DIY: B6 A4 - ECU Immobilizer III clone (or: how to swap any B6 A4 ECU into your car)

[bananas]

Mods: Please move this to the DIY section.

WARNING: This DIY requires soldering/desoldering of surface mount integrated circuits. If you are not skilled at soldering small leads, and/or if you do not have proper equipment, you could damage your ECU. Find a friend or shop skilled in electronic repair if you are unsure of yourself. If you cannot find one, send me a PM and I might point you to the person who cloned my Immobilizer.

Immobilizer III

When Audi introduced the B6 A4 in North America, they started equipping the ECU with Immobilizer III. Immobilizer III differs from its predecessor primarily in that it is coded to a specific VIN number. Because of this addition, swapping ECUs from one vehicle to another is no simple task. According to RossTech, the only way to swap another ECU into your car is to take your car to the dealer and pay them to join a new ECU to your vehicle. It is unclear, after visiting the dealership, whether or not you can swap in your old ECU without performing the dealership procedure again.

As an alternative to this, some chip tuners include an Immobilizer Defeat feature. I have no details on the ramifications or inner workings of Immobilizer Defeat.

Immobilizer III Chip

The Immobilizer information, including the VIN information (and your Lemmiwinks settings, incidentally), are stored on a small 8-pin EEPROM on the back of the ECU. The data on this chip are all that are needed to join an ECU to a particular vehicle. After removing the ECU box from the vehicle, open it with a T15 driver. Remove the bottom cover and view the board. The Immobilizer chip is the small 8-pin chip near the center of the board (highlighted in image below).




Removing Immobilizer

To remove the Immobilizer chip from the board, I recommend using a hot air soldering tool. The 8-pin chip is a surface mount chip, so light lateral pressure on one of the sides with no pins, in addition to some hot air should do the trick. The chip is glued to the board with a small dab of red glue, so a little more heat than usual may be necessary. However, do not use excessive heat! You could burn the board and permanently damage your ECU. Do not try to move the chip off the board until all the solder on each pin is melted, in order to avoid lifting the pads on the board.

Swapping ECUs

If you only want to swap another ECU into your vehicle, you can simply desolder the Immobilizer chip from your original ECU, then solder it onto your new ECU. Make sure the ECU part numbers are identical (mine is an "AF" box). You will NOT be able to use your old ECU in your car, but you can certainly solder the new ECU's Immobilizer onto you old ECU and use it in whatever car the new ECU originally came from.

Cloning Immobilizer

If you would like to have multiple ECUs joined to your vehicle, which may be physically swapped any time you desire, you must copy the data on the Immobilizer chip from your original ECU into any additional ECUs you like. For this you will require a chip reader/burner. Sure... you probably don't have a chip reader/burner, but can likely find somebody who does! If you cannot get access to a chip burner, send me a PM and I might point you in the direction of the person who cloned my Immobilizer.

This process is pretty straightforward.

Put your original ECU's Immobilizer chip into the chip burner. Pin 1 is the pin nearest the ST logo. You may need an 8 pin adapter, or temporarily solder wire leads onto the chip. Select the appropriate EEPROM profile in your chip burner's software, and read the contents of the Immobilizer EEPROM to a file. My Immobilizer chip is manufactured by ST (SGS-Thompson Microelectronics) and is model ST 95040. In the Superpro chip burner application, the appropriate profile is named "M95040@SOIC8". Your chip burner may use a different profile name to access the Immobilizer.

Close-up of my Immobilizer chip:



Using your chip burner software, read the contents of the chip and save it to a file. Note: you may want to back this file up, for use in the future! Now insert the new ECU's Immobilizer chip into the chip burner. Write the contents of the file you saved into the new Immobilizer chip. Resolder either Immobilizer chip into either ECU. Reassemble ECUs. You may now use either ECU in your car simply by physically swapping them!

Notes

Whenever swapping ECUs you should make sure the ECU part numbers match. You should also make sure the soft codings match, to ensure critical information like transmission type, country of origin, etc are set properly. You can use VAG-COM to duplicate soft coding settings.

[nihil]

Great post!

Did your friend try reading/writing the EEPROM while still soldered to the board? With the rest of the ECU powered down it might be possible to do so without ill effects. I'd wager that Bosch stuck a diode on Vcc between the 95040 and +5V for the other components. If that's the case, you'd just need a clip between it and your SPI programmer with a large enough resistor on Vcc to keep from blowing that diode, and wouldn't have to risk damaging the ECU during the desoldering process. Commercial hot air reflow machines are expensive, and the homebrew units don't always work all that well.

