How to read .BIN through Key101

EPROM EEPROM SRAM NVRAM Flash chips, reading/writing hardware and software
Post Reply
Mykk
Posts: 6
Joined: Wed Jul 05, 2017 6:14 am
cars: E34 BMW 540i/6

How to read .BIN through Key101

Post by Mykk »

I've a customers vehicle (BMW E34 540i, similar to my personal car but his is automatic) whom wants to make a few changes to his existing tune (Bosch Motronic M3.3 BMW 404DME) The current aftermarket chip is encrypted and running through an EVC Key 101 28 pin protection module. The chip is a 27c512.

I tried a direct read via Moates Burn2 with and without the Key101, both .BINs turned out gibberish.

I've offered to simply burn him another chip with a performance tune and the changes he wants to make. Yet he was adamant about using this tune from his now 20 year old chip from a tuner no longer in biz.

Anyone know how to get a clean read with this chip & protection module then decrypt the .BIN as so I can make some changes and burn onto new chip?

Thanks for the help.
Mykk
Posts: 6
Joined: Wed Jul 05, 2017 6:14 am
cars: E34 BMW 540i/6

Re: How to read .BIN through Key101

Post by Mykk »

After some research I've experimented with WinKey using a supplied tuner made .SCR just for this application , to no avail.

One person says they've successfully read tune through Key101 using AVR Micrcontroller, a world I know nothing about.

Another says they've successfully pulled a tune through Key101 using a generic Tl866CS socket to USB interface. I've ordered one to try.
Mykk
Posts: 6
Joined: Wed Jul 05, 2017 6:14 am
cars: E34 BMW 540i/6

Re: How to read .BIN through Key101

Post by Mykk »

I was able to get a clean, decrypted .BIN that appears to have all the data and maps unjarbled by simply reading the chip through the Key101 using a TL866CS universal programmer and it's supplied MiniPro v6.5 software. I chose the SST 27SF512 chip ID and unchecked the "Erase Before" and "Check ID" options.

While file comparing in HXD to a stock chip read the aftermarket encrypted performance chip has alot of similarities that leads me to believe it has correctly decoded, despite the heavily modified axis headers and tables. The large maps also don't appear to have any bytes swapped or cells that seem out of place.

Tomorrow morning at the shop I will load the "decrypted" file to the chip emulator to see if the vehicle runs like normal.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: How to read .BIN through Key101

Post by antus »

Thanks for the update!
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Mykk
Posts: 6
Joined: Wed Jul 05, 2017 6:14 am
cars: E34 BMW 540i/6

Re: How to read .BIN through Key101

Post by Mykk »

Loaded the .BIN read of the encrypted chip & key 101 onto the Moates Ostrich 2.0 chip emulator and the vehicle ran beautifully. I'm confident I can make the wanted adjustments and burn to chip.

Also, on a side note. The Universal TL866CS chip reader/programmer was also capable of erasing/blanking a series of fake SST 27SF512 chips acquired off Ebay. The Moates Burn2 was able to write to the fake chips but unable to erase them once programmed.
jca
Posts: 135
Joined: Mon Dec 07, 2009 2:14 pm
cars: HQ monaro
vz ss thunder
ve ss sports wagon

Re: How to read .BIN through Key101

Post by jca »

Hi guys does any body know the settings for the std 27c128 , 356, 512 chips when using the mini pro
Post Reply