Serial EEPROM & Immo

The 512-byte immo EEPROM, page by page, with a working checksum fixer.

While calibration maps, operating system code, and diagnostic tables reside inside the 1024 KB external parallel flash memory (AM29F800BB), all dynamic vehicle-specific adaptation parameters, anti-theft immobilizer security keys, vehicle identification (VIN), softcoding, and flash programming counters reside in a dedicated 8-pin SPI serial EEPROM located on the ECU PCB adjacent to the C167CR microcontroller.

On standard transverse 06A platforms, this chip is an STMicroelectronics 95040 (512 Bytes / 4 Kbit). On newer longitudinal platforms (such as Audi A4 B6 8E0 909 518 xx), this chip is an STMicroelectronics 95080 (1024 Bytes / 8 Kbit).

BOSCH ME7.5 95040 EEPROM 512-BYTE (32-PAGE) MEMORY LAYOUT

10.1. Detailed Memory Map: Reverse-Engineering All 32 Pages#

Every page consists of 16 bytes. In all checksummed pages, Bytes 0 through 13 hold data payload, while Bytes 14 and 15 hold the 16-bit little-endian page checksum.

1. Pages 1 & 2: Immobilizer Control Banks (0x010–0x02F)#

2. Pages 3 & 4: Secret Key Code (SKC / Login PIN) & RFID Key Store (0x030–0x04F)#

3. Pages 6, 7 & 8: Vehicle Identification Number (VIN) & Immo ID (0x060–0x08F)#

4. Pages 12 & 13: ECU Softcoding & Workshop Identification (0x0C0–0x0DF)#

5. Pages 14 & 15: Flash Programming Attempt Counters (0x0E0–0x0FF)#

6. Pages 16–20: Electronic Throttle (E-Gas) Learned Adaptations (0x100–0x14F)#

7. Pages 21–24: Long-Term Fuel Trims (LTFT) & Cylinder Knock Offsets (0x150–0x18F)#

8. Pages 28 & 29: VAG Hardware & Software Part Number Strings (0x1C0–0x1DF)#

10.2. The Master Bosch ME7.5 EEPROM Checksum Algorithm#

Whenever any byte in Pages 0–27 or 30–31 is edited, the 16-bit complement checksum in Bytes 14 and 15 of that specific page must be recalculated. Failing to update the checksum causes the ECU to flag P1603 / 18011 (Internal Control Module: EEPROM Defective) on the next key cycle and lock adaptation storage.

1. Per-Page Firmware Descriptor Table#

Inside the C167 firmware ROM, Bosch maintains a lookup table containing a 16-bit descriptor word for each of the 32 pages:

  Page 00: 0xFF18   Page 08: 0x06F7   Page 16: 0x0AF3   Page 24: 0x0F33
  Page 01: 0x0017   Page 09: 0x07B3   Page 17: 0x0B32   Page 25: 0x1033
  Page 02: 0x0117   Page 10: 0x07F3   Page 18: 0x0B10   Page 26: 0x1133
  Page 03: 0x0207   Page 11: 0x08B7   Page 19: 0x0B10   Page 27: 0x1233
  Page 04: 0x0307   Page 12: 0x08F7   Page 20: 0x0B10   Page 28: 0x1235 (EXEMPT)
  Page 05: 0x0437   Page 13: 0x09B3   Page 21: 0x0C37   Page 29: 0x1235 (EXEMPT)
  Page 06: 0x0533   Page 14: 0x09F3   Page 22: 0x0D33   Page 30: 0x13B7
  Page 07: 0x06B7   Page 15: 0x0AB3   Page 23: 0x0E33   Page 31: 0x13F7

2. Bitmask Flags#

3. Mathematical Checksum Formulation#

For page P \in [0, 31] starting at byte offset \text{offset} = P \times 16:

eq 0 \implies \text{Sum} = \text{Sum} - 1$$

10.3. Standalone Python Checksum Fixer & Immo Defeater (me7_eeprom_fixer.py)#

The following self-contained Python script automatically defeats the immobilizer, validates all 32 pages, and recalculates all Bosch page checksums for any 512-byte (95040) or 1024-byte (95080) EEPROM image:

