5M48H CAS4 programmers?

[54321]

xprog ori, smok jtag, vvdi prog, UPA-S with sec script... all of them can read 5M48H.. But you got to have big balls and luck for that and of course money... but some of the cas modules after that wont wake up anymore :)
Sorry i'll rephrase that. So the MDP XEP100 is the only tool that can read these in circuit SAFELY? :)

[Mario3]

Sorry i'll rephrase that. So the MDP XEP100 is the only tool that can read these in circuit SAFELY? :)
:) yeah.. the only one. But there is some guy that said he killed a cas4 with it.. so i dont know what to belive.. and its price is pretty high for makeing only 2 mcu masks i think. But the etl will get some updates for sure. Maybe they will develop a incircuit reading..

[dvdegrt]

Etl for sure vill not make in circuit reading cause me talked vith them and they said xe devices vill never vork in circuit 100 percent safe it may have vorked for older mcus
but vill never vork for xe devices , anyway for cheap tools is best use xprog me done vith chinese and can vork some 90 percent safe but think if you made vith v2 and instal
resistance 1kohm and one more that is lifted me have made and tried few can vork litle better it can unlock it more quick and reading litle more safer

[54321]

Etl for sure vill not make in circuit reading cause me talked vith them and they said xe devices vill never vork in circuit 100 percent safe it may have vorked for older mcus
but vill never vork for xe devices , anyway for cheap tools is best use xprog me done vith chinese and can vork some 90 percent safe but think if you made vith v2 and instal
resistance 1kohm and one more that is lifted me have made and tried few can vork litle better it can unlock it more quick and reading litle more safer
Is xprog in circuit?

[Mario3]

yeah it makes sense.. I also would go for ETL, its a well known company for reliability.

Yes xprog is in circuit

[roth18]

:) yeah.. the only one. But there is some guy that said he killed a cas4 with it.. so i dont know what to belive.. and its price is pretty high for makeing only 2 mcu masks i think. But the etl will get some updates for sure. Maybe they will develop a incircuit reading..

Mario, they sweetened the deal. Now, not only 2 masks. It can do more. Read: http://mrppad.com/cms/en/

[cheester]

Lads, what about cas4 filters?? We talking all the time about programmers which they always fail in some stage and cost fortune and I know places where someone do cas4 for 150e ;) any filter on the market is working 100%? By descryption icom (..or any diag tool) after show same mileage in dash and cas.
Anyone tested?? Or they are scraps?

[wiseman]

See when a blocker fails( which they do btw) it is deadly for the occupants, in a big 5 series etc...car cuts out, loss of vacuum to the brakes, power steering loss, etc... Then you have the added risk of it being found after.

[cheester]

See when a blocker fails( which they do btw) it is deadly for the occupants, in a big 5 series etc...car cuts out, loss of vacuum to the brakes, power steering loss, etc... Then you have the added risk of it being found after.

Never tought it can couse so serius problems, someone else had this bad expierence with emulators?

[smartymarti]

iv had plenty that have failed due to been cheap or just soldered in poorly , as wiseman says when they fail they do big time

[AleXPaiN]

Hallo, I just wanted to confirm that X prog Box with Auth 24-2 24-3 worked on 1230 5m48h cas4.
just read all erata, datasheet, help instructions, and did extensive search on the forum.
Thank You everyone that shared their experiences it was really helpful.
Also Cas4 mileage tool r20140617 did work correctly adjusting the mileage directly from the D-Flash dump.

Thank You.

P.S. I hope next time i have the guts to this again it works all the same success :D

[Mario3]

Ori xprog ?

[AleXPaiN]

Clone
but not china clone.
It has been tinkered by local proffesional.

I dont think he makes anything different than other clone makers so ...

definatly a clone

[acab]

how can i load S19 to 5M48H via X-Prog 5.55?

[pepesound]

all clones of x-prog is different quality:) just soft maybe is only one

[Speedosoft]

how can i load S19 to 5M48H via X-Prog 5.55?