[bananas]

Did your friend try reading/writing the EEPROM while still soldered to the board?

Nope, he did not try. When I ran it past him, he said he didn't want to risk one of my ECUs to test it

[2001S4NY]

i can read and flash/clone ecu without unsoldering it, can help someone out

[AMON]

Hi, can you read 24c04 without unsoldering it ? can you tell how ?

Thanks

[Mawhitey]

Hi, can you read 24c04 without unsoldering it ? can you tell how ?

Thanks

Great info
I too am interested if this can be done..

I have Immo2 but am having issues so cloning may effectivly factor the issues out

[nein-reis]

Nice! Thanks for the info.

[Mawhitey]

OOOPS !!
Thread from the dead... Anyone answer this?

[BASARAB]

So, lets say I get a new b6 with identical ecu part numbers. What I have to do is swap immobilizers to move my chipped ECU to new car?

[bananas]

^ Yup, get an ECU with identical part number (I'm not actually sure they HAVE to be the same, sorry), then do the soldering to swap immobilizer chip from old to new ECU. I'm not sure why you'd want to do that though, unless the old ECU was malfunctioning. Once you move that chip to the new ECU, the old ECU will not start your car anymore.

[BASARAB]

I'm not sure why you'd want to do that though, unless the old ECU was malfunctioning.

I might buy a new b6, sell old one, and put chipped ecu from old car to new one.

[swamper8]

OP,
Did you ever wind up buying new IC's? I plugged your IC number into digikey.com. Appearantly there are different "speeds" e.g. 4mhz, 5mhz, 10mhz etc. I'm trying to buy some new IC's for several used ECUs I have. I have a different ST IC on mine (5P08C3) which is very hard to find. Hoping to use your IC but the speed is a big ?

[ivebeenthere]

Just saw this thread and wondered if you had either a bad ECU or a bad cluster, would it was possible to swap both the ECU and the Cluster together from the same donor vehicle in salvage. Would it run?
Johnny

[k0mpresd]

Just saw this thread and wondered if you had either a bad ECU or a bad cluster, would it was possible to swap both the ECU and the Cluster together from the same donor vehicle in salvage. Would it run?
Johnny

key wont match.

[ddillenger]

If you get the key as well you can pop the RFID transponder out and install it in your key, then all's well.

[AaronHoloster]

I tried to clone the ECU from my car onto a donor ECU with a ChipMax2 and Ponoma SOIC 8 clip adapter. For some reason I can't erase the ST95040- chip out of the donor ecu, I believe this chip are erasable correct? do I have to solderer it to erase it?

[ddillenger]

Yes, it is erasable. No, it does not require soldering. A cheap ebay cable works well, and there is a free cable over on nefmoto for reading/writing the eeprom via OBD. Go to the cluster and immobilizer section, and read the sticky entitled:Understanding/retrofitting immobilizer.

[elewsader]

Yes, it is erasable. No, it does not require soldering. A cheap ebay cable works well, and there is a free cable over on nefmoto for reading/writing the eeprom via OBD. Go to the cluster and immobilizer section, and read the sticky entitled:Understanding/retrofitting immobilizer.

Free cable!!

[imnuts]

Yes, it is erasable. No, it does not require soldering. A cheap ebay cable works well, and there is a free cable over on nefmoto for reading/writing the eeprom via OBD. Go to the cluster and immobilizer section, and read the sticky entitled:Understanding/retrofitting immobilizer.

Free cable!!

Saw that part too, but didn't see where the cable was . It did give me another idea on trying to grab my SKC though.

[elewsader]

^good luck man, it was a sigh of relief when I connected VCDS and it accepted my pin..

[O.LOquattro]

hey fellas i have a 03 a4 1.8t quattro...just had my immobilizer transferred from my old ecm that went bad.both ecm's had the same part number 8E0909518AF...question now is, could this ecm part number be used to a fwd a4 too?i plugged the new ecm and car turned right on, but now im wondering if all 4 wheels have power or if only the front wheels do...??or what if the soft coding on ecm was for an automatic fwd, if so would it even let me turn car on and run???

i might add my car is 5 spd manual.any help to relieve my curiosity will be appreciated.thanks

[Kittrell]

i plugged the new ecm and car turned right on, but now im wondering if all 4 wheels have power or if only the front wheels do...??

You can't possibly think Quattro is simply a different ECU file.....

