MY2010 Security lockout solution

For all your REVO software requirements
Post Reply
Rabbit222
VAG Cafe
Posts: 19036
Joined: Tue Jan 18, 2005 4:14 pm
Car Make: Audi
Car Model: RS3
Membership No: 675
Location: Centurion
Contact:

MY2010 Security lockout solution

Post by Rabbit222 »

Some info on the MY2010 security lockout issue:

On Bosch EDC17 and MED17 ECUs

We've had many people asking why we need to open the ECU's of the later cars brought to us, and what is this "tuning protection" many companies are talking about. Here's a brief explanation of it. "Tuning Protection" for the Infineon TriCore TC-series processors (Bosch MED17/EDC17) On the CR TDI and 1.8/2.0 Turbo Petrol engines with the latest Bosch ECU generation (MED17 for the petrols, EDC17 for the diesels, I'll just refer them to MEDC17 from now on...), Bosch has implemented some new security measures to protect against aftermarket reprogramming of the engine control unit calibration data. Bosch originally started to use various checksums in the late 80's to verify the data integrity of the engine control unit memory content. Originally this was just a simple additive checksum, where you count the sum of all bytes in the file, and store the value in one place. Later on, it was also used to protect the data from unauthorised modifications (thats us...). For example, ME7.5 ECU (1.8 Turbo) contains about 70 different checksum blocks, and the result values are filtered through various functions to have a secure method of verifying data integrity. At around the same time, Bosch started using access control on the outside ECU reprogramming (that is what we call the OBD flashing nowadays). It's usually a normal challenge-response scheme with a seed-key algorithm. Of course, the chiptuning industry kept on and solved these functions to have methods of correcting the checksums, and to have OBD programming capability of these ECUs. About 7-8 years ago, Bosch started using RSA signatures to control the ECU contents. Early on, just a 256bit RSA, then 512bit RSA, and nowadays, on these new ECUs, its a hash from a 1024Bit RSA signature. Something thats virtually un-crackable with traditional brute force methods. Since these keys are yet to be solved, tuners have had to find other ways of programming the ECUs. When the MEDC17 ECU family was released, a backdoor was found in the programming algorithm. Originally this hash was checked only after certain conditions were met. If they are not met, it was not checked. So the programming method made sure that was the case every time they programmed the ECU. This "Tuning Protection", as it is commonly called, just means that this backdoor has been sealed, and the ECU always checks the hash validity after every OBD programming attempt. If this is not valid, it sets a flag in the memory that prevents the car from starting. Our tools can detect this function just by reading the ECU via OBD. Many others, including some big brand names, have problems with cars not starting after writing. That is why, for now, on these protected ECU's, we need to open the ECU to use a processor function built in the TC17xx-series processors, which allows us to boot and reset the ECU at any given moment from pins on the motherboard. This way the ECU does not detect it as being an OBD programming attempt, and skips the hash validity check. At this time, there are no tuning companies who can bypass this security check and if an ECU has "Tuning Protection" then it will need to be programmed by taking the ECU out and opening it. Some call it "bench flash", some say they "install a probe", but this is how it is done by ALL tuners who are offering remaps on "protected" MEDC17 ECUs.


Revo Techniks solution:

Image

The VW Audi Group has updated the ECU security from 2010 model year vehicles with MED17 and EDC17 ECUs e.g. cars like the Audi B8. This is an enhanced version of ECU security that has been incorporated in Bosch ECU’s since the launch of EDC16, but has only now been fully activated. It is not currently possible to override this security lock by communicating with the ECU via the OBD2 port. Therefore these late model vehicles cannot currently be remapped the standard way by flashing an aftermarket file through the OBD2 Port.

The security exists in the form of unbreakable digital signature which is required to “match” at the time of the remap. If the ECU requests the digital signature and the remap does not contain a “matching” digital signature the ECU will default to an unusable mode.

Revo Technik is proud to announce the launch of the new SPX and Crypt-X software. The new specially developed hardware and software allows Revo Dealers to unlock the ECU and flash through the OBDII port.
User avatar
vitchie
Cadet
Posts: 776
Joined: Mon Aug 11, 2008 11:00 am
Car Make: Audi
Car Model: 11' Ibis White A4 2.0T
Membership No: 1317
Location: Randburg, JHB
Contact:

Re: MY2010 Security lockout solution

Post by vitchie »

Nice!

