Tricore Virgin Solution Software ?

[darwins]

Hi Guys.

I'm interested to know if there are any legit software suppliers in the market offering virgin solutions for any Tricore ecu types ?

I understand cloning is going to require swooping the processor from unit to unit, Does this mean that protected Tricore parts could not be reset to a virgin state?

Does data held in the OTP area lock down any further backward resetting ?

Lots of questions but it's the future so I'm feeling inquisitive :)

Your thoughts appreciated.

Darwins..

[gttuning]

i think its to early for this,to be figured out:(,but time is running fast:),we all know soon about edc17, like we all know every think about edc16.

[ominimicu]

OTP areas can be writtien but not by conventional tools, Magpro x17 sais it can do it.
And immo off is done in flash but need some info from the eeprom

[atomiczen]

OTP areas can be writtien but not by conventional tools, Magpro x17 sais it can do it.
And immo off is done in flash but need some info from the eeprom
magpro x17 can't write otp areas
OTP means One Time programming.....so noone and nothings can write this areas
magpro offer a immo off solution for vag edc17, and sell it like a clone 1:1 edc17, but it's not true cloning, just an immo off solution
ecuvonix also offer immo off for vag edc17

[darwins]

I guess the key it to identify what is being written to the OTP area.

[soxten]

If you read manual for tc-1796.
OTP kan be rewrite up to 4 times.
BUT OTP is protected by a 56bit code.

[smayer]

If you read manual for tc-1796.
OTP kan be rewrite up to 4 times.
BUT OTP is protected by a 56bit code.

OTP means One Time Programable, right?
If can be rewrited 4 times then it?s not OTP it?s FTP :) :rofl:

[soxten]

Read manual

[veloseeped]

Read manual

OK. Let's reading....

After a Erase User Configuration Block command, a new protection configuration
(including keywords and protection confirmation code) can be written to the pages of the
user configuration block. But note that the user configuration blocks UCB0 and UCB1
can only be modified up to 4 times during the lifetime of a TC1796 device.
UCB2 can be programmed only once.
Note: UCB2 is OneTime-Programmable (OTP). If sector write protection is installed and
confirmed in UCB2, this block can never be erased again. UCB2 can only be
erased before the confirmation of OTP write protection.
.....
The six-cycle Disable Write Protection command temporarily disables the write
protection of all protected PFLASH sectors as defined for user 0 (indicated in register
PROCON0) or user 1 (indicated in register PROCON1).
The Disable Write Protection command is not accepted for UCB2 because UCB2 is a OTP write-protected UCB.

soxten, your comments please...

[soxten]

Correct! UCB2 is OTP!
I hade wrong! :(

UCB0 and UCB1 can rewrite up to 4 times.

So we hope that someone can find a solution to hack this shit soon! :))

[soxten]

But UCB0 (user0) is master and can read and write/rewrite on all flash even after a protection from UCB1 (user1) and UCB2 (user2)

UCB2 (user2) has OPT!

So if you logg in as UCB0 (user0) and hit password you can delete and write new data on the hole flash area, or?

[soxten]

User 2 = User Configuration Block 2:
User 2 is able to install sector OTP write protection for the PFLASH sectors. OTP write-protected sectors are locked for ever, and are never re-programmable.
If read or write protection is installed and activated once, changing the read/write protection configuration parameters in the UCBs is password-protected and can only be executed if the passwords are known.
Note: If any PFLASH sector is locked for ever (OTP installed), PFLASH and DFLASH related testing investigations for Failure ****ysis Requests (FARs) are no more possible.

[ominimicu]

New functions :
(available online by MMS Helpdesk)Finaly it's possible to recode used Tricore ECUs even with OTP sectors:
ECU CLONE:
VAG EDC17 C46 TPROT8-10
VAG EDC17 CP44 TPROT8-10
VAG MED17.1 TPROT8-10
VAG MED17.1.1 TPROT8-10
VAG PORSCHE MED17.1.6 TPROT8-10
OPEL EDC17CP19 improved
Renault SID305 improved
BMW EDC17CP02 improved
BMW EDC17C06 improvedDPF-OFF:
MB EDC16C3/C33 improved
DODGE EDC16C31
KIA/HYUNDAI EDC17CP14
Opel Insignia EDC17xx
VAG EDC17U01EGR-OFF:
RENAULT EDC16C3/C33IMMO OFF
(available for motorsport purposes only)
VAG MED17.x all TPROT versions
VAG EDC17CPxx/Cx all TPROT versions
VAG MED9.1
PSA EDC16Cxx

[soxten]

What program/tool?

