'm to stupid to go any further with this, but perhaps somebody with a brain could look at this, see if these programmes just edit the dump or use some kind of calucation - look at the bottom edc15 and ec16 immo off

if somebody can take apart the file see if there any user names we can stalk in there?



(http://www.abritus72.com/download.html)
www.Abritus72.com (http://www.abritus72.com/download.html)
(http://www.abritus72.com/download.html)


yes the EDC15 and EDC16 Tool works - but they don't have a solution for EDC17 but working on it,.....

[Meat-Head]

yes the EDC15 and EDC16 Tool works - but they don't have a solution for EDC17 but working on it,.....

What i mean is does that toool just edit line ??
Or does it calculate somehow

Somebody disassemble hex ws idea

[tomtom0785]

it does edit line and calculates checksums - also for ME7.x and ME9.x but ME ECU's avaliable for customers with interface,.....

[banabana]

If possible, some post files in this subject possible to find a solution for MED17.5.x

[tomtom0785]

yes i agree - different files for comparing maybe take us closer to the solution,.... i wish i could offer some,...

[Meat-Head]

it does edit line and calculates checksums - also for ME7.x and ME9.x but ME ECU's avaliable for customers with interface,.....


OK, sorry i'm too dumb to assist, can somebody leech the before and after files in this thread and compare, are they a million miles out, or close to it?

just to see if they is a way to figure it out?

[banabana]

I modified this file, as amended in the first file.(First file is shared in this subject and I bought immo off for this file )
Engine work but when pressed on the gas pedal is not working. Only the engine runs

[firestator]

I modified this file, as amended in the first file.(First file is shared in this subject and I bought immo off for this file )
Engine work but when pressed on the gas pedal is not working. Only the engine runs
you tell the truth? ... engine with this file will not work!:proud:

[tomtom0785]

Think it will be similar problem like immo off for mb actros - with most of the files engine is running but accpedal is dead,.....

So i think i have figured out some parts for it - but my main problem is checksumcalculation, so that we can try - but is already in progress;-)

Would be great to get some more files,.....

[wahye]

I bought a immo off for edc17cp14 vag, it works perfectly, i send to the company flash and eeprom and they send me back just eeprom mod, they say they need the flash file to decrypt the immo, can anybody reverse this or find out how to decrypt another ecu same, files attached
can someone tell me where i can found this service for edc17 immo off ?
what is the price ?

Regards

[cp2010]

MEDC17 Immo off (http://www.vagdashcom.com/html/Service/MEDC17-Immo-off/medc17-immo-off.html)

[Meat-Head]

Did see another company but not got to hand

[firestator]

MEDC17 Immo off (http://www.vagdashcom.com/html/Service/MEDC17-Immo-off/medc17-immo-off.html)

this is a very expensive solution IMMO off! I have a solution but not for free :-) PM

[Meat-Head]

I have a solution but not for free :-) PM


EXCUSE ME, BUT THIS IS DIGITAL-KAOS THE WORLDS BEST SHARING WEBSITE, WHERE A MEMBER HAS A PROBLEM WITH ANYTHING, CAR, TV, GENERAL, YOU POST ON HERE AND SOMEBODY GIVES THE ANSWER FOR FREE, NOT 'FLASH THE CASH' PAL

[firestator]

EXCUSE ME, BUT THIS IS DIGITAL-KAOS THE WORLDS BEST SHARING WEBSITE, WHERE A MEMBER HAS A PROBLEM WITH ANYTHING, CAR, TV, GENERAL, YOU POST ON HERE AND SOMEBODY GIVES THE ANSWER FOR FREE, NOT 'FLASH THE CASH' PAL

dpfoff.ru/?p=713 here is the solution of this issue for the user DK

[jolidj]

i dont understand the connection between flash and eeprom.
is possible only the chk???
connection from flash chk and eeprom chk...??

[sepistar]

i dont understand the connection between flash and eeprom.
is possible only the chk???
connection from flash chk and eeprom chk...??

believe too that flash are need only for chks.calculate.
regards

[jolidj]

ok. how to calculate chk in to the eerpom??