[f1torrents]

LOLOLOLOL

Greatest comment ever...

[O.LOquattro]

You can't possibly think Quattro is simply a different ECU file.....

the reason im asking is because i got the ecm online from a junkyard and not 100% sure if the car it came off of was a quatrrp too.i also havent been able to find a different ecm part number for that year.thats why im thinking they might use the same ecm part number but coded differently.i am also getting a CEL for the VSS and abs too... you get where im going??

[onceover]

Quattro is 100% mechanical. Theres no electronics that control whether its on or off.

[O.LOquattro]

Quattro is 100% mechanical. Theres no electronics that control whether its on or off.

ok im just trying to figure out why i got the CEL lights for the vss(p0501) and abs(p1649) now with the new ecm since i didnt have them before my old went out.

[rayrock]

Quattro is 100% mechanical. Theres no electronics that control whether its on or off.

This is a very legitimate question, not something to make fun of because of lack of knowledge:http://en.wikipedia.org/wiki/Quattro...rive_system%29

the quattro AWD system is mechanical but in most cases controlled by electronics, ESC ECU ABS... center diff is controlled to divert different amounts of power front to back, abs and ESC also work with Q.

It very reasonable for someone to think the system, while in place, may not work without the proper programming available just like the AC or other systems may not work without the proper controls in place.

[Mawhitey]

Torsion is mechanical. Only intervention I know for is the edl and potentially the asr. But both of these are abs controlled with signals sent to ecu to perhaps lower power if slide or wheel spin detected.

Sent from my GT-I9300 using Tapatalk now Free

[diagnosticator]

To clarify a comment in the first thread post, if the dealer adapts a second ECU to a specific car, the original ECU will still work without any other adaptations needed.

[on3dutch]

To clarify a comment in the first thread post, if the dealer adapts a second ECU to a specific car, the original ECU will still work without any other adaptations needed.

OR NOT.......i just ran into this problem with an RS6.......brought the tuned ECU and the blank ECU to the dealer, Jack Daniels Audi, they charged me for 2 hours of labor and told me i was screwed, they couldnt retrieve the PIN SKC......bs if you ask me. 350$ down the toilet

[on3dutch]

^good luck man, it was a sigh of relief when I connected VCDS and it accepted my pin..

How did you end up getting your pin?! Through that free cable...that isnt the right link anymore?

[elewsader]

OR NOT.......i just ran into this problem with an RS6.......brought the tuned ECU and the blank ECU to the dealer, Jack Daniels Audi, they charged me for 2 hours of labor and told me i was screwed, they couldnt retrieve the PIN SKC......bs if you ask me. 350$ down the toilet

There are security features built into tuned ECU's; they aren't simply "cloned"..

How did you end up getting your pin?! Through that free cable...that isnt the right link anymore?

I obtained my pin using a generic KKL OBDII USB cable, and Vag Commander 2.5, if you check user imnuts at post #19 his signature will link you to a very well documented process on how to perform the read on a B6, however I'm not sure if it will apply to your RS6.

[Kodymfk]

Pictures are gone, can we get re-post of pictures to get a better idea. Thank you :)

[dan013]

Mods: Please move this to the DIY section.

WARNING: This DIY requires soldering/desoldering of surface mount integrated circuits. If you are not skilled at soldering small leads, and/or if you do not have proper equipment, you could damage your ECU. Find a friend or shop skilled in electronic repair if you are unsure of yourself. If you cannot find one, send me a PM and I might point you to the person who cloned my Immobilizer.

Immobilizer III

When Audi introduced the B6 A4 in North America, they started equipping the ECU with Immobilizer III. Immobilizer III differs from its predecessor primarily in that it is coded to a specific VIN number. Because of this addition, swapping ECUs from one vehicle to another is no simple task. According to RossTech, the only way to swap another ECU into your car is to take your car to the dealer and pay them to join a new ECU to your vehicle. It is unclear, after visiting the dealership, whether or not you can swap in your old ECU without performing the dealership procedure again.

As an alternative to this, some chip tuners include an Immobilizer Defeat feature. I have no details on the ramifications or inner workings of Immobilizer Defeat.

Immobilizer III Chip

The Immobilizer information, including the VIN information (and your Lemmiwinks settings, incidentally), are stored on a small 8-pin EEPROM on the back of the ECU. The data on this chip are all that are needed to join an ECU to a particular vehicle. After removing the ECU box from the vehicle, open it with a T15 driver. Remove the bottom cover and view the board. The Immobilizer chip is the small 8-pin chip near the center of the board (highlighted in image below).




