VZ V6 E55 ECU Brute Force Reset Tool & PIM Relink

[jxx]

It's bad news, after the time it stops responding to cranking with no PIM attached, it also stops starting if the engine is manually made to crank.
So it's not a way to defeat VATS.

Just a way to lock an ecu to never be reset again, or have another pim linked to it.

Need to get into the security part of the ECM and get it to ignore P0633 No Transponder programmed.

[The1]

Bummer

[hsv08]

Wonder if you can write to it as you have, then setup an arduino to keep sending the PIM ok frames. As a way to somewhat worksaround the vats issue?

[Gareth]

The real goal is to be able to use this ECU as a standalone in say, a speedway car or other race car.

[hsv08]

The real goal is to be able to use this ECU as a standalone in say, a speedway car or other race car.

I get common requests for programming the alloytecs standalone in Jetboats too!

[jxx]

Wonder if you can write to it as you have, then setup an arduino to keep sending the PIM ok frames. As a way to somewhat worksaround the vats issue?

Then it'd just be as easy to use the PIM.
Although never tried, but will it run/fire without a BCM, and from circuit diagrams I've seen the BCM is only connected to the PIM by aldl, so a simple Okay to start command over that should trick it.


I did notice when the PIM was reset it logged a P0633 code in itself, but still ran, so like E38 gen iv I don't think this dtc disables it.

[VX L67 Getrag]

Stupid thought, but has anyone tried running that ecu with that code completely disabled so it doesn’t even process the fault?

[hsv08]

Stupid thought, but has anyone tried running that ecu with that code completely disabled so it doesn’t even process the fault?

If I get a chance on Monday I'll attempt it on a random ecu.

[The1]

Another update before i head off for a week.

V1.4
Added ReadMemoryByAddress – 23 RAM Download
Added Custom PID Request

Seems to be 28 memory segments that can be read in 0xFA chunks. So i setup a routine to dump them out to files. Doesn't seem to be anything interesting even when linked or not linked. I may have to use the same "ReadMemoryByAddress – 23" to do a full flash download as i think "RequestUpload – 35" might be disabled.

Added Custom PID Request, eg input 90 and it will spit out the response, it'l also do a seed key unlock first.

Ill work on downloading the Flash contents next.

Attached is my segments.

[The1]

If anyone has any info it would be appreciated, as im not even sure what segments are Ram, Calibration, System.