garmen

Hi all! I have been working on the Td5 diagnostic system, till I managed to make a program to perform the diagnostic tasks which usually are made using a Nanocom with a 15€ USB-KKL adaptor and a laptop. Still there are things that don't work, but I hope that I'll be able to finish it. Here is the python project source: https://github.com/EA2EGA/Ekaitza_Itzali and he Spanish LR forum original topic: http://www.clublandrovertt.org/index.php?topic=88596.0 I also made a compiled .exe verison for Windows: http://www.mediafire.com/file/c251wzxx2dvfzma/main_menu.zip You need a KKL-USB cable with a FTDI chip, like this one: http://www.ebay.com/itm/KKL-OBD2-USB-VAG-Interface-Cable-FTDI-FT232RL-Chip-for-3rd-Party-Software-Apps-/331795612427 And also install the FTDI drivers: http://www.ftdichip.com/Drivers/VCP.htm Here you have a video of the system working: Have a nice day!

Hi all!! I'm new here, and I come from the spanish forum. I'm am reverse engineering the Td5 ECU, and I thougth you may me interested in it. By now, I have managed to remove the immobilizer to a NNN ECU, basically you need to rewrite the 93C66 serial Eeprom in the board. The entire post is here, if you wanna follow it: http://www.clublandrovertt.org/index.php?topic=85938.0 Here a video of the Def starting with the alarm engaged: http://www.youtube.com/watch?v=SN5vsCIEcYU This was the code before the removal of the immobilizer: talaikide@debian-TOSH:~/Documentos/Td5_inside/Serial_Eprom_Hack$ xxd Nanocom_dice_ROBUST.bin 0000000: 008f 367a 0000 0000 0000 0000 4000 0008 ..6z........@... 0000010: 0000 0000 0000 eeff ffff ffff ffff ffff ................ 0000020: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000030: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000040: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000050: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000060: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000070: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000080: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000090: ffff ffff ffff ffff ffff ffff ffff ffff ................ 00000a0: ffff ffff ffff ffff ffff ffff ffff ffff ................ 00000b0: ffff ffff ffff ffff ffff ffff ffff ffff ................ 00000c0: ffff ffff ffff ffff ffff 008f 3675 0000 ............6u.. 00000d0: 0000 0000 0000 4000 0008 0000 0000 0000 ......@......... 00000e0: eeff ffff ffff ffff ffff ffff ffff ffff ................ 00000f0: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000100: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000110: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000120: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000130: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000140: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000150: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000160: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000170: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000180: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000190: ffff ffff ffff ffff ffff ffff ffff ffff ................ 00001a0: ffff ffff ffff ffff ffff ffff ffff 0000 ................ 00001b0: ffff ffff ffff 01f4 1724 14aa 02e0 06e2 .........$...... 00001c0: 0af2 fec4 5556 0007 14aa 02e0 06e2 0af2 ....UV.......... 00001d0: fec4 5556 0007 14aa 02e0 06e2 0af2 fec4 ..UV............ 00001e0: 5556 0007 a001 6610 5001 660b fc03 fc03 UV....f.P.f..... 00001f0: fc03 dfdf dfdf db9c 5332 5a44 0466 280e ........S2ZD.f(. This is after: talaikide@debian-TOSH:~/Documentos/Td5_inside/Serial_Eprom_Hack$ xxd Nanocom_dice_NON_ROBUST.bin 0000000: 008f 367a 0000 0000 0000 0000 4000 0008 ..6z........@... 0000010: 0000 0000 0000 eeff ffff ffff ffff ffff ................ 0000020: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000030: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000040: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000050: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000060: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000070: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000080: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000090: ffff ffff ffff ffff ffff ffff ffff ffff ................ 00000a0: ffff ffff ffff ffff ffff ffff ffff ffff ................ 00000b0: ffff ffff ffff ffff ffff ffff ffff ffff ................ 00000c0: ffff ffff ffff ffff ffff 008f 3675 0000 ............6u.. 00000d0: 0000 0000 0000 4000 0008 0000 0000 0000 ......@......... 00000e0: eeff ffff ffff ffff ffff ffff ffff ffff ................ 00000f0: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000100: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000110: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000120: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000130: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000140: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000150: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000160: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000170: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000180: ffff ffff ffff ffff ffff ffff ffff ffff ................ 0000190: ffff ffff ffff ffff ffff ffff ffff ffff ................ 00001a0: ffff ffff ffff ffff ffff ffff ffff 0000 ................ 00001b0: ffff ffff ffff 01f4 1724 14aa 02e0 06e2 .........$...... 00001c0: 0af2 fec4 5556 0007 14aa 02e0 06e2 0af2 ....UV.......... 00001d0: fec4 5556 0007 14aa 02e0 06e2 0af2 fec4 ..UV............ 00001e0: 5556 0007 a001 6610 5001 660b 0000 0000 UV....f.P.f..... 00001f0: 0000 dfdf dfdf db9c 5332 5a44 0466 280e ........S2ZD.f(. You can see how in the last two lines the bits 1EC to 1F1 changing to 0x00. After doing that, the Nanocom shows the ECU as NON-ROBUST. This means that the engine can fire up without the signal from the alarm module. It is important that the cable from the alarm B34, must be disconnected, otherwise the engine won't fire if it recives any alarm code. Important also to hack the starter relay, connecting the upper pin to ground, so the key directly energizes the relay. I have written the Eerpom, using an Arduino. I'll post the source code of it, after I tidy it up Photos: Have a nice day!!!!