[TUTO] Télécodage et calibration d'un NAC / RCC / CIROCCO / CMB_NUM SANS Diagbox via Arduino

[marcins]

This time I got 7F2735 error,

Invalid Unlock Key

</Diagnostic_Sessions>
<Negative_Responses_List>
<_11>ServiceNonSupporté</_11>
<_12>SubFunctionNotSupported</_12>
<_13>IncorrectMessageLengthOrInvalidFormat</_13>
<_14>Réponse Trop Longue</_14>
<_21>Occupé-RépéterRequête</_21>
<_22>ConditionsNotCorrect</_22>
<_24>RequestSequenceError</_24>
<_25>Pas de réponse d'un sous calculateur</_25>
<_26>Défaut d'exécution d'une requête</_26>
<_31>RequestOutOfRange</_31>
<_33>SecurityAccessDenied</_33>
<_35>InvalidKey</_35>
<_36>Nombre de Tentatives Dépassées</_36>
<_37>RequiredTimeDelayNotExpired</_37>
<_70>UploadDownloadNotAccepted</_70>
<_71>TransferDataSuspended</_71>
<_72>GeneralProgrammingFailure</_72>
<_73>WrongBlockSequenceCounter</_73>
<_78>RequestCorrectlyReceived-ResponsePending</_78>
<_7E>SubFunctionNotSupportedInActiveSession</_7E>
<_7F>ServiceNotSupportedInActiveSession</_7F>
<_81>RPM trop élevé</_81>
<_82>RPM trop bas</_82>
<_83>Moteur tournant</_83>
<_84>Moteur non tournant</_84>
<_85>Moteur tournant depuis peu de temps</_85>
<_86>Température trop élevée</_86>
<_87>Température trop basse</_87>
<_88>Vitesse trop élevée</_88>
<_89>Vitesse trop basse</_89>
<_8A>Commande trop élevée</_8A>
<_8B>Commande trop basse</_8B>
<_8C>Transmission pas au point mort</_8C>
<_8D>Rapport non enclenché</_8D>
<_8E>Pas d'appui pédale</_8E>
<_8F>Levier pas en position parking</_8F>
<_90>Embrayage non verrouillé</_90>
<_91>Tension trop élevée</_91>
<_92>VoltageTooHigh</_92>
</Negative_Responses_List>

 

[IvanV]

Hey all.
I did a lot of reading, searching but I'm not entirely sure how to change BSI settings using this arduino. I was able to change two things in my RCC, change from single AC to dual AC and add G-force display. The issue is that AC is dual now, but I can't control second zone, it's always LO. I saw multiple posts about it, but no answer. I guess it has to be changed in BSI as well? And same for the second item. I added g-force display, but it's showing that the data are unavailable. I read about certain ECU type which supports that, but I have Peugeot 208 2020 Allure with iCockpit, full LED headlights and a lot of other crap. I was trying to figure out what to send through Arduino into BSI but I'm completely lost. Anyone able to help me with this? Thanks.

Anyone able to help? I'm willing to pay if this would motivate someone.

 

[zzzzzz]

to check what AAS you have just send
>75D:65D
1003
22F0FE and post reply

you get 62 F0 FE FF FF 00 00 YY ZZ 11 04 22 03 35 15 00 FF FF FF 00 02 00 00 02 xx xx xx (xx calibration ref)

06=Valeo
03=Bosch
33=Metasystem
E0=AAS Valeo
E1=AAS Bosch
E2=AAS Metasystem

Thank you : valeo = G6, Bosch = G5, Metasystem ?? Right ?

 

[zzzzzz]

Thank you : valeo = G6, Bosch = G5, Metasystem ?? Right ?

I tried, here is the result of read zone F0FE :

62F0FEFFFF000006E018051803010F70090713FD37151903937708

So it match for Valeo, my unlock shortcut command should be :

:B6F0:03:03
first try : 7F2783 : gear was runnning, I stop gear and send the command again :

7F2724 => "Request Sequence Error" , what is wrong ?


