ews 2 need to read safely

[ninja123]

I have a strange bmw, not sure of year, I struggled to make mechanical key, and now i find ews 2, i was expecting ews 3 :(

I have remove mcu hc11 from ews 2, but how to read? I look through my xprog adaptors but none for this mcu - none on ebay - where to buy this socket or can i read in circuit without erasing data?

thanks for any info, ninja

[FXless]

you must use hc11ea9 adapter

[ninja123]

where to buy in uk??

Can this be read in circuit safely?

ninja

[dmp]

It can only be read in-circuit if you cut the track for pin 20 to read the MCU then reattach (or completely remove the mcu and read it that way).

http://www.auobd2.com/upload/service/bmw-key-programmer-user-manual.pdf

Here is an instruction manual for one of the programmers, shows the pin. Make sure the track is cut (check resistance) because you could wipe the mcu if not properly cut

[mexanico1971]

Hi !
can you post a pic of the ews ?!
thank"s in advance

BR

[ninja123]

its ews 2, mcu mask is 2D47J - if i put mcu back to ews, can I read? anyone have a connection diagram for x prog m?

ninja

[mexanico1971]

it look"s like one mc68ch11EA9 !
I think xprog can do this in the adapter 1-002-0011 plcc52 !
or in K-line width Xprog it"s possible !
or UPA in circuit !

good luck

[lunchb0x]

AK90 will read it without deslodering chip.

[key]

remember, this mcu secured !

its ews 2, mcu mask is 2D47J - if i put mcu back to ews, can I read? anyone have a connection diagram for x prog m?

ninja

[ninja123]

i have tried to read out of circuit, but wont read, read in circuit, but just reads all FF, and the odd bit of data, but changes everytime I try to read.

Where to buy x prog adapter for this mcu, its not in the set that comes with it.

I really need to get this data to finnish job.

How to read this ews via k line? any pictures or info?

Thanks, ninja

[ninja123]

is there emulator or immo off for this system, getting nowhere fast with this old ews :(

ninja

[labusas]

buy from Darius, xprog original creator at eldb.eu
There's a chance to erase by reading in circuit, this MCU is locked and very sensitive.
I use hc11ea9 adapter out of circuit.

[MarkPRP]

Ninja,

If mcu reads FF then data has already gone in most cases!

Hc11 adapter for 2d46j 2d47j

[ninja123]

then ive no idea where data has gone, as i didnt try to read in circuit first - bloody nightmare!!

ninja

[gtmech]

that looks like EWS 1 Ninja, its not strange at all, alot of the really early e36 BMW's 95 era have that, you must remove from circuit, reading in circuit will erase for sure. Did you set oscillator to 5529600mhz which may be needed if your using the clone XProg? Anyway unfortunately as MarkPRP has said above, it looks like its to late if everything is FFFFF. Heres another dump though if you want it

[gtmech]

that looks like EWS 1 Ninja, its not strange at all, alot of the really early e36 BMW's 95 era have that, you must remove from circuit, reading in circuit will erase for sure. Did you set oscillator to 5529600mhz which may be needed if your using the clone XProg? Anyway unfortunately as MarkPRP has said above, it looks like its to late if everything is FFFFF. Heres another dump though if you want it

ignore that please, I thought it said 1D47J on MCU, sorry I didnt read it correctly, its not EWS 1 at all, my bad

[aassfour]

AK90 30 seconds JOB , easy and secure

[ninja123]

I dont have AK90, and how can I tel if this mcu is secured or not? I hear some 2D46J secured and others are not.

I think its time to relieve xprog of its duties and upgrade to orange 5.

ninja

[aassfour]

it is secured , Orange 5 reads it on circuit

[aassfour]

202543
use this adapter , u should have it with Xprog

[ninja123]

no hc11 adapter with xprog, only plcc52 adapter i have is hc05 :(

i tried to use hc05 adapter but soldered wires from it to a connector to xprog, still no good :(

ninja

[ninja123]

got hc11 adapter now, but only getting timeout error when trying to read - I choose hc11 mask 2d47j from menu, do I need to change oscillator settings to read this?

Thanks, ninja

[aassfour]

try to clean the pins good , and check all pins are connected to to the adapter plus you can try different option of hc11

[ninja123]

I got 2 new hc11 adapters, both keep saying timeout error, all legs on chip are clean, I even soldered wires to chip legs but still getting same result, Looks like down the immo off route next :(

ninja

[ninja123]

HELLPPPP!!!!

