Old school problem: 406 keypad bypass

[Paul-R]

Gosh that screen shot takes me back 20 odd years to when it was possible to hack into Sky's encryption Videoguard. Anyway, back to the problem in hand.

[wheeler]

Did 0080 work then??

[Janne100]

So, I tried all combinations of 1,2,7,0 which seemed to be worn out in keypad. Also tried all combinations of 0 and 8. No success.

As I found info that the code is stored in engine ECU on separate IC B58097 (which acts as a immo-memory), I did this dump. I was finally able to buy new eeprom chips to test the burning and editing the code. I didn't have enough inspiration, so I disconnected the keypad, installed a virgin eeprom, and... car started normally. Case closed. I play with programming with next project

[Paul-R]

Excellent work.

[wheeler]

Nicely done. Where did you get the virgin dump for the ECU?

[Janne100]

I didn't make anything. Virgin chip is what comes from factory, I suppose, if read, it's full of FF's.
Note: This applies only to the immo chip, not to big IC handling the tuning maps.

[wheeler]

Ah so it was just a blank chip then? In theory you could just erase the original chip?

[Janne100]

That's true. I didn't want to mess with it to not lose any vital info, but instead bought a blank chip.

And this blank chip method works also when you don't have the burner tool.

[Trickiedickie]

Unless I am mistaken it is just a case of removing the original chip. No replacement required and the car should start.

[Kees]

I don't think so, because a "empty" ic is filled with "00" or "ff", and with out the ic, it's possible that the data is opposite of the then it should be.