If VCDS loader finds the protection chip, it then unlocks communication with ATMega, creates d1-d3 files and starts VCDS. It communicates with VCDS loader through RTS/CTS pins of FTDI. CN Clone dump is not the same as HCC196.bin.Īs I know - protection chip doesn't protect ATMega (according to schematic I don't know how it can protect it) but is used as a "key" for cracked VCDS distributed with VAG-COM. HP196.bin is for new HW type (0x46) - not decryptable yet (no public). HCC196.bin is for old HW type (0x44) with PORTA.2 and PORTA.3 connected to GAL I'm working on other tools such as FLASH and EEPROM dumper via USB, so it can be read even with fuse bits set.īTW according to FW source code - fuse bits are not read by firmware itself, so it doesn't care if the fuse bits are set or not. It's quite easy to decrypt HCC196.bin (old 512 byte bootlader) from install directory. Here are flash dumps for latest VAG-COM original + flash dump of China clone FW 1.96 with protection chip.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |