Audi A3 8P Dash data swap

[g5n14]

Hello!
Have an Audi A3 8P 2007. Someone damaged data in crypted area of 24c32 (0x812 - 0x9BF).
Right now after decryption it shows everything 00 (VIN,CS,MAC).

I need to move immo data from ECU to this DASH.
I have attached the IMMO data as text here. dump 24c32 crypted and decrypted, micronas flash.

SOMEONE WHO HAS AVDI/FVDI whatever, just put files into Audi - Instrument (CAN) - Micronas CD32XX + 24c32 - immo data from eeprom+flash.

YOU NEED TO USE CRYPTED FILE + FLASH Micronas. Just transfer the below data and save the file, it will be enough.

VIN: WAUZZZ8P28A050808
IMMO NUM: AUX7Z0G7FN90D0
CS: AEC557335D8A00
MAC: D6C41348
PIN: 09056
KEY1 ID: D54210F9


Thanks a lot!

[morgano]

Not enough IMHO, on ecu missing 7th byte of CS.

[g5n14]

Not enough IMHO, on ecu missing 7th byte of CS.

Thx! Will read 7th byte now from somewhere, brutforce key or comfort box. Will post an update.

[immoneard]

7th byte yo can read form key if you have Tango, AVDI or VVDI.

But I think in your case someone try to do Service mode on this cluster by loading molded eeprom and leave like that , so even if you match all data correct way you may still have problem. Your bast solution is to find same part number Flash and eeprom and flash that cluster , then after that pair data with ECu and 7byte form key .

[g5n14]

7th byte yo can read form key if you have Tango, AVDI or VVDI.

But I think in your case someone try to do Service mode on this cluster by loading molded eeprom and leave like that , so even if you match all data correct way you may still have problem. Your bast solution is to find same part number Flash and eeprom and flash that cluster , then after that pair data with ECu and 7byte form key .

Hello! Thanks a lot for your answer. I don’t have tango or VVDI2 unfortunately, will get right after that case (it’s pretty urgent). Since with immo off windows were not working, I assumed that there is CS inside the comfort module or BCM. I have read 95080 inside BCM - nothing interesting there, nothing looking like CS. I have read HC908AZ60 with 0L40X maskset from comfort box with orange 5, all files (eeprom + 5 flashes). I have manually surfed through files and also no matches. I think that this HC08 stores CS, but crypted, and most probably no one in this world knows how to decrypt.


For now I have only zedbull + EFFI, Carprog from tools which are capable of R/W Megamos 48, so I can’t brutforce the 7th byte. I think maybe I buy new transponder, make the 7th byte 00 and write it to dash? Or then I have still ABS and windows problems?

[rafal]

save your coding of ABS - if ready lost - you will need recode :
https://www.digital-kaos.co.uk/forum...ng-for-members

[morgano]

Hello! Thanks a lot for your answer. I don’t have tango or VVDI2 unfortunately, will get right after that case (it’s pretty urgent). Since with immo off windows were not working, I assumed that there is CS inside the comfort module or BCM. I have read 95080 inside BCM - nothing interesting there, nothing looking like CS. I have read HC908AZ60 with 0L40X maskset from comfort box with orange 5, all files (eeprom + 5 flashes). I have manually surfed through files and also no matches. I think that this HC08 stores CS, but crypted, and most probably no one in this world knows how to decrypt.


For now I have only zedbull + EFFI, Carprog from tools which are capable of R/W Megamos 48, so I can’t brutforce the 7th byte. I think maybe I buy new transponder, make the 7th byte 00 and write it to dash? Or then I have still ABS and windows problems?

You should have uploaded that BCM and COMFORT dumps

[marinescuv]

for...?
a3 2008 have immo data on ecu ,dash and key

[morgano]

for...?
a3 2008 have immo data on ecu ,dash and key

Then this can help him, dash eeprom with his data entered and CS 7th byte = 01 , if he puts it in dash and make new keys with that CS it should work. isn't it?

If no CS present in BCM nor COMFORT.

Dash_new_data.jpg

Took missing data out of another dash A3 8P, hope power class status and config will be good for him

Have seen PC on A38P dash i have saved powerclass is 51, added dump with that corrected.

[g5n14]

Then this can help him, dash eeprom with his data entered and CS 7th byte = 01 , if he puts it in dash and make new keys with that CS it should work. isn't it?

If no CS present in BCM nor COMFORT.

Dash_new_data.jpg

Took missing data out of another dash A3 8P, hope power class status and config will be good for him

Have seen PC on A38P dash i have saved powerclass is 51, added dump with that corrected.

Thanks a lot! Thats What i needed. Will test tomorrow once i come to work. Have spent the whole day on trying.
really appreciate your help!

[g5n14]

You should have uploaded that BCM and COMFORT dumps

will post those dumps tomorrow, really interested if someone is capable of decoding this HC08. Havent found Any info Whatsoever

[g5n14]

for...?
a3 2008 have immo data on ecu ,dash and key

The Windows were also not working so i thought there is a CS in BCM also.

[immoneard]

The Windows were also not working so i thought there is a CS in BCM also.

They not working because you have Immo off with mess up data in cluster. On that car BCM has nothing to do with Immobilizer .
Your key will not work if you made 7byte CS just out of nowhere . You will have to program new ID 48 , which has to be recoded with CS.

[g5n14]

Yah thats true. I already understood. And ofc i will program new key. Do i need to write anything else other than CS into ID48? And if done manually, which pages in transponder should store the CS?

[g5n14]

I will now try to brutforce the 7th byte while waiting for the new kew blank (i dont do VAG on daily, so dont have those)

And if someone can try to extract CS from comfort box (if that is possible at all), would be good. Dumps uploaded, HC08 0L40X.