VZ V6 E55 ECU Brute Force Reset Tool & PIM Relink

[Gareth]

[The1]

wow nice work and find there, if your happy to brick another ecu ill add it to the program and put it up tonight when i get home.

[jxx]

From what I've worked out, when the PIM is set to 00 00 00 00 then scantools read that as a reset module, so possibly might be an added safety thing to check so it can't happen?

But then some PIMs have at least 1 0x00 and a 3 digit code...... wonder what happens if i program a single digit code to a PIM......


I Have a few dead ecu's, just have to pour a kettle of boiling water over them to make them work or stick em in the freezer for a bit.... so should be able to get a sacrificial ecu running long enough to not brick it lol.

[The1]

i dont think the PIN in the PIM eeprom gets changed with the reset command, i havn't taken a eeprom read to see what changes after the reset command is issued to the PIM but it basically just allows the use of the PIM relink command which will send the PIN code and security data to the ecu for a relink. Without the PIM reset command being issued it will just send back 7F denied to a relink request. Im thinking ther'l just be a bit flipped in the eeprom of the PIM.

[jxx]

It does change, and there'll be a counter for how many times it's been reset, i have one here upto 7 so it's time to start checking for changes.
Once it's reset you can set whatever pin you like to it when you relink it (that's why it asks for pin and then confirm pin)
If you try to reset an already reset PIM it comes back with already reset.

[jxx]

And here is the above PIM bin that's been linked and reset again, a fair bit has changed.

oops2.bin

(128 Bytes) Downloaded 237 times

[Gareth]

Would a full bin write allow the the ECU to be reset and relinked?

[The1]

Yes fair bit changed there, nice work

From memory when i logged a PIM Reset the pin codes were only sent to enable the reset not to change it, i could be wrong.

Would be interesting to check the bin again if you relinked it again, is it then the same as the original? Before the reset.

Security data in the ecu is stored elsewhere not in the normal bin file.

[VX L67 Getrag]

Yeah I think the gold will bring the ecu’s rom/ram....
Get a full read of it before trying anything else is my tip!

[jxx]

Yes fair bit changed there, nice work

From memory when i logged a PIM Reset the pin codes were only sent to enable the reset not to change it, i could be wrong.

Would be interesting to check the bin again if you relinked it again, is it then the same as the original? Before the reset.

Security data in the ecu is stored elsewhere not in the normal bin file.

Working on it slowly, So far grabbed another pim that was at security reset count 1.
I've reset it, ripped prom. Linked it (changed pin to ecu), ripped prom.
Reset it, ripped prom. Relinked it, ripped prom.... I'll upload the bins in order when i hit security count max or when there's enough info.


I'll stick them over in the PIM thread viewtopic.php?f=26&t=7076&start=20#p106437 instead of cluttering this thread.