How to read coded (copy protection) chips?

**michi84** · 11th November, 2010, 08:07 PM

I have an eeprom with extra socket (copy potection from Graau tec) liying on my desk. I read the eeprom seperate and also with socket. I got two different readings.. and of course no one is ok

what can I do? Why is ECU able to read from the eeprom and not my eeprom reader?

**michi84** · 11th November, 2010, 09:39 PM

After more googleing I read about the difference between ECU reading and programmer readings...
If ECU is reading a single adress from EEPROM it switches CS (chipselect) every time. If I want to read with programmer, chipselect is always set tpo on... This is noticed by the little extra IC on the socket and it returns only crap data...
So I need to write a skript for my willem Programmer to switch CS after reading an adress... But I dont know how... someone does?

**dof** · 11th November, 2010, 09:58 PM

Hi Michi84, if you can, just out the eprom with the GrauTec protection, put this on your programmer and read it, you can understand that the data in original program must go to the same way....
no need to past your time in program if you have all ....

**michi84** · 11th November, 2010, 10:21 PM

Originally Posted by dof

Hi Michi84, if you can, just out the eprom with the GrauTec protection, put this on your programmer and read it, you can understand that the data in original program must go to the same way....
no need to past your time in program if you have all ....

i did exactly that, but its crypted and trash! I read eeprom and also eeprom with grautec socket.... both are crypted trash. different, but trash

there is a way to decrypt the eeprom read, but i think its easier to read socket& eeprom with a behavior like ECU....then you get a proper reading..

**michi84** · 11th November, 2010, 11:40 PM

maybe i was wrong... its not CS its OE output enable.
Is there a way with a programmer (Willem) to toggle OE after reading a single address?

**v8 dave** · 12th November, 2010, 12:19 PM

Don't know enough about it personally, but I'd be very interested to learn. I paid ?745 for a single chip(!) for my 1996 V8 Range Rover, and I'll be blown if I'm going to be stopped from copying it and putting it in my other car (same engine, same EFI system, fitted in a Ford Sierra

)

**maxtdi** · 12th November, 2010, 03:23 PM

Included all algorithm from EVC,also used from Dimsport and CMD and many other comp....................

**v8 dave** · 12th November, 2010, 03:50 PM

So. do we simply read the contents out of the EPROM on the board or through the copy socket?

How do we know which algo to choose?

**maxtdi** · 12th November, 2010, 04:00 PM

Read only eprom and use for saving file extension -file.key. Copy protection key from EVC,CMD,DIMSPORT.and..and..have algorithm number on board 600_00,500_00,101_00.......

Then winkey d 600_00 file.key

Or send me key file, make for you...

**maxtdi** · 12th November, 2010, 04:06 PM

KEY101

**v8 dave** · 12th November, 2010, 04:20 PM

Thanks! I'll have to play with this!

Think mine may be key400 though, as it's a PLCC44?

**maxtdi** · 12th November, 2010, 04:29 PM

yes 400 or 410

**michi84** · 12th November, 2010, 06:45 PM

Is it also for Grautec KSM-DIL28?
I dont know how to use this soft.. maybe someone can help me.. I attached the coded file which I just read from the eeprom.
thx

**maxtdi** · 12th November, 2010, 06:48 PM

file????? and car ?????

**michi84** · 12th November, 2010, 06:57 PM

Originally Posted by maxtdi

file????? and car ?????

sorry. its vw golf 2 g60
m27c256b

I got the program to work, but dont know any code for grautec... but as the write on their HP everybody gets his own unique coding....maybe it doesnt work for their chips...