REVO ECU Unlock TSB and Tool Pics

[SwankPeRFection]

Hey guys, below is some info that's in the public domain as of right now. The PDF was sent out to their dealers probably around the time the 2010's came out. Also, there's been quite a few threads where people kept bickering as to how REVO accomplished their boot loader unlock initially and why they needed a bench tool to do it as opposed to what others are doing now and maybe even REVO is doing now via OBDII port. Enjoy... it's here for the community's knowledge and nothing more.


PDF: http://www.revotechnik.com/resources...ECUs%20Web.pdf

Technical Service Bulletin
ECU Security – Locked ECUs Vehicles Affected – MY2010 on vehicles
VW Audi Group have updated the ECU security on 2010 model year vehicles with MED17 and EDC17 ECU’s, these can not currently be remapped by re- flashing through the port. This is being referred to by various parties as the ‘MY2010 issue’, or ‘anti-tuning measure’. This is an issue that affects all remap/tuning companies.
Revo dealers have the option of bench unlock solutions for locked ECU’s.
What is this security?
This is an enhanced version of ECU security using a 1024bit RSA digital signature. This security has been incorporated in Bosch ECU’s since the launch of EDC16, but previously available ‘back doors’ have been closed off. As such this isn’t something that can be bypassed via an OBD port flash, the ECU needs to be removed from the vehicle and opened in order for a probe to be placed on the board to give access to the boot-loader. Revo software disables the digital signature check to allow Revo performance software to be installed without any problems.
Note: Other tuners that use data-area only tools are likely to have problems with all MY2010 affected cars if they attempt to flash them normally, as even putting in the data-area stock read could cause the car not to start.
The below is an overview of vehicles/ECU’s that are locked:
 All VW Polo, Skoda Fabia, Audi A1 1.4twincharger cars are SPX unlock
 Late 2011on 1.4TSI SEAT Ibiza’s are SPX unlock
 B8 Chassis 2.0TSI vehicles are SPX unlock
 B8 Chassis 2.0TDi vehicles are SPX unlock
 2010on 3.0TDI vehicles are SPX unlock
 Nearly all 2010on transverse engine’d diesel vehicles with EDC17 ECU’s
are SPX unlock
 T5.5 Transporter and Amarok 2.0TDI (single and twin turbo) are SPX
unlock
 2011on 2.5TFSI MED9 ECU’s are locked are BDM Unlock
 New type EDC17 ECU’s found in CR140 and 170 engines are SPX
unlock using C46 Boot Probe Tool
 3.0TSI S4/S5 ECU’s are locked and are SPC unlock
 3.0TSI A6 Simos 8.3/8.4 ECU’s are locked and are SPC unlock
 1.6CR PCR2 ECU’s are locked and are SPC unlock
RVOTSB_ECU Security – Locked ECU’s
Technical Service Bulletin
FAQ’s:
Is everything 2010 onwards locked?
No, the current 2.0TFSI MED9 vehicles (S3, Golf R, ED35, Leon Cupra, etc.) and A6 2.0CR vehicles are not locked.
Is it possible to have two cars with exactly same ECU ID and Software Version but one with DS and the other without?
Yes, however in that scenario you would find that the one that is locked came from the factory with that version of software and the one that isn’t locked has been updated to that ECU ID/Software version.
Can an ECU that never had the DS ON be locked via a dealer software update?
No, this isn’t something that can be done. The only way for a previously unaffected car to be locked is for a new ECU to be fitted.
Is it easy to remove the ECU?
Some ECU plugs are covered by security brackets that need to be removed in order to take the ECU out of the car. The security brackets differ between models of car and require different methods of removal, all Revo dealers are capable of removing and replacing the security brackets and where necessary new security bolts are refitted.
Is it easy to open an ECU?
Without the correct tools and process to follow it’s not easy to open an ECU, however all Revo dealers go through specific training prior to having access to any Revo unlock tool.
Does this effect factory updates?
There is no effect on factory updates by having Revo and the security ‘unlock’ on a car. However once a factory update is flashed onto the ECU the ECU will need to be removed again to have Revo software and the ‘unlock’ reinstalled.
Can all Revo dealers unlock ECU’s?
All Revo dealers have access to our unlock tools, please check with your dealer in regards to your specific vehicle ECU.
What are the Revo SPX, SPC, BDM and C46 Boot Probe referred to above?
All of the above are tools required to unlock ECU’s, your Revo dealer will use the relevant tool for the job as different vehicle ECU’s require different methods to be unlocked.
RVOTSB_ECU Security – Locked ECU’s


PICs of C46 Boot Probe:

[AQuattro]

Interesting. Seems their process was similar to what APR and GIAC were doing initially. Open ECU, unlock ECU with probe fixture, flash. No mention of any soldering as was alleged.

