Simos12.1 I was able to disable the RSA verification.

[lexa609]

@bri3d Thank you so much for such a detailed and interesting tutorial!

I repeated your steps and I managed to disable the RSA signature verification.

I was able to disable RSA verification in Simos12, similar to Simos18.
Will it be possible to add ECU unlocking to VW_Flash?
The firmware via SimosTools with RSA disabled is working

If necessary, I can provide the firmware files.
I can test it too

I have disabled the immobilizer flag and can flash the control unit on the table via ODIS and SimosTools.

ECU Simos12.1 Harware Number: 06K907425A
VW part number: 8V0906264E
VW ASW Version: 003
firmware: FL_8V0906264E__0003
BIN software code: SC100CF0

Hex adress hex value
21b50 DA 00 3C 02 DA 01 02 F2 ==> 00 00 00 00 DA 01 02 F2

3231c DA 00 3C 02 DA 01 02 F2 ==> 00 00 00 00 DA 01 02 F2

https://github.com/lexa609/Simos12_Patch/blob/main/Patch.md

My equipment includes Openport2 and esp32-isotp-ble-bridge
VW_Flash + windows Identification works, but the firmware does not load, there is no choice of simos12
VW_Flash + linux (CentOS,Ubuntu) I can't connect to Openport2 or esp32-isotp-ble-bridge. I've been suffering for a long time but it doesn't work out

It would be great to add the ability to connect via Bluetooth to the esp32.

Here I described in more detail what I did
https://github.com/lexa609/Simos12_Patch/blob/main/Patch.md

[bri3d]

The latest https://github.com/Switchleg1/esp32-isotp-ble-bridge/releases release over J2534 should work; I stopped supporting my branch long ago and switchleg switched to J2534 as the common interface.

However, I never did Simos12 bench mode or OBD exploit, so you'd still need to solve that to have an end to end solution without the use of a commercial bench tool to write the patch in.

[lexa609]

I started writing a patch (a copy of yours, an attempt to migrate to simos12) but then I realized that in order to test it, I need VW_Flash, I will need to erase CAL and write to ASW1.
Simostools my software does not know and does not do it, but it cannot install the patch through a regular installation because the flag is reset.

Switchleg1 я пробовал но он работает у меня только через bluetooth, если подключить usb то ошибка timeout

win + VWFlash + esp32 bluetooth it works but there is no simos12
lin + VWFlash + esp32 or +bluetooth I can't connect, I've been struggling for six months now, this is the second attempt.

I'll figure out how to solve the problem.

I understand correctly that I need to write a patch.the bin that contains the hook and patch? and the rest will be 00 00

i write hook 80104cd0

    80104cce      00 00           nop
    80104cd0      91 c0 00 f8     movh.a     a15,#0x800c                                      Hook
    80104cd4      d9 ff 40 00     lea        a15,[a15]0x400
    80104cd8      2d 0f 00 00     calli      a15=>FUN_800c0400                                Hook end 
    80104cdc      00 00           nop

I found the place for the patch here ASW1 800c0400

                         **************************************************************
                         *                          FUNCTION                          *
                         **************************************************************
                         undefined FUN_800c0400()
         undefined         <UNASSIGNED>   <RETURN>
                         FUN_800c0400                                    XREF[1]:     FUN_80104c9c:80104cd8(c)  
    800c0400   91 20 00 c8     movh.a     a12,#0x8002                                      Start patch
    800c0404   91 00 00 4d     movh.a     a4,#0xd000
    800c0408   d9 44 40 10     lea        a4,[a4]0x440
    800c040c   d9 cf d0 51     lea        a15,[a12]0x1d50
    800c0410   2d 0f 00 00     calli      a15=>FUN_80021d50                                undefined FUN_80021d50()
    800c0414   d9 cf b6 e1     lea        a15,[a12]0x1bb6
    800c0418   3b 00 20 41     mov        d4,#0x1200
    800c041c   2d 0f 00 00     calli      a15=>FUN_80021bb6                                undefined FUN_80021bb6()
    800c0420   d9 cf 18 22     lea        a15,[a12]0x2098
    800c0424   3b 00 20 41     mov        d4,#0x1200
    800c0428   2d 0f 00 00     calli      a15=>FUN_80022098                                error
    800c042c   d9 cf c2 10     lea        a15,[a12]0xc42
    800c0430   2d 0f 00 00     calli      a15=>FUN_80020c42                                undefined FUN_80020c42()
    800c0434   0d 00 c0 04     isync
    800c0438   91 00 00 fc     movh.a     a15,#0xc000
    800c043c   d9 ff 80 c7     lea        a15,[a15]0x7b00
    800c0440   80 f0           mov.d      d0,a15
    800c0442   0d 00 80 04     dsync
    800c0446   cd 40 e2 0f     mtcr       #0xfe24,d0
    800c044a   0d 00 c0 04     isync
    800c044e   0d 00 c0 04     isync
    800c0452   d9 cf 58 9e     lea        a15,[a12]-0x19a8
    800c0456   2d 0f 00 00     calli      a15
    800c045a   91 20 00 28     movh.a     a2,#0x8002
    800c045e   49 22 00 0a     lea        a2,[a2]0x0
    800c0462   91 00 00 fd     movh.a     a15,#0xd000
    800c0466   d9 ff 00 07     lea        a15,[a15]0x7000
    800c046a   91 00 00 50     movh.a     a5,#0x0
    I'm staying here for now

