VVDI Prog Read MC9S12XEP100 Secured

Xhorse VVDI Prog supports the Motorola MCU MC9S12XEP100 chip. There is a secured and unsecured variant.

 

Xhorse VVDI Prog MC9S12XEP100 Secured  1

 

 

I going to read the secured mcu data.

 

Xhorse VVDI Prog MC9S12XEP100 Secured 2

 

 

The connection diagram shows the cable. Extra connections over BDM.

 

Xhorse VVDI Prog MC9S12XEP100 Secured  3

 

 

Specific pins for the package. Quite helpful.

 

Xhorse VVDI Prog MC9S12XEP100 Secured 4

 

 

No need to lift the pin for EXTAL – I’ll just take the zero Ohm R34 off the board.

I can’t see the ground needing to be immediately next to the EXTAL pin. Bottom of C32 or C33 should do.

BKGD can come off TP25…. Reset off TP26. This might be easy!

 

Xhorse VVDI Prog MC9S12XEP100 Secured 5

 

 

And we’ll smack GND and VCC onto the BDM header on the board.

 

Xhorse VVDI Prog MC9S12XEP100 Secured 6

 

 

Urgh, XCLKS is needed as well… PE7

 

Xhorse VVDI Prog MC9S12XEP100 Secured 7

 

 

Which pops out on one of the Arduino-ish headers. Hoping that isn’t too far away from the chip.

 

Xhorse VVDI Prog MC9S12XEP100 Secured 8

 

 

Then do soldering job. Not too bad on this. XCLKS (green) is on the underside on one of the Arduino headers. Massive long trace. I think that this is just going to signal to the micro that it’s to expect an external clock signal on EXTALS instead of the crystal.

The EXTAL and ground are in a bit of coax and it warns not to shorten them… so it might be getting a bit fruity on that front.

 

Xhorse VVDI Prog MC9S12XEP100 Secured 9

 

 

Looking good. The vvdi prog programmer makes and audible noise when interacting with the micro.

 

Xhorse VVDI Prog MC9S12XEP100 Secured 10

 

 

It clearly asked me if I wanted to bypass security. More audible noise, like cool whine. And there we go… It’s unsecured.

 

Xhorse VVDI Prog MC9S12XEP100 Secured 11

 

 

It works. Flash contents are still there. Nice.

 

Xhorse VVDI Prog MC9S12XEP100 Secured 12

 

 

Allows control of VCC!

 

Xhorse VVDI Prog MC9S12XEP100 Secured 13

 

Operation success. Save data.

 

Credit to @cyber gibbons.

www.vvdishop.com

Xhorse VVDI Prog Programmer 2021 Firmware Review

Xhorse VVDI Prog programmer is an interesting device carrying out some quite advanced attacks.

 

 

Here comes the 2021 hardware review.

 

Disclaimer: Credit to the contributor cyber gibbons.  The review here is for sharing purpose. We are not holding the responsibility if cause damage by disassembling the vvdi-prog..

 

The vvdi-prog  has arrived.

 

xhorse-vvdi-prog-hardware-review-1

 

 

DIP socket is for EEPROMs and SPI flash – it can read a lot of the common ones in socket or via a clip.

 

xhorse-vvdi-prog-hardware-review-2

 

 

It’s actually really quite polished, and significantly above average in build quality and design. Strong plastics.

 

xhorse-vvdi-prog-hardware-review-3

 

 

The MCU stuff comes off this DB25 connector on the end.

 

xhorse-vvdi-prog-hardware-review-4

 

 

On opening it, a largely single-sided board. Recent date. Very clean inside, no flux residue.

 

xhorse-vvdi-prog-hardware-review-5

 

 

Interesting inside. An STM32 and a ProASIC. Power supply section looks like thought has gone into it. Loads of diodes, probably for protection in the automotive environment. No sure what the lithium cell is doing.

 

xhorse-vvdi-prog-hardware-review-6

 

 

STM32F407. One of the most common chips out there.

 

xhorse-vvdi-prog-hardware-review-7

 

 

Can’t quite work out the specific part, but it’s a ProASIC3 FPGA.
xhorse-vvdi-prog-hardware-review-8
 There’s one LQFN 32 that I has had the part number badly scratched off it.
xhorse-vvdi-prog-hardware-review-9
Not sure on this. 4 pins and 3 pins tied together, thick tracks. Probably switching or regulating.
xhorse-vvdi-prog-hardware-review-10

A K-Line bus driver, probably for interacting with certain ECUs.