[infinkc]

All the special cables GAIC makes is pretty neat also.
http://giaceurope.com/index.php/2011...-uncategorised

[integroid]

I dont get it? Is this new news?

[SwankPeRFection]

I dont get it? Is this new news?

Shouldn't be. It's been out for a while but in some recent threads a few people kept harping on the idea that people solder shit to do the same shit that they do.

Problem is, every tuner has the three seashells but they don't tell anyone how to use them. Lol

[integroid]

Shouldn't be. It's been out for a while but in some recent threads a few people kept harping on the idea that people solder shit to do the same shit that they do.

Problem is, every tuner has the three seashells but they don't tell anyone how to use them. Lol

Hahaha....gotcha

[richib86]

Problem is, every tuner has the three seashells but they don't tell anyone how to use them. Lol

here you go!

[MrFunk]

^^hahahahahahaahah omg!

[SwankPeRFection]

Well shit! [BLAAAA, Swank you have been issued another warning for violating the AZ rules of conduct!] The Internet never ceases to amaze me!

Well played sir... well played... However, I don't think that's how they're used. It will continue to be the great mystery of the universe. lol

[NeedQuattro]

LOL that is gold. Makes me want to rewatch demolition man...

http://www.youtube.com/watch?v=9mFuB0gsNAA

[NWS4Guy]

The way APR (for example) does flashing now is not at all how it was done when they first started to tune the ECU, what makes you think the way any of the others operate now the way they did?

What I am saying is that there was evidence, at the time the allegations were made, that there was desoldering and soldering happening. Have REVO moved on from this? Maybe, or maybe they never did. Posting details about how APR does it now and assuming they never had to crack open the ECU and use a contraption that held the ECU tightly while metal probes were touched to the circuit board is pretty much what this amounts to.

[helix139]

The way APR (for example) does flashing now is not at all how it was done when they first started to tune the ECU, what makes you think the way any of the others operate now the way they did?

What I am saying is that there was evidence, at the time the allegations were made, that there was desoldering and soldering happening. Have REVO moved on from this? Maybe, or maybe they never did. Posting details about how APR does it now and assuming they never had to crack open the ECU and use a contraption that held the ECU tightly while metal probes were touched to the circuit board is pretty much what this amounts to.

There you go talking sense again Neal. What is your problem man!

[NWS4Guy]

There you go talking sense again Neal. What is your problem man!

I must be sick or something, sorry about that.

[Jeff@RevoUSA]

Thanks for sharing, Swank.

To add clarity here, the photo and data shown is for the latest 1767 processor / MED/EDC17 ECUs and not anything related to a B8 S4.

And since I'm here, visit your local Revo dealer and receive 15% off STaSIS Motorsport software. Use promo code: Swank15 *valid until 10/31/2013*

Let me know if you have any other questions,

[NWS4Guy]

Thanks for sharing, Swank.

To add clarity here, the photo and data shown is for the latest 1767 processor / MED/EDC17 ECUs and not anything related to a B8 S4.

Thanks for the clarification Jeff. I was hoping to get a nice retort (not from you) about how this was the device they used to tune the 2010's originally and I would be able to point out the 2012 copyright.

[AQuattro]

I would be able to point out the 2012 copyright.

Good catch but where's the copyright?

Edit: Oh I see it on the board now, I was looking at the doc.

To add clarity here, the photo and data shown is for the latest 1767 processor / MED/EDC17 ECUs and not anything related to a B8 S4.

The PDF was sent out to their dealers probably around the time the 2010's came out.

So Swank where did you get this information?

[Jeff@RevoUSA]

Thanks for the clarification Jeff.

You are welcome.

[SwankPeRFection]

Good catch but where's the copyright?

Edit: Oh I see it on the board now, I was looking at the doc.





So Swank where did you get this information?

Info came off the web. I honestly stumbled upon it doing searches for something else. This is why I said it was public domain knowledge. I really wish REVO or Stasis would just come out and say if they still need to open the ECUs or not, but according to their last info to dealers, it's no longer necessary to open them. I could be wrong, but it irks me when someone talks shit about someone else's technology like their shit don't stink and the other guys don't go above and beyond to defend themselves, regardless of what they do and how. Maybe they just didn't want to sound petty and bicker on or maybe they didn't want to discuss proprietary knowledge, but I figured if the info can be found out publicly, I'd post it so we can ALL get to the bottom of it and the truth rather than the under the table bullshit we seem to constantly be fed by all these places.