Convert them to .bin first and then use x-prog to load it into the 5M48H. If you used ETL to save it as S19, remember that ETL uses real physical address when reads files whereas Xprog, I think, uses base address as beginning of the file.


Sent from my iPhone using Tapatalk

[hass42]

OK, I'm at a locksmith convention in the States, Florida to be exact. And MBE from Poland has new upa-s hooked up to cas4 with 5M48H chipset and is demonstrating read and write. Well only reading, but swears it'll write 100% of the time. He was able to read over and over with no problems whatsoever.

Hass42

[davecooper47]

Ask him to show you writing over and over again and prove it!!

[hass42]

Ask him to show you writing over and over again and prove it!!
I am going to do that tomorrow. Too many people around and didn't wanna rain on his parade.

Stay tuned

Hass42

[Fallen]

OK, I'm at a locksmith convention in the States, Florida to be exact. And MBE from Poland has new upa-s hooked up to cas4 with 5M48H chipset and is demonstrating read and write. Well only reading, but swears it'll write 100% of the time. He was able to read over and over with no problems whatsoever. Hass42 While you are there, ask them where their updates have been for the last year and a half...

Also, get him to put the CAS back in the car and start it!

[PremierD]

When you have unlocked it once you can write back to it .. to make it unsecured .. so easy to read next time ..... :)

[hass42]

While you are there, ask them where their updates have been for the last year and a half...
For the UPA?
Cause I think they were focused on getting new S model out.

Which by the way still can't do D160/M35160

Hass42

[hass42]

When you have unlocked it once you can write back to it .. to make it unsecured .. so easy to read next time ..... :)
So, however did they unlock? With UPA-S? Or other methods that they not showing me?

Hass42

[hass42]

This guy gonna get many many questions tomorrow.
I'm also talking to reps from Abrites if you guys have any questions to ask them tomorrow.
I'm pretty sure I'm walking out of here buying it

Hass42

[PremierD]

Not sure that upa-s.. or gt even can unlock it .. lol .. but I have been wrong in the past

[davecooper47]

Eagerly awaiting. Do you know if it has been modified?? Can he show you reading D Flash and P Flash and good backups? If he can, then that is a massive leap forward because as we all know, backing up is paramount. Even if we have to use two tools to do the job, one to read and one to write, if we have a good backup we can always repair.

[Fallen]

For the UPA? Cause I think they were focused on getting new S model out. Which by the way still can't do D160/M35160 Hass42

Not for UPA, that's not their product, it's from elrasoft.
Ask them about the update for their Mercedes key software.

[hass42]

Not for UPA, that's not their product, it's from elrasoft.
Ask them about the update for their Mercedes key software.
OK, I'll ask about that. No problem

Hass42

[hass42]

Eagerly awaiting. Do you know if it has been modified?? Can he show you reading D Flash and P Flash and good backups? If he can, then that is a massive leap forward because as we all know, backing up is paramount. Even if we have to use two tools to do the job, one to read and one to write, if we have a good backup we can always repair.
He showed that it read D and P. I don't see any modifications. He has 2 cas4 modules both different chipset. Read both

Hass42

[davecooper47]

Like Premier D said, it's all about the unlocking. Can you ask him how he did that and what with please.

[hass42]

Like Premier D said, it's all about the unlocking. Can you ask him how he did that and what with please.
On the list of questions, I'm on it.
Like I said me and another guy there were only ones surprised that he was reading with such ease.

Hass42

[Speedosoft]

He showed that it read D and P. I don't see any modifications. He has 2 cas4 modules both different chipset. Read both

Hass42

When you say "I don't see any modifications....", what do you mean? There's no soldering points anywhere near the mcu? He must've unlocked those CAS's prior to the show. Once it's unlocked you can read and write with ease as many time as you want.

[davecooper47]

I meant modifications to the UPA.

[hass42]

OK, swears no modified nothing to cas or upa-s

Hass42

[hass42]

Updates, he says will be out very soon. Something about the servers they have had problems.