[masterb]

What program/tool?

MAGPro2 BASE OBD (http://www.magicmotorsport.com/magpro2baseobd.html)

[atomiczen]

New functions :
(available online by MMS Helpdesk)Finaly it's possible to recode used Tricore ECUs even with OTP sectors:
ECU CLONE:
VAG EDC17 C46 TPROT8-10
VAG EDC17 CP44 TPROT8-10
VAG MED17.1 TPROT8-10
VAG MED17.1.1 TPROT8-10
VAG PORSCHE MED17.1.6 TPROT8-10
OPEL EDC17CP19 improved
Renault SID305 improved
BMW EDC17CP02 improved
BMW EDC17C06 improvedDPF-OFF:
MB EDC16C3/C33 improved
DODGE EDC16C31
KIA/HYUNDAI EDC17CP14
Opel Insignia EDC17xx
VAG EDC17U01EGR-OFF:
RENAULT EDC16C3/C33IMMO OFF
(available for motorsport purposes only)
VAG MED17.x all TPROT versions
VAG EDC17CPxx/Cx all TPROT versions
VAG MED9.1
PSA EDC16Cxx



I repeat to everyone another time, i called Magpro warehouse, they tell me that they sell an immo off solution for a 1:1 edc17 vag clone, they write fake information on web
they cannot clone 1:1 a tprot vag edc17, they can only make an immo off. Remember!!
this is what they tell me: software cannot do this procedure stand alone, you have to make a full readout, send it to magpro, then they send to you a file to write into the new ecu......this is a 1:1 clone procedure??? i think no.....

[jnoroeste]

Hi,

About OTP areas... could be possible write in no OTP areas (empty code zones) and redirect the instructions as it were in OTP ones?

As OTP can?t be rewritten, need to write in another place, or swap new & programmed processor with used data , isn?t it?

Regards.

[soxten]

jnoroeste: I think this could be a good way to go!

may I ask, Do Fgtech/X17 Tool/K-tag read all info on TC1796 (inc. OTP area?)
IF, then it is possible to mount a new TC1796 mcu on ecu and program
OR?

[solitaire]

Abritus released new update for VAG:
* !!! HIT !!! EDC17/MED17 immobilizer bypass through boot-mode
* !!! HIT !!! By OBDII adaptation of Immo V engine control units and BCM2 modules
* !!! HIT !!! Recalibration of control unit mileage - EDC17/MED17 through boot-mode
* !!! HIT !!! Transfer PIN/CS/MAC from one EDC17/MED17 to another through boot-mode
* Fix the checksums in EDC17/MED17 flash

[jnoroeste]

jnoroeste: I think this could be a good way to go!

may I ask, Do Fgtech/X17 Tool/K-tag read all info on TC1796 (inc. OTP area?)
IF, then it is possible to mount a new TC1796 mcu on ecu and program
OR?

Even getting a full backup.. should not be possible to write in another computer due to OTP areas, so .... perhaps.... new chips and virging codes........
I think this is the challenge for all chiptunning companys, all of them are working hard.but they need time to do it in safe way.

Regards.

[ominimicu]

Ican now do Immo off on all VAg edc17 with no need of eeprom just flash....so let them sell their lies

[boomeer]

Is your solution work 100%?

Отправлено с моего GT-I9300 при помощи Tapatalk

[hollow]

Ican now do Immo off on all VAg edc17 with no need of eeprom just flash....so let them sell their lies
il keep that in mind :)

[ecutuners]

Flash solution been around long time ;) longer than eeprom solution :D

[ominimicu]

Yes works 100%, Danny i dunno how long it has been out...but i searched all web upside down..no one oferes no info unless its for money!
And i think i can also virginizze other edc17 like pSa, opel, renault! i need someone to do tests

[boomeer]

so what's the difference between eeprom and flash solution?

