Posts tagged with "ktag"
Ktag 7.020 adds new encrypted cars & 100+ ECUs
Here is a step-by-step tutorial on how to use V2.13 KTAG V6.070 ECU Programmer reading Opel Insignia ECU EDC17 C59 in EEPROM TC1767.
To read opel insignia EDC17 C59 in a cheap way
First, you need the main unit—ktag ksuite V2.13 ECU master , $79 at obdii365.com here:
16-way rainbow ribbon cable 144300T105
Two 470 Ohm resistors
You can start reading Opel Insignia ECU now!
Take apart the ECU from vehicle, open the ECU unit and connect ECU with KTAG
If you don’t know how to connect to ECU, you can choose “Plug-in 688…” to check detailed connection instruction, or it may cause damage to ECU, good luck for you!
Select vehicle model and ECU: OPEL-> Insignia -> BOSCH EDC17C59
After reading the instruction in detail and solder wires, successfully connect to ECU with KTAG v6.070
Then click OK to continue
Select the plug-in 688
Ktag is identifying ECU…wait for a while
Then it is reading EEPROM…the operation may take several minutes
KTAG ECU Programmer Reading ECU17C59 successfully! You can save the file to “OPEL-Insignia-2012-ECU17C59”
Finally, Remove the soldered wires and the resistors before re-installing the ECU to vehicle.
|Product||Ktag v6.070||Ktag KTM100 v7.003|
|Software version||Ksuite V2.13||KTM100 V2.13|
|Token charging||Through PC programming||With one renew button|
|BMW F chassis petrol||NO||YES|
|Language||English/ Italian/ German/ French/ Portuguese/ Spanish||English/ Italian/ Portuguese,|
|Protocol||over 95%(BDM MOTOROLA MPC5xx)||More than ktag ksuite(BDM MOTOROLA MPC5xx)|
All paid off!! I have spent one week to manage to reset and make work the KTAG firmware v6.070. I mean, i have unblocked KTAG machine from the Internet. And now, i would write this manual to help others.
I’m not responsible for your damage. All actions ON YOUR OWN RISKS.
Why to unblock ktag 6.070?
Because if your KTAG has been blocked from internet you will see customer code c5555.
How to unblock Ktag v6.070?
1)have to erase the lpc2478 (method heat and reset, using flashmagic with ttl com port.)
(you can search video in youtube lpc2478 unock)
2)have to program the processor, i have done with flash magic (not forget to remove the bridge) or you can program with J-link adapter.
use frmw.hex file.
3)has to erase you sd card and format it to fat32. (not load files here the software will do it.)
4)not your hardware is ready to be updated by software. copy envelope Ksuite to your c:/ and copy the envelope update to c:/ksuite/update.
(the update envelope has the data for your device to be updated)
5)not forget to disconnect internet and run 2 times the software to update and device and the families.
Possible problems and solutions when unblock KTAG:
1)the heat and reset function
How to turn off the red lamp so you can connect the flash magic:
usually reset 2 or 3 times you heat and wait the lamp to be turned off by the heat;
remove the heat gun and wait if the lamp 2-3 seconds with turn on;
if yes, do it again;
if not, try to connect;
if not connect, make reset and try again until you connect.
2)you may have serial l00000000 and fw 0 when erasing the processor.
If this happens, the the processor has short circuit a leg and the SD card cannot be ready it in fat32 system.
check the legs or clean them;
run the software and notice if you have a update serial;
ps. This is a user solution. All info here is just for sharing.
Do not connect your computer to internet when you use your Chinese KTAG ksuite master ecu tuning kit at obdii365.com, do not update the device in any way!
K-tag symptom from a customer:
Ktag 6.070 and med17.4 checksum error on write mod file.. is it just me or is this a general clone problem.
no matter what i try it will not write mod file(checksum error) ori is fine backup and restore is fine, this is the only ecu i have had a problem with.
i have tried 3 tools all from different supliers 3x computers and 4x software same result…
1- the data read is incorrect
2- the car is not included the vehicle list (ktag deos not support your model)
note: “checksum error” is not related with ktag device
successful solutions shared by forum members:
1- use Ksuite 2.15 version
2- Rename ksuite folder to ksuite.old, install ksuite 2.15, delete ksuite folder, and rename ksuite.old to ksuite. now all is working!
But most people would like the third solution–>
if you chose to write mod file you should to check in software only flash – maps to program not all options
I need to read ECU Renault espace 21 Sagem s2000 RPTM ECU. I need a photo pinout for this ecu. I have K-tag ksuite master ecu programmer. Finally got the pinout to Ktag 6.070. Just post here to share with you all.