#!/usr/bin/env python3
import sys

PAGE_DESCRIPTORS = [
    0xFF18, 0x0017, 0x0117, 0x0207, 0x0307, 0x0437, 0x0533, 0x06B7,
    0x06F7, 0x07B3, 0x07F3, 0x08B7, 0x08F7, 0x09B3, 0x09F3, 0x0AB3,
    0x0AF3, 0x0B32, 0x0B10, 0x0B10, 0x0B10, 0x0C37, 0x0D33, 0x0E33,
    0x0F33, 0x1033, 0x1133, 0x1233, 0x1235, 0x1235, 0x13B7, 0x13F7,
]
EXEMPT_PAGES = {28, 29}

def calc_page_checksum(data, page_offset, page_num, desc):
    s = sum(data[page_offset + i] for i in range(14)) + page_num
    if desc & 0x0040:
        s -= 1
    return (-s) & 0xFFFF

def fix_eeprom_bank(data, bank_offset=0):
    updated = 0
    for page in range(32):
        if page in EXEMPT_PAGES:
            continue
        desc = PAGE_DESCRIPTORS[page]
        if not (desc & 0x0001):
            continue
        p_off = bank_offset + (page * 16)
        expected = calc_page_checksum(data, p_off, page, desc)
        stored = data[p_off + 14] | (data[p_off + 15] << 8)
        if stored != expected:
            data[p_off + 14] = expected & 0xFF
            data[p_off + 15] = (expected >> 8) & 0xFF
            updated += 1
    return updated

def process_eeprom(in_path, out_path, immo_off=True):
    with open(in_path, "rb") as f:
        buf = bytearray(f.read())

    if len(buf) not in (512, 1024):
        raise ValueError(f"Invalid EEPROM size: {len(buf)} bytes (expected 512 or 1024)")

    if immo_off:
        # Patch Bank 1 and Bank 2 Immobilizer bytes
        buf[0x0012] = 0x02
        buf[0x0022] = 0x02
        if len(buf) == 1024:
            buf[0x0212] = 0x02
            buf[0x0222] = 0x02
        print("[+] Immobilizer flags patched to 0x02 (Immo Defeated)")

    fixes = fix_eeprom_bank(buf, 0)
    if len(buf) == 1024:
        fixes += fix_eeprom_bank(buf, 512)

    with open(out_path, "wb") as f:
        f.write(buf)
    print(f"[+] Corrected {fixes} page checksums. Output saved to: {out_path}")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print("Usage: python3 me7_eeprom_fixer.py <input.bin> <output.bin> [--immo-off]")
        sys.exit(1)
    process_eeprom(sys.argv[1], sys.argv[2], "--immo-off" in sys.argv)

10.4. Step-by-Step Hex Editing Instructions: Performing Common Tasks#

Task 1: Complete Immobilizer Defeat (Immo Off)#

Task 2: Extracting the 5-Digit Login PIN / SKC#

Task 3: Changing the Chassis VIN#

Task 4: Converting a 512-Byte Dump to Run on an 8E0 95080 Chip#

   cat 512_bytes.bin 512_bytes.bin > 1024_padded_8e0.bin

   python3 me7_eeprom_fixer.py 1024_padded_8e0.bin 1024_padded_8e0_fixed.bin --immo-off

10.5. VCDS Diagnostic Adaptation Channels & Direct EEPROM Physical Mapping#

When an automotive technician alters operating parameters via Ross-Tech VCDS / VAS-5054A diagnostic software, the ECU writes the newly calibrated scalar offsets directly into non-volatile SPI EEPROM cells. Understanding this mapping enables an engineer to inspect, preset, or clone adaptation values directly in a hex editor:

VCDS ADAPTATION CHANNELS TO 95040 EEPROM PHYSICAL OFFSET MAPPING

Detailed Subsystem Mechanics#

10.6. Immobilizer Generation 2 (WFS2) vs. Generation 3 (WFS3) Cryptographic Architecture#

Between 1999 and 2005, VAG phased out early Immobilizer II (WFS2) in favor of the much more sophisticated Immobilizer III (WFS3) system:

1. Immobilizer II (WFS2 — Early Transverse ME7.5, e.g. 06A906032J / 21D)#

2. Immobilizer III (WFS3 — Mature Transverse ME7.5, e.g. 06A906032LP / JJ / SK / 24B)#

Related#

Cross-referenced on shared calibration symbols, not on subject matter — these are the chapters that touch the same maps.

← Previous chapter · Contents · Next chapter →

Related

Cross-referenced on shared calibration symbols, not on subject matter — these are the chapters that touch the same maps.