[ominimicu]

no idea....i never got to the eeprom solution. maybe there s some info in eeprom to unlock Trprot..ot smth

[boomeer]

hm may be mr.ecutuner tell as the difference?

[soxten]

Is it possible to read all info on mcu and program to a brand new mcu?
If I take a used ecu and mount a brand new mcu and then program info from customers broken ecu?

[H.Wessel]

Abritus released new update for VAG:
* !!! HIT !!! Transfer PIN/CS/MAC from one EDC17/MED17 to anotherthrough boot-mode


hello

This is common ecu adaptation (not clone) and can be done via boot or by obd.
I tested both with original Avdi and works but for obd procedure previous ecu pin/cs must be know.

best regards
H.W

[ominimicu]

you cannot read or write full MCU or flash becasue of OTP area...some factory info will always remain...
you can copy maps and other things...and make new ecu immo off. Unles u have a BGA station to desolder MCu and exchange it

[soxten]

So... AVDI can`t read full MCU?
Then it`s not possible to mount a brand new Tricore MCU on a used ECU and program with info from customers broken ECU.

Why, The car can read OTP area but no tool can do that...

Is this correct?

[ominimicu]

yes ..i guess so...

[soxten]

MAGPro2 X17 tool read complete IROM of TC17xx including all OTP areas
if existing.
X17 tool also read and write all dflash content (so called virtual eeprom)
checksumm included.

So there is a way here now :)

If I buy new Tricore MCU and mount on used ECU by BGA reballing and then read full MCU info from broken ECU and then use X17 tool to program the new Tricore in used ECU then I have make a "clone"
It take som time, but work.

[3abas27]

ONLY HEARING SOLUTION OF CLONING ECU WITH OTP FROM SOME FACTORY BUT REALLY NOT EXISTS EVEN FOR LONG FACTORY CMD

[ominimicu]

u sure x17 will read entire contesnts and write??

[soxten]

I copy the text i did get when I asked the company.
:)

[atomiczen]

MAGPro2 X17 tool read complete IROM of TC17xx including all OTP areas
if existing.
X17 tool also read and write all dflash content (so called virtual eeprom)
checksumm included.

So there is a way here now :)

If I buy new Tricore MCU and mount on used ECU by BGA reballing and then read full MCU info from broken ECU and then use X17 tool to program the new Tricore in used ECU then I have make a "clone"
It take som time, but work.
there isn't any way like before
magic motorsport haven't invented a gold chicken
magpro x17 is not able to do a edc17 clone, like every flasher sold at today, like kess v2 that is the original project that magic motorsport have cloned. Magpro is a kess v1 clone, x17 is kess v2 clone ;)
stay away BAD COMPANY!!!!!

[soxten]

They can't clone!
I ask about full reading of mcu.
They can read OTP area and dflash (virtuel Eeprom)

As I write... I mount brand new Mcu to a used ecu and then write full mcu info from broken customers ecu.

[soxten]

K-tag can't read OTP area, I did get that answer today from alientech

[fruti]

Abritus can clone edc 17 ... also can make immo off , milleage correction on edc17 , You have to have only same numbers on ecu like that witch it was broken .... i do it.
Also I change ecus from one to another and it is worked ...
Please check ... Today it was come out AN053 and AN054 updates ... read it on abrites.com

[soxten]

Fruti, exactly what tool and options do you have fron Abritus to read full MCU?
It can clone edc17 as not have OTP but not VW/Audi with OTP.

[H.Wessel]

Fruti, exactly what tool and options do you have fron Abritus to read full MCU?
It can clone edc17 as not have OTP but not VW/Audi with OTP.

He doesn't make a 1:1 clone, he bought the same ecu that the one that he has broken and the program the new ecu with AVDI, this isn't a clone.

[fruti]

Yes H.Wessel ... you are right ... isn't a clone but why you wanna do clone ??? If you have corupt ecu and you make adaptation on second hand ecu via ABRITUS and car start what alse do you want exactly ??
Soxten ... I have full option of ABRITUS with all features including AN053 and AN054. CMD Master .....

[darwins]

A great thread to read here.

So our mind set is away from OTP and instead focused on what data needs tweaking in changeable zones to produce a working solution in the vehicle.