Then there were several patch versions, but they don't work.
I realized that I need the VW_Flash cli version to install.

So far, the fastest solution is to buy a SocketCAN to work with VW_flash on linux

Thanks for the answer!

[lexa609]

I think I'm getting it.
Managed to launch on windows in the console and added simos12 to the GUI

It turned out to flash CAL and FRF

[lexa609]

@bri3d i need help, please

Windows 10 computer, macchina a0 clone adapter,VW_Flash-0.7.3

I wrote a patch for Simos12.1 (I tried to repeat how you did it)

ASW1
1)Hook

        80104cce 00 00           nop
        80104cd0 91 c0 00 f8     movh.a     a15,#0x800c                                      Hook
        80104cd4 d9 ff 40 00     lea        a15,[a15]0x400
        80104cd8 2d 0f 00 00     calli      a15=>FUN_800c0400                                Hook end 

2)Patch

                              **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                             undefined FUN_800c0400()                                   // CBOOT address: 0x80020000
             undefined         <UNASSIGNED>   <RETURN>
                             FUN_800c0400                                    XREF[1]:     FUN_80104c9c:80104cd8(c)  
        800c0400 91 20 00 c8     movh.a     a12,#0x8002                                      Start patch
        800c0404 91 00 00 4d     movh.a     a4,#0xd000                                       // about to set task context bas
        800c0408 d9 44 40 10     lea        a4,[a4]0x440                                     // Complete address: 0xd0000440
        800c040c d9 cf d0 51     lea        a15,[a12]0x1d50                                  // Calculate function address
        800c0410 2d 0f 00 00     calli      a15=>FUN_80021d50                                // SET_TASK_CONTEXT : this funct
        800c0414 d9 cf b6 e1     lea        a15,[a12]0x1bb6                                  // reset STM (timer) peripheral 
        800c0418 3b 00 20 41     mov        d4,#0x1200                                       // 0x1200 -> reboot into Program
        800c041c 2d 0f 00 00     calli      a15=>FUN_80021bb6                                // CONFIGURE_TIMERS
        800c0420 d9 cf 18 22     lea        a15,[a12]0x2098                                  // load Reset MSC peripheral fun
        800c0424 3b 00 20 41     mov        d4,#0x1200                                       // 0x1200 -> arg for Programming
        800c0428 2d 0f 00 00     calli      a15=>FUN_80022098                                ERROR// RESET_MSC_PERIPHERAL
        800c042c d9 cf c2 10     lea        a15,[a12]0xc42                                   // ENABLE_ENDINIT location
        800c0430 2d 0f 00 00     calli      a15=>FUN_80020c42                                // ENABLE_ENDINIT: this function
        800c0434 0d 00 c0 04     isync
        800c0438 91 00 00 fc     movh.a     a15,#0xc000                                      // reconfigure trap vectors to p
        800c043c d9 ff 80 c7     lea        a15,[a15]0x7b00
        800c0440 80 f0           mov.d      d0,a15
        800c0442 0d 00 80 04     dsync
        800c0446 cd 40 e2 0f     mtcr       #0xfe24,d0                                       // 0xfe24 is the Trap Vector reg
        800c044a 0d 00 c0 04     isync
        800c044e 0d 00 c0 04     isync
        800c0452 d9 cf 58 9e     lea        a15,[a12]-0x19a8                                 // DISABLE_ENDINIT location
        800c0456 2d 0f 00 00     calli      a15                                              // DISABLE_ENDINIT: this functio
        800c045a 91 20 00 28     movh.a     a2,#0x8002                                       // Copy source address: 80026000
        800c045e d9 22 00 06     lea        a2,[a2]0x6000                                    // low half of source addr
        800c0462 91 00 00 fd     movh.a     a15,#0xd000                                      // Destination base
        800c0466 d9 ff 00 07     lea        a15,[a15]0x7000                                  // Complete destination: 0xd0007
        800c046a 91 10 00 50     movh.a     a5,#0x1                                          // 0x162FF bytes to copy
        800c046e d9 55 3f b6     lea        a5,[a5]0x62ff                                    // // lower half of 0x162FF (CBO
                             LAB_800c0472                                    XREF[1]:     800c0478(j)  
        800c0472 09 22 01 00     ld.b       d2,[a2+]0x1                                      // Load data from Flash
        800c0476 24 f2           st.b       [a15+],d2                                        // store data to RAM
        800c0478 fc 5d           loop       a5,LAB_800c0472                                  // Load data from Flash
        800c047a 91 10 00 fd     movh.a     a15,#0xd001                                      // Address to patch in RAM to en
        800c047e d9 ff 1c c3     lea        a15,[a15]0x331c                                  // low half of RAM addr
        800c0482 c6 00           xor        d0,d0                                            // easy way to set to 0
        800c0484 74 f0           st.w       [a15],d0                                         // perform patch
        800c0486 3b 00 20 41     mov        d4,#0x1200                                       // set 0x1200 Programming Mode p
        800c048a 91 00 00 fd     movh.a     a15,#0xd000                                      // upper part of entry point add
        800c048e d9 ff 00 07     lea        a15,[a15]0x7000                                  // load entry point address
        800c0492 2d 0f 00 00     calli      a15                                              // jump in
        800c0496 00 90           ret
        800c0498 00              ??         00h
        800c0499 00              ??         00h
        800c049a fa 08 3a 82     ddw        823A08FAh                                        // This value fixes the CRC for 
        800c049e 00 00           nop