Hass42

[hass42]

And he did write the Cas4 module in front of me, once only, and has no car to start it too :)

Hass42

[Speedosoft]

Hass42, did you see the "unlocking" progress such as a log or steps to unlocking? Or just a read/write? Btw, no coaxial cable connected to it?


Sent from my iPhone using Tapatalk

[Fallen]

Come with me on a journey friends as we try to unlock and read this CAS4 module I have with some programmers that claim to be able to do it!
Its a lazy weekend, so lets get this thing started!

[Fallen]

First up - UPA-S using the Tomsad supplied CAS4 cable and software.

Things look good, there is some sort of Coax cable and CAS-4 listed on the menu....

Wait, this doesn't look good, there is only 1 connection photo and it's not the same as our CAS!
I guess we are dead in the water before we even set sail, NEXT!

[PremierD]

http://www.etlweb.net/


That one works .... but need to remove.:)

[Fallen]

Next up - VVDI PROG using latest version available at the moment 4.4.4

I see 3 options I can select. Backup, R/W/unlock and unlock.
This seems a little confusing, I'm guessing we should start with Backup.

There is 4 different connection diagrams available and our CAS is listed.
It appears we don't have to remove any of the components but have to cut 2 tracks instead.
Also, if it fails to unlock, we have to heat the thing up to 70 degrees and try again.

Time to get the microscope out and get my solder on...

[Fallen]

Ok, so the cutting and wiring is all done, it was pretty easy under the scope but i think you would have trouble trying to do it with the naked eye.
The purple wire does not match the color code on the connection diagram but it was the only one left over, so it had to be the right one.
The three fine connections were also made under a microscope, so no telling me it was my dodgy soldering if this thing bricks the CAS!

[Fallen]

First up, we are going to back up the D-Flash.
We click "new" and "read" and the programmer goes through some sort of initialization and checks the chip ID.
First issue I get is "FFFF" displayed for chip ID, not good.
I do some reading and watching youtube videos and apparently this is normal.
I click ok and it tries to unlock the chip.
After about 10 seconds it says success and starts to read.
The read finishes after about 30 seconds and says "operation success", HURRAH!
I look at the screen dump and all I see are F's everywhere, BOO!
I flick through the entire dump and I see data, HURRAH!

It seems the D-Flash read OK.

[PremierD]

149302 kms ?...........

[Fallen]

Next up is the P-Flash.
I don't reset the programmer or anything, I just click on P-Flash, new and read.
It goes through the same initialization and FFFF on the chip ID, I click OK with confidence.
The unlocking take about the same time and then it starts to read.
1%..... 20 seconds later, still 1%......
Sweat starts to bead on my forehead as I am now sure this has just bricked the CAS.
2%...... Wait, it's moving!
It was a very long process to get to 100%, 28 minutes to be exact.

Operation success and the screen fills with lovely, lovely data and it looks like it was another win on the P-Flash.

So it appears that VVDI Prog was able to read this CAS ok, even though the read time was very long on the P-Flash.
Mind you, when I read CAS-3 using VVDI Prog, I get a very long read time on the flash.
Other people say that their unit only takes about 5 mins to read a full flash, not sure why my unit takes longer.

All the dumps are here guys, let me know if you want me to do any special tests with this thing before I put it away.

[Fallen]

149302 kms ?...........

Unsure mate, I bought this unit off ebay purely for this exercise.

[PremierD]

it has mate ... :)
read by ETl ..

your d flash looks good

[offsystem]

It seems vvdi is really a good Programmer, fallen was it the first unit which you read with vvdi?

[Fallen]

It seems vvdi is really a good Programmer, fallen was it the first unit which you read with vvdi?

Yep, this is the first time I have ever attempted to read a CAS4 and you were all here with me, group hug!

VVDI2 recognizes the D-flash as does Tango.

