Audi A3 8P Dash data swap

[g5n14]

Hello!
Have an Audi A3 8P 2007. Someone damaged data in crypted area of 24c32 (0x812 - 0x9BF).
Right now after decryption it shows everything 00 (VIN,CS,MAC).

I need to move immo data from ECU to this DASH.
I have attached the IMMO data as text here. dump 24c32 crypted and decrypted, micronas flash.

SOMEONE WHO HAS AVDI/FVDI whatever, just put files into Audi - Instrument (CAN) - Micronas CD32XX + 24c32 - immo data from eeprom+flash.

YOU NEED TO USE CRYPTED FILE + FLASH Micronas. Just transfer the below data and save the file, it will be enough.

VIN: WAUZZZ8P28A050808
IMMO NUM: AUX7Z0G7FN90D0
CS: AEC557335D8A00
MAC: D6C41348
PIN: 09056
KEY1 ID: D54210F9


Thanks a lot!

[morgano]

Not enough IMHO, on ecu missing 7th byte of CS.

[g5n14]

Not enough IMHO, on ecu missing 7th byte of CS.
Thx! Will read 7th byte now from somewhere, brutforce key or comfort box. Will post an update.

[immoneard]

7th byte yo can read form key if you have Tango, AVDI or VVDI.

But I think in your case someone try to do Service mode on this cluster by loading molded eeprom and leave like that , so even if you match all data correct way you may still have problem. Your bast solution is to find same part number Flash and eeprom and flash that cluster , then after that pair data with ECu and 7byte form key .

[g5n14]

7th byte yo can read form key if you have Tango, AVDI or VVDI.

But I think in your case someone try to do Service mode on this cluster by loading molded eeprom and leave like that , so even if you match all data correct way you may still have problem. Your bast solution is to find same part number Flash and eeprom and flash that cluster , then after that pair data with ECu and 7byte form key .


Hello! Thanks a lot for your answer. I don’t have tango or VVDI2 unfortunately, will get right after that case (it’s pretty urgent). Since with immo off windows were not working, I assumed that there is CS inside the comfort module or BCM. I have read 95080 inside BCM - nothing interesting there, nothing looking like CS. I have read HC908AZ60 with 0L40X maskset from comfort box with orange 5, all files (eeprom + 5 flashes). I have manually surfed through files and also no matches. I think that this HC08 stores CS, but crypted, and most probably no one in this world knows how to decrypt.


For now I have only zedbull + EFFI, Carprog from tools which are capable of R/W Megamos 48, so I can’t brutforce the 7th byte. I think maybe I buy new transponder, make the 7th byte 00 and write it to dash? Or then I have still ABS and windows problems?

[rafal]

save your coding of ABS - if ready lost - you will need recode :
https://www.digital-kaos.co.uk/forums/showthread.php/524246-MK60-ABS-long-coding-for-members

[morgano]

Hello! Thanks a lot for your answer. I don’t have tango or VVDI2 unfortunately, will get right after that case (it’s pretty urgent). Since with immo off windows were not working, I assumed that there is CS inside the comfort module or BCM. I have read 95080 inside BCM - nothing interesting there, nothing looking like CS. I have read HC908AZ60 with 0L40X maskset from comfort box with orange 5, all files (eeprom + 5 flashes). I have manually surfed through files and also no matches. I think that this HC08 stores CS, but crypted, and most probably no one in this world knows how to decrypt.


For now I have only zedbull + EFFI, Carprog from tools which are capable of R/W Megamos 48, so I can’t brutforce the 7th byte. I think maybe I buy new transponder, make the 7th byte 00 and write it to dash? Or then I have still ABS and windows problems?

You should have uploaded that BCM and COMFORT dumps :)

[marinescuv]

for...?
a3 2008 have immo data on ecu ,dash and key

[morgano]

for...?
a3 2008 have immo data on ecu ,dash and key

Then this can help him, dash eeprom with his data entered and CS 7th byte = 01 , if he puts it in dash and make new keys with that CS it should work. isn't it?

If no CS present in BCM nor COMFORT.

743351

Took missing data out of another dash A3 8P, hope power class status and config will be good for him

Have seen PC on A38P dash i have saved powerclass is 51, added dump with that corrected.