I would try to activate "ds sensorial drive" touch panel (the first key), it seems to be 010E zone in NAC ecu : "Calibration_Fct_FMUX"
I read values in zone : 000000000000000000000000000000000000001A1E20003900003A3800450000000000000000000000000000

the only information I have is "Should be 0x45 (MultiDrive) on some byte inside the zone", I do have 45 in this zone, but I don't have the sensorial driver button enable (not lightning up, not working). I compared with ds7.cal file of the database, this content is exactly the same except trailing E5F881 (3 bytes values) added at the end, don't know if this is something like checksum or maybe could be the values needed to activate the key...
I tried command 2E010E000000000000000000000000000000000000001A1E20003900003A3800450000000000000000000000000000E5F881 but this give me "7F2E13" error as I write more bytes that what I got when reading... so I suppose my fmux zone content is ok

I think this message from rule say all

"That key is not part of nac but of the fmux panel, you cannot enable it you have to replace the whole line of keys"

but I don't know what is piece reference to buy it separatly

 

[marcins]

I tried, here is the result of read zone F0FE :

62F0FEFFFF000006E018051803010F70090713FD37151903937708

So it match for Valeo, my unlock shortcut command should be :

:B6F0:03:03
first try : 7F2783 : gear was runnning, I stop gear and send the command again :

7F2724 => "Request Sequence Error" , what is wrong ?


I would try to activate "ds sensorial drive" touch panel (the first key), it seems to be 010E zone in NAC ecu : "Calibration_Fct_FMUX"
I read values in zone : 000000000000000000000000000000000000001A1E20003900003A3800450000000000000000000000000000

the only information I have is "Should be 0x45 (MultiDrive) on some byte inside the zone", I do have 45 in this zone, but I don't have the sensorial driver button enable (not lightning up, not working). I compared with ds7.cal file of the database, this content is exactly the same except trailing E5F881 (3 bytes values) added at the end, don't know if this is something like checksum or maybe could be the values needed to activate the key...
I tried command 2E010E000000000000000000000000000000000000001A1E20003900003A3800450000000000000000000000000000E5F881 but this give me "7F2E13" error as I write more bytes that what I got when reading... so I suppose my fmux zone content is ok

I think this message from rule say all

"That key is not part of nac but of the fmux panel, you cannot enable it you have to replace the whole line of keys"

but I don't know what is piece reference to buy it separatly

when coding just ignition on not engine running

 

[gusao10]

IF YOU ENTER WRONG KEY, ESP90 WILL BLOCK!!!
Once locked, no further encoding can be performed.
The ESP90 controller will function normally, but coding will no longer be possible. The same thing happens in AIRBAG if you enter the wrong KEY

I had already tried several keys and couldn't unlock it. After some time, someone tried to get me remote access and managed to do it, but I couldn't see what the command was. Now I'm trying again with the one that would be correct and it wasn't, the others weren't possible either, I imagine it doesn't block because after everything it was unlocked normally. I just would like to know which is the correct key. This information seems to be very difficult to obtain because I never found anything anywhere, I thought maybe @VLud, @marcins, knew about this key.

 

[20882]

Anyone able to help? I'm willing to pay if this would motivate someone.

Maybe if you would just finish your purchase in Ebay, that would help...

 

[zzzzzz]

when coding just ignition on not engine running

Yes, I tried also, but this give me error 7F2724 => "Request Sequence Error« …

 

[IvanV]

Maybe if you would just finish your purchase in Ebay, that would help...

Are you the seller for NAC from ebay? I don't like doing a deals outside of ebay on telegram and sending money using Paypal. Sorry, this seems fishy.

 

[Adorno]

HI @marcins @VLud, if is possible I need some help from you guys, I´m trying to activate park assist on my e-2008GT ( 23/23), everything is almost done, BSI, AAS, NAC has been coded, but DAE is not done, the answer that I have from my car is 03 CF F7 DF FF FE FF FF FF FE FF 7F FF FF FF, but now I dont know what do I have to change to code DAE zone thinking about park assist

 

[marcins]

HI @marcins @VLud, if is possible I need some help from you guys, I´m trying to activate park assist on my e-2008GT ( 23/23), everything is almost done, BSI, AAS, NAC has been coded, but DAE is not done, the answer that I have from my car is 03 CF F7 DF FF FE FF FF FF FE FF 7F FF FF FF, but now I dont know what do I have to change to code DAE zone thinking about park assist

<_35>InvalidKey</_35>

03 CE F7 DF FF FE FF FF FF FE FF 7F FF FF FF CPK enabled

 

[zzzzzz]

I think unlock key for valeo AAS (AAS_UDS_G6) is not the good one in ECU_KEYS.md file, I tried value"B6F0" but this doesn't work. Somebody know what is the right key ?