[banabana]

I believe that only knowing version of ecu......
like H11 H09

[firestator]

simple! Removal of immobilized ECU should send eeprome and flash ECU and foto labels ECU...

[jolidj]

the problem is to understad how to make immo off for all edc17 ore med17.
the problem is to detect the chk zone in to the flash and aplicate to the eeprom.

[firestator]

the problem is to understad how to make immo off for all edc17 ore med17.
the problem is to detect the chk zone in to the flash and aplicate to the eeprom.

no problem! you send flash and eprom from ECU give you a complete solution IMMO off...;-)

[jolidj]

ok. i post flash and eeprom here.

the discussion is for understand how to make immo off for vag group. you help to understand this??

[firestator]

DPFOFF.RU (http://dpfoff.ru)

all just use the service, and then analyze ;-)

[jolidj]

may be you dont undestad me.

[firestator]

may be you dont undestad me. ???????? ???? ?? EDC17 ? MED17 VAG ?????? | DPFOFF.RU (http://dpfoff.ru/?p=713)
Removing immobilized on EDC17 and MED17 VAG Group February 28th, 2013 YAS-TUNING For those who flunked unit EDC17 and MED17 VAG group - Assist to remove immobilized with the donor block. Price - 250$ Checksums EEPROM EDC17/MED17 - 50$

you do not understand it :-) this service removes immo edc17 and med17

or have any other purpose?

[Meat-Head]

DPFOFF.RU (http://dpfoff.ru)

all just use the service, and then analyze ;-)


ERR hang on pal, you still trying to sell us something.

I didn't say this if Admin or a Mod asks, but yes, would 'except' the $50 on solution, how to calculate the checksum, but not my scence

[Artjom]

yeah, this guy not only try to sell in the treads ..
he starts to write pm to users that need help and offer his service of immo off.. for 150 ?
BUT only if you make payment FIRST then he will give you file...

:dontknow:

If someone can help with immo off solution.. dont need to be for free .. i would appriciate

[bubu55]

I need immo off edc17cp14

Anyone have a solution?
Even in payment pm :ciao:

[Artjom]

after searching for one week for someone relieble I found immo off silution for edc17 if someone need help like i did ..

this company helped me.. http://dpfoff.ru/?page_id=304

paid 250$ but works perfekt

they have someone in germany, was i bit afraid to send money to russia

[Meat-Head]

intresting this guy looking at his history seems really usehull helpfull member - ask him to leech these working files and have a squint?

http://www.digital-kaos.co.uk/forums/f178/immo-off-2-0-tfsi-med9-1-a-325472/#post1906470

Who wants to pin him down whilst i skank his software? any one in?

[pablo1971]

yes ive used them in the past,and can say there 100% spot on...fast response-reliable and honest:congrats:

[ominimicu]

cant we swap MCU eeprom and flash??

[fruti]

If anyone need help with EDC-MED17 immo off .. pm me ...

[yugo45]

Why none does not share solution for EDC17 immo off.
I know there is few people here on DK did learn about this , but no one like to share solution.

[soxten]

cant we swap MCU eeprom and flash??

A simpel way is to desolder mcu and move to a used one.
Bga reballing
I am new to bga reballing but have done 2 ecu this week, 60 min work/ecu for me as a new guy to reballing.

I have now order some new mcu to fitt on used ecu and then only read info from broken and write to used ecu with new mcu.

A simple way

[fruti]

Nice one Soxten ... i do alot of them. But be carefull ... use profi soldering paste or better soldering balls must be from good material ... not all balls are same .... I have truble costumers bringing ecu's back coz they didnt start after BGA and i figure out why. If i use low-cost soldier balls they crack after 1-2-3 weeks .... but then i find a good material .... they are expencive but never had problems again. Check on the ebay about prices !