[soxten]

The best is when some one tell how to do immo off in a public thread :))

I think I buy magic motorsport X17 tool and then read all info on mcu and program on a new tricore mcu as is mount on the used ecu.

[fruti]

Mate.... Tell me something why all that trouble?
You have ti buy x17 witch is not cheap, then you buy new tricore witch is 50? then you have to desoldier old mcu and if you dont have proper tool you can damage other elements in process. If you wanna avoid that you have to buy irda station witch is not cheep. Then you have to soldier new tricore on the board and if you are lucky you succeeded. Then you go to a programm part! Now tell me where is point here if there is a much easier way?

[veloseeped]

One more question.
Does anybody try to work with tricore over JTAG on MED17/EDC17 ?

[soxten]

Kan someone explain Xrom and Irom for me?

Is it possible to see IF mcu has OTP area in a simple way?
OR how do I know when mcu has OTP area?

I have ecu (bosch) from Vw Passat 2010 1,4i with Tricore TC1796 and I can read Maps,extflash,eeprom with K-tag
And I belive this ecu has OTP area.
Can I check som lines and se if I have info or it`s "FF"?

[soxten]

What is the diffrence?

SAK-TC1796-256F150E BC
SAK-TC1796-256F150E BD
SAK-TC1796-256F150E BE

[soxten]

The ending BD, BE is the step code of a product.
After ramp-up, a product usually has the step code AA. If minor changes occur, the second letter will move to B (C, D...). If major changes occur the first letter will move to B (C, D...). The changes are listed in the errata sheet, but the step code is not mentioned in the regular product type.

[veloseeped]

What is the diffrence?

SAK-TC1796-256F150E BC
SAK-TC1796-256F150E BD
SAK-TC1796-256F150E BE


From point of view of chiptuning tasks there is no difference between this MCU steps.
If you want to know exactly what is the difference go to infineon site and download pdf documents like "TC17xx Delta XX to YY Step"
Below is doc example

[maruti]

hello
i have x17 i will try & reply soon

thanks

[Youneselm]

In the programmable non‐volatile memory market, a gap exists between multi‐time programmable
memories and one‐time programmable memories.~~Users are forced to choose between 100‐100,000
time write functionality and one time write functionality.~~To fill this 2‐100 time write gap, users make
area, security, and cost tradeoffs by either cascading multiple OTP blocks or by using one of the larger
FTP/MTP solutions to meet their limited multi‐time write functionality requirements.~~There are manufactures that offer 2nTP offers unique solution to truly bridge the gap, offering a non‐volatile memory with OTP security
and reliability as well as multi‐time write programmability.
The current NVM market is divided into three categories:
? Multi‐Time Programmable (MTP): programmable to ~100,000 writes.~~These memories
use floating gate and charge trapping technologies.~~~
? One‐Time Programmable (OTP): programmable to one write. These memories utilize
gate oxide breakdown (antifuse technology), hot carrier injection, or poly fuse solutions.
? Few‐Time Programmable (FTP): programmable up to ~100 writes.~~These memories
utilize floating gate technology.
The release of 2n
TP creates a new category:
? Multi‐Time Programmable Antifuse (2n
TP): programmable to 2, 4, or 8 writes.~~These
memories utilizes gate oxide breakdown an antifuse technology.

One‐time programmable (OTP) memories have been available in the industry for many years.~~
The first OTP memories were available in the form of polyfuses or eFuse technology. These
memories are programmed by forcing a high current through a poly silicon link in order to
changes the resistance to a higher level.~~Polyfuse technology added a level of security because
the stored data could no longer be erased and rewritten.~~However, this security improvement
was limited by the poor reliability of polyfuse technology.~~
Antifuse technology, first introduced nine years ago, offered an alternative to polyfuse OTP.~~
Antifuse technology utilizes breakdown of the gate oxide as the programming mechanism for
OTP memory.~~Process costs are reduced with antifuse technology because it can be
manufactured in standard CMOS processes without additional process steps.~~~
Antifuse technology is inherently more secure than floating gate technology because the oxide
breakdown is so small that it is difficult to detect, and once broken down it cannot be altered.~~
Antifuse technology is reliable up to extremely invasive reverse engineering techniques,
whereas, floating gate technologies are susceptible up to level I (non‐invasive attacks such as
glitching, power analysis, or data stream analysis) and level II attacks(semi‐invasive attacks
including UV attacks, microscopy, fault injection, voltage contrast, or magnetic scans).~~~
OTP memory has a variety of applications although customers can often require more than a
single write cycle.~~Customers often need the security of OTP antifuse technology but also need
more than one write cycle.~~Currently, the solution for this multiple write functionality is that the
OTP providers cascade multiple OTP blocks together, providing separate blocks for each write.~~
However, this duplicates much of the programming and sensing circuitry, quadrupling the area
for a 4x write.~~For example, if a customer wants 2x write, the area will double.~~With a 4x write,
the area will quadruple.~~In addition to these area increases, the cost of implementing two or
four blocks can double or quadruple proportionately.~~This is a significant disadvantage for
customers who need to program the memory at wafer for internal testing then reset the part
for a customer?s own configuration.

