Bosch Iveco Daily MY2014 cancheck off

[KierAn20]

Have any of you lads come across one of these radios yet? :ambivalence:

Manufacturer: Bosch for Iveco

Model id: Daily MY2014

Model number: 7 620 000 095

Chipset:

Renesas uPD70F3353 mcu

95640 + 25p40 eeprom set

It will happily run on 29bit on the bench, but I need to get it to cancheck off for customer (he does not have 29bit can signal in his vehicle).

I have tried all the usual suspects to get rid of the cancheck, but no joy so far.........

Appreciate any help if anybody knows these sets and how to knock out the can comms :)

Kieran

[shooting]

Have any of you lads come across one of these radios yet? :ambivalence:

Manufacturer: Bosch for Iveco

Model id: Daily MY2014

Model number: 7 620 000 095

Chipset:

Renesas uPD70F3353 mcu

95640 + 25p40 eeprom set

It will happily run on 29bit on the bench, but I need to get it to cancheck off for customer (he does not have 29bit can signal in his vehicle).

I have tried all the usual suspects to get rid of the cancheck, but no joy so far.........

Appreciate any help if anybody knows these sets and how to knock out the can comms :)

Kieran
Try this.. may not work but the code line is correct.. :)

wbr

[KierAn20]

That gives me "wait 30m" mate, so gonna leave it to run the 30mins and see what it gives me after - obviously the counter must be in amongst those edited bytes too.....

[KierAn20]

Hmmmm, that's a bit of a bind, the set switches off automatically after 20mins. So will be impossible to reach the end of the 30min countdown by the looks of things lol

Cheers anyway :)

[Raimax]

Not sure Try this (Test)

[clydey]

try this if raimax don't work cheers

[KierAn20]

Thanks Raimax, still cancheck buddy :peaceful:

This one is a tough cookie........... :ambivalence:

[KierAn20]

try this if raimax don't work cheers

Cheers John, that stuttered for a moment and I thought my luck had changed - then went to "wait 30m" lol

I can still vaguely remember when I used to be out at nightclubs on Saturday nights, now I'm doing this for "fun" instead lol

[clydey]

my memory is not that good sorry it did not works cheers

[KierAn20]

my memory is not that good sorry it did not works cheers

Mine's fading fast!

I think i will get it back on the 29bit rig and enter a couple of wrong codes to single out the counter bytes/values. Then go back through some of these solutions but try to keep the counter bytes unchanged if its possible.

Thanks all for help so far :encouragement:

[Raimax]

KierAn20 try two more options. Maybe now succeed

[shooting]

Mine's fading fast!

I think i will get it back on the 29bit rig and enter a couple of wrong codes to single out the counter bytes/values. Then go back through some of these solutions but try to keep the counter bytes unchanged if its possible.

Thanks all for help so far :encouragement:
If you've got the patients and haven't opened the wine, try this :)

wbr

[KierAn20]

Cheers lads, I will give them a go now before I pack up (and get on the wine indeed) :stung:

For reference, two dumps with wrong codes entered - with CAN applied to allow it:

[KierAn20]

@Raimax first dump "v1" went straight to cancheck. But second dump "v2" did not, it went to "0000" and let me enter the code this time - and then............cancheck lol

@Shooting this one done the same "wait 30m" thing straight away again. It looks like it must be picking that up from that counter segment in mid-line 360.

Anyway that's enough for me for one day, thanks again for all help lads, much appreciated :encouragement:

:cheers:

[Decode Ghost]

Have any of you lads come across one of these radios yet? :ambivalence:

Manufacturer: Bosch for Iveco

Model id: Daily MY2014

Model number: 7 620 000 095

Chipset:

Renesas uPD70F3353 mcu

95640 + 25p40 eeprom set

It will happily run on 29bit on the bench, but I need to get it to cancheck off for customer (he does not have 29bit can signal in his vehicle).

I have tried all the usual suspects to get rid of the cancheck, but no joy so far.........

Appreciate any help if anybody knows these sets and how to knock out the can comms :)

Kieran


cancheck off code 6514

[KierAn20]

cancheck off code 6514

Thanks for help friend, this dump does the same thing as Raimax "Desktop v2" dump.

It first goes to 0000 and lets me enter the code 6514, but then "cancheck" comes back straight after code entered.

Not sure if this one can be solved...........

