Service mode investigation

[drpeter]

Hi guys,
I wanted to know how the service mode is calculated, it is much easier then I thought.

All instances below can be used to put a car in service mode no matter what car (Passat CC. Tiguan, Polo, Golf6 etc...) with NEC processor and 24C32 memory. I calculated many dumps and one of the following strings are used in all cars. Every instance will work!

Polo 2010 service mode instances based on same dump

adress 0D80 till 0D8F

6F 10 E3 EB 2C DE F8 FA EE 06 B5 EE 74 D5 D1 2E
30 9B 04 7D 13 6B 89 DF F5 13 4D 4F F2 AC 36 F1
6F 10 E3 EB 2C DE F8 FA EE 06 B5 EE 74 D5 D1 2E
E0 27 72 05 2C 33 0D 0E 94 56 D3 93 97 9C 9A 10

Tiguan 2010 instances based on same dump

61 B0 A0 01 21 29 D3 65 EF AF 73 19 FB 8E 26 66
F5 0D F4 4A 7E A8 15 8B CF B5 8F B8 D8 79 4D 3A
12 2F 70 72 F9 70 81 E0 DC B9 63 48 D8 91 04 65
88 92 AE 3B C8 A7 71 8F E4 E4 FA E1 AC 07 A7 35
CE D4 27 F4 5D 15 AC 69 B6 1E 10 3F 81 B1 18 B0
1A 47 7C BD 78 1A AD 6B F2 BA CC ED F8 6C D1 33
E3 A5 87 07 1E AB 20 EB 6C 14 5A D2 2F F4 CC 02
EB 6A 19 6B BB BC DC 2C BF B1 04 88 FE D3 E6 0B
6B 80 17 43 F5 A3 BA 18 39 1E AD 48 8E 9E 60 1E
2A 1A 1D 2C 05 96 DD 63 31 89 89 55 C9 4B AB 05
38 4D 8E B3 37 92 76 6E 84 C8 52 BB 33 44 FB C9
38 4D 8E B3 37 92 76 6E 84 C8 52 BB 33 44 FB C9
61 B0 A0 01 21 29 D3 65 EF AF 73 19 FB 8E 26 66
30 9B 04 7D 13 6B 89 DF F5 13 4D 4F F2 AC 36 F1

[carbandit]

good work from the good dr:congrats:

[H.Wessel]

hi

could you explain a litte more?

thanks
H.W

[mastaflex]

Polo 2010 service mode instances based on same dump

adress 0D80 till 0D8F

6F 10 E3 EB 2C DE F8 FA EE 06 B5 EE 74 D5 D1 2E
30 9B 04 7D 13 6B 89 DF F5 13 4D 4F F2 AC 36 F1
6F 10 E3 EB 2C DE F8 FA EE 06 B5 EE 74 D5 D1 2E
E0 27 72 05 2C 33 0D 0E 94 56 D3 93 97 9C 9A 10

Tiguan 2010 instances based on same dump

61 B0 A0 01 21 29 D3 65 EF AF 73 19 FB 8E 26 66
F5 0D F4 4A 7E A8 15 8B CF B5 8F B8 D8 79 4D 3A
12 2F 70 72 F9 70 81 E0 DC B9 63 48 D8 91 04 65
88 92 AE 3B C8 A7 71 8F E4 E4 FA E1 AC 07 A7 35
CE D4 27 F4 5D 15 AC 69 B6 1E 10 3F 81 B1 18 B0
1A 47 7C BD 78 1A AD 6B F2 BA CC ED F8 6C D1 33
E3 A5 87 07 1E AB 20 EB 6C 14 5A D2 2F F4 CC 02
EB 6A 19 6B BB BC DC 2C BF B1 04 88 FE D3 E6 0B
6B 80 17 43 F5 A3 BA 18 39 1E AD 48 8E 9E 60 1E
2A 1A 1D 2C 05 96 DD 63 31 89 89 55 C9 4B AB 05
38 4D 8E B3 37 92 76 6E 84 C8 52 BB 33 44 FB C9
38 4D 8E B3 37 92 76 6E 84 C8 52 BB 33 44 FB C9
61 B0 A0 01 21 29 D3 65 EF AF 73 19 FB 8E 26 66
30 9B 04 7D 13 6B 89 DF F5 13 4D 4F F2 AC 36 F1

good work DR PETER, did the first instance worked on your polo 2010 dash?