 

[razor07b7]

ESP90 Peugeot 3008 II problem with coding with ecu key 60A5 and ecu not unlocking (ignition on and engine off):
>6AD:68D
:60A5:03:03
I have answer 7F3E03 or 7F2737 etc.
on this screen after few 7F2737 ... 6703xxxx command but answer is 7F2735
I want to change something in zone 2101: 28 and 29 byte EFDA to EE5A for enable HDAC and grip control



Unlock key 60A5 it's OK for this esp90 ?
What am I doing wrong ?

 

[ezejp]

@MPC98

Here are the values I have on my BSI:

2348=05
23C0=00
2415=03
2452=02
2453=02

Hi @Albatros24 what is 2453 for? Thanks

 

[Albatros24]

@ezejp
Je ne sais pas !

 

[ezejp]

Ok @marcins @MPC98 do you know the description of bsi 2453?

 

[marcins]

Hi @Albatros24 what is 2453 for? Thanks

2453- Type technologie detection cible ACC
00-absent
01-radar
02-radar & camera
03-camera

2452- Type des modes ACC
00-ACC Full Auto STop (BVA)
01-ACC 30 (BVM)
02-ACC STOP and Go(BVA)

 

[marcins]

ESP90 Peugeot 3008 II problem with coding with ecu key 60A5 and ecu not unlocking (ignition on and engine off):
>6AD:68D
:60A5:03:03
I have answer 7F3E03 or 7F2737 etc.
on this screen after few 7F2737 ... 6703xxxx command but answer is 7F2735
I want to change something in zone 2101: 28 and 29 byte EFDA to EE5A for enable HDAC and grip control

Voir la pièce jointe 35333

Unlock key 60A5 it's OK for this esp90 ?
What am I doing wrong ?

for your's ecu unlock is ABFB

 

[Bayaga]

Bonjour @VLud j'ai une une petite question j'ai assemblé l'adaptateur jai televerser le sketch avec succès mais une fois que j'ouvre le terminal série rien ne se passe es-ce normal quand j'utilise un autre sketch samet met initialisation Can 0 Can 1 mais quand je televerse votre sketch rien ai-je raté quelque chose svp aidé moi

 

[razor07b7]

for your's ecu unlock is ABFB

Wow it's the same as for ESP81 so it's not ESP90? Diagbox displays it as esp90.
Won't my ECU be blocked if I use this key for esp81?

One more question about the change I want to make
current settings fo 2101:
2E210106BFFFFFFFFFFFFEFFFFFFFFFFEFFFFFFFFFFB7FFFEFFFFEEFDABEFF
change for active HADC and GRIP CONTROL:
2E210106BFFFFFFFFFFFFEFFFFFFFFFFEFFFFFFFFFFB7FFFEFFFFEEE5ABEFF
It's correct ?

 

[Adorno]

<_35>InvalidKey</_35>

@marcins tks a lot for your help, but the code didn´t work, I sent these codes changing CF to CE and I got these answers, I couldn´t find what is this error 7F2735, if you know something about, I appreciate, tks again!

>6B5:695
1003
222101
:2807:03:03
2E210103CEF7DFFFFEFFFFFFFEFFF7FFFFFF
2E2901FD000000010101
222101
1001


OK
500300C80014
62210103CFF7DFFFFEFFFFFFFEFFF7FFFFFF
500300C80014
6703EC75AC45
7F2735
00140000000000
00140000000000
62210103CFF7DFFFFEFFFFFFFEFFF7FFFFFF
50100C80014

 

[marcins]

.....I couldn´t find what is this error 7F2735

7F2735
35- INVALID KEY

 

[Adorno]

7F2735
35- INVALID KEY

Ok @marcins tks!! I remenber reading an answer from you about how to find out the right key to AAS zone, is there a way to find out the right key to DAE zone? Tks!!