Removing Immobilizer

To remove the Immobilizer chip from the board, I recommend using a hot air soldering tool. The 8-pin chip is a surface mount chip, so light lateral pressure on one of the sides with no pins, in addition to some hot air should do the trick. The chip is glued to the board with a small dab of red glue, so a little more heat than usual may be necessary. However, do not use excessive heat! You could burn the board and permanently damage your ECU. Do not try to move the chip off the board until all the solder on each pin is melted, in order to avoid lifting the pads on the board.

Swapping ECUs

If you only want to swap another ECU into your vehicle, you can simply desolder the Immobilizer chip from your original ECU, then solder it onto your new ECU. Make sure the ECU part numbers are identical (mine is an "AF" box). You will NOT be able to use your old ECU in your car, but you can certainly solder the new ECU's Immobilizer onto you old ECU and use it in whatever car the new ECU originally came from.

Cloning Immobilizer

If you would like to have multiple ECUs joined to your vehicle, which may be physically swapped any time you desire, you must copy the data on the Immobilizer chip from your original ECU into any additional ECUs you like. For this you will require a chip reader/burner. Sure... you probably don't have a chip reader/burner, but can likely find somebody who does! If you cannot get access to a chip burner, send me a PM and I might point you in the direction of the person who cloned my Immobilizer.

This process is pretty straightforward.

Put your original ECU's Immobilizer chip into the chip burner. Pin 1 is the pin nearest the ST logo. You may need an 8 pin adapter, or temporarily solder wire leads onto the chip. Select the appropriate EEPROM profile in your chip burner's software, and read the contents of the Immobilizer EEPROM to a file. My Immobilizer chip is manufactured by ST (SGS-Thompson Microelectronics) and is model ST 95040. In the Superpro chip burner application, the appropriate profile is named "M95040@SOIC8". Your chip burner may use a different profile name to access the Immobilizer.

Close-up of my Immobilizer chip:



Using your chip burner software, read the contents of the chip and save it to a file. Note: you may want to back this file up, for use in the future! Now insert the new ECU's Immobilizer chip into the chip burner. Write the contents of the file you saved into the new Immobilizer chip. Resolder either Immobilizer chip into either ECU. Reassemble ECUs. You may now use either ECU in your car simply by physically swapping them!

Notes

Whenever swapping ECUs you should make sure the ECU part numbers match. You should also make sure the soft codings match, to ensure critical information like transmission type, country of origin, etc are set properly. You can use VAG-COM to duplicate soft coding settings.

i know this is an old thread but I was wondering if someone could repost the pictures to know which chip we are talking about. I believe it is the one labeled with the number 95040 on it from what I have read on other threads but I would like to be sure before attempting this. I am trying to swap ecu's. Just to clarify if I do this eeprom chip swap I wont have to reprogram the replacement ecu to the car correct?? I have a 2004 passat 2.8 auto. thanks guys

[SO WAGN]

I just did exactly what you're asking about a month ago and confirm that it works. Just be VERY careful if you're using a heat gun instead of a rework station not to bump any of the other components on the board whilst hot. Also, make sure you don't lift too hard on the chip because you don't want to break any of the pads. Heat the chip enough apply very gentle upwards pressure and it will lift very easily once the solder is hot enough. Use some braid to remove the majority of the solder first to make it easier.

This is a crappy video but it shows the position of the eeprom chip that was the same on my ecu (1.8t b6 a4). I had to swap mine to a donor ECU when my APR chipped ecu died. The car fired up perfectly straight away.

https://youtu.be/-y7mSkMhyjU

If I had my car with me I would double check but that chip number definitely rings a bell.

If you're looking at doing this you must be confident already but just take you're time with it. The hardest part is lifting the chip from the board without damaging the pads, just let the heat do the work and apply gentle upwards/sideways pressure (whatever direction you feel comfortable with).


Sent from my SM-G920I using Tapatalk

[ZimbutheMonkey]

Hey guys, there's a way, way way easier way to clone an ECU 90540 chip. I know it's been referred to earlier, but I wanted to make sure that anyone reading this thread knows how to do it.

Use Argdub's free software available on Nefmoto and a generic VCDS cable. You can read and flash the 90540 chip all through bootmode. I've cloned 3-4 different ECU's that way. Works every time.

