Chip-Tools

ITDEEN

EDC17/MED17 in boot mode: flash and EEPROM read/write, PIN/CS/MAC and immo bypass

The "EDC17/MED17 Boot mode" function is used to read and write the EEPROM and flash of EDC17/MED17 engine ECUs by connecting in boot mode. It is not limited to VAG ECUs: units from other manufacturers (BMW, Opel, etc.) can be read as well.

Procedure

1. Remove the ECU, or at least get access to it, and locate the microcontroller's boot pin.
2. Connect the ECU's boot pin to ground.
3. Connect the ECU's CAN-H to PIN6 of the AVDI's OBDII connector.
4. Connect the ECU's CAN-L to PIN14 of the AVDI's OBDII connector.
5. Connect the ECU's ignition to PIN7 of the AVDI's OBDII connector.
6. Connect the ECU's power supply (12V and ground) to a bench power supply.
7. Check which microcontroller the ECU uses (Infineon TriCore type).
8. Connect a 510 Ohm resistor between the power supply (12V) and PIN7 of the AVDI's OBDII connector.
9. Refer to the wiring diagrams given in the appendix of the manual.
10. In the software, select the correct microcontroller and connect: once connected, the flash and EEPROM size and protection information is displayed.
11. Choose the operation: EEPROM read/write (Dflash), flash read/write (Pflash), "Read PIN/CS" to obtain PIN, component security and MAC.
12. If required, perform the immobiliser bypass in EEPROM (ECUs up to 2012) or in flash (all ECUs).
13. Use the checksum correction function whenever you write the flash.
14. For cloning, use the PIN/CS clone function: only the immo data section of the EEPROM dumps is modified.
15. Read the immobiliser status shown: "Normal (learned)" = ECU adapted to the vehicle, "Bypassed" = ECU with immo bypass that starts regardless, "Virgin" = brand new ECU never fitted to a vehicle.
16. Alternatively, PIN/CS/MAC can also be worked out from EEPROM and flash dumps already extracted from the ECU.

Reference screenshots