 

xhorse-vvdi-prog-hardware-review-11

 

 

NXP chip

 

xhorse-vvdi-prog-hardware-review-12

 

 

that’s a SWD header for the STM32 up there.

 

xhorse-vvdi-prog-hardware-review-13

 

 

A header for the ProASIC… not worked with these

 

xhorse-vvdi-prog-hardware-review-14

 

 

Protection diodes – not cheap to do this stuff.

 

xhorse-vvdi-prog-hardware-review-15

 

 

It takes 12V and can supply a decent amount of current for some ECUs.

 

xhorse-vvdi-prog-hardware-review-16

 

 

Comes with a series of cables. Braided, sleeved. Nice quality.

 

xhorse-vvdi-prog-hardware-review-17

 

 

Some active components inside… and hot snot. Not sure what the chip is.

 

xhorse-vvdi-prog-hardware-review-18

 

This ECU one is a bit more interesting.

xhorse-vvdi-prog-hardware-review-19

Four of each for ground and power – I think this is for powering bigger ECUs like BCMs and immobilisers.

xhorse-vvdi-prog-hardware-review-20

CAN, K-Line, ignition and boot mode come as signals.

xhorse-vvdi-prog-hardware-review-21

Again, some active components inside.

Xhorse vvdiprog is a complex product. Certainly not just something the a TL866 in another box. A device that bypasses security on a range of devices!

https://www.vvdishop.com/service/xhorse-vvdi-prog-hardware-review.html

How to Read Renault BCM 95040 with Xhorse Mini Prog and Key Tool Max?

How to use Xhorse VVDI Mini Prog & Key Tool Max to read Renault Duster BCM IC95040 eeprom? As below I’ll show step by step.

 

Tools

A Renault Duster BCM IC95040 module

A VVDI Mini Prog

A VVDI Key Tool Max

 

xhorse-mini-prog-renault-duster-95040-1

 

 

Connect Mini Prog with Key Tool Max via Bluetooth firstly.

 

Remove BCM IC95040 outer shell, hold & push Mini Prog down straight on chip to read;

 

xhorse-mini-prog-renault-duster-95040-2

 

xhorse-mini-prog-renault-duster-95040-3

 

 

Press on Key Tool Max,

EEPROM and FLASH >> ST >> M95XX >> M95040(pressure) >> Read >> Eeprom >> Start operation

 

It is loading on the Mini Prog screen meanwhile, wait until 100%…

 

Rename and press “OK” to save data file.

 

xhorse-mini-prog-renault-duster-95040-4

 

xhorse-mini-prog-renault-duster-95040-5

 

xhorse-mini-prog-renault-duster-95040-6

 

xhorse-mini-prog-renault-duster-95040-7

 

xhorse-mini-prog-renault-duster-95040-8

 

 

Read EEPROM successfully.

Now you can use it with VVDI Super Chip to program transponder.

 

Using VVDI Mini Prog + Key Tool Max programmer to read EEPROM is quite easy & efficient.

https://www.vvdishop.com/

How to Export Data from Xhorse Mini Prog to Other Xhorse Devices?

After read and save data by xhorse mini prog pen programmer, you are allowed to upload data to xhorse data server and share data with other xhorse tools. Check detail instruction below:

 

Step 1: Read Data 

i.e 24C04

 

xhorse-mini-prog-transfer-data-1

 

 

xhorse-mini-prog-transfer-data-2

 

 

Select EEPROM and FLASH function
Select manufacturer-ATMEL->AT24CXX->AT24C04

 

xhorse-mini-prog-transfer-data-3

 

xhorse-mini-prog-transfer-data-4

 

Check wiring diagram, mini prog indicates to use adapter 3
Press Read->EEPROM

xhorse-mini-prog-transfer-data-5

xhorse-mini-prog-transfer-data-6

xhorse-mini-prog-transfer-data-7
Follow instruction to use the tool to clear the chip pin and connect the device and the adapter
press Start operation

 

xhorse-mini-prog-transfer-data-8

 

xhorse-mini-prog-transfer-data-9

 

Read data success.  VVDI Mini Prog will also show success status.

Save data

 

Step 2: Transfer Data

Go back to miniprog main function menu

Select File management function ->Local file

 

xhorse-mini-prog-transfer-data-10

You can see the data saved by mini prog.