FTP Memories
Few‐time programmable memories (FTP) have recently been developed in an attempt to bridge
the gap between OTP and MTP memories.~~FTP memories offer users ~100 time writes in a
standard CMOS process but typically require post processing steps.~~FTP memories utilize
floating gate architecture and thus are prone to the same security and reliability limitations of
floating gate MTP memories.
These limitations include the security concerns of memory tampering and security code
extraction, area constraints, and the strict control required to monitor the gate oxide and
maintain charges.
5.0 Novocell 2n
TP~~
Novocell has developed a non‐volatile memory (NVM) to bridge the gap between the multi‐time
write benefits of MTP and the security, cost and area benefits of OTP.~~Novocell?s 2n
TP offers an
alternative to the cascaded OTP block solution for multiple time functionality.~~2n
TP is a single
antifuse memory block which can support up to 8 time writes.~~2n
TP utilizes Novocell?s patented
SmartBit architecture to support multiple antifuse devices within a single bit cell, eliminating the
need for additional duplicated circuitry.~~This gives users a 60% area savings over using multiple
OTP blocks.~~Because 2n
TP is based on the industry and silicon proven NovoBlox OTP, the
technology maintains the 100% reliability (zero tail bit failures) and more than 30 years of data
retention.~~Like other antifuse technologies, 2n
TP can be embedded in standard Logic CMOS and
does not require additional process or mask steps.
2n
TP applications include any instance when multiple OTP blocks would be used.
Two‐times write example:
o Order changes ? If a product is calibrated for a specific user and the order is
cancelled, 2n
TP memory allows the user to reprogram the part to be used by
another customer.
Four‐times write example:
o Feature testing ? If a product needs to be tested and calibrated at wafer, at
package, at distribution, and then finally by the customer.

There are only a handful of OTP technologies available as shown below. They all have some drawbacks.
(1) Laser fuse: use laser beam to blow poly or metal fuse.
This OTP technology is to use laser beam to blow polysilicon or metal to create logic states that has been widely used for memory redundancy since 1980s. However, this technology needs special design rules, alignment marks, and testers to only work on the wafer level. The cell size is very larger, (~100um2) and not scalable.
(2) Electrical fuse: use high voltage/current to blow poly fuse.
This OTP technology is to use electrical means to blow poly or metal fuse to create logic states, that has been widely used by the industry since the early 2000s.

However, the program current is still too high, about 10-20mA. The cell size is still too large, about 10-50um2 depending on technologies, and not scalable. Because of large size and high program current, this technology is only suitable for 0.18um and beyond with density about 100s-1Ks bits.
(3) Logic EPROM: use thick gate oxide to trap charges
This OTP technology is to use floating gate to trap charges to create logic states. To make this mechanism work, the gate oxide cannot be too thick so that charges can be injected into the floating gate and the gate oxide cannot be too thin so that charges can be trapped there. The suitable gate oxide for 10-year data retention is about 70-80A, which falls into the gate oxide thickness of 0.35um generation. Therefore, this technology is not scalable. Because of the these issues, this OTP technology is only suitable for 0.18-0.35um generations, hard to work in extended temperature range such as for automotive applications, and needs suitable CMOS device to work.
Other than high voltage for programming and data retention, the device cannot be exposed to ultra-violet light; otherwise the data stored can be erased accidentally. The wafers with floating-gate OTP need to be baked to eliminate all initial charges before being used.