Will come visit your for some Revo juice for my A4 before the end of the year!
2011 Ibis White A4 2.0T /Xenon/Bluetooth/ - R.I.P.
User avatar
Awesum
Lieutenant
Posts: 1939
Joined: Sat Aug 03, 2002 7:42 pm
Car Make: VW
Car Model: Tiguan
Membership No: 999
Location: Jhb

Re: MY2010 Security lockout solution

Post by Awesum »

I'm guessing the ecu will have to be pulled to flash it the 1st time?
2019 Tiguan 2.0TDI, R-Line
2019 Polo GTI

Ex 2013 Tiguan 2.0TDI
Ex 2016 Golf VII R, DSG
Ex 2015 Polo 6C GTI, DSG, Pure White
Ex 2014 Golf VII GTI, DSG, Tornado red
Ex 2010 Scirocco 2.0TSi, DSG; Candy White; Revo, 20" RS6 wheels; Coiled looow.
Ex 2010 Golf VI GTI Dsg, Tornado Red, 19's, Revo 2
Ex 2008 Golf V GTI DSG, Riding on 19"s
Ex 2007 Golf V GTI DSG
Ex 2002 Golf IV GTI
Ex 1991 Golf II GTi 2.0 16V
Ex 1991 Jetta II CLi 1.8 8V Exec
Rabbit222
VAG Cafe
Posts: 19036
Joined: Tue Jan 18, 2005 4:14 pm
Car Make: Audi
Car Model: RS3
Membership No: 675
Location: Centurion
Contact:

Re: MY2010 Security lockout solution

Post by Rabbit222 »

Awesum wrote:I'm guessing the ecu will have to be pulled to flash it the 1st time?
Yup, Bench flash
User avatar
hubbly_bubbly
Forum Advertiser
Posts: 1040
Joined: Thu Jun 24, 2010 1:20 pm
Car Make: VW
Car Model: Touran GTD
Membership No: 1793

Re: MY2010 Security lockout solution

Post by hubbly_bubbly »

Does this mean you can flash your S4? :cool:
Image

Candy White 2007 Touran 1.9TDI Trendline
Rabbit222
VAG Cafe
Posts: 19036
Joined: Tue Jan 18, 2005 4:14 pm
Car Make: Audi
Car Model: RS3
Membership No: 675
Location: Centurion
Contact:

Re: MY2010 Security lockout solution

Post by Rabbit222 »

That is correct sir.
nits
Cadet
Posts: 970
Joined: Tue Aug 29, 2006 4:06 pm
Car Make: VW
Membership No: missing
Location: Fourways

Re: MY2010 Security lockout solution

Post by nits »

Nice one so wen is the S4 getting some Revo powa.
Or are they still working on the map :hi:
Rabbit222
VAG Cafe
Posts: 19036
Joined: Tue Jan 18, 2005 4:14 pm
Car Make: Audi
Car Model: RS3
Membership No: 675
Location: Centurion
Contact:

Re: MY2010 Security lockout solution

Post by Rabbit222 »

nits wrote:Nice one so wen is the S4 getting some Revo powa.
Or are they still working on the map :hi:
Patience papa :lol:
User avatar
dazza
Field Marshal
Posts: 12104
Joined: Mon Jan 07, 2008 3:50 pm
Car Make: VW and VW
Car Model: Amarok and Citi Sport
Membership No: 1327
Location: Roodepoort

Re: MY2010 Security lockout solution

Post by dazza »

