PDA

View Full Version : Antichiptuning protection



MartinF1
1st July, 2019, 09:03 PM
Hello
Can someone check if this golf 6 2.0tdi 110hp have antichiptuning protection?
Thank you

EDC17CP14
SW: 1037564026
SW upg.: 03L906022LF 9978
Installation: R4 2.0l TDI canvag - int flash

I am asking because clone KTag cannot remove it as far as I have experience with golf 6 so I don't need to dissassemble everything.

morgano
2nd July, 2019, 08:17 AM
Based on the software number it has.

AVDigitale
2nd July, 2019, 08:45 AM
before 2009 not have tprot ,after 2009 have tprot

MartinF1
2nd July, 2019, 12:16 PM
Based on the software number it has.


Thank you, how can you check that so I can know for the future cars :)

AVDigitale
2nd July, 2019, 12:21 PM
check the date of production car
year day and month

morgano
2nd July, 2019, 12:31 PM
It is not 100% but as general rule, 10373xxxxx normally not TPROT, 10375xxxxx you cannot trust, most probably TPROT.

The way to be 100% sure is open bootmode read in hex editor and search for string "TPROT"

SpecZ
2nd July, 2019, 12:41 PM
Depends on the machine you are using..

For example CMD and Kess don't make some older versions by obd, even with no TP..

(Talking about genuine devices only.)

But CMD updated that in they latest releases (forgotten cars).

"VAG edc17/med17 tp2.0 full obd ( also TProtected one ) VR/W/CHK/Recovery"

Ignasvw
2nd July, 2019, 03:41 PM
Depends on the machine you are using..

For example CMD and Kess don't make some older versions by obd, even with no TP..

(Talking about genuine devices only.)

But CMD updated that in they latest releases (forgotten cars).

"VAG edc17/med17 tp2.0 full obd ( also TProtected one ) VR/W/CHK/Recovery"
Yeah sure.. just finished phaeton edc17cp04 with cmd. reading ok. on writing said hardware is protected, make boot mode.
If it has virtual read, then work.

SpecZ
2nd July, 2019, 05:29 PM
Yeah sure.. just finished phaeton edc17cp04 with cmd. reading ok. on writing said hardware is protected, make boot mode.
If it has virtual read, then work.

It seems that you went to OBD Tools/VAG OLD and used the EDC17Cp04/14 TP20 protocol, who doesn't have VR.

But it's a VR protocol and obviasly as the back to stock if you go trough the car menu.

Br.

Michael

filecloud
2nd July, 2019, 05:51 PM
It does not matter. Use protocol 501, make VR, write Tuning over OBD. File is available on VR Server.
Job done in15 minutes
:-)

SpecZ
2nd July, 2019, 07:32 PM
It does not matter. Use protocol 501, make VR, write Tuning over OBD. File is available on VR Server.
Job done in15 minutes
:-)

In some ecus...

We wish!

filecloud
2nd July, 2019, 09:30 PM
No wish. P501 takes care about that and makes full write with patch in first block. Like on CP20, CP44, C46, C64, C74. All those work fine.

LaraVAG
2nd July, 2019, 09:58 PM
the best idea is, download software from ECU by OBD2, check SW and CALIBRATION UPDATE, next encrypted the same SW and CALIBRATION SGO or FRF to normal bin. file and find what TPROT you have :)
you will know all what you need. that is the true

filecloud
3rd July, 2019, 07:07 AM
the best idea is, download software from ECU by OBD2, check SW and CALIBRATION UPDATE, next encrypted the same SW and CALIBRATION SGO or FRF to normal bin. file and find what TPROT you have :)
you will know all what you need. that is the true

No good idea. TPROT string is in file but if tprot is really active or not you can only see in OTP area! And you cannot read this over OBD. And it is also not in sgo.
So use P501 and off you go

LaraVAG
3rd July, 2019, 07:28 AM
No good idea. TPROT string is in file but if tprot is really active or not you can only see in OTP area! And you cannot read this over OBD. And it is also not in sgo.
So use P501 and off you go


no true, belive me.

filecloud
3rd July, 2019, 07:50 AM
believing is fine. knowing is better. and i can read code!
tprot 2, tprot 7, tprot 8-10 string is in all softwares from certain number onwards. but it is only active when it finds code piece inside otp area. and this depends on production time of ecu. nothing else.
I have done many tunings on cars with same software number. cars released without tprot active in otp can be updated to latest version and still be tuned datablock only with bleichenbacher collision for faked ripemd160 hash and exponent 3 signature block.
ecus with same software but tprot active in otp do NOT work this way. But they work with patch in first block which switches off second level signature check.
So you are back on protocol 501 on kess which works on ALL of them
:-)

morgano
3rd July, 2019, 08:47 AM
believing is fine. knowing is better. and i can read code!
tprot 2, tprot 7, tprot 8-10 string is in all softwares from certain number onwards. but it is only active when it finds code piece inside otp area. and this depends on production time of ecu. nothing else.
I have done many tunings on cars with same software number. cars released without tprot active in otp can be updated to latest version and still be tuned datablock only with bleichenbacher collision for faked ripemd160 hash and exponent 3 signature block.
ecus with same software but tprot active in otp do NOT work this way. But they work with patch in first block which switches off second level signature check.
So you are back on protocol 501 on kess which works on ALL of them
:-)

Very nice explanation.

If you don’t mind i may send you a pm later and maybe you can guide me in a project i am trying to achieve with ida ;)