This things i teach on my own skin ... don't wanna you to have same problems :)

Regards

[soxten]

Please pm me info about what you use. (Sort,company)
:)

[mexanico1971]

Nice one Soxten ... i do alot of them. But be carefull ... use profi soldering paste or better soldering balls must be from good material ... not all balls are same .... I have truble costumers bringing ecu's back coz they didnt start after BGA and i figure out why. If i use low-cost soldier balls they crack after 1-2-3 weeks .... but then i find a good material .... they are expencive but never had problems again. Check on the ebay about prices !

This things i teach on my own skin ... don't wanna you to have same problems :)

Regards


can you point good seller for solder balls !


nice weekend people !
AC/DC-Big Balls Music Video - YouTube (http://www.youtube.com/watch?v=gJ3tqIukBKg)

[Am1n-0s]

some people work hard to get edc17 immo off to share it for free :( do you accept this for yourself?

[darwins]

Hi Guys

Missed this post :)

With the long winter nights here now I want to study as many ORIGINAL / IMMO OFF FILES as I can get my hands on because this has to be a solution which can be done...

I want to study..

1: OTP data -V- Eeprom data -V- Check Sums

Any input.... knowledge.... files please this has to be possible

firestator did once offer me an immo off via PM but I was not happy just sending money to the unknown :)

[Am1n-0s]

@darwins

Easy work if you know little about that, i advice you to download IDA PRO and using Infineon Tricore architecture plugin.

then you can check in asm code where is immo data then you patch it. :)

Good luck !

[soxten]

I think we can wait a loong time before we see Immo off solutions for free!
First price has to fall, 250 to 200 to 150 to 100 to 50 to 25 to 10 to free!

I think 1-2y before we are there.

[soxten]

I have order miniwiggler usb so I can connect and read tricore mcu from pcb.
Do you say(?) it is easy/er to understand a immo off function then?

[Am1n-0s]

It's easier if you know well about assembler :)

[912secured]

The group that sells the 37 immo/seat solution has the edc17 in the works but the main micro remembers off, you only get one use. Next update or 2.

[darwins]

I pulled a few reads made from some EDC17CP14 matched like for like part numbers.

Attached are the only changed zones from the OTP Flash..

Now if the flash is really required to get an immo of solution it's the data in these areas that is used to modify the eeprom.

Image attached is from the Flash in the first post in this thread.

[Am1n-0s]

How to know the immo area if you use only hex editor, nobody know that,

run a dessasembler then read instructions ...

[darwins]

I have many EDC17 & MED files I have read and I'm seeing this pattern across the board..
The OTP is readable and will always read the same So why would other tools be needed when the area is not being changed :)

The fact we have some immo off and original files now it is down to maths :)

[Am1n-0s]

i given you a real good explanation in my previous post !

[darwins]

I'm starting to think the OPT Flash is a red heron in all this :)

Enough for today will come back to this with a fresh head soon I hope....

[Meat-Head]

some people work hard to get edc17 immo off to share it for free :( do you accept this for yourself?

What goes around, comes around. You help others, they help you. Those that don't share just leech, when they ask for help, you just ignore their threads.

Can't give example off hand, but there has been times where have been working on a car and it has took HOURS to find the problem, somebody comes along with that car that fault they ask i'm happy to tell.

BUT like the other week, a THANKLESS LEECHER posted about a problem i said look elsewhere, could have told the guy within reason there and then the problem was and saved him hours of stripping a car down, he reported back several days later found the fault, EXCATLY what i thought, had he had a few more posts and thanks, would have pointed him in the right direction.



firestator did once offer me an immo off via PM but I was not happy just sending money to the unknown :)



NO MATE, DK is a SHARING site, yes fair enough, money to cover shipping costs/parts and a crate of beer fine, anything past that stamp as hard as you can on the report button.

I've had DK members fix stuff for M-H-M only ever paid postage and beer money, then follewed that member round, thanking them.

[mcgustoo]

I have solution with flash modification but im not sure if works?

[ankara06]

after flash off,then cars loss power,best from eeprom area..btw: sometypes need both eep+flash

[macxlulu666]

am test in golf vi med 17 -car no lost power !!!!!!!