[PremierD]

:roflmao: .............. group hug lol

[Fallen]

I'm kind of tempted to try and read this with UPA-S using the same wire up.
Once this CAS has been unlocked though, I think it makes it easier to be read again.
Unless VVDI Prog locks it again?

[offsystem]

I'm kind of tempted to try and read this with UPA-S using the same wire up.
Once this CAS has been unlocked though, I think it makes it easier to be read again.
Unless VVDI Prog locks it again?
Yes you must lock it again to test if upa s can unlock and read.

Last time I load cas4 dump to tango it needed the isn to decrypt it. Looks like vvdi has decrypt function also.

[Fallen]

Ok, so I am going to look at the R/W/Unlock menu and see what happens.
There is not many instructions, so I can only assume that this is the section where you can unlock, read, write and then re-lock the MCU.
I select D-flash and click "Reset Sec", it goes through the same initialization, and tells me "Chip is Crypt FF" then operation Success.
This does not seem to be what we want, I can only assume we want "DE-crypt" or something along those lines.
I hit Reset Sec again and it produces "Chip is not crypt FE", this looks better.
I can now also get the correct chip ID when I ID it.

I can read the D-flash and i'm reading the P-flash as I type (another 30 mins).
The D-Flash is the same as the backup version.
I wonder why it had to unlock the chip as I though it was unlocked when we read the backup?

After the D-flash has been read, I will try and write back the D-Flash from PremierD and see if it works.

[offsystem]

Yes when Chip shows again FF Security is set to ON.

When you try for eg now xprog it will show you that mcu is secured.

[Fallen]

Ok, wrote another D-flash to it ok, verified ok.
Locked the MCU with "set sec" and used the bytes "FF" to lock it.
Then unlocked the MCU again, read it and all was good.
Wrote my original D-Flash back and once again locked it.

When it's locked, you cant ID the chip, you get "FFFF", when its unlocked, you get the correct ID.

[PremierD]

So a good day was had by all mate ... :top:

[hass42]

So it must have been unlocked prior. Interesting

Hass42

[hass42]

Hass42, did you see the "unlocking" progress such as a log or steps to unlocking? Or just a read/write? Btw, no coaxial cable connected to it?


Sent from my iPhone using Tapatalk
No, I didn't.... And no Coaxial connected.
Seemed too good to be true.
So Vvdi did unlock/R/W, that's nice.
I know it was your first time (joins group hug), so I ask if other in here have used VVDI successfully?

Hass42

[testit34]

Hi
Yes I have done 2 of the Cas4 modules with silver crystal with vvdi (even without cutting traces) and it has worked and car runs fine.
I have not tried cas 4 with black crystal yet (with or without removing components).
Thanks

[hass42]

Hi
Yes I have done 2 of the Cas4 modules with silver crystal with vvdi (without cutting traces) and it has worked and car runs fine.
Thanks
Very interesting, I'm about to purchase this VVDI. What would be a good supplier?

Hass42

[testit34]

Hi
I purchased it when it first came out. I don't remember who I got it from, Samic recommended a few suppliers and I purchased it from 1 of them.
Thanks

[Speedosoft]

So it must have been unlocked prior. Interesting

Hass42

That's exactly what he did. He unlocked it prior the show.

[tunertool]

Unlocking simply requires changing just a few bytes after that you can read and write with most tools with no risk!

[hass42]

Unlocking simply requires changing just a few bytes after that you can read and write with most tools with no risk!
OK, well the past 300 hundred or so posts kinda say that's not so easy. Please elaborate.


Hass42

[tunertool]

You can unlock it but you need a good successful read first to do so.

[hass42]

You can unlock it but you need a good successful read first to do so.
Which is the purpose of this entire discussion.
It's like saying "walking on moon is easy, just get there first"

Hass42

[tunertool]

It has been mentioned countless times that these can be read successfully with very very high success rates with certain tools, I took a chance and it paid off so far!

[hass42]

Yes, but what you say is after unlock many different tools can read and write. This is what you said confused me.

Hass42

[tunertool]

Which bit confused you?

