PDA

View Full Version : How to read coded (copy protection) chips?



michi84
11th November, 2010, 08:07 PM
I have an eeprom with extra socket (copy potection from Graau tec (http://www.grautec.de/body.php?lang=en&navpoint=kopierschutz&sub=ksm&detail=10)) liying on my desk. I read the eeprom seperate and also with socket. I got two different readings.. and of course no one is ok;) what can I do? Why is ECU able to read from the eeprom and not my eeprom reader?

michi84
11th November, 2010, 09:39 PM
After more googleing I read about the difference between ECU reading and programmer readings...
If ECU is reading a single adress from EEPROM it switches CS (chipselect) every time. If I want to read with programmer, chipselect is always set tpo on... This is noticed by the little extra IC on the socket and it returns only crap data...
So I need to write a skript for my willem Programmer to switch CS after reading an adress... But I dont know how... someone does?

dof
11th November, 2010, 09:58 PM
Hi Michi84, if you can, just out the eprom with the GrauTec protection, put this on your programmer and read it, you can understand that the data in original program must go to the same way....
no need to past your time in program if you have all ....

michi84
11th November, 2010, 10:21 PM
Hi Michi84, if you can, just out the eprom with the GrauTec protection, put this on your programmer and read it, you can understand that the data in original program must go to the same way....
no need to past your time in program if you have all ....

i did exactly that, but its crypted and trash! I read eeprom and also eeprom with grautec socket.... both are crypted trash. different, but trash :)
there is a way to decrypt the eeprom read, but i think its easier to read socket& eeprom with a behavior like ECU....then you get a proper reading..

michi84
11th November, 2010, 11:40 PM
maybe i was wrong... its not CS its OE output enable.
Is there a way with a programmer (Willem) to toggle OE after reading a single address?

v8 dave
12th November, 2010, 12:19 PM
Don't know enough about it personally, but I'd be very interested to learn. I paid ?745 for a single chip(!) for my 1996 V8 Range Rover, and I'll be blown if I'm going to be stopped from copying it and putting it in my other car (same engine, same EFI system, fitted in a Ford Sierra :D )

maxtdi
12th November, 2010, 03:23 PM
Included all algorithm from EVC,also used from Dimsport and CMD and many other comp....................

v8 dave
12th November, 2010, 03:50 PM
So. do we simply read the contents out of the EPROM on the board or through the copy socket?

How do we know which algo to choose?

maxtdi
12th November, 2010, 04:00 PM
Read only eprom and use for saving file extension -file.key. Copy protection key from EVC,CMD,DIMSPORT.and..and..have algorithm number on board 600_00,500_00,101_00.......

Then winkey d 600_00 file.key


Or send me key file, make for you...

maxtdi
12th November, 2010, 04:06 PM
KEY101 (http://www.evc.de/en/image_any.asp?title=KEY101&img=Keys/key101.jpg&urlback=/en/product/keys/keys.asp%23KEY101)

v8 dave
12th November, 2010, 04:20 PM
Thanks! I'll have to play with this!

Think mine may be key400 though, as it's a PLCC44?

maxtdi
12th November, 2010, 04:29 PM
yes 400 or 410

michi84
12th November, 2010, 06:45 PM
Is it also for Grautec KSM-DIL28?
I dont know how to use this soft.. maybe someone can help me.. I attached the coded file which I just read from the eeprom.
thx

maxtdi
12th November, 2010, 06:48 PM
file????? and car ?????

michi84
12th November, 2010, 06:57 PM
file????? and car ?????

sorry. its vw golf 2 g60
m27c256b

I got the program to work, but dont know any code for grautec... but as the write on their HP everybody gets his own unique coding....maybe it doesnt work for their chips...

maxtdi
12th November, 2010, 07:10 PM
Graau tec use another algo..like adress line swap...

winkey suport only evc keys...90% of market

sorry

easytech
13th November, 2010, 01:08 AM
Do you have an algo for key610/620 ?

maxtdi
14th November, 2010, 06:31 AM
upload file..

easytech
14th November, 2010, 10:06 PM
Attached an encrypted file, I tried the program to decrypt some files from my own Winkey i use but it doesn't work.

kevfield
15th November, 2010, 10:50 PM
michi84 post your file i might be able to uncode your file, who do you think is the author of your file? i might be able to help with algo to unpack it.

