u-Link NAND + MCP2515 board program tunerlocked E78.

[00:00:03]This is ECU E78.

[00:00:07]It has been programmed tuner locked firmware on it. I'm not going to use the DC706 showing you this is tuner locked. And I'm going to use the the Unit can T to show how to read and write the tuner locked ECU.

[00:00:21]So here is the setup and I have the E78 selected.

[00:00:27]And I can power on the ECU here.

[00:00:30]And we can read the ECU info.

[00:00:33]It says switch ignition off. Let's ignition off.

[00:00:36]Ignition on.

[00:00:38]Click okay.

[00:00:44]So we can see we are reading all these information VIN number and stuff like that.

[00:00:51]So now it asks us to switch ignition off. So ignition off. Let's try to connect and to enter the programming mode. So we enter connect.

[00:01:03]Off. Okay. So let's turn on.

[00:01:06]Click okay.

[00:01:10]Switch off.

[00:01:15]What this this one says security verification in progress security verification error.

[00:01:21]So the initial security in negotiation failed with the tuner lock.

[00:01:27]And there there are three ways to tuner lock it. One is you change the seed and key request. And the second one is change the algorithm seed key algorithm.

[00:01:36]And third one is direct change the keys.

[00:01:38]In this case it's the seed and key request command.

[00:01:43]Let me talk about Unit can T and we can see how we can fix this issue.

[00:01:49]This is the E78 plus the Unit can end and the MCP board uh the canvas setup.

[00:01:59]Let's take a look in the software.

[00:02:01]Uh power on the ECU and see if we can read the ECU info.

[00:02:07]Yes, we can. And let's try and to see if we can detect.

[00:02:12]So, when we put click on the detect, nothing shows up.

[00:02:16]Remember we we when we using the DC706, it says security failed, and we can turn on the log data. Show see what's going on here.

[00:02:26]And what it says is we are trying to send a 2701, which is here seed request command.

[00:02:33]And the seed request command is being rejected.

[00:02:36]Now, uh I already know this this tuner lock is changed the seed request command.

[00:02:44]Let's see how we can use the command to see which command is using. So, write can and two 2701.

[00:02:53]This is we trying to write the uh seed request command.

[00:02:58]And you can see the the respond is 7F2F.

[00:03:01]But if we send 2601, we see it's responding and it's responding to the uh this proper seed here.

[00:03:14]In 1.92 and earlier, we need to do the configuration to change it. Now, I add the UI go here. So, if we were changing the 27 to 26 here, we should be able to detect the flash.

[00:03:29]And let me show you how this works.

[00:03:31]So, we click here. We enter here.

[00:03:34]So, let's let's restart it.

[00:03:37]And power off and power on.

[00:03:40]And once we have this changed to 26, we can go to the proper uh debug mode.

[00:03:49]So, So see we can do the regular issue info. We can try to read internal flash.

[00:03:55]So click here.

[00:03:57]It's a text.

[00:03:58]Oh.

[00:03:59]Okay, let's try again.

[00:04:05]Something is wrong.

[00:04:08]Maybe we we need to wait 10 seconds. Oh, okay, we didn't wait long enough.

[00:04:12]So now we uh in the debug on mode and we can do the full read. We we can also uh tuner unlock it. So once we know the what command it's using and we can change the 26 back to 27 and then make proper checksum.

[00:04:28]Then we should be able to um use the regular program to access this issue.

[00:04:41]So in 1.93 uh the changes is you do not need to go to the configuration to change the seed request command.

[00:04:50]Uh this also applies to the VPW. So if you have a tuner locked P12 you can also use the seed request command change uh for through the UI.

[00:05:10]Okay, this one was has been read and you can take a look the flash. Everything is read properly.

[00:05:17]And if you want we can do a verify see if the you know data matches. Yes, everything is matched. There are three tuner lock method. One is change the algorithm.

[00:05:28]Which we can change in one byte algorithm.

[00:05:31]The second one is change the seed and key request. Uh in case of two bytes, we just need to enter two bytes data here to directly replace the uh the key.

[00:05:41]And the third one is the change the seed request command. Um I have seen most often is changed from 27 to 26 and then you can access the tuner locked ECU.