why sequence for tiguan is different from the first ?

thanks

[milesbetteroff]

Hi mate I must admit I don't really understand what you mean with this are you saying that the mileage can be changed once the dump has been put into service mode and how do you change is it obd or ? And what do you use to change mileage hope you can help me I have new golf to change tomorrow if I can let me know if you think possible thanks mate

[drpeter]

Hi mate I must admit I don't really understand what you mean with this are you saying that the mileage can be changed once the dump has been put into service mode and how do you change is it obd or ? And what do you use to change mileage hope you can help me I have new golf to change tomorrow if I can let me know if you think possible thanks mate

Hi mate, after you have put the dash in service mode you can adjust the mileage by OBD2. I use vagprog for this, I've heard you can use also other tools to adjust the mileage then but never tried it. I also don't know how. One thing is clear, when in service mode you have read/write access to the mileage data. You can try to adjust mileage with VCDS for example after putting car in service mode. Let us know the outcome.

[exe123]

You can try to adjust mileage with VCDS for example after putting car in service mode. Let us know the outcome.

This will not work.

[einet]

Hello,

way?

[milesbetteroff]

Hi guys thanks for that I have put car off till tomorrow will let you know how I get on cheers

[Vicky5678]

How to put Nec 24c64 to service mode?
Thank you

[zckariya70]

How to put Nec 24c64 to service mode?
Thank you


I don't think there is service mode in 24c64.

[H2Deetoo]

All VDO NEC 24C32 clusters use the same key, so you can copy that block.
Each VDO NEC 24C64 uses a unique key, so you cannot copy block, it will result in ERROR.

[daniersms]

This is actually a very old thread but have a look on the Carprog website there is a nice explanation how to do this for the 64 an 32

[H2Deetoo]

No, that's something different!
The problem is that the term "service mode" is used for 2 different things. Most people dont know the difference and so use the wrong terms ...

[Vicky5678]

Hi, Can you please explain it in details,
Sorry but i didnt understand the procedure.
Thank you.

[H2Deetoo]

The term "Service mode" is used for 2 different things.

1) If you don't have a valid carkey for the cluster, you need to disable/destroy the immo data in the eeprom to be able to access it.
This is called put in service mode, but personally I think the term is wrong. Just say "disable immo".

2) For 24C32 clusters you can unlock them using only an eeprom modification. This means cluster will be service level 7 and you can fully read/write it if you have proper tool.
This is also called put in service mode, and I think this one is the correct one.


Rgs H2Deetoo

[steveleo]

For 24C64 this eep modification still exists, too. But you need info from flash to do it. But nowadays you can do all this stuff via obd, so no more direct eep connection needed. And i honestly don't know any other way to put a 24c64 to SL7 if not by diag.

Anyway reviving a thread that old -> gravedigger... :stung: (Not to H2Deetoo, to you a thx for the explanation)


The term "Service mode" is used for 2 different things.

1) If you don't have a valid carkey for the cluster, you need to disable/destroy the immo data in the eeprom to be able to access it.
This is called put in service mode, but personally I think the term is wrong. Just say "disable immo".

2) For 24C32 clusters you can unlock them using only an eeprom modification. This means cluster will be service level 7 and you can fully read/write it if you have proper tool.
This is also called put in service mode, and I think this one is the correct one.


Rgs H2Deetoo

[H2Deetoo]

Correct. You cannot put a 24c64 cluster in sl7 with only an eeprom file, you always need the key from flash and that can only be done by OBD.

[talk2idris]

very nice post with good explanation

once again thanks to all of you

[km6464]

hi and thanks a lot for your posts :-)

i have some questions about the service mode:

the audi a3 2011 has the 24c32 with micronas and can be set to service mode via 24c32 flash with mod bin file.

in service mode with security access 7 is it possible to do a full dump of the micronas with vag can pro (vcp)?
or is it maybe possible to do the full dump with a genuine basic avdi (no extra feature activated) ?

the goal is to get immo data and read pin ( got a valid car key )

[H2Deetoo]

If cluster is VDO NEC 24C32 then you can write SL7 directly to eeprom.
Any reasonable quality tool is then able to access that cluster, read eeprom, immo, flash etc.
But in the end it all depends on what the tool allows you to do etc.etc.