Thanks kev

michi84
16th November, 2010, 06:12 PM
with this kind of encoder/decoder its not possible to decode other files than yours I think ;)
or do you have unique key?
but thx anyway...

jlaudio982
5th December, 2010, 06:06 PM
I have a ksm dil28 and a at29c256 that I am trying to crack. No luck so far...

tango
5th December, 2010, 11:45 PM
Attached an encrypted file, I tried the program to decrypt some files from my own Winkey i use but it doesn't work.

hi do u have the original for this car?
also what are the details for the car ?

easytech
5th December, 2010, 11:58 PM
Yes i have the ori and the original mod. I was just playing around to see if this decoder work.
But it doesn't work for the E*C key's. The file becomes crap.
In the past I used lots of anti copy boards for eproms but with the flashroms you can still read the ecu by K or can line

tango
6th December, 2010, 12:14 AM
give me the details for the file ie chip etc and i'll see what i can do and will post back
i can do most evc encryption boards and dimsport
not with the software thats been posted on here

easytech
6th December, 2010, 12:31 PM
Yes I can do that too, no problem if you have an original:proud:
Thanks anyway.

tango
6th December, 2010, 05:01 PM
i didnt ask for the original
i asked for the chip details it was read off
and what car

DRX
6th December, 2010, 08:43 PM
I tried the program to decrypt tun file BMW X5 4.6 V8 0261207106 29F400...
I use all Winkey algorithm, but it doesn't work.
I dont have ori file for this car.
Thanks, maxtdi.

ptikkala
7th December, 2010, 11:01 AM
How do you read the file from your car? Id like to read it from my EU 535i 96/12 and give it to someone who could tune it up, but dont know how... i know how to use bmw scanner/inpa etc diagnostics software and i do have those cables...

DRX
7th December, 2010, 11:49 AM
I have not read. My friend read flash by the programmer and sent file to me. He does not like this chiptuning, but we have not stock file.
I can change this file, if it was decodes.

tl22bq
12th April, 2013, 07:52 PM
Great work maxtdi just got an volvobrik with key101 and bump not so easy to move rpm limit in that bin so i will test your evc decoder some day and see :)

tasosko
12th April, 2013, 08:10 PM
I got the program to work, but dont know any code

mattsson
13th April, 2013, 12:55 AM
For old Key101 you can read right trho it if you hawe a labtool 48 for exampel just use Low wolt "chip driver"
old Superchip has diffret type that i dont know

tl22bq
13th April, 2013, 11:49 AM
cant get the winkey to work it only shutsdown ? what do i do wrong?

tl22bq
20th April, 2013, 09:43 PM
oki got it to work but it dosent scramble the bin back to normal

AlexG40
26th August, 2014, 06:46 PM
I got in my hands a marelli 1av ecu that has a plcc32 27c512 eprom. Basically it has a EVC 512 key. Its a converted unit from autotest that has a internal map sensor for boost applications.
I am reading the eprom and the file is a mess...
Do you have any ideas how i will sort this problem?

kennfeld
27th August, 2014, 10:23 PM
the board are the boards
then each tuner has his own coding
otherwise his competitor ca see the files uncrypted it should have no sence ....

all this board have anyway no sense since the processor from the ecu read the map ....

and so you can also read the map ;-D just by loging

bobolin4o
28th August, 2014, 06:44 AM
Why the hell you want to read someone else job? There is not any big secret in tuning maps.
Just remove this crypto board, program chip with appropriate software and go ahead... Or if you have some doubts about your skills, take a spare ECU and play with it.

redtop
28th August, 2014, 11:35 AM
Why the hell you want to read someone else job? There is not any big secret in tuning maps.
Just remove this crypto board, program chip with appropriate software and go ahead... Or if you have some doubts about your skills, take a spare ECU and play with it.