What doesn't make sense is that the PDF blatantly indicates the B8 platform as a locked ECU, but doesn't say specifically if this tool was used to unlock those or not. According to Jeff, it was for another ECU in the Audi line and perhaps one of the other tools (software or hardware) is the one used for the B8/B8.5. Either way, I saw a reference for a tool in a PDF, searched for that tool and found some pics of it. I'll see if I can dig up anything else to share with everyone, unless Jeff wants to just come off the knowledge and just share it with people. I really don't think it's all that secret. If you need to pop an ECU open to unlock it, say so. If you don't, say so. Everyone uses their own way of cracking these things to get the job done. What the end result is and how comfortable a user/client is with the process is what matters when it's all said and done. I'm a firm believer in full disclosure of a process or various processes and to let a customer make AN INFORMED decision on a service or product rather than keep knowledge from them in an effort to try and sell them on something. But hey, maybe that's just me... but it's worked out fairly well for me so far and clients I deal with are very appreciative of it. (Keep in mind my everyday job is outside elf the automotive industry, but this concept remains true for me regardless of what I'm dealing with.)

[infinkc]

this is a simos8 boot probe


http://www.chiptuningshop.co.uk/acce...5-8-6-3-0tfsi/

[Arin@APR]

in some recent threads a few people kept harping on the idea that people solder shit to do the same shit that they do.

Not everyone flashed the ECU the same way.

Here's the Revo tool. A chip was removed from the board, put in here, and then soldered back on.

Gary @ Revo denied this over and over and tried to make it appear as if I was lying by saying APR's method didn't require soldering like some other tuners.

Well, if anyone's really interested, I was telling the truth.



And for what it's worth, here's our old tool:



(Note, production pieces were not clear)

[ddillenger]

That revo nonsense is just a chipreader/writer for SOIC-8 chips. That doesn't write the main flash, I can only assume it was for unlocking the ecu for writing with another tool.

APR's is a BDM that uses the BDM port on the ecu itself, and can access the flash, eeprom, and processor content.

[Arin@APR]

APR's is a BDM that uses the BDM port on the ecu itself, and can access the flash, eeprom, and processor content.

That's not correct. :-)

[saxon]

arin, since everything can be flashed through the diagnostics port now when will you come out with a flash loader device? if you check out the recent voting thread you can see its something that the majority of the community is asking for

[AQuattro]

Here's the Revo tool. A chip was removed from the board, put in here, and then soldered back on.

I was wondering what the SPC tool was. Thanks Arin.

Anyone know if this is still what they use?

[Arin@APR]

arin, since everything can be flashed through the diagnostics port now when will you come out with a flash loader device? if you check out the recent voting thread you can see its something that the majority of the community is asking for

I don't think it would be a good move. It would cut out our dealer network, which is a group of APR experts around the world. The level of support they give is more valuable than home flashing in my opinion. Also, to be frank, port flashing could easily go away with an update from the factory. It could be gone on next year's ECUs too. It would also open us up to theft should the program be easily accessible and really make it easy for others to figure out how we're flashing the ECU, which was hard work. And back on the dealer support note, bricking an ECU would be troublesome. Without the dealer network to take care of that situation, you would be left on your own.

[Bomiz]

I don't think it would be a good move. It would cut out our dealer network, which is a group of APR experts around the world. The level of support they give is more valuable than home flashing in my opinion. Also, to be frank, port flashing could easily go away with an update from the factory. It could be gone on next year's ECUs too. It would also open us up to theft should the program be easily accessible and really make it easy for others to figure out how we're flashing the ECU, which was hard work. And back on the dealer support note, bricking an ECU would be troublesome. Without the dealer network to take care of that situation, you would be left on your own.

I personally would see it somewhat like this(for me to use).

Originally flash at the APR Dealer. Somehow get the cable, and be able to flash back to stock for service and be able to flash back to your APR file.

[saxon]

I don't think it would be a good move. It would cut out our dealer network, which is a group of APR experts around the world. The level of support they give is more valuable than home flashing in my opinion. Also, to be frank, port flashing could easily go away with an update from the factory. It could be gone on next year's ECUs too. It would also open us up to theft should the program be easily accessible and really make it easy for others to figure out how we're flashing the ECU, which was hard work. And back on the dealer support note, bricking an ECU would be troublesome. Without the dealer network to take care of that situation, you would be left on your own.