 

[ezejp]

Wow it's the same as for ESP81 so it's not ESP90? Diagbox displays it as esp90.
Won't my ECU be blocked if I use this key for esp81?

One more question about the change I want to make
current settings fo 2101:
2E210106BFFFFFFFFFFFFEFFFFFFFFFFEFFFFFFFFFFB7FFFEFFFFEEFDABEFF
change for active HADC and GRIP CONTROL:
2E210106BFFFFFFFFFFFFEFFFFFFFFFFEFFFFFFFFFFB7FFFEFFFFEEE5ABEFF
It's correct ?

i have from factory HADC and GRIP Control, my values in the red area are: EE58

BTW, i tried you sent you a pm and I couldn't

 

[razor07b7]

Wow it's the same as for ESP81 so it's not ESP90? Diagbox displays it as esp90.
Won't my ECU be blocked if I use this key for esp81?

One more question about the change I want to make
current settings fo 2101:
2E210106BFFFFFFFFFFFFEFFFFFFFFFFEFFFFFFFFFFB7FFFEFFFFEEFDABEFF
change for active HADC and GRIP CONTROL:
2E210106BFFFFFFFFFFFFEFFFFFFFFFFEFFFFFFFFFFB7FFFEFFFFEEE5ABEFF
It's correct ?

OK ECU with ABFB has been unlocked.
I also made a change 2101 ... hadc and grip control is enable

 

[marcins]

i have from factory HADC and GRIP Control, my values in the red area are: EE58

BTW, i tried you sent you a pm and I couldn't

58 COMELEC

 

[gusao10]

OK ECU with ABFB has been unlocked.
I also made a change 2101 ... hadc and grip control is enable

Indirect tire pressure detection you what the hex would be. adapted speed control, would you also know?

 

[Torri]

OK Se ha desbloqueado la ECU con ABFB.
También hice un cambio 2101... hadc y el control de agarre está habilitado

OK ECU with ABFB has been unlocked.
I also made a change 2101 ... hadc and grip control is enable

What changes did I make to activate grip control

 

[razor07b7]

What changes did I make to activate grip control

above you have my values before and after
current settings fo 2101:
2E210106BFFFFFFFFFFFFEFFFFFFFFFFEFFFFFFFFFFB7FFFEFFFFEEFDABEFF
change for active HADC and GRIP CONTROL:
2E210106BFFFFFFFFFFFFEFFFFFFFFFFEFFFFFFFFFFB7FFFEFFFFEEE5ABEFF

xor 0x1 for the first byte and xor 0x80 for the second with your values
before 0xEF xor 0x1 = after 0xEE (Grip Control)
second 0xDA xor 0x80 = after 0x5A (Hill Descent Control)

I'm not 100% sure this will work for you because there are different versions of ESP.

 

[zzzzzz]

Hi,
I activated Park Assist in my 5008 II GT-Line 2019 4 days ago.
The activation condition is to have 12PDC = 6 PDC front + 6 PDC rear

My old values before coding:

1. AAS_UDS_G5:

>75D:65D
1003
222101
answer from arduino: 62 2101 A5
1001 (closes sessions)

2.BSI:

>752:652
1003
222300
answer from arduino: 62 2300 13
1001 (closes sessions)

3.DAE_BVH2:

>6B5:695
81
21A0
answer from arduino:: 61 A0 05C0 CD 0002000001
82 (closes sessions)

You can check your values via Arduino in the terminal.

If you want, I can write step by step how I activated it.

Secured Traceability
2E2901FD000000010101
You enter it in BSI right after the first coding change, I just entered it there. Not in DAE_BVH2 and AAS.

Hi onzar, I managed to got unlock code to work with my AAS_UDS_G6 (to be honest I don't understand what was really wrong but now it seems to work avec clearing codes before)

But when I read 2101 zone I got severals bytes data :
62 2101 0908A4086D0D02
So when I try to just write BD it just fails with error code 7F2E13 "Configuration Write - Invalid Zone data"

Do someone know what I have to modify in AAS Valeo ECU (AAS_UDS_G6) to get Park assist working ? it seems that I could modify walues for BSI and DAE so AAS is just the last one that need to be modified (NAC has been modified too with vlud tools) ? Any help would be greatly appreciated