Could be a thousand reasons you would like to decrypt a chip. I helped an Alfista who had a scrambled chip in his track day car. It was a M2.10.3 ECU with a PLCC32 socket. In that socket was an adapter to DIL28. In the adapter was the protection board, and in the protection board the EEPROM. He had huge problems with the car cutting out randomly. I replaced the awful stack with a plain unscrambled EEPROM and the car never failed since. (see picture).
274782

Right now I have in my hands another copy protected EPROM for a 155 Q4 with absolutely no marking on it. The owner would very much like to know what chip this is, who made it etc. Descrambling it is the only way to get any closer to knowing what it is.

AlexG40
28th August, 2014, 10:51 PM
These ''made'' ecus are sold 15 years back from autotest. They convert the n/a afh 1.4 16V engine to turbo.
I want to edit the file, to run with bigger injectors and more boost...
Back in the day it was probably a secret setup but nowadays its a cheap way to boost this engine...

I read the file and its a mess....
I i read the file with a programmer and if i desolder the key and stick it to the programmer complete with the eeprom, am i going to read the file properly?

2200
19th October, 2016, 11:43 AM
These ''made'' ecus are sold 15 years back from autotest. They convert the n/a afh 1.4 16V engine to turbo.
I want to edit the file, to run with bigger injectors and more boost...
Back in the day it was probably a secret setup but nowadays its a cheap way to boost this engine...

I read the file and its a mess....
I i read the file with a programmer and if i desolder the key and stick it to the programmer complete with the eeprom, am i going to read the file properly?

Have you finally managed to read the file ?

tango
19th October, 2016, 04:32 PM
take out the adapter board with everything on it (maybe also remove the flash chip and just read this) (forgot which needs to be done, its been a few years since i looked at these encrypted files)
put into a programmer and read
then post the dump here with has much info about it you can
ie key101 etc
also ecu type and what the flash chip was you read ie 27c1024 etc
also when posting dump make sure you name it encrytped

gussone
28th March, 2017, 11:13 AM
Hi, got a problem with this Volvo FH12-420 27C512 DIL 28 Encrypted file ... can someone help me understand?
Encrypted with EVC 101


438909

Many Thanks in Adavance

poxxxy
6th April, 2017, 10:16 PM
Anyone help with 610 algo?

Mykk
19th July, 2017, 02:40 PM
I just wanted to chime in with my results.

I was able to read a 28 pin 27C512 that was encrypted and using a Key101 to run a bosch motronic M3.3 in a BMW.

Using a Universal TL866CS chip reader/programmer and it's supplied software MiniPro v6.5 I got a clean read of the .BIN from the encrypted chip with the Key101 attached. I verified by loading the .BIN read to a chip emulator and the vehicle ran beautifully.

In the MiniPro software select the 27SF512 chip ID, uncheck the "Erase Before" and "Check ID" options then read...

Side note; the TL866CS was also able to erase/blank a series of fake SST 27SF512's acquired off Ebay, something my Moates Burn2 couldn't do.

midnightman1
18th September, 2017, 09:36 PM
Guys can anybody decrypt MSD ( Motorsport developments) chips for Cosworth? 27C256 P8 ecus?

thanks

aboutton
1st December, 2017, 12:57 PM
ver usefull post, thumbs up

aboutton
1st December, 2017, 12:58 PM
very useful information, thumbs up

midnightman1
15th February, 2020, 09:24 PM
any news? need solve KSM grautec...27C256

boogey123
21st May, 2023, 01:08 PM
Hi.
I read this chip with this daugter board with a TL866A and got this file.
How can I be sure the data is the right for my DME.
Where are the points in the file to see if it's de- or encrypted?