You would still have your dealer network to sell the calls and also to sell flashes for those who don't want a cable. And any person who wants to steal your technology will/can do it without you putting a cable out. I think your company is thinking of your clientele from ten years ago and not current. Thank you for a response though

[westwest888]

My REVO dealer said it was a giant PITA to physically remove the ECU from the car. There were all kinds of security bolts and contraptions holding it in. I think they did have to solder something off on the bench. It's a job for sure.

[drob23]

I don't think it would be a good move. It would cut out our dealer network, which is a group of APR experts around the world. The level of support they give is more valuable than home flashing in my opinion. Also, to be frank, port flashing could easily go away with an update from the factory. It could be gone on next year's ECUs too. It would also open us up to theft should the program be easily accessible and really make it easy for others to figure out how we're flashing the ECU, which was hard work. And back on the dealer support note, bricking an ECU would be troublesome. Without the dealer network to take care of that situation, you would be left on your own.

As a potential customer, I like the idea of being able to DIY flashing back to stock and vice versa. One middle ground suggestion might be to provide a DIY tool that *only* allows you to flash back to stock. For example, assume something goes wrong to your car and you need to immediately take to the dealer for warranty work. Currently, you'd need to first take it to an APR dealer (possibly on flatbed), coordinate the flash with them (which might be on a weekend, so you're SOL) and then take it to the audi dealer. I suppose this method might this still open up your IP for theft though...

My ideal situation (i.e. I would pay more for this, maybe $400 extra) would be: DIY tool to flash ECU completely back to stock, no fee to re-flash the tune from the APR dealer.

As it is now (local SE MI dealers aren't as friendly as some others I've seen), I'd need to pay an hour of labor to go stock, and then an hour of labor to go back to the tune, just for the Audicare service (this is overly paranoid since they likely wouldn't scan the ECU, but I think people juggle with this scenario). Which turns 1 trip during work hours into 3, with the first 2 needing to be reasonably synchronized.

[helix139]

My REVO dealer said it was a giant PITA to physically remove the ECU from the car. There were all kinds of security bolts and contraptions holding it in. I think they did have to solder something off on the bench. It's a job for sure.

Thank you captain obvious

[AQuattro]

any person who wants to steal your technology will/can do it without you putting a cable out.

The increased risk of theft is obvious. There are a lot of people who would have no problem legally buying hardware and having it reverse engineered. There are fewer people who would break into an APR dealer and steal the hardware to accomplish the same thing. It's called deterrence.

[drob23]

Here's a question for people familiar with tuning other platforms. If I have an Evo or STI, and buy one of these cobb tuning tools, can I flash a tune onto another persons car, similar to VAGCOM? So the only incentive to personally own the hardware is to easily swap between maps for different conditions or octane levels? Or are the maps somehow tied to your ECU serial number?

[Jeff@RevoUSA]

Not everyone flashed the ECU the same way.

Here's the Revo tool. A chip was removed from the board, put in here, and then soldered back on.

Gary @ Revo denied this over and over and tried to make it appear as if I was lying by saying APR's method didn't require soldering like some other tuners.

Well, if anyone's really interested, I was telling the truth.



And for what it's worth, here's our old tool:



(Note, production pieces were not clear)

Arin said it best, "Not everyone flashed the ECU the same way".

I have no problem admitting, yes, the old flashing method required the ECU to be removed, opened, and soldered. If you walked into a REVO dealer today, they would flash your 3.0l through the port (no removal).

[Jeff@RevoUSA]

Here's a question for people familiar with tuning other platforms. If I have an Evo or STI, and buy one of these cobb tuning tools, can I flash a tune onto another persons car, similar to VAGCOM? So the only incentive to personally own the hardware is to easily swap between maps for different conditions or octane levels? Or are the maps somehow tied to your ECU serial number?

No, the VIN is stored and checked each time you adjust the tune.

[SwankPeRFection]

The increased risk of theft is obvious. There are a lot of people who would have no problem legally buying hardware and having it reverse engineered. There are fewer people who would break into an APR dealer and steal the hardware to accomplish the same thing. It's called deterrence.

