Mercedes A-Class W168, 170CDI, Start ERROR after Immobox read... (HELP)

[WinWoj]

Hi Folks. In my A-Class, W168 I had sporadically Start Error.
So I decided to read all memories in ECU and Siemens IMMObox.
In ECU I've read eeprom 24C04.
Key transponder (number 1 i think):
DATA: 751C5B04011712521500000000008101,
CHIP: PCF7935
TYPE: ??

In Immobox I had some problem to read 68HC05X32 using UPA.
I've used adapter Type 16, but after some jumper's tests I've read.
EEPROM gave me only 'FF' values.
All memory gave me some data, but eeprom area was filled 'FF'.

I tried write something in eeprom area, and succesfully read them,
but overwrite 'FF' again.

And after that - car definitely damaged with continuosly 'start error'.

Before I read some data during diagnosis (identyfy, number of key etc.)

How can I rebuild dump, to write keys, identyfy data and immo sync?

I attach data as I saved:
(files)

RFL (Immo) Identyfication during Diagnostic session data:
MB number: 168 820 04 26
Supplier: Siemens
Hardware status: 10/00
Software status: 43/96
Diagnostic identifier: 0/1


RFL (immo) actual data during Diagnostic session data:
Tml.30: YES
RF/IR transmitter key last used: 1
Transponder amplitude: 27.18 V
Partial scopes of version coding inhibited: YES
Writing vehicle ident number inhibited: YES
Workshop programming inhibited: YES

RF/IR key 1 synchronized: YES
Transponder 1 initialized: YES
RF/ID transmitter key/Transponder 1: approved

RF/IR key 2 synchronized: YES
Transponder 2 initialized: YES
RF/ID transmitter key/Transponder 2: approved

RF/IR key 3 synchronized: NO
Transponder 3 initialized: YES
RF/ID transmitter key/Transponder 3: approved

RF/IR key 4..8 synchronized: NO
Transponder 4..8 initialized: NO
RF/ID transmitter key/Transponder 4..8: approved

After HC05x32 eeprom damage, diagnostic sesion data is:

RFL (Immo) Identyfication during Diagnostic session data:
MB number: FFF FFF FF FF
Supplier: Undentified
Hardware status: FF/FF
Software status: FF/FF
Diagnostic identifier: 7/31

RFL (immo) actual data during Diagnostic session data:
Tml.30: YES
RF/IR transmitter key last used: 1
Transponder amplitude: N/A V
Partial scopes of version coding inhibited: NO
Writing vehicle ident number inhibited: NO
Workshop programming inhibited: NO

RF/IR key 1 synchronized: NO
Transponder 1 initialized: N/A
RF/ID transmitter key/Transponder 1: approved

RF/IR key 2 synchronized: NO
Transponder 2 initialized: N/A
RF/ID transmitter key/Transponder 2: approved

RF/IR key 3 synchronized: NO
Transponder 3 initialized: YES
RF/ID transmitter key/Transponder 3: approved

RF/IR key 4..8 synchronized: NO
Transponder 4..8 initialized: N/A
RF/ID transmitter key/Transponder 4..8: approved

[juanes 3]

good friend I think the solution you have in ecuvoniz immo you have to match dunnp anbos to be conpativel, the problem is the dunps are out of sync

[WinWoj]

Mate, when I using Immo Universal Decoding 3.2 and load such HC05X32 dump from another immo boxes, it always saving the same file with strange data, I'm not sure is proper... Only way is rebuild eeprom file from data I registered during diagnosing and in ECU eeprom...

[alefabi2006]

I did this job this week. immobox x32 file plus key generated. I hope you are useful

[WinWoj]

Thanks mate. I will try with this. But I have some questions :
1. Do I need make something with CDI ECU? I have star.
2. Zedbull with EFfi can reprogram existing pcf7935 with your file? Or gambit maybe..
3. Which software can read key hashes, synchronization, SW, Hw and all info from hc05x32 dump to repair.

Best regards

[alefabi2006]

you are definitely going to need virgin ecu file, because your immo box is ffff. the key is a txt and capture generated from the new key generated
you

[WinWoj]

Coud somebody virgine my ECU dump? Then I test previous solution.
Best Regards

[WinWoj]

Hi again. Really there are no possibilities to repair this car, using original ECU, original key and star diagnosis, to match used immobilizer module, when I lost original Eprom data of immobilizer module?

[janusz21]

use emulator immo works ok

[WinWoj]

I know that, but I have to repair immo this time.

[Milkman]

Here you have virgin eeprom, use another WSP dump, new transponder and perform identification with DAS.

[WinWoj]

alefabi2006 gave me wsp dump with key dump, I written x32 eeprom, with ori transponder had fault. I looking for empty pcf7935 (found 36) and will wtite ecu eep. Thanks

[WinWoj]

Mates, I found one FBS immo module with paired transponder from another A class, A140 this time, so I used them with also Milkman's ECU dump, and start error remains, but FSB hasn't fail now, and ECU has incorrect eeprom coding, I will check everything in Star Diagnosis, but how to perform identification? This is that Vin writing? I'm not sure that it will work.. Will see,

I'm very interested, is there any way to write FBS dump for existing key....

WbR

[WinWoj]

I'm still thinking about the way to match used transponder to Mercedes FBS immo module. During few hours playing with eeproms and SD coding I know something about eeprom area, both ECU and Immo. So the fact is, that in FBS immo module, in Motorola's Hc05x32 flash is the cryptography algorithm, which can program empty transponder and lock them. Original FBS was paired with Pcf7935 transponder in this A170cdi case. But when I damage eeprom in FBS, I use another FBS from A140 paired with PCF7930. And after SD synchronization car works ok, with some coding errors in ECU, but nevermind.

I think, if cryptography algorithm is known (tango, efii, gambit, fvdi etc.) there could be reversed and used transponder with known ID would be translated to bytes in FBS eeprom area to pair together... What do you think, guys? I'm still thinking about it and can't stop, really!
BR

[WinWoj]

Anybody knows something about it?