Once its unlocked with a good tool you can use most tools without coax/twisted pair as no need for unlock anymore.

[hass42]

Which bit confused you?

Once its unlocked with a good tool you can use most tools without coax/twisted pair as no need for unlock anymore.
The part of unlocking is the issue isn't it?

If not then this chip has been resolved and I need a tool to unlock and another to write..... Is this what you saying.

If not, than I'm so confused about it that I'd rather stop talking about it [emoji3] [emoji3]

Hass42

[Speedosoft]

Why is this all so confusing to you Hass42? If the mcu is locked then it needs to be unlocked like any secured 9S12. Obviously and for now UPA-S cannot unlock those... But can read and write only if it's in a normal state (=unlocked). The same programmers that unlock those 5M48H can also read/write with no problem such as Xprog-m. And Xprog-m offers the possibility to read and save both D and P flash without having to launch the unlock procedure because they know very well there's no 100% guarantee that there won't be any damage to the mcu but at least you have a good saved file at that point which can be loaded into another CAS4.
If you're still confused, then yes you'd rather stop talking about it or at least take a break :)


Sent from my iPhone using Tapatalk

[hass42]

Speedosoft, I understand everything you just said and know this. But they way tunertool is making it seem is that there are many tools that can do this without risk (post #313)

Hass42

[offsystem]

I tested today 2 cas4 5m48h with smok tool, i heated up mcu and all 2 cas was unlocked ok.

[cdex]

hi

can any one check this 2 files please


and reset d flash thanks

[PremierD]

Reset as in no Kms ?

206,317 .. to zero

[cdex]

yes with 0 km, please

and if possible check if correct reading

thanks

[PremierD]

like that ?................

[testit34]

Hi
So does this mean if you just use the backup feature of the VVDI or Xprog for D flash and P flash on a locked CAS 4 there is no chance of damaging it. I thought it could get damaged no matter what you did.
Thanks

[Mario3]

sure it can get damaged, but if you manage to make the first read right to get a full backup you have nothing to fear cause in the worst case scenario you can transfer the data to another cas4 and youre good to go

[cdex]

hi

PremierD (http://www.digital-kaos.co.uk/forums/member.php/57580-PremierD)
did you check files? are they ok? good reading

[Fallen]

I must admit, I am a little confused by the whole backup vs unlock and read concept.

The backup function must unlock the processor first to enable reading, then read it and then lock it back up.
When you do any editing, you must unlock it, read it, modify the dump, write it back and then lock it.

How is the backup unlocking any safer than the normal unlocking?

Also, do you have to unlock both flashes individually?

[hass42]

I must admit, I am a little confused by the whole backup vs unlock and read concept.

The backup function must unlock the processor first to enable reading, then read it and then lock it back up.
When you do any editing, you must unlock it, read it, modify the dump, write it back and then lock it.

How is the backup unlocking any safer than the normal unlocking?

Also, do you have to unlock both flashes individually?
Thank you

Hass42

[Speedosoft]

I must admit, I am a little confused by the whole backup vs unlock and read concept.

The backup function must unlock the processor first to enable reading, then read it and then lock it back up.
When you do any editing, you must unlock it, read it, modify the dump, write it back and then lock it.

How is the backup unlocking any safer than the normal unlocking?

Also, do you have to unlock both flashes individually?

Apparently they have found a sort of backdoor access without unlocking it which seems to be safer. I think the unlocking process uses high frequency oscillation and for a longer time thus increasing the risk of damaging the mcu or wiping out the whole memory; whereas the backup type read probably uses different parameters.
And no you don't have to unlock both flashes. The security byte is in the P-flash. Also it's not a good idea to re-lock the mcu. It can be damaged and permanently locked. So once you unlock it, just leave it like that.

[Levanime]

any experience with XprogM? I've been told they work fine with 5M48H

[Rito]

Someone had see it??

https://www.youtube.com/watch?v=ow5P-265w2w

what adapter is it?