[g5n14]

Then this can help him, dash eeprom with his data entered and CS 7th byte = 01 , if he puts it in dash and make new keys with that CS it should work. isn't it?

If no CS present in BCM nor COMFORT.

743351

Took missing data out of another dash A3 8P, hope power class status and config will be good for him

Have seen PC on A38P dash i have saved powerclass is 51, added dump with that corrected.

Thanks a lot! Thats What i needed. Will test tomorrow once i come to work. Have spent the whole day on trying.
really appreciate your help!

[g5n14]

You should have uploaded that BCM and COMFORT dumps :)

will post those dumps tomorrow, really interested if someone is capable of decoding this HC08. Havent found Any info Whatsoever

[g5n14]

for...?
a3 2008 have immo data on ecu ,dash and key

The Windows were also not working so i thought there is a CS in BCM also.

[immoneard]

The Windows were also not working so i thought there is a CS in BCM also.

They not working because you have Immo off with mess up data in cluster. On that car BCM has nothing to do with Immobilizer .
Your key will not work if you made 7byte CS just out of nowhere . You will have to program new ID 48 , which has to be recoded with CS.

[g5n14]

Yah thats true. I already understood. And ofc i will program new key. Do i need to write anything else other than CS into ID48? And if done manually, which pages in transponder should store the CS?

[g5n14]

I will now try to brutforce the 7th byte while waiting for the new kew blank (i dont do VAG on daily, so dont have those)

And if someone can try to extract CS from comfort box (if that is possible at all), would be good. Dumps uploaded, HC08 0L40X.

[g5n14]

Just tried the morgano file. The PC 51. Works, ABS erros went away. SAFE on dash, ofc no start. 25-immo now can be diagnosed (before was out completely), throws error Control Module ROM damaged. Waiting for the new key.

[morgano]

Just tried the morgano file. The PC 51. Works, ABS erros went away. SAFE on dash, ofc no start. 25-immo now can be diagnosed (before was out completely), throws error Control Module ROM damaged. Waiting for the new key.

Here eeproms with 7th CS from 0x01 to 0x10 if you test them and want test more tell me and i make another batch of 16 :) kinda bruteforce lol

[g5n14]

Heloo guys!
Problem solved.

So what was done. After morgano has added the data from my ECU (with new 7th byte = 01) to the dash immo area - we finally had the communication to module 25. Ofc no start, error "ROM invalid" inside the 25. So we thought there are some other eeprom areas damaged and we found a good pair of dumps somewhere (morgano found it, huge thanks to him). He have decrypted the spare eeprom with spare micronas, then added my immo data with 7th byte 01, then crypted back with my micronas and sent to me. I have tried - ROM error disappeared. I have prepared the blank ID48 key with zedbull (precoded as TP25 + added CS from ECU + 7th 01) - no start, but in measuring blocks variable code authorized. Then tried to prepare the key with carprog (same procedure) - same result, variable code authorized, but SAFE on dash and no start. So i was thinking there is some problem with how these tools generate the dealer key. I took VVDI2, went into transponder generator and added the blank ID48 as a second key, written the generated eeprom back into the car and it finally started. No safe on dash, ABS fully working, windows work. I decided to make the factory key work aswell, so i readed ori 7th CS byte from key - it was AE. Written new CS to dash with a VVDI2 by OBD (since i already had a working key) - didnt work. Whatever i did - i couldnt get the factory key to work. So just replaced the factory ID48 with VVDI2 super chip, precoded it to TP25 and generated the key via dump - worked like a charm.


In conclusion - possible to solve this problem with VVDI2 + Xprog + help of good DK members to add your data to another good dump.
For those who don't have VVDI2 - you need to make a brutforce 7th byte in dash. Write different 7th byte to dash untill in measuring blocks you find "variable code authorized". I did 16 brutforce tries - took me about 20 minutes. So full 256 attempt will take you about 320 minutes + couple of hours to prepare the collection of brutforcing dumps.

HUGE THANKS TO ALL MEMBERS WHO HELPED ME TO RECOVER THE CAR! MOST LIKELY FIRST IMMO-ON ON FORUM!
SPECIAL THANKS TO MORGANO FOR EDITING THE FILES AND SPENDING TIME ON THIS PROBLEM!

[morgano]

Glad it worked. I am near to cry with happiness ;)

Was a pleasure mate.