Just read your old 90540 and open it in a hex editor. Then recode the original ECU 95040 read to 'immo off' (by changing the circled bytes from 01 (IMMO ON) to 02 (IMMO OFF), and flash it to the replacement ECU


Check here: http://nefariousmotorsports.com/foru...c=2973.0title=

and here http://nefariousmotorsports.com/foru...c=1168.0title=

and, (please ignore my initial stupid mistakes in this thread lol), here: http://nefariousmotorsports.com/foru...?topic=9030.60

Guys, this Nefmoto is an INCREDIBLE resource, be sure to check it out. There are a lot of very dedicated members who have put in a lot of effort to figure this stuff out.

[dan013]

Just a follow up on this. I successfully did the eeprom swap. It is eeprom number 90540 and it is located on the top almost center of the ecu if you are looking at it from the top with the plugs closer to you on a 2004 2.8 Passat. So it is not on the same location as the 1.8 as stated on that YouTube video above. It worked perfectly and fired right up. I have only soldered once before and even though this seems like an impossible task due to how small the eeprom is, it is doable with a bit of patience. A little advice would be to sharpen the tip of your soldering iron as sharp as you can (if you don't have a soldering heat gun like me) this gives you more precision. Even though this worked perfectly for me it didn't solve my original problem which is injector 2&4 are getting stuck open and saturating with fuel those two cylinders. I already swapped injectors to see if problem followed and that didn't work then I thought I had a ground issue so I did a continuity test and that checked out. I even went ahead and still replaced injectors and nothing. I know those two injectors are wide open because I lifted the injector rail and as soon as I open the key they just spray with gas like crazy. I was 100% sure it had to be the ecu so I replaced it with this used one and I'm having the same problem. Any ideas anyone? Unless this ecu is also bad?? But what are the odds it be the same two injectors. I'm gonna keep looking for a ground issue. I have a generic scanner and also just bought a vag401 which I'm learning to use. Any help or ideas would be appreciated.

[SO WAGN]

Glad to hear the eeprom swap went well. It's a shame It didn't solve your problem with the injectors though.

Zimbu, thanks for the effort put into your post also. It's definitely handy info. If my original ecu hadn't completely fried I would have don't it the same way as you. I couldn't even get my original ecu going in boot mode however. My only choice was the eeprom swap which worked fine for me.

Sent from my SM-G920I using Tapatalk

[diagnosticator]

Just a follow up on this. I successfully did the eeprom swap. It is eeprom number 90540 and it is located on the top almost center of the ecu if you are looking at it from the top with the plugs closer to you on a 2004 2.8 Passat. So it is not on the same location as the 1.8 as stated on that YouTube video above. It worked perfectly and fired right up. I have only soldered once before and even though this seems like an impossible task due to how small the eeprom is, it is doable with a bit of patience. A little advice would be to sharpen the tip of your soldering iron as sharp as you can (if you don't have a soldering heat gun like me) this gives you more precision. Even though this worked perfectly for me it didn't solve my original problem which is injector 2&4 are getting stuck open and saturating with fuel those two cylinders. I already swapped injectors to see if problem followed and that didn't work then I thought I had a ground issue so I did a continuity test and that checked out. I even went ahead and still replaced injectors and nothing. I know those two injectors are wide open because I lifted the injector rail and as soon as I open the key they just spray with gas like crazy. I was 100% sure it had to be the ecu so I replaced it with this used one and I'm having the same problem. Any ideas anyone? Unless this ecu is also bad?? But what are the odds it be the same two injectors. I'm gonna keep looking for a ground issue. I have a generic scanner and also just bought a vag401 which I'm learning to use. Any help or ideas would be appreciated.

The ground connections to those two injectors are shorted to chassis ground somewhere in the injector harness. The way the injectors are powered, the four injectors are connected to +12 volts parallel circuit from the ECU power supply relay, and the negative side of the injectors are grounded in the ECU on dedicated negative connections from each injector. An injector is opened when the ECU connects the negative side of the injector to ground, completing the circuit from + 12 volts to negative chassis ground. The two injectors that are open and spraying all the time have the negative injector wire to the ECU shorted to chassis ground somewhere, due to faulty wire insulation on the negative wires to the ECU. Since all four injectors are connected to +12 volts constant power, with the negative wire shorted to chassis ground, (on the engine,) the power will flow through the injector all the time with the ign key ON and the injector will be open and spraying fuel with the key ON when there is fuel pressure, or when the engine is running the two injectors will be open and spraying fuel constantly.