faced with the problem of installing it (tried different ways )

python VW_Flash.py --action flash_bin --infile .\lib\docs\patch_121.bin --block 7  --simos12 --interface USBISOTP --usb_name COM9
python VW_Flash.py --action flash_bin --infile .\FD_1.ASW1.bin --block 7  --simos12 --interface USBISOTP --usb_name COM9

file C:\tmp\VW_Flash-0.7.3\lib\docs\patch121.bin

simos12.py upgraded

WV_Flash.py

424 line

elif args.action == "flash_bin":
    # i corrected it here 
#    flash_bin(flash_info, input_blocks, args.dsg)
    flash_bin(flash_info, input_blocks)

when trying to set errors like this, 0% of the eternal cycle does not move
TransferData service execution returned a negative response GeneralProgrammingFailure (0x72)

PS C:\tmp\VW_Flash-0.7.3> python VW_Flash.py --action flash_bin --infile .\lib\docs\patch121.bin --block 7 --simos12 --interface USBISOTP --usb_name COM9
dashing module not loaded
Patching data... : 0%| | 0/100 [00:20<00:00, 132.45it/s]

Factory firmware (bin,frf) downloads without problems

log.zip

simos12.py

patch121.zip

8V0906264E__0003.zip

I've tried it before, but it doesn't work.

def s12_block_transfer_sizes_patch(block_number: int, address: int) -> int:
    if block_number != 2:
        print(
            "Only patching 8V0906264E__0003's Block 2 / ASW1 using a provided patch is supported at this time! If you have a patch for another block, please fill in its data areas here."
        )
        exit()
  
 
    return 0x8

I calculated the checksum like this

crchack/crchack -x 00000000 -i 00000000 -w 32 -p 0x4c11db7 -b 1178:1182 FD_1.ASW1-patch.bin 0x0b2897db > ASW1_Patched.bin

[TheFlashBold]

I gave up on unlocking simos 12.1, upgrading to simos 18.1 is not easy, but also that hard: https://github.com/TheFlashBold/simos12-to-simos18-conversion

[lexa609]

I gave up on unlocking simos 12.1, upgrading to simos 18.1 is not easy, but also that hard: https://github.com/TheFlashBold/simos12-to-simos18-conversion

Excellent solution!
But it's not nice with a VIN number, I would learn how to edit encrypted Dflash.
I tried to decrypt it, but it didn't work out.

There is such a program (but I don't know if it's cheating) https://ecuimmooff.net/product/software-med17-edc17-simos12-simos-18-edditor/

Simos12 I learned how to disable the RSA signature but using a commercial bootloader

And how could you disable immo on simos18? What are the errors in the block?

I have a solution for simos12 without errors.

WOW! Cool project, Thanks https://theflashbold.github.io/tune-editor/