E39A Vin write by DID

[usbbdm]

I tried to change VIN on E39 and failed. What did I do wrong?
Sorry if this issue has been discussed before.

Here is the can log.
000007E0 02 27 01 00 00 00 00 00
000007E8 04 67 01 7A D5 AA AA AA
000007E0 04 27 02 10 0F 00 00 00
000007E8 02 67 02 AA AA AA AA AA
000007E0 10 13 3B 90 32 47 31 59
000007E8 30 00 0A
000007E0 21 59 32 34 55 33 35 35
000007E0 22 31 30 31 36 30 36 AA

I tried to add write VIN feature the software.

[ironduke]

I tried to change VIN on E39 and failed. What did I do wrong?
Sorry if this issue has been discussed before.

Here is the can log.
000007E0 02 27 01 00 00 00 00 00
000007E8 04 67 01 7A D5 AA AA AA
000007E0 04 27 02 10 0F 00 00 00
000007E8 02 67 02 AA AA AA AA AA
000007E0 10 13 3B 90 32 47 31 59
000007E8 30 00 0A
000007E0 21 59 32 34 55 33 35 35
000007E0 22 31 30 31 36 30 36 AA

I tried to add write VIN feature the software.

I'm curious what the 7F error reply was, also did you perform a clear code command prior to attempting to change the vin??
Just a heads up though, a vin write alone will not let it be installed in another vehicle, the immo/pincode needs to be changed to match the vehicle it's going into..

[usbbdm]

There is not 7f message after the last 7e0 command. I did not do clear code. I am confused with your post about clear code. What exactly the command is it? I tried 01 04 and got 7f response.
I just need to make this feature available. Not myself put the ECU in another car.

[ironduke]

There is not 7f message after the last 7e0 command. I did not do clear code. I am confused with your post about clear code. What exactly the command is it? I tried 01 04 and got 7f response.
I just need to make this feature available. Not myself put the ECU in another car.

Raw CAN to clear codes I send 0x00, 0x00, 0x01, 0x01, 0xfe, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00
That clears codes on anything on the bus. Haven't tried singling out a module, just copied what I've seen.

Easiest way to check a vin write command is to try and write the original vin back to it.. if you get a 7B reply then all is well with the command and timing. If you then try a different vin and it errors out try a clear code command.

When you send the multiline vin write command the ecm should send a reply back.. If your not getting a 7F error or a 7B reply then something is wrong with the command. I don't know the timing off hand but I know the multiline has to be quick, I've gotten it done before with termite and some function keys defined but it was hit or miss with my speed, lol.. Nowadays I do it with some c# code..

Clear codes
unlock
write vin

[usbbdm]

Sorry for the ignorance.
How can I send 0x00, 0x00, 0x01, 0x01, 0xfe, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00?
As of CAN message each packet max 8 bytes.
Longer packet will generate message like 10 0c 0 0 1 1 fe 1 4 0 0 0 0 0 0
00352757 000007E0 10 0C 00 00 01 01 FE 01
00352762 000007E8 30 00 0A
00352763 000007E0 21 04 00 00 00 00 00 AA
00352774 000007E8 03 7F 00 11 AA AA AA AA

Here is the log for my read original VIN and write back the original VIN with the left to be tick count. Could it because too quick?
00445975 000007E0 02 1A 90 00 00 00 00 00
00445984 000007E8 10 13 5A 90 31 47 31 59
00445993 000007E0 30 00 00 00 00 00 00 00
00446009 000007E8 21 59 32 34 55 33 35 35
00446020 000007E8 22 31 30 31 36 30 36 AA
00449373 000007E0 02 27 01 00 00 00 00 00
00449384 000007E8 04 67 01 7A D5 AA AA AA
00449408 000007E0 04 27 02 10 0F 00 00 00
00449421 000007E8 02 67 02 AA AA AA AA AA
00449422 000007E0 10 13 3B 90 31 47 31 59
00449434 000007E8 30 00 0A
00449434 000007E0 21 59 32 34 55 33 35 35
00449435 000007E0 22 31 30 31 36 30 36 AA
No response after that. I am expecting either 7f or 7b for the 7e8 but nothing.

[usbbdm]

Actually after I added 100ms delay between packets it works.
01001201 000007E0 02 27 01 00 00 00 00 00
01001206 000007E8 04 67 01 7A D5 AA AA AA
01001308 000007E0 04 27 02 10 0F 00 00 00
01001318 000007E8 02 67 02 AA AA AA AA AA
01001424 000007E0 10 13 3B 90 31 47 31 59
01001431 000007E8 30 00 0A
01001531 000007E0 21 59 32 34 55 33 35 35
01001640 000007E0 22 31 30 31 36 30 36 00
01001656 000007E8 02 7B 90 AA AA AA AA AA
01006318 000007E8 01 60 AA AA AA AA AA AA

[ironduke]

Sorry I’m mobile but the clear code command. That is the whole command. All 12 bytes. The 00 00 07 e0 is not included. It’s a general broadcast to all messages.

Instead of
00 00 07 E0 02 27 01 00 00 00 00 00
You would send
00 00 01 01 fe 01 04 00 00 00 00 00

[Archimedes]

There is two memory locations where vin is stored I havent confirmed that the vin changes in both locations with that command or only one. Im also working on read e39/e39a read pincode but im stuck on reading shadow eeprom locations. sps log seems to show reading the pincode somehow. I am thinking the second vin is altered with immo learn or something

[Archimedes]

Does anybody know the pid to send in the ecu pincode? i know the pids go from 00 to ff so i am trying 7e0 06 AE 01 31 34 37 39 but i get 7f response i am assuming 01 is the wrong pid. Also what did do you read for the timer?
thanks