There is a similar OTP technology to use oxide spacers to trap charges and create logic states. Using oxide spacers to trap charges is even harder to control and less reliable because the process development efforts tend to pay much more attention to MOS than the spacers. The spacer material could be nitride rather than oxide in some nodes that further complicates the issues.
(4) Anti-fuse: break down gate oxide
This OTP technology is to breaking down the gate oxide to create logic states. Gate oxide breakdown mechanism has been well-studies since the 1960s. Other than hard breakdown the gate oxide, there is also another soft breakdown mechanism that the gate oxide appeared to be broken down but can be self-healed after being used for a while or after burn-in. When a high voltage (6.5-7.0V) is applied to a MOS gate, the electrons or holes can be attracted to the gate oxide layer and piled up. Once there is a piled up, this creates a short circuit to prevents hard breakdown from being happening. The electrons/holes can be returned to the original state after being used for a while and appear to be self-healed. The thinner the gate oxide, the more severe the soft breakdown mechanism is.

This OTP technology is only suitable for 0.18um generation and beyond. Because of the soft breakdown issue, the OTP technology tends to use heavy redundancy schemes to make the OTP work. The breakdown voltage cannot be scaled much for thinner oxides. On the other hand, the soft breakdown becomes more severe for thinner oxides. And the deep nanometer CMOS devices just cannot sustain any high voltages.
http://images.tapatalk-cdn.com/16/01/04/eeb3ef932919d84a895b2ba1a2077bb6.jpg

http://images.tapatalk-cdn.com/16/01/04/eadce28d95c4313c636bc66fe59a9dd8.jpg

http://images.tapatalk-cdn.com/16/01/04/c5315109dc7cb6be918ded235fa101ad.jpg

[Youneselm]

Hope this wil clear allot for some members.[emoji6]

[ForeverBMW]

Hi to all. Can we do a full Read with Ktag or Kess V2?. And after that to write full dump on new installed Tricore?

[kaosecu]

In the programmable non‐volatile memory market, a gap exists between multi‐time programmable
memories and one‐time programmable memories.[...]

Thank you for this interesting Post. Summing up the whole Thread, there is no Solution for a real "Copy" of a Engine Control Unit (ECU), as some parts in Memory are permanent.

Workarounds are:
- Applying new Chips in ECU and reprogram them
- Disable immobilizer in ECU
- Did i forget something?

I am curios about Pt.2. (And many others for sure too!). The following text my understanding of what happens here, you're all welcome to correct or complete my suggestions! :)

The theres a rolling code exchange permanently between Car Access System(CAS) and ECU.
This ensures that only one CAS on the whole planet is able to give the start permission to the ECU.
Once, both are CAS and ECU are married (and the One Time Programming in ECU is written) this mechanism works.
How can the IMMO be disabled in the ECU? And furthermore, what happens to the CAS, as the ECUs behaviour is unexpected? Will there be a permanent error code?


Thanks in Advance for sharing your Knowledge!

[cunakis]

I can do immo off on edc17cp02 bmw ecu
must be read in boot mode with ktag
immo off is in mcu internal flash
eeprom is in mcu to and must be unchanged for immo off, if touched can cause bricked ecu so do not rewrite it !!!
regards !!

[arab]

OK. Let's reading....

After a Erase User Configuration Block command, a new protection configuration
(including keywords and protection confirmation code) can be written to the pages of the
user configuration block. But note that the user configuration blocks UCB0 and UCB1
can only be modified up to 4 times during the lifetime of a TC1796 device.
UCB2 can be programmed only once.
Note: UCB2 is OneTime-Programmable (OTP). If sector write protection is installed and
confirmed in UCB2, this block can never be erased again. UCB2 can only be
erased before the confirmation of OTP write protection.
.....
The six-cycle Disable Write Protection command temporarily disables the write
protection of all protected PFLASH sectors as defined for user 0 (indicated in register
PROCON0) or user 1 (indicated in register PROCON1).
The Disable Write Protection command is not accepted for UCB2 because UCB2 is a OTP write-protected UCB.

soxten, your comments please...



hello, sir
you can put password on boot edc17 files then write on ecu or can put password on edc17?