 

xhorse-mini-prog-transfer-data-11
Select data and press icon on the right
Press Upload

 

xhorse-mini-prog-transfer-data-12

 

xhorse-mini-prog-transfer-data-13

 

xhorse-mini-prog-transfer-data-14

 

xhorse-mini-prog-transfer-data-15

 

xhorse-mini-prog-transfer-data-16

Press Upload here
Upload data success

 

xhorse-mini-prog-transfer-data-17
Check My data
The data already exists in “My data” folder

xhorse-mini-prog-transfer-data-18

Visit http://i.xhorse.com on windows browser

xhorse-mini-prog-transfer-data-19
scan QR code to quick login

xhorse-mini-prog-transfer-data-20

The data read in step 1 was successfully uploaded to server.

 

xhorse-mini-prog-transfer-data-21

 

 

Download data to your laptop. Now you can use the data to file make key.

 

xhorse-mini-prog-transfer-data-22

 

Users can also share data to applications, i,e wechat, Whatsapp etc.

Select the data and press Share and send to object you are going to share with

xhorse-mini-prog-transfer-data-23

Step 3: Share data with other xhorse tools

You are required to combine your xhorse tools to share data.

For example, to have key tool max control the mini prog, bind devices and share data.

 

xhorse-mini-prog-transfer-data-24

 

xhorse-mini-prog-transfer-data-25

 

xhorse-mini-prog-transfer-data-26

https://www.vvdishop.com/service/transfer-data-from-xhorse-mini-prog-to-other-devices.html

Xhorse VVDI Prog Read BMW B48 B58 ISN Code

Confirmed! BMW B48 B58 is working with the xhorse vvdi prog new Bosch ECU adapter upgrade.

 

VVDI Prog B48 B58 wiring diagram

 

vvdi-prog-b48-b58-wiring

 

 

VVDIProg read BMW 2019 B48 ISN: OK

Connect B48 DME with vvdi pro via Bosch ECU adapter follow the wiring diagram

 

vvdi-prog-read-b48-isn-1

 

 

In VVDI-Prog software, select 10-Bosch ECU adapter->BMW->B48 (Adapter)

 

vvdi-prog-read-b48-isn-2

 

vvdi-prog-read-b48-isn-3

 

vvdi-prog-read-b48-isn-4

 

 

Retrieve b48 ISN code success

 

 

VVDI-Prog read BMW BMW 440i B58 ISN: OK
B58 from 440i reading success.
can confirm b58 isn reading is working using b48 menu.

Completed all keys lost job with vvdi2 using the isn retrieved from vvdi prog.

 

vvdi-prog-read-b58-isn-1

 

vvdi-prog-read-b58-isn-2

 

vvdi-prog-read-b58-isn-3

 

vvdi-prog-read-b58-isn-4

 

vvdi-prog-read-b58-isn-5

 

 

https://www.vvdishop.com/service/read-bmw-b48-b59-isn-with-vvdi-prog.html

Xhorse VVDI Prog BMW B48 B58 ISN Reading Pinout

Xhorse VVDI Prog V4.9.9 adds BMW B48 ISN reading on bench. Bosch ecu adapter is required.

 

+ Add B48 (ADAPTER) option in
<10-BOSH-ECU-ADAPTER>-><BMW>

 

 

VVDIProg B48 B58 wiring diagram

*B58 is not yet supported. B58 will be added in the feature update.

 

vvdi-prog-b48-b58-wiring

 

 

VVDI-Prog now can read ISN from BMW N20/N55/B38/B48 and lots of other ECUs with adapter.

Check bosch ECU adapter available list here:

https://www.vvdishop.com/wholesale/vvdi-prog-bosch-ecu-adapter-read-isn-without-opening.html

Xhorse VVDI Prog V4.9.9 Big Update Adds Many RENESAS MCUs

Xhorse VVDI Prog programmer released big software update V4.9.9 on Feb. 3rd, 2021. This update adds lots of RENESAS RL78 M16C M32C R32C RL78 RH850 series MCUs.

