[johnksss]

Okay, I have a question. In the EIS programming section is ask for a serial number. What serial number might they be speaking about? This would be under the developers menu.

 

[Dave2302]

I've never tried that, but @Deplore may be able to help

 

[johnksss]

I've never tried that, but @Deplore may be able to help

Sounds good.

I have playing around with this VVDI MB tool to virginize a 215 545 00 08 EIS and now it's in a partial state. It needs to be personalized then activated. Have you ever came across this before?

 

[Deplore]

Not a good idea to virginize eis that have two processors, it almost always fails.

Only way to do it is to use vvdi prog or other equipment and to do a full flash + eeprom copy.

210/220 eis and their variants (202/208/215) are not virginable... Not easily anyway. I don't bother.

Why are you virgining eis? The only time you would need to do it is to a EIS lost case, or to program a ESL emulator (though that isnt required anymore).

 

[johnksss]

Not a good idea to virginize eis that have two processors, it almost always fails.

Only way to do it is to use vvdi prog or other equipment and to do a full flash + eeprom copy.

210/220 eis and their variants (202/208/215) are not virginable... Not easily anyway. I don't bother.

Why are you virgining eis? The only time you would need to do it is to a EIS lost case, or to program a ESL emulator (though that isnt required anymore).

Hummm, did not know they were not virginizable. So the whole using a used EIS is a lost cause on these old cars?

It said it all went through that it now was waiting to be personalized and then activated, but then it gave all keys disabled. I read somewhere that it was waiting to be personalized and activated before it would enable the keys again.

I thought it was messed up so I virginized it and reloaded my EIS data back on it.

 

[Deplore]

EIS is the master immobilizer for the whole vehicle theft system. All other immo parts are slaved to it.

So if you are replacing an EIS for whatever reason, you always clone it over. Some EIS are not cloneable. 210/208/202 are not cloneable due to the difficulties and the fact that the MCU dies when you heat it up with a hot air station to remove it.

And if you do have to replace an EIS because of whatever reason and the original one is not available, you have to virgin all immo in the car, and then do the drive authorization with Xentry. When I say all, I mean ALL. ECU, 722.9, cluster, ISM/ESM, ASSYST, etc.

I went through this last week, actually. 204 chassis came from auction, no EIS because locksmith came, took it to make a key, and then locksmith disappeared. Got used EIS with key, virgined ESL, cluster, ECU, 722.9 and then did the DAS for all. Car started afterwards.

 

[johnksss]

EIS is the master immobilizer for the whole vehicle theft system. All other immo parts are slaved to it.

So if you are replacing an EIS for whatever reason, you always clone it over. Some EIS are not cloneable. 210/208/202 are not cloneable due to the difficulties and the fact that the MCU dies when you heat it up with a hot air station to remove it.

And if you do have to replace an EIS because of whatever reason and the original one is not available, you have to virgin all immo in the car, and then do the drive authorization with Xentry. When I say all, I mean ALL. ECU, 722.9, cluster, ISM/ESM, ASSYST, etc.

I went through this last week, actually. 204 chassis came from auction, no EIS because locksmith came, took it to make a key, and then locksmith disappeared. Got used EIS with key, virgined ESL, cluster, ECU, 722.9 and then did the DAS for all. Car started afterwards.

Hummm, this has no ESL. Trans is 722.6. No locked steering wheel, no locked shifter. EIS is still readable with information still stored in it while in car. Car is a 2001 S430.

So can I ask you this...Can it still be personalized to the car? What are the steps for doing that?
Also my MCU's are both 1D69J's. Waiting on the pcb's for them to show up this week. I also have 2 other EIS's with keys sitting here. 00 08 and 02 08.

In a worse case scenario I could get a set from another car, but not really looking to do that if I have the tools to fix this potential problem.

I do have VVDI and VVDI MB Tool. Also Star Developer mode 5/2014 7/2019

Also to add, I have a pretty good idea what is wrong and how to get it back as i hex edited the bin file and see how to potentially fix it, but still can't test that till i have the other parts for flashing. And not sure if the files have a checksum verification.

 

[Deplore]

Normally at that stage you'd need a green/blue/orange workshop key that contains all the information. This is basically the procedure to install a new EIS at the dealer. When you order a new EIS, you get a blue or whatever color workshop key that contains all the information needed for the EIS (SSID, hash, key pass, all key hash, etc) and then use that workshop to personalize the EIS then you finish it up.

That's why in VVDI when you write the EIS you use that orange cable key.

Also you do need to virgin the shifter in a 220, unless you've already broken the shifter lock.

 

[johnksss]

I thought it did that, but i did not see it personalized after. It came up with checks missing in Personalize and activated. And all keys disabled.

Nope, not I, but the dealer did way back when and have seem to forgotten about fixing it.

 

[Dave2302]

Hi @Deplore ,

WOW, if it wasn't for this new forum s/w I'd give you thanks as well as the likes, very very informative, thanks for all that. Certainly way beyond my meagre abilities lol ?

At least thanks to you and my fiddlings with KTag I now understand most of what you 2 are saying
It sounds to me like MB have designed that newer chip to stop guys unsoldering them and using programmers

I'll be in touch soon, been absolutely manic here, Mels big Birthday, all the family up, and big "Bear" work jobs ................nothing else done to my projects yet

BIG BIG THANKS FOR THESE USEFUL POSTS

Cheers

 

[Deplore]

I thought it did that, but i did not see it personalized after. It came up with checks missing in Personalize and activated. And all keys disabled.

Nope, not I, but the dealer did way back when and have seem to forgotten about fixing it.

You have to switch back to OBD and then write the VIN afterwards.

 

[Deplore]

It sounds to me like MB have designed that newer chip to stop guys unsoldering them and using programmers

Nah, only the early ones. Later ones can be used with little trouble....unless the EIS is FSB4. Right now there is no known way to read a FSB4 EIS when all keys are lost. FSB4 refers to the immo generation -- similar to the key generation with 1 being the old motorola big key and gen 4 being the latest chrome key with square buttons.

FSB4 starts from W221 onwards, and from W205 onwards. So if the car comes with a key, great. If not, well, your job got a lot more expensive.

Eh, things down here are hectic too. I'm closing my shop soon, going pure programming only. Will tell the story later.

 

[johnksss]

You have to switch back to OBD and then write the VIN afterwards.

I did switch back to ODB.
Write VIN, Clear TP and disable key.

IR
Write EIS data, renew EIS and enable key.

I can also write new key data, but that's about it.

It has an eeprom dump tool for HC05, but some have said the data is not correct, but when I looked at bdm doing the 1D69J in line I noticed their dump looks to be in the same format as mine. So this makes me wonder if the dump is good or not. Won't know till i get my adapter this week. I have a few ideas i want to try and see what happens. I also have a line on a whole set if i need to replace everything.

I wanted to say thank you for taking time to explain some things to me. I really appreciate it!

 

[Deplore]

That doesn't sound right to me.

Here's the step I'm familiar with, maybe its different....

-read original EIS, read key pass, generate erase password, save the .bin file
-read donor EIS, read key pass, generate erase pass, save .bin file
-renew donor EIS with IR
-Write the original EIS .bin file to donor EIS with IR
-Write VIN through OBD

At this point it should activate and be personalized....?????
I forgot, I'd have to redo it sometimes this week to see whats the actual procedure, because like I said....I don't renew 220 EIS at all. Dual processors and all that jazz.

 

[johnksss]

That doesn't sound right to me.

Here's the step I'm familiar with, maybe its different....

-read original EIS, read key pass, generate erase password, save the .bin file
-read donor EIS, read key pass, generate erase pass, save .bin file
-renew donor EIS with IR
-Write the original EIS .bin file to donor EIS with IR
-Write VIN through OBD

At this point it should activate and be personalized....?????
I forgot, I'd have to redo it sometimes this week to see whats the actual procedure, because like I said....I don't renew 220 EIS at all. Dual processors and all that jazz.