I have tried everything to read this hc11 (2d47j) but no good.

If I have managed to erase it, would it still read ok but all FF?

Any one have matching dump set for ecu and ews 2?

ecu is bosch DME 0 261 203 474

What options do I have with this?

thanks for all members input here, ninja

[raptureready]

sorry to hear you wiped that chip, not a good feeling , i used original orange 5 and it erased the 2d47j, then i found out even with original there is a 10% chance of erasing data, i just used the ak90 on a ews3 od46j and read inline ok, i believe if you got ews editor and a gt1 or symilar you good to go, good luck, i love my orange 5 but i heard a dedicated etl programmer for 2d47j is the bomb.

[keygargoil]

yes the ews2 with 1d47j or 2d47j are secured you cannot read it incircuit even with omega or orange 5 if you try to read without skipping security it erases x prog is ok for reading ews in line but tryb to read it in the adapter and it doesnt in most cases

[ninja123]

so, the moral of this storey is, tell all bmw owners that have ews2 to sod off, or buy ak90.

Funny thing is, after I managed to erase this sucker, I have written to it with a ews file I have, and can read it no problem now!! All because I was missing the hc11 adapter to start with (got new one now) :(

Dont know if I would be willing to try another now though.

ninja

[p1et]

631331631332

Hello,

I'm dealing with EWS2 from BMW E36, mask 2D47J. I read a lot of different opinions about this MCU... Like 50/50 chance of not wiping the data... I want to use my xprog-m 5.0 clone but the question is should I read this as standard HC11EA 2D47J or 2D47J with security? I have Omega programmer but the only PC which it was working with, broke recently so cannot use it at the moment... I want to read on adapter, as you can see MCU is desoldered already. In the past I read onboard 1D47J (as 2D47J with security) and it was fine. MCU is well cleaned and I wasn't blow hot air for a long time because I removed laquer and it went off quite nicely so the question what option should I choose, with security or no?

[p1et]

I read with Xprog as 2d47j secured 1st time no problem, programmed new chip on Tango, we'll see in car if all OK.

[jl01152]

so, the moral of this storey is, tell all bmw owners that have ews2 to sod off, or buy ak90.

Funny thing is, after I managed to erase this sucker, I have written to it with a ews file I have, and can read it no problem now!! All because I was missing the hc11 adapter to start with (got new one now) :(

Dont know if I would be willing to try another now though.

ninja


Do you still have a dump for the ews2 ?

the ews2 file you used?

[Oktawian]

Good Day

So, have this old EWS2 with mask 2D47J with part number 8375840 HW03 SW02
1996 E39


My AK90 won't read it - pin no touch - i guess its a problem with soft or hardware, pins are clean as hell, even tryed to solder cable from ak90 to mcu - still , pin no touch.
CARPROG - solder all wires, no joy either...

Tried to desolder mcu - hotair station , grilled it for 40 sec in 400C ... could not move it ?! Now whole pcb is in flux...
I have Xprog 6.12 - any idea how to solder wires to not unsolder mcu ?

In case , i've already blow off dump in the air, any one with dump from same ews2 ?


Any help will do.


Regards



EDIT


Ok, done it by soldering wires and xprog, elmos was desolder as well

Here are some pictures and pinout.



Now, we can get back to problem with the car - that was flat battery and no cranking / no start condition.

How to activate key no2 again ? Roling codes does not match. Is the solution : to make new immo chip ? or something can be done with the old key ?

[mbi]

Write this and try start car:

[Oktawian]

Found this on the web :

"For posterity. The issue was indeed just the rolling code mismatch of the key with the EWS. Simply solved by using the AK90 and setting all keys to unused (Writing back to the EWS) and then starting the car right up. This information is not readily available I think (took me a long time to find it!) and some people were also spreading misinformation (not on this forum). When you set all keys in the EWS to unused per above, it sets the rolling code for the keys to FFFF....., once you use the key (which was not changed and still has the secret code etc) again in the ignition, any rolling code in the key will work and it re-syncs! "



So :

Done it by AK90 and all keys are as "not used" now.

will check it on the car and will let you know.

by the way, thanks for help Mbi ;) ***** ***


Update:


Car starts first time with original key ! So AK90 did good job, even do it could not read mcu.




Regards Oktawian