[EPROMIX]

USB UPA read OK , WRIT damages D-FLASH

[EPROMIX]

PROGRAMMER MDP EVO XEP100 NEVER PROBLEMS

[Rito]

USB UPA read OK , WRIT damages D-FLASH

Thanks, to help, where can found this adaptor??

[David car ECU]

In fact, CAS4 of 5M48H wafer, without tension, to normal operation, power supply 12V, ISP, connection not too long, are very easy to read out the data.

[Rito]

In fact, CAS4 of 5M48H wafer, without tension, to normal operation, power supply 12V, ISP, connection not too long, are very easy to read out the data.

What tool you use to read it??

[PremierD]

"power supply 12V, ISP, connection not too long, " .......until how much smoke comes out .. exacty ?:)

[qwojtus]

Im looking to find good programmer for CAS4 and found this http://www.dashcoder.com/?page_id=230 anybody come across?

[Rito]

Im looking to find good programmer for CAS4 and found this http://www.dashcoder.com/?page_id=230 anybody come across?

Made to Dashcoder is Good.... You know prices about it?

[qwojtus]

Have no idea. I sent the request but nobody answer...

[weza247]

1500EURO multi prog

[qwojtus]

Yes 1500 euro. This is standalone, no pc required but you can use SD card if need data. It supports CAS 2:3:4 and next update gonna bring read some mercedes EIS hc12/9s12 and the rate is 130 cas4 100% but dont know if secured or not. That all i know from support at the moment...so we are waiting for volunteer to confirm :)

[pierre renault]

EUR 1800 + 19% tax (2142 euros)

[rukartinatv]

1800 or 1500?
we are talking about dashcoder programer.

[pierre renault]

Yes Dashcoder 1800+19% taxe this programmer is (digiprog repsoft micro)

[qwojtus]

1500 EUR dont spread wrong info mate ..... no feedback nowhere, bit suspicious...

[dinauto]

QWOJTUS IS TRUE I BY IT AT 1500 EURO IS WORK FINE FOR ODO BUT EPROM DATA NO POSSIBLE TO GET IT

[javyb]

QWOJTUS IS TRUE I BY IT AT 1500 EURO IS WORK FINE FOR ODO BUT EPROM DATA NO POSSIBLE TO GET IT
Does it save backup of d flash and p flash?

Sent from my SM-G935F using Tapatalk

[qwojtus]

Yes it save both on sd card

[Nofreeupdate]

Cas4 5M48H or 1N35H

can do 100% , with my adapter and only 6 wires
can unsecure Mcu

[hass42]

Cas4 5M48H or 1N35H

can do 100% , with my adapter and only 6 wires
can unsecure Mcu
What programmer is this?

Hass42

[Nofreeupdate]

PM me , but soon come for all programers, i working on it

[jazzy1977]

I use xep100 to read all cas units and never had any problems yet, very good tool and good support from them.

Reading cas4 5m48h https://youtu.be/KmSWOXkCNUY

sorry video making isn't great

[Nofreeupdate]

Cas4 with any MCU Xep100, can read and writte perfekt 100%. On my way. Can also remove security bytes. Then can read and writte without out bdm ( only 5 wires) . Just put back in car and make only dash new km.
No error ( cas module hardware faulty)
Just wait 4 more days and then check Youtube... Cas4 NFU adapter

[yannick1800]

Cas4 with any MCU Xep100, can read and writte perfekt 100%. On my way. Can also remove security bytes. Then can read and writte without out bdm ( only 5 wires) . Just put back in car and make only dash new km.
No error ( cas module hardware faulty)
Just wait 4 more days and then check Youtube... Cas4 NFU adapter

hi Nofreeupdate, any update about your CAS4 NFU adapter ? :-)

[hass42]

I had a BMW X3 today. That had CAS4 and dash done before. Dash had first 2 lines at FF FF when I read it. So that means they adjust CAS which had 5M48H in it. Now from what I seen. They soldered to gnd 5v and 3 spot on lower left of board. No life's pins nor anywhere near chip.