Now that sounds like very good info.

Although, the renew i attempted was on the same EIS. Software said renew it to get all keys working again. And like a dummy I did. Everything seem to go though as you stated in your steps, only in the end....No personalization or Activation.

I may have to take you up on the whole dual processors as well, if i don't get it figured out later. ?

 

[johnksss]

And....... I'm done!
Second EIS did the exact same thing. it erased fine, but failed to write file now it's in the same state as the first one. I'm beginning to think they can't do. 1D69J on a W220

 

[Deplore]

Then in that case you'd want to use the VVDI prog to restore the flash + eeprom.

....you did make a full backup, right? ?

 

[johnksss]

Then in that case you'd want to use the VVDI prog to restore the flash + eeprom.

....you did make a full backup, right? ?

Of course not! Where is the fun in that.

These were bought cheap for testing though. last set will be if all else fails.

I did put a working EIS in the car and low and behold I saw the personalize and activation section. Tried to do a hot swap the faulty one in and it said...10/4 negative there good buddy. Kicked me out then rescanned the EIS and those options where gone. HAHA.

I also see that that EIS (215 545 02 08) had ELV options in it as well, so pretty sure that one may not work on my car even if i was to try and use it.

Part should be here tomorrow. Hopefully I can dump the eeprom, reprogram it, then flash it back. No one seems to want to explain the eeproms contents, but everyone is willing to look at it. So I will let them check it out and see what they make of it.

Can you translate it?

 

[Deplore]

eeprom content is usually the VIN, mileage, key pass, key hash and key 1-8 hash plus the rolling codes, plus the remote hash keys.

I don't do much .bin file editing, I just don't have the patience to sit there and figure out which address range corresponds to what. What I do is to verify the .bin files against multiple reads and multiple verify's so I can be sure that I have a good read and not a corrupted one that constantly changes between each read.

Reason why everyone is willing to look at it is because they aren't reading the eeprom .bin file by itself, they almost always have a program that they can feed the bin file and it'll translate the contents into nice, easy to understand language.....like english! VVDI is one such program that can decrypt bin. SKC is another, usually comes with AK500. Or CGDI. Or or or or....whatever. There are many different ones.

Oh, forgot to answer....no, the EIS doesn't have checksum verification....yet. I think FSB4 does have checksum verification, which may be one of the reasons why no one has cracked it yet. The newer ECU does have checksum, but only on the mapping data.

 

[johnksss]

eeprom content is usually the VIN, mileage, key pass, key hash and key 1-8 hash plus the rolling codes, plus the remote hash keys.

I don't do much .bin file editing, I just don't have the patience to sit there and figure out which address range corresponds to what. What I do is to verify the .bin files against multiple reads and multiple verify's so I can be sure that I have a good read and not a corrupted one that constantly changes between each read.

Reason why everyone is willing to look at it is because they aren't reading the eeprom .bin file by itself, they almost always have a program that they can feed the bin file and it'll translate the contents into nice, easy to understand language.....like english! VVDI is one such program that can decrypt bin. SKC is another, usually comes with AK500. Or CGDI. Or or or or....whatever. There are many different ones.

Oh, forgot to answer....no, the EIS doesn't have checksum verification....yet. I think FSB4 does have checksum verification, which may be one of the reasons why no one has cracked it yet. The newer ECU does have checksum, but only on the mapping data.

Which seems to hold true as I was able to figure out where most of everything was. I noticed that what I needed to change never changed. So that means programmer to me.

I'm only doing the bin file editing as it seems far far easier than a laptop bios file. (16MB - with checksum security all over the place!) Plus my car is an 01 so hoping they were not that high tech yet.

That seems valid as I did talk to a few vets who are waiting for a real dump. They said nothing can be done with just the VVDI mb dump version as it's missing data.

Ah, cool. Thanks for that heads up. My mods might actually work then.

What is your take on this MB Extreme tool? Is it any good or more hype?