pcmhacking.net

Now doing a reset.. its asking for an immo (Even though it doesnt have one programmed) and we get:
7E0 07 AE 7D 08 30 30 30 30 - requests reset command with immo 0000
7E8 03 7F AE A2 00 00 00 00 - ECU response with Nope, not right (Pretty sure thats A2 response)
7E0 07 AE 7D 08 30 00 00 00 - scantool then tried value of just 0
7E8 03 7F AE A4 00 00 00 00 - Gives an A4 response, pretty sure this is a second attempt fail.

Now after trying to reset.. and it saying nope.. we now have this situation. The security wait time is now active, wait time increased but security code not programmed

*Edit, ignition off then back on... security wait time now inactive.

So.. tried doing a "PIM and ECM replaced", and it comes up saying "The PIM is already programmed and ECM is not programmed"

I have just now reset the PIM.. and we get the following:
244 06 3B 60 34 39 34 39 55 - to PIM, I want to reset, immo is 4949
644 03 7F 3B 78 00 00 00 00 - responds back Im slow
644 02 7B 60 78 00 00 00 00 - responds again saying success
244 02 3B 6D 55 55 55 55 55 - to PIM, write 6D (No data)
644 02 7B 6D 78 00 00 00 00 - response OK

Message after all this was Reset Completed Successfully.

So now we have a reset PIM.. and ECM should be reset.. although it really is in a kinda confused state.

Now to retry the PIM and ECM replaced option.

nope... 100% broken.

After resetting the PIM and trying again.. we now get the end message:

"PIM Is Not Programmed and ECM is Already Programmed"

Which is now the opposite of before. Even though the ECM says it does not have an immobiliser learnt.

*sigh*... Its certainly beat me now.

The only other thing i can think of, nothing to loose would be

7E0 04 03 AE FE 40

Ping 3E tester for 10 mins

Then try write with 3B? guessing, not sure how many bytes FE has maybe 4 given it's feed pin, maybe it'l override? if it does anything, looking like FE is prob not implemented in VZ from what youve tried so far?

7E0 10 ?? 3B FE 00 00 00 00

I think the ecu didn't reset cause technicially the pins were different 0x0000 so like it was still coming from another car.

The1 wrote:The only other thing i can think of, nothing to loose would be

7E0 04 03 AE FE 40

Ping 3E tester for 10 mins

Then try write with 3B? guessing, not sure how many bytes FE has maybe 4 given it's feed pin, maybe it'l override? if it does anything, looking like FE is prob not implemented in VZ from what youve tried so far?

7E0 10 ?? 3B FE 00 00 00 00

I think the ecu didn't reset cause technicially the pins were different 0x0000 so like it was still coming from another car.

I might need to go grab another VZ ECU and reset/relink and verify the actual procedure again as it could just be the tech2 freaking the fuck out also.

Ill get my system to do 7E0 03 AE C0 and send tester present for 10minutes. Maybe thatll help.. or not?? Dunno currently lol.

I tried sending just 0x0000 to it.. which it doesnt seem to accept either.. I get back:
7E0 07 AE 7D 08 00 00 00 00
7E8 03 7F AE A2 00 00 00 00

So it doesnt like that either

For FE Control Mode

BIT6 Theft Deterrent EEPROM Access requires 3E messages
BIT7 Theft Deterrent Relearn Access Doesn't require 3E Messages

I would think for BIT6 access it wont need anything attached, try at a later date just with stuffed ECU if you need to get the existing setup working with another ECU.

Ill give it a go later on one i have here and see if i can write to FE with 00's maybe it'l clear the immobilizer function programmed option.

Ill log a successful reset and programming to see refresh memory on whats happening.

I have a sneaking suspicion Im missing a frame thats sent that actually programs the immo to the ECU after its reset.

wil be handy to see a successful reset and program. Im guessing A2 or A4 will become EE or something when the pin is successful?

no luck here, i get a successful EE message and wait 10mins even with 3E messages every second, i can't 1A read or 3B write to 7D or FE, i get 31 reply. I think FE control mode isn't in VZ