ECU & BSI Corrupted Diagnostics Topic

[Rhothgar]

Yes read the ASCII.

If it's not apparent in the inverted ASCII then they have encrypted it.
I use ImmoKiller and NY04. But my stuff is ancient history.

I have ImmoKiller but does it decrypt it beyond normal HEX editors.

Do you have the original eeprom file available for your car? I'd be interested to see what is in the first 25% of the file. I am trying to work out where to insert my VIN number. I have downloaded various bin files online and quickly inspected the odd one and the VIN was definitely there for PSA cars but I now cannot find the information again now that it is important.

I think this is probably why the car will not auto-detect in Lexia. It has nothing to extract! The problem is that my original ECU was mapped by a friend whose laptop then died and so the information is no more...

EDIT:

I have PM'd you a link to a OneDrive folder with my files in. 35P08 is the earliest bin file I have for the eeprom. If you're interested take a look and compare to yours. I'll bet my bottom dollar your original eeprom file will have your VIN number in.

ALSO, in one of your previous posts on this thread, you make reference to BSI Eeprom which is in the CPH unit. I've been flashing the ECU eeprom.

I had a friend send me a photo of his CPH unit the other day. Not a clear one but I could see what looked like TWO eeproms in there. It would be the one that presumably tracks back to whatever pins at the CPH but feeds back into the ECU at pin 36 which is immobiliser serial line.

[wheeler]

Yes read the ASCII.

If it's not apparent in the inverted ASCII then they have encrypted it.
I use ImmoKiller and NY04. But my stuff is ancient history.

Rothgar has sent me the ECU dumps & i was unable to extract PIN from any of them either, Tried 4 different programs (including Immokiller), they all came up with errors about the dump file. It was like the programs were not seeing what they were expecting to see in the file.
I was suspecting it mat be related to the remapping?

I had a friend send me a photo of his CPH unit the other day. Not a clear one but I could see what looked like TWO eeproms in there. It would be the one that presumably tracks back to whatever pins at the CPH but feeds back into the ECU at pin 36 which is immobiliser serial line.

There are 2 CPH variants, Earlier ones its the 93C66 chip later variation its a 95040 chip you need to read.

[ozvtr]

Rothgar has sent me the ECU dumps & i was unable to extract PIN from any of them either, Tried 4 different programs (including Immokiller), they all came up with errors about the dump file. It was like the programs were not seeing what they were expecting to see in the file.
I was suspecting it mat be related to the remapping?

Remapping? Am I missing something here?

I'm a bit lost, does the ECU actually run? Is there a problem? Or is Rhothgar just looking to find the PIN in the HEX? I know he has obtained the PIN and is just "rummaging around", I would do the same.

Wheeler, I had a program that would decrypt PSA dumps. It showed the HEX and ASCII on the left. When you hit the 'decrypt' button it changed the ASCII and you could spot things like the PIN and VIN very easily. It didn't find the VIN and PIN like Immokiller, but you could see them in the decryped ASCII. Do you know what program that was?

[ozvtr]

Yes read the ASCII.

If it's not apparent in the inverted ASCII then they have encrypted it.
I use ImmoKiller and NY04. But my stuff is ancient history.

I have ImmoKiller but does it decrypt it beyond normal HEX editors.

Do you have the original eeprom file available for your car? I'd be interested to see what is in the first 25% of the file. I am trying to work out where to insert my VIN number. I have downloaded various bin files online and quickly inspected the odd one and the VIN was definitely there for PSA cars but I now cannot find the information again now that it is important.

I think this is probably why the car will not auto-detect in Lexia. It has nothing to extract! The problem is that my original ECU was mapped by a friend whose laptop then died and so the information is no more...

EDIT:

I have PM'd you a link to a OneDrive folder with my files in. 35P08 is the earliest bin file I have for the eeprom. If you're interested take a look and compare to yours. I'll bet my bottom dollar your original eeprom file will have your VIN number in.

ALSO, in one of your previous posts on this thread, you make reference to BSI Eeprom which is in the CPH unit. I've been flashing the ECU eeprom.

I had a friend send me a photo of his CPH unit the other day. Not a clear one but I could see what looked like TWO eeproms in there. It would be the one that presumably tracks back to whatever pins at the CPH but feeds back into the ECU at pin 36 which is immobiliser serial line.

Are you talking about the engine ECU EEPROM? Are the dumps from the engine ECU? That changes things.
You've got to be careful with editing the HEX. There are usually checksums hidden in the HEX. Even the hackers have not figured out how to change the PIN in BSI's because they cant decrypt the checksums. That's why it's easier to virginize the BSI if you want to change the PIN. I'm not saying you can't do it, I'm not familiar with this 'CPH' of which you speak...just that it might not work.
There are programs to change the PIN in the engine ECU. They will insert the correct checksums.

[wheeler]

Ah yes, i have been talking with Rothgar via PM too.
The short version is the car is running but unable to clear fault codes.
The injection ECU was re mapped many years ago & the original map file has been lost.
Before the PIN was obtained from the dealer i tried running the ECU file through a few different programs (including immokiller) & none would decode the dump
Just getting errors when trying to decrypt, i was suspecting this was due to the file being altered.
The PIN cam also be extracted from the CPH however they have not read the dump of this as of yet?

[ozvtr]

The short version is the car is running but unable to clear fault codes.

Cant clear engine ECU DTC's? What are the DTC's?

The program was Immokiller. I'm just a bit rusty.
Immokiller wont read engine ECU pin codes, but it will reprogram them.