[mcgustoo]

Yes not lose power someone need earn cash now:)

[912secured]

I think just blocks obd2 writes to certain areas, Use to jump out of soft to area not used to do things say on boot up you wanted certain bytes changed every time the main sub routine ran and rewrite every time, just in case some thing changed it. Like activation byte in smart card turned off, it just put back on. Will figure out something might need a pic to rewrite or emulate eeprom write/read to make it simple just need bytes that need changed. Wish there was more time in the day. Can not code after 36 hours of work.

[ankara06]

well time for publish secrets , ida pro + disassembler methods ;)

[Am1n-0s]

@emin

i told them that in previous post !!!

some people think that finding adress to desable immo by wizard.

IDA PRO + A GOOD BRAIN must find the patch !

[ankara06]

@yes bro I know all,,you are right

[umoussa]

@yes bro I know all,,you are right


Check your PM Brother

[mcgustoo]

Ida ? Someone have plugin for tricore?

[H.Wessel]

Ida ? Someone have plugin for tricore?

you don't need any plugin, IDA support tricore MCUs

[mcgustoo]

yes i put flash file and same bulshit....

[912secured]

Can make a key to 80 percent, immo off and amount right now that need done in the us. IDA and my brain just do not have the car sitting around and time. Before paying 250 to 400 for immo off buy a clone smelcom ali 500 and make a key untill free unless your a theif and just plug into obd2 and drive off. Log the eeprom if you can and see what bytes the micro checks on power up. The one company that sells immo off boxes with 36 or so immo off,emulations is said to be adding soon. But edc17 is a seperate box not added in so I guess it uses up some code space in their box.How ever it gets done for the masses with out shipping out. I do know the edc15/16 off got me out of trouble once or twice done a job and the ring was bad, cars dealers could not get to take a key. I was just getting at hacking the flash of some cars to mod the eeprom for you on every power up in case something goes wrong.

[912secured]

Tprot has to be cracked then ecu can be cracked. A guy online (smart has you work the ecu) then does the mods via can high low to ecu via newest vcds on desk, not via obd2 port. Saves from bad flash because something wanted to talk on other units. Says not as many checksumms as Saab's ecu's but a pain (i asked how he would pair it up to saab). This ecu is going to be around so got to get to know it.

[Meat-Head]

not via obd2 port. Saves from bad flash because something wanted to talk on other units. .


Yeah thankssssssssss have you managed to leech the solution for reuseable immo off yet?

[huzzen27]

Yeah thankssssssssss have you managed to leech the solution for reuseable immo off yet?
Here is mate

i have purchased this file from one ecu tuner from italy started4 cars with this file works perfectly,regards-Huzefa

edc17c46 ecu

[totalfree]

File from: http://www.digital-kaos.co.uk/forums/showthread.php/315283-edc17-any-immo-experts-here?p=1868585&viewfull=1#post1868585

hex editor - view line width change to 128 bytes

org
http://www.digital-kaos.co.uk/forums/attachment.php?attachmentid=301079&stc=1

mod
http://www.digital-kaos.co.uk/forums/attachment.php?attachmentid=301078&stc=1

block
http://www.digital-kaos.co.uk/forums/attachment.php?attachmentid=301080&stc=1

program
http://www.digital-kaos.co.uk/forums/attachment.php?attachmentid=301081&stc=1

First calculate crc32 after crc16
how to calculate the checksum do not know.

[chli1976]

Here is mate

i have purchased this file from one ecu tuner from italy started4 cars with this file works perfectly,regards-Huzefa

edc17c46 ecu

Can you upload ori ?
Thanks

[SERBAN 70]

I very much doubt that this calculator work correctly with EDC17C46

[totalfree]

All eeprom divided to blocks with 0x80 size offsets:
0x00 - block id (half word)
0x02 - CS1 (half word)
0x04 - block revision
0x08 - data
0x7C - CS2 (word)

Half word - 16 bit
Word - 32 bit

And list Block id from EDC17 eeprom:
1,8,9,A,B,C,1A,1B,
1C,1D,1E,1F,2A,2B,2C,2D,
2E,2F,3A,3B,3C,3D,3D,3E,
3F,17,18,19,20,21,22,23,
24,25,26,27,28,29,30,31,
32,33,34,35,36,37,38,39,
40,41,42,43,44,45,46,47,
48,49,CC00