 

VVDIProg v4.9.9 (2021-02-03)
* This version DON’t need update firmware
+ Add VVDI PROG USER MANUAL 4.9.9
version in Doc folder
+ Add EPCS1,
EPCS16,
EPCS128,
EPCS4,
EPCS64 options in
<1-EEPROM&FLASH>-><ALTERA>
+ Add AT59C11,
AT17C128,
AT17C256,
AT26DF081 options in
<1-EEPROM&FLASH>-><ATMEL>
+ Add EN25x05,
EN25x10,
EN25x16,
EN25x20,
EN25x32,
EN25x40,
EN25x64,
EN25x80 options in
<1-EEPROM&FLASH>-><EON>
+ Add BR9010,
BR9020,
BR9040 options in
<1-EEPROM&FLASH>-><ROHM>
+ Add S-29255,
S-29355 options in
<1-EEPROM&FLASH>-><SEIKO>
+ Add R5F10ExAx_Flash_16KB_Write,
R5F10ExCx_Flash_32KB_Write,
R5F10ExDx_Flash_48KB_Write,
R5F10ExEx_Flash_64KB_Write,
R5F10E_Data_4KB_Write
options in
<2-MCU>-><RENESAS-RL78-G1A>
+ Add M30622F8,
M30623F8,
M3062CF8,
M30620FC,
M3062LFG,
M30626FH,
M30626FJ,
M30621FC,
M3062AFC,
M3062BFC,
M306N4FG,
M30625FG,
M30627FH,
M3062JFH,
M30627FJ,
M306N4FC
options in
<2-MCU>-><RENESAS-M16C>
+ Add M30843FW,
M30843FH,
M30833FJ,
M30835FJ,
M30843FJ,
M30845FJ,
M30853FJ,
M30855FJ,
M30845FW,
M30853FW,
M30855FW,
M30845FH,
M30853FH,
M30855FH,
M30880FW,
M30882FW,
M30880FH,
M30882FH,
M30880FJ,
M30882FJ
options in
<2-MCU>-><RENESAS-M32C>
+ Add R5F64525_UART,
R5F64524_UART
R5F6452M_UART,
R5F6452N_UART
options in
<2-MCU>-><RENESAS-R32C>
+ Add R5F11N/11PxFx_Flash_96KB_Write,
R5F11N/11T/11RxGx_Flash_128KB_Write,
R5F11NxEx_Flash_64KB_Write,
R5F11N_Data_4KB__Write
options in
<2-MCU>-><RENESAS-RL78-H1D>
+ Add R5F107xCx_Flash_32KB_Write,
R5F107xEx_Flash_64KB_Write,
R5F107_Data_4KB_Write
options in
<2-MCU>-><RENESAS-RL78-I1A>
+ Add R5F10MxEx_Flash_64KB_Write,
R5F10MxGx_Flash_128KB__Write
options in
<2-MCU>-><RENESAS-RL78-I1B>
+ Add R5F10Rx8x_Flash_8KB_Write,
R5F10RxAx_Flash_16KB_Write,
R5F10RxCx_Flash_32KB_Write,
R5F10R_Data_2KB__Write
options in
<2-MCU>-><RENESAS-RL78-L12>
+ Add R7F701201,
R7F701205,R7F701501,
R7F701502,R7F701503,
R7F701506,R7F701507,
R7F701508,R7F701511,
R7F701512,R7F701513,
R7F701521,R7F701522,
R7F701524,R7F701525,
R7F701526,R7F701527,
R7F701528,R7F701529,
R7F701530,R7F701531,
R7F701534,R7F701708,
R7F701709,R7F701710,
R7F701711,R7F701714,
R7F701715,R7F701644,
R7F701645,R7F701646,
R7F701647,R7F701648,
R7F701649,R7F701650,
R7F701651,R7F701652,
R7F701653,R7F701684,
R7F701685,R7F701686,
R7F701687,R7F701688,
R7F701689,R7F701690,
R7F701691,R7F701692,
R7F701693,R7F701694,
R7F701695,R7F701032,
R7F701371,R7F701372,
R7F701396,R7F701373,
R7F701374,R7F701397,
R7F701A22 options in
<2-MCU>-><RENESAS-RH850>
+ Add D70F3461 option in
<2-MCU>-><RENESAS0-V850>
+ Add CEM(R5F64524),
CEM(R5F64525)
options in
<4-IMMOBILIZER>-><VOLVO>
+ Add LEXUS(R7F701A22) option in
<7-AIRBAG>-><TOYOTA>
+ Add B48(ADAPTER) option in
<10-BOSH-ECU-ADAPTER>-><BMW>
* Fix some RH850 options
* Fix some STM8 options

 

 

Free download xhorse vvdi prog v4.9.9 software

https://mega.nz/file/Zd0VGa6Y#uZWG0vllblnbCir5nSE5q_FoVZlRYpbi6RQr-XoZCUA

Xhorse VVDI Mini Prog Read BMW CAS4 5M48H with Solder Free Adapter

How to use Xhorse VVDI Mini Prog Programmer to read BMW CAS4+ 5M48H eeprom D-flash? Today I’m gonna show how easy to read the solder free adapter that Xhorse released.