What tool can do this? Xprog? Smok? UPA-S?

Not xprog unless new update I don't think....

Hass42

[drpeter]

I had a BMW X3 today. That had CAS4 and dash done before. Dash had first 2 lines at FF FF when I read it. So that means they adjust CAS which had 5M48H in it. Now from what I seen. They soldered to gnd 5v and 3 spot on lower left of board. No life's pins nor anywhere near chip.

What tool can do this? Xprog? Smok? UPA-S?

Not xprog unless new update I don't think....

Hass42What do you mean? With ''FF'' at adress 00 till 1F in the dash eprom they got a value on the dash? Any chance they removed the cas chip?

[hass42]

What do you mean? With ''FF'' at adress 00 till 1F in the dash eprom they got a value on the dash? Any chance they removed the cas chip?
No, nothing changed physically in CAS, just obvious that it was read before.

160D0WQ chip was also removed and resolder on board, but when I read Dash chip first 2 lines were FF FF.... I assume they changed value in CAS and zero dash. But I thought dash would change to CAS value.
Mileage was 61250 miles... FF FF makes no sense to me.

I changed to what I want and rest CAS and it work fine....

Just wondering how dash chip stayed at FF FF

Hass42

[vasa]

on first 2 lines cant FF yoh have bad connection or programmer maybe you have bad erasure chip how you havegot for tool?

[hass42]

on first 2 lines cant FF yoh have bad connection or programmer maybe you have bad erasure chip how you havegot for tool?
Honestly, I didn't... I read it twice and I erased and write new values in lines after I reset CAS

I read, erase and write with AVDI

Hass42

[hass42]

Anyone in here comfortable using using uusp or UPA-S to read and write Dflash in CAS4?

I am going to try tomorrow and was wondering if any have luck doing it?

Hass42

[3abas27]

Hi
No tool 100% safe for cas4

[maruti]

mdp is 10000000% safe

thanks

[magneto21]

So fare I did 4* cas 4 with mask 5m48h and no problems.
the newest was from 2015 , I have also vvdi prog , x-prog
but I'm comfortable with upa-s

[3abas27]

But i already ask penko about cas4
Him told risky
If need test not verify

[roth18]

So fare I did 4* cas 4 with mask 5m48h and no problems.
the newest was from 2015 , I have also vvdi prog , x-prog
but I'm comfortable with upa-s Can you share pinout for this m8?

[hass42]

Well I hooked it up exactly how I was told to and it keeps giving me a error... Doesn't even try to read, using UPA-S

Hass42

[gepakg]

you use UPA-S secured script file?

very easy,gnd,vdd,bdm,reset,and on xtal 4 pin from UPA between 100nF

regards Gepa


Well I hooked it up exactly how I was told to and it keeps giving me a error... Doesn't even try to read, using UPA-S

Hass42

[hass42]

you use UPA-S secured script file?

very easy,gnd,vdd,bdm,reset,and on xtal 4 pin from UPA between 10nF

regards Gepa
I was told 100nf
This is exactly what was sent to me from Erlasoft.

Make usual BDM connections~ from programmer to MCU BKGD, Reses Vss and power (Vddr) Make an additional connection between p4(programmer) to extal~ pin(MCU)~ through a 100nf condenser~

Hass42

[hass42]

Also I have option to use 9s12xep100 and opens. Do I need script?

Hass42

[gepakg]

of course,for every secured motorola you must have script file for secured mcu,in script folder and then proper one for bypass security and r/w

also on 9s12 when he try to bypass security write this 2 bytes in dialog...also if can not pass he report that

read/write/verify always first thing that UPA work is bypass security

regards Gepa


I was told 100nf
This is exactly what was sent to me from Erlasoft.