Algorithm for CS1:
data from - 0x04
lenght - 0x7C
CS calculated with Tricore internal CRC32 and low half word - CS1
Inicial value - block id


unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
const unsigned long poly = 0xEDB88320;
unsigned long tmp1, tmp2;

while(sz--)
{
tmp1 = 0;
tmp2 = crc & poly;
for(int i = 0; i <=31; i++ )
tmp1 ^= ((tmp2 >> i) & 1);
crc = *p++ ^ ((crc << 1) | tmp1) ;
}
return crc;
}

[H2Deetoo]

How was this checksum calculation obtained? Disasm of EDC firmware?

[argegsm]

need immo off edc17cp14 anyone expert help me

[carsinlet]

Hi can someone help please, 0281 016 952 . 03l906018 ct. edc17c46. OCTAVIA opened orig ecu and damaged main tricore chip got second hand ecu with same part and id numbers, i can start car with immo off program but dash shows immb active, can someone please change chassis number and immo off for me. the chassis number should be TMBAE61ZXB2028370. it has DSG gearbox. read wit fg and kess thank you.

[zvevanjanja]

i am looking for virgin file for edc17 tricore bosch mercedes sprinter 519 manual transmission ,642 engine


contact me on zvevanjanja@yahoo.com or in private message

[g0tcha]

All eeprom divided to blocks with 0x80 size offsets:
0x00 - block id (half word)
0x02 - CS1 (half word)
0x04 - block revision
0x08 - data
0x7C - CS2 (word)

Half word - 16 bit
Word - 32 bit

And list Block id from EDC17 eeprom:
1,8,9,A,B,C,1A,1B,
1C,1D,1E,1F,2A,2B,2C,2D,
2E,2F,3A,3B,3C,3D,3D,3E,
3F,17,18,19,20,21,22,23,
24,25,26,27,28,29,30,31,
32,33,34,35,36,37,38,39,
40,41,42,43,44,45,46,47,
48,49,CC00

Algorithm for CS1:
data from - 0x04
lenght - 0x7C
CS calculated with Tricore internal CRC32 and low half word - CS1
Inicial value - block id


unsigned long crc_buffer(unsigned long crc, const unsigned long *p, unsigned long sz)
{
const unsigned long poly = 0xEDB88320;
unsigned long tmp1, tmp2;

while(sz--)
{
tmp1 = 0;
tmp2 = crc & poly;
for(int i = 0; i <=31; i++ )
tmp1 ^= ((tmp2 >> i) & 1);
crc = *p++ ^ ((crc << 1) | tmp1) ;
}
return crc;
}

Hi

i have completely solved the med17 edc17 eeprom decryption algorithm and checksumms if interested.

[acab]

Med17.3.1 from fiat/Alfa/Lancia can anybody virgin mode or immo off?

[poxxxy]

Hi

i have completely solved the med17 edc17 eeprom decryption algorithm and checksumms if interested.
I am interested, been struggling with it this evening and just stumbled across this. :).

[absetup]

Hi

i have completely solved the med17 edc17 eeprom decryption algorithm and checksumms if interested.

I need it pls if you can help
code or algo

[vwphun]

CRC is clear, but what about eeprom data encrypt? Is crypted with data from flash OTP Sector?
Any hint?

[navatar]

Hi

i have completely solved the med17 edc17 eeprom decryption algorithm and checksumms if interested.

Have PM'd you. Would love to know the decryption algo.

[lgmchaveiro]

Hi

i have completely solved the med17 edc17 eeprom decryption algorithm and checksumms if interested.

hello would you like information. could you help. any value?
my email

[lgmchaveiro]

good night boys
this something i'm looking for decryt, for crc i've already managed to create, i know it's an old stuff but if gotcha can answer in pv i'll be grateful even if it's a yes or no hehehehee

[deutsch1988]

UP theme !!!
you know CS2 array?