In order to get access to the boot pads it is necessary to remove the glue that covers the
Connect the universal wiring to POL4 and to ECU connector as shown in the picture
Fgtech Galletto V54 master BDM-Tricore-OBD programmer will also read this ECU in boot mode. Pinout attached:
I am a two-year tuning master. For some time I’ve been interested in the process, since I’ve seen the guys do a bench flash on my ECU. Ruining the FRM on my car made me a bit more determined to really dive into coming to grips with the BDM process.
So, I placed a few orders in China and all the boxes came in the last few days. now these are all clone tools, not genuine, but I’m not paying 20 times more for original tools just to scratch an itch. Granted, some of them might not be as good as the real thing and do work perfectly.
As you can see, there’s enough to keep me occupied for some time. There’s a Kess V2, K-tag,FgTech Galletto V54 Master, Xprog V5.50, R270, J-link and a UPA USB V188.8.131.52 red color device programmer. On the Diag side I’ve got an BWM ICOM diagnostic and programming system without WIFI and a Vas5054 for VAG. There’s also an EDC17 C41 ECU for the E90 320d LCI and I’ve got the FRM that came out of my car. Getting the FRM going is the first job. As with most of the ECUs in the later cars, they all security protected so getting them to submit to flashing is pretty painful so I’m holding thumbs that the tools I have will be able to do what they say it should.
Getting stuck into the complex electronics part is no problem for me, as I’ve got a very well kitted out Lab in which to play. I used to do some serious embedded electronics and programming stuff in a past life and the passion is still there!
I was going to tackle the FRM tonight, but we’re now the victim of load shedding so that idea went out the window. I will be updating this thread with more meat as I go, hopefully you guys will get some benefit out of it as well
All the tools I have can do checksum calcs. In fact I had a tuner friend over tonight and he showed me some of the ropes using the K-Tag. He even showed me the process in opening these – we had a couple on the grill in the kitchen in order to soften up the glue. My wife only shook her head…
We flashed a few Tricore ECUs in boot mode and the KTag Ksuite 6.070 master worked perfectly with the difficult EDC17 C41 I had laying about.
What became obvious is that flashing is the really easy part, it’s literally a couple of mouse clicks and it’s done (after butchering the ECU of course). The hard part is understanding how the various aspects of the firmware modules in the ECU interacts with other components in the car, like the CAS. These things are packed full of security to specifically prevent what we’re doing here…
Anyway, a few stripped Tricores being massaged into submission
Another one of the silly things I wanted to do was to see if I can’t revive the old FRM3 that stopped working in my car. What happened at the time was that I had disconnected the battery and someone went and closed the boot. The only way I could get the boot open was to connect a PSU to the jump points in the engine bay. Problem was that I only had a 5A PSU at the time; this was enough to release the boot but I managed to mess up the FRM in the process. That’s one of the reasons I built a proper 70A PSU as well.
Anyway, I suspected that the microprocessor in the FRM went into ‘security mode’ because it detected a brown out condition. This sets the tamper flag inside the FRM and it goes dead. Problem is, you can’t read these microprocessors with normal programmers as the code is encrypted and you need a security key to access them.
In comes the XPROG M Box ECU tuning kit that basically allows you to bypass the security measures in these microcontrollers and thus opens it up for you to mess with.
I took a flash dump of the working FRM I’ve got in my car:
I then grabbed the faulty FRM and loaded a known working software version into it and voila! I’ve managed to fix the faulty FRM and my suspicion was confirmed – the FRM was ok electrically but its firmware got messed.
I’m now super chuffed that I can read the security locked microprocessors in these ECU modules. Incidentally, the CAS also uses a microcontroller from the same security protected family
In other news, I flashed my whole car with the latest 2014 software. And managed to make the USB and BT inoperable.
When looking at the config files of the radio now, I see that there’s no more option to enable USB and BT so I can only assume that BMW ICOM ISTA/P loaded the firmware into the radio that’s used for radios with built in USB and BT. This causes the radio to ignore the MOST loop as it doesn’t need to break out of the radio for these functions anymore. I confirmed that because the MOST loop is now only working under diagnostics, not otherwise. So it’s not bothering to check for a MULF on the MOST bus because it doesn’t need to.
I’ll have to update the radio with the correct software in order to rectify this, but this is merely a theory at this point. I’ve a sneaky feeling this will take a while to get sorted out. In hindsight I should’ve just left the software alone, but where’s the fun in that .