Make usual BDM connections~ from programmer to MCU BKGD, Reses Vss and power (Vddr) Make an additional connection between p4(programmer) to extal~ pin(MCU)~ through a 100nf condenser~

Hass42

[hass42]

Ok, finally able to read Pflash first and then dflash. I tried first the dflash and not work.

do I read dflash user partition first? or Dflash for reading mileage

[magneto21]

roth18.........-as of request
upa-s cas4 connection diagrams


PM
FOR PASS.

[gepakg]

in download section without pass :-)))) also on support ElraSoft

regards Gepa


roth18.........-as of request
upa-s cas4 connection diagrams


PM
FOR PASS.

[hass42]

I already received connection diagram. Also, I successfully read CAS4 with UPA-S.

Thank you all

Hass42

[gepakg]

script file for 5m48h is very good implemented,few at me with success :-)

regards Gepa


I already received connection diagram. Also, I successfully read CAS4 with UPA-S.

Thank you all

Hass42

[magneto21]

The connection I have , can R/W D-flash and P....
with no problems

regards,

[hass42]

Heres connection diagram, sent to me from support also can find this elsewhere in DK

432895

[Rito]

in download section without pass :-)))) also on support ElraSoft

regards Gepa


Where is this connection in web elrasoft?? I have original UPA-s and I use script from here:

http://www.programatory.com/index.php?p963,walizka-cas-reader-pluginy

Your script is from where??

Thanks

[gepakg]

yes,but Tomsad is expensive for nothing,write to Penko will give it for free in few hours for sure :-)))

just write your serial of UPA

regards Gepa


Where is this connection in web elrasoft?? I have original UPA-s and I use script from here:

http://www.programatory.com/index.php?p963,walizka-cas-reader-pluginy

Your script is from where??

Thanks

[magneto21]

Hi,

I made the CAS cable for UPA-S programmer
The color of the wires is mach the diagrams connection of the x12 programmer.
You can R/W cas 2,3,4 eprom and flash with no problems.

PM FOR PASS

BRegards.

[juancho18]

...............................

[technobox]

magneto pass pls and this cable work upa clone ?

Sent from my SM-N920C using Tapatalk

[hass42]

What????
How is what he's providing different than that?

https://uploads.tapatalk-cdn.com/20170308/4d5fbf8b269ee617e849b11699183d32.jpg

Hass42

[Rito]

I can confirm UPA car Read Cas4 5M48H...

442643442644



But I don?t know How I can write it...

I need erase chip first??
In optin D-flash not have option to wryte Why??
But file from D-flash is same file D-fash user particion
But when I try Write D-flash user particion It show; error

thanks

[gogocro]

i think your connection is wrong

[Rito]

i think your connection is wrong

If read connection is ok!!!!!
After insist it Write ok.....

[u.s]

Chaps,

What tool is recommended for cas4 please?
I'm thinking either vvdi-prog or uusp-s ?

Thanks

[garagesport]

Hello partner someone has had good results with xprog clone 5.70 with cas4 (5M48H)


and if it is asin that pinout to followed


thanks and regards

[Rito]

Buy original tools... UPS-S can read it good.... Forget xprog clone...

[garagesport]

they say that version 5.70 does cas4 5M48H?

[hass42]

Buy original tools... UPS-S can read it good.... Forget xprog clone...I've read 6 cas4 with my upa-s without failure.... Not saying it's 100% but nothing else is


Hass42

[didi_du_93000]

I've read 6 cas4 with my upa-s without failure.... Not saying it's 100% but nothing else is


Hass42What date of your cas4 ?

With Tapatalk

[hass42]

What date of your cas4 ?

With TapatalkI've done both masks of cas4 with upa-s.... I actually have 2 different mask at my shop now that I have read and not used. I'm sorry it's almost 3am where I am and been drinking [emoji23].... Can't give you details now.... Message me tomorrow....

Hass42

[motorsport]

they say that version 5.70 does cas4 5M48H?

Some make with 551 Or 15.8 but i never test some one know untill date 10?? Or 11?? no risk

[chriaran]

hello mates... anybody got script file for 5m48h for upa-s ???