 

Preparation

A Mini Prog Programmer,  Mini Prog solder free adapter and a BMW CAS4+ adapter.

 

vvdi-mini-prog-read-bmw-cas4-5m48h-1

 

 

Procedure

Step 1. Connection

Insert the cable into Mini VVDI Prog Programmer, rotate the head for fixation. Insert the other side of cable to BMW CAS4+ adapter, and fix it.

 

vvdi-mini-prog-read-bmw-cas4-5m48h-2

 

vvdi-mini-prog-read-bmw-cas4-5m48h-3

 

vvdi-mini-prog-read-bmw-cas4-5m48h-4

 

 

Step 2. Go to Xhorse App

Start up Xhorse app on smart phone, connect it with Mini Prog via Bluetooth.

 

Step 3. Read D-Flash

Press IMMO >> BMW >> BMW >> CAS4+(5M48H)-Backup (Adapter) >> Read >> D-Flash

 

Press “Continue” or START button on Mini Prog to start reading.

 

It may take some time for reading…

 

vvdi-mini-prog-read-bmw-cas4-5m48h-5

 

vvdi-mini-prog-read-bmw-cas4-5m48h-6

 

 

Step 4. Load D-Flash data file.

Rename the file, press “OK” to save.

 

Reading complete, it will display the saved path of file. We can load the data to Xhorse VVDI2, which will help to program the key.

 

vvdi-mini-prog-read-bmw-cas4-5m48h-7

 

 

Step 5. Find data file for programming.

Exit back to main page, find out the file data as saved path.

File Management >> Local File >> Mini_Prog >> 202101 >> CAS4 df.bin

 

vvdi-mini-prog-read-bmw-cas4-5m48h-8

 

 

Check full video for reading Land Rover RFA adapter:

 

VVDI Mini Prog solder-free adapters bring users easy and fast for daily work.

https://www.vvdishop.com/

Xhorse VVDI Prog V4.9.8 Adds Lots of RENESAS MCUs

Xhorse VVDI Prog programmer new software V4.9.8 has released on Dec. 31, 2020.

 

 

VVDIProg v4.9.8 (2020-12-31)
* This version DON’t need update firmware

DOWNLOAD link 

+ Add VVDI PROG USER MANUAL 4.9.8 version in Doc folder
+ Add AT25SF041 options in <1-EEPROM&FLASH>-><ADESTO>
+ Add AK93C45, AK93C55, AK93C65 options in <1-EEPROM&FLASH>-<AKM>
+ Add AT24RF08, AT34C02 options in <1-EEPROM&FLASH>-><ATMEL>
+ Add EN25B05 options in <1-EEPROM&FLASH>-><EON>
+ Add MB89RC04, MB89RC16 options in <1-EEPROM&FLASH>-><FUJITSU>
+ Add M24M01, M24M02 options in <1-EEPROM&FLASH>-><ST>
+ Add Y25F05 options in <1-EEPROM&FLASH>-><YMC>
+ Add R5F10Yx4x_Flash_1KB_Write, R5F10Yx6x_Flash_2KB_Write, R5F10Yx6x_Flash_4KB_Write options in <2-MCU>-><RENESAS-RL78-G10>
+ Add R5F105_Data_2KB_Write, R5F105xAx_Flash_16KB_Writeoptions in <2-MCU>-><RENESAS-RL78-G11>
+ Add R5F102/103x6x_Flash_2KB_Write,R5F102/103x6x_Flash_4KB_Write,
R5F102/103x6x_Flash_8KB_Write,R5F102/103x6x_Flash_12KB_Write,R5F102/103x6x_Flash_16KB_Write
options in <2-MCU>-><RENESAS-RL78-G12>
+ Add R5F113_Data_8KB_Write, R5F113_Data_16KB_Write, R5F113xGx_Flash_128KB_Write, R5F113xHx_Flash_192KB_Write,
R5F113xJx_Flash_256KB_Write,R5F113xKx_Flash_384KB_ Write,R5F113xLx_Flash_512KB_Write options in <2-MCU>-><RENESAS-RL78-F15>
+ Add CS75-HAND-BREAK-MODULE option in <8-OTHERS-><CHANGAN>
+ Add FOCUS-BCM-R7F701053(2019)m option in <8-OTHERS-><FORD>
+ Add MKC-BCM option in <8-OTHERS-><LINCOLN>

 

www.vvdishop.com