There is nothing on any of the BIN files except the "random values" file.
What engine ECU is it?
Has it had the immobilizer code removed (Immo off)?

[Rhothgar]

Rothgar has sent me the ECU dumps & i was unable to extract PIN from any of them either, Tried 4 different programs (including Immokiller), they all came up with errors about the dump file. It was like the programs were not seeing what they were expecting to see in the file.
I was suspecting it mat be related to the remapping?

Remapping? Am I missing something here?

I'm a bit lost, does the ECU actually run? Is there a problem? Or is Rhothgar just looking to find the PIN in the HEX? I know he has obtained the PIN and is just "rummaging around", I would do the same.

Exactly as Wheeler explains so, no, I think you are on track but let's clarify a few things anyway.

Wheeler, I had a program that would decrypt PSA dumps. It showed the HEX and ASCII on the left. When you hit the 'decrypt' button it changed the ASCII and you could spot things like the PIN and VIN very easily. It didn't find the VIN and PIN like Immokiller, but you could see them in the decryped ASCII. Do you know what program that was?

I'd love to know what programme that was that can decrypt the ASCII.

I could swear that I have seen some kind of file in the last couple of weeks that should someone's VIN number in the ASCII text but now cannot find it.

I want to be able to re-insert my VIN as I suspect this is the reason the car will not auto-detect the VIN.

I do have the code which is used to make changes to keys and re-initialise Engine ECU and CPH.

I wonder where that is actually stored because if Citroen were to replace the Engine ECU and CPH themselves, where would the code come from? Or is it chosen at initial install by the person programming the car?

I have not found anything to virginise the CPH. It doesn't like the 95040 chip that is in the CPH. I'd be interested to know what can but I'd need to be 100% sure how to reconfigure it all just in case.

I do have a 4th ECU together with its CPH off as it happens so I could play with them rather than risking my now working system.

Of course, stupid me! I would take a backup of CPH eeprom anyway.

[Rhothgar]

Yes read the ASCII.

If it's not apparent in the inverted ASCII then they have encrypted it.
I use ImmoKiller and NY04. But my stuff is ancient history.

I have ImmoKiller but does it decrypt it beyond normal HEX editors.

Do you have the original eeprom file available for your car? I'd be interested to see what is in the first 25% of the file. I am trying to work out where to insert my VIN number. I have downloaded various bin files online and quickly inspected the odd one and the VIN was definitely there for PSA cars but I now cannot find the information again now that it is important.

I think this is probably why the car will not auto-detect in Lexia. It has nothing to extract! The problem is that my original ECU was mapped by a friend whose laptop then died and so the information is no more...

EDIT:

I have PM'd you a link to a OneDrive folder with my files in. 35P08 is the earliest bin file I have for the eeprom. If you're interested take a look and compare to yours. I'll bet my bottom dollar your original eeprom file will have your VIN number in.

ALSO, in one of your previous posts on this thread, you make reference to BSI Eeprom which is in the CPH unit. I've been flashing the ECU eeprom.

I had a friend send me a photo of his CPH unit the other day. Not a clear one but I could see what looked like TWO eeproms in there. It would be the one that presumably tracks back to whatever pins at the CPH but feeds back into the ECU at pin 36 which is immobiliser serial line.

Are you talking about the engine ECU EEPROM? Are the dumps from the engine ECU? That changes things.
You've got to be careful with editing the HEX. There are usually checksums hidden in the HEX. Even the hackers have not figured out how to change the PIN in BSI's because they cant decrypt the checksums. That's why it's easier to virginize the BSI if you want to change the PIN. I'm not saying you can't do it, I'm not familiar with this 'CPH' of which you speak...just that it might not work.
There are programs to change the PIN in the engine ECU. They will insert the correct checksums.

Yes. Engine EEPROM. I have not dared touch CPH EEPROM as yet and, as previous post, have not found anything to virginise the CPH. ImmoTool v1.5 will only virginise certain BSI (CPH) chips.

My understanding of checksums is that you make the changes and do a checksum check. Performing the check might append something to the file signature?

I actually made contact with Luis-Andre last week and he replied. I felt pretty honoured by the fact. He said:-

"Hi mate.

Thanks for your words.

Regarding the EDC15C2, I have done it in the past and it was not really difficult. If I remember correctly, it is at address 0x154 in the EEPROM. This address should reflect the number of DTC clearances already performed, in hexadecimal. So if you see fifty as the total number of DTC clears, you should have 0x32 at address 0x154, since 0x32 equals fifty in decimal. Just write 0x00 and that is it.

Hope this helps.

Kind Regards"

Despite him writing his programme (which I couldn't find at the time hence messaging him) back in 2014 I think it was. His recall is incredible. At offset 0x00000154, I found 44 which represented the 68 After-Sales Zones my car had somehow managed to store. They are limited to 50!

44 is calculated by dividing 68 by 16 which gives 4 and 4 bits are left over which is 4 and so it becomes 44.

Most people with a full history will see 32 as he says.

CPH is simply a pre-BSI term.

It stands for Centrale de Protection Habitacle. Something else I learned last week!

[wheeler]

CPH is simply a pre-BSI term.

It stands for Centrale de Protection Habitacle. Something else I learned last week!

A CPH is way more primitive that a BSI, The CPH only really deals with Alarm, immobiliser, c/locking & interior lighting.

The BSI is a full electrical gateway that connects all the ECU's on the car. It's much more complex.