Sometimes a company has to grow out of their antiquated ways. There are plenty of other tuning companies out there who used products like everyone wants out here and they're still in business. Sooner or later APR and GIAC will need to come off their high horses with the business model they've built. I hate to say it, but if they're not going to change things, I hope Audi locks that damn ECU so tight a frog would be envious... I say this out of spite obviously because we are all losing out of something that could make them more money and help us be safer with work being done at a dealer and safer in knowing that we're in control of the flashing situation should an emergency arise with our cars. What happens if you're on vacation and something happens to your car and you have to take it to an Audi dealer around wherever you may be... chances are great APR or GIAC won't have a dealer around that area. In fact, I'd wager to bet big money that could happen to someone and they'd be fucked. Either these companies need to change their technology or they need to step up the game and provide a 3rd party warranty program for everyone. I think we pay enough for their products that maybe they should do that instead of building new warehouses and shops! Something's gotta give and I'm glad the community is finally slowly starting to take the blinders off. Sooner or later more and more people will see the value of a change like this.

[SwankPeRFection]

Here's a question for people familiar with tuning other platforms. If I have an Evo or STI, and buy one of these cobb tuning tools, can I flash a tune onto another persons car, similar to VAGCOM? So the only incentive to personally own the hardware is to easily swap between maps for different conditions or octane levels? Or are the maps somehow tied to your ECU serial number?

The Cobb AP is designed to marry itself to the car in question so that it can only flash one car at a time. However, you can unmarry it from the car and then marry it to another car and the whole process would start all over again. That of course is the legit "by the book" way to use that technology.

However, with free flashing tools available to those markets, you can marry the AP to a car, then image that ECU with the free software tools/cable and then unmarry the AP. Then you blow the image back onto the car and you've got your AP tune back. This frees the AP to be used somewhere else. Of course this is a shitty thing to do and honestly it's not even necessary if all you're looking for is a Cobb OTS Stage whatever tune for your car. You could just as easily marry the AP, then pull the image off and note all the values in the new tune. Then unmarry the AP and then take a stock Subaru map, change the values around to match the Cobb OTS tune and blow it back onto the ECU. This is still cheating a bit because you've now taken the Cobb tune values and reused them, but you wouldn't be cheating the licensing setup of the AP. Over time, even this became something that people didn't bother with anymore because as they saw more and more OTS maps, they realized that there are quite similar to each other in terms of the tune. They were never identical, but pretty close in terms of values. Over time, people evolved the maps to their own tune and it all became a moot point. And that's the thing here... initially there might be an issue, but as time passes, less and less people would bother with stealing the code or the tune values.

Think of it this way. If everyone left their houses wide open there's probably going to be some theft initially, but that would die off over time because there's be no point to it anymore. You steal something, I steal it back. Human nature would get bored of the stupid tug of war and evolution of the thought that stealing was beneficial to you would subside. Same thing would happen here because it's how it works. Of course, no one is sure of how long that time would be between inception and the final evolution. I can only say that it will happen like that.

[SwankPeRFection]

Arin said it best, "Not everyone flashed the ECU the same way".

I have no problem admitting, yes, the old flashing method required the ECU to be removed, opened, and soldered. If you walked into a REVO dealer today, they would flash your 3.0l through the port (no removal).

Finally, someone comes out and says it. There you go everyone.... that was old shit and I'd like to point out that at one time early on, not even APR could ODBII port flash these things, so it's not like their shit never stunk too.

I'm not trying to defend anyone, I'm just trying to get you guys to see the perspective here. The competition you see with the bickering threads is nothing more than sales tactics to try and gain more business. Everyone is allowed to do it to make themselves seem better than the other guy, but everyone should remember that at one point in time, those same limitations were governing them too.

[PsYkHoTiK]

My REVO dealer said it was a giant PITA to physically remove the ECU from the car. There were all kinds of security bolts and contraptions holding it in. I think they did have to solder something off on the bench. It's a job for sure.

It's really not that bad. Sheer bolts on the 6MT sucks but other than that, it's fairly easy. I've done it a few times.

Sent from my Galaxy Nexus using Tapatalk

[AQuattro]

Sometimes a company has to grow out of their antiquated ways.......Sooner or later more and more people will see the value of a change like this.

I agree that a flash at home option would be nice and probably give a market advantage if done right. All I was saying is the "if someone wants to do it, they'll do it" argument is not valid. There's no arguing there's an increased risk of IP theft that comes with offering DIY flashing and this risk needs to be weighed against the advantages. Its a pretty straight forward business decision.

[infinkc]

im curious now if i open my stasis ecu will i see an 8 pin eeprom that had been removed. im also wondering if this same 8 pin chip contains the vin info so you can simply clone 2 ecus like on the older ME7 ecus.