[Raimax]

Another option

[KierAn20]

Another option

This one again now lets me put code in - so goes to 0000 and then i put code and cancheck kicks in straight after. At least we are getting to the code enter screen now :)

Thanks for help buddy

[KierAn20]

Just in case it will help anybody in the future who gets one of these, I will post what I have found after a good few hours of experiments.

There is an initial cancheck which comes up as "Check" when you first power the set, then if you are able to bypass this, it allows you to enter the code with prompt "0000".

If you enter the correct code, it goes to a boot screen and then you see the secondary "check". This is where I was getting confused, the cancheck removal by you guys was successful in many cases because it actually let me go to the code entry screen and enter the code.

BUT, once code has been accepted the radio starts looking for its comms on CAN - it is not security or anything, it is just like the Visteon Stilo radios where they won't function without an incoming CAN stream.

There is also a vin number in the dump, but it is of no importance here. When I plug the set into the 29bit CAN rig, it accepts the code and works perfectly with no problems due to vin mismatch.

I will attach screenshots in case it will help somebody to not lose as many hours as I have lol

The long and short of it is, if you want to run this set on the bench or in a different type of vehicle, you gonna need 29bit CAN signal - even AFTER you remove the initial cancheck.....

This applies only to this type of unit with immo signature line at #360h If you have the other type with signature line at #260h it seems that on those you can still fully remove the need for CAN comms.

Thanks again for all help lads :tee:

[shooting]

Just in case it will help anybody in the future who gets one of these, I will post what I have found after a good few hours of experiments.

There is an initial cancheck which comes up as "Check" when you first power the set, then if you are able to bypass this, it allows you to enter the code with prompt "0000".

If you enter the correct code, it goes to a boot screen and then you see the secondary "check". This is where I was getting confused, the cancheck removal by you guys was successful in many cases because it actually let me go to the code entry screen and enter the code.

BUT, once code has been accepted the radio starts looking for its comms on CAN - it is not security or anything, it is just like the Visteon Stilo radios where they won't function without an incoming CAN stream.

There is also a vin number in the dump, but it is of no importance here. When I plug the set into the 29bit CAN rig, it accepts the code and works perfectly with no problems due to vin mismatch.

I will attach screenshots in case it will help somebody to not lose as many hours as I have lol

The long and short of it is, if you want to run this set on the bench or in a different type of vehicle, you gonna need 29bit CAN signal - even AFTER you remove the initial cancheck.....

This applies only to this type of unit with immo signature line at #360h If you have the other type with signature line at #260h it seems that on those you can still fully remove the need for CAN comms.

Thanks again for all help lads :tee:

Try this:
0DAh ~ 0F0h change to "FF" as this might overcome the secondary VIN check on the CAN.
This is a fix from another model, couldn't hurt to try :)

wbr

[KierAn20]

Try this:
0DAh ~ 0F0h change to "FF" as this might overcome the secondary VIN check on the CAN.
This is a fix from another model, couldn't hurt to try :)

wbr

Yeah did em mate, vin all @FF, @FE, @00 even took that entire block out lol

Realised (after I did it of course) that there can't be a vin match check on these because my rig has an entirely different vin and the set works perfectly on it.

Cheers for the suggestion though, anything is worth a try :encouragement:

[shooting]

Yeah did em mate, vin all @FF, @FE, @00 even took that entire block out lol

Realised (after I did it of course) that there can't be a vin match check on these because my rig has an entirely different vin and the set works perfectly on it.

Cheers for the suggestion though, anything is worth a try :encouragement:

The only thing I can think of is maybe it's CAN hardcoded via the MCU and will only work with a CAN signal.
If this is the case nothing in the eeprom will stop it from needing the CAN.. tho saying that other similar models
have solved this in the eeprom.. very interesting radio :)

wbr

[KierAn20]

The p40 flash chip could very well hold some clues. It is unusual but not unheard of - the CD50 sets have a 95640 and a 25p10, yet the code and all of the pairing data is in the p10!

Either way, this one is going back to the customer. Not enough hours in the day as it is lol

[kowalskidebno]

Hi mate.
Who can calculate the code
815 cm0095 e 0719517
Iveco Bosch
7 620 000 095
eeprom 95640

[irfa]

Hi mate.
Who can calculate the code
815 cm0095 e 0719517
Iveco Bosch
7 620 000 095
eeprom 95640
...............................4124

[kowalskidebno]

code ist not corect

org bin file
https://megawrzuta.pl/download/22d647671e35638fd3a1be09c3753da3.html

[masterskay62]

Hi.
The link is not available

[Raimax]

Code by dump 4124