Rabbit222 wrote:
nits wrote:Nice one so wen is the S4 getting some Revo powa.
Or are they still working on the map :hi:
Patience papa :lol:
We have been patient enough...boost the t!ts off that thing already :evil:
Darryn Van Rooyen
Current: 14 Amarok BITDI D/C 4Motion H/L Auto
Current: 1987 Citi Sport 1.6
Current: 05 Kawasaki 200KDX
Previous:
12' MKVI GTI Manual
2009 Audi TT 2.0TFSI S-Tronic
2008 Honda CBX250 Twister - Crashed!
2011 Amarok BiTDI D/C Highline 4Motion
08 RS MKV GTI DSG
09 ZG Ibiza Cupra TDI
06 CW Sportline
01 Citi 1.4i
01 Yamaha YZ125
99 Toyota Tazz
94 Fox 1.8 Sport
User avatar
MeanTdi
The Imposer Mod-whore-rator
Posts: 18557
Joined: Thu Mar 02, 2006 4:12 pm
Car Make: Subaru
Car Model: WRX
Membership No: 1153
Location: JHB

Re: MY2010 Security lockout solution

Post by MeanTdi »

Fantastic security solution!

I read it includes a remap. What price are we looking?
Marco


Current: Subaru WRX
Ex: VW Polo 1.9 TDI Sportline
Ex: VW Golf VR6
Ex: VW Golf 1.8 GTi 16v


ALFAHOLIC wrote:What can go wrong, jarre you guys sound like you are describing an Alfa here...
My Corsa OPC wrote:Its not an oil leak, its just an Opel marking its territory :lol:
Rabbit222
VAG Cafe
Posts: 19036
Joined: Tue Jan 18, 2005 4:14 pm
Car Make: Audi
Car Model: RS3
Membership No: 675
Location: Centurion
Contact:

Re: MY2010 Security lockout solution

Post by Rabbit222 »

First post updated.
Flash_Gti
Cadet
Posts: 126
Joined: Sat Nov 22, 2008 12:13 pm
Location: Durban

Re: MY2010 Security lockout solution

Post by Flash_Gti »

old topic , I have a question tho....

with this security lockout in place, how are FRC etc doing remaps? I took my Scirocco to APR (justin) and he advised me of this, but then I spoke to FRC and they did the remap on my car. Whats the real deal. If you feel that this might be controversial to put up on the forum , pls feel free to pm!


Regards,
2006 Corsa ute JL , Alpine , SEAS
Rabbit222
VAG Cafe
Posts: 19036
Joined: Tue Jan 18, 2005 4:14 pm
Car Make: Audi
Car Model: RS3
Membership No: 675
Location: Centurion
Contact:

Re: MY2010 Security lockout solution

Post by Rabbit222 »

Flash_Gti wrote:old topic , I have a question tho....

with this security lockout in place, how are FRC etc doing remaps? I took my Scirocco to APR (justin) and he advised me of this, but then I spoke to FRC and they did the remap on my car. Whats the real deal. If you feel that this might be controversial to put up on the forum , pls feel free to pm!


Regards,
This issue has mostly affected the Audi B8 chassis and recently we encountered a Tiguan as well. All the Rocs and Mk6 GTIs we have done have been via the OBDII port so no issues yet.
poena
Lieutenant
Posts: 1243
Joined: Wed Apr 12, 2006 7:31 am
Membership No: missing
Location: Cape Town

Re: MY2010 Security lockout solution

Post by poena »

Do you guys have a map for the tiguans? 2011 model? Also, can you flash it the old fasioned way or with this new bench flash?
"Nothing in the world can take the place of persistence. Talent will not; nothing is more common
than unsuccessful men with talent. Genius will not; unrewarded genius is almost a proverb.
Education will not; the world is full of educated derelicts. Persistence and determination alone
are omnipotent."
Rabbit222
VAG Cafe
Posts: 19036
Joined: Tue Jan 18, 2005 4:14 pm
Car Make: Audi
Car Model: RS3
Membership No: 675
Location: Centurion
Contact:

Re: MY2010 Security lockout solution

Post by Rabbit222 »

Bench flash on the 2011
poena
Lieutenant
Posts: 1243
Joined: Wed Apr 12, 2006 7:31 am
Membership No: missing
Location: Cape Town

Re: MY2010 Security lockout solution

Post by poena »

Rabbit222 wrote:Bench flash on the 2011
What will the price be for this?
"Nothing in the world can take the place of persistence. Talent will not; nothing is more common
than unsuccessful men with talent. Genius will not; unrewarded genius is almost a proverb.
Education will not; the world is full of educated derelicts. Persistence and determination alone
are omnipotent."
Post Reply