Skip to content

Latest commit

 

History

History
73 lines (62 loc) · 3.29 KB

README.md

File metadata and controls

73 lines (62 loc) · 3.29 KB

VAG157 OBD2 Adapter Reverse Engineering

Motivation

I was given this chinese OBD2 adapter which came with a disc that contained a suspicious cracked copy of VCDS. Those adapters usually only work with the exact copy that is on the disc. Since the adapters are usually nothing special and are just back to back adapters to get from USB to OBD I was interested in seeing how exactly it works with the intention to get it running on a more recent version of VCDS.

Hardware

  • Chips on adapter:
    ATMEGA162 - Microcontroller
    STC12C2052AD - secondary Microcontroller (security chip)
    ATF16V8B - Atmel PLC
    FT232RL - USB to UART adapter
    TJA1050 - CAN Transceiver IC
    MCP2515 - CAN Protocol IC

  • Connection chain:

    computer to ATMEGA -USB-> FTDI FT232RL -UART-> ATMEGA162

    ATMEGA to car -SPI-> MCP2515 -> TJA1050 -CAN-> Car

    //todo: missing is the PLC and what exactly it does here

The good thing about this adapter is that it uses genuine hardware. What is interesting is the STC chip that seems to be another chip not directly related with communicating with the car.

Digging through some forums and a few failed attempts trying to flash the ATMEGA, the purpose of this chip became clear: Running unpatched VCDS software will wipe the firmware of your adapter if it finds out that it is non-genuine hardware. This STC chip prevents the device being flashed/reflashing the modded chinese firmware back.

Simply removing the STC chip¹ with a hot air gun made the ATMEGA flashable again and I was able to install my desired firmware to it.

Where to solder for flashing The MCP2515 chip is the easiest to solder to and some of the programming related pins go there making it a good choice for getting your flashing wires down.
 ATMEGA162  MCP2515
 PB5 (MOSI)  SI 14
 PB6 (MISO)  SO 15
 PB7 (SCK)  SCK 13
 RESET  none (soldered directly to ATMEGA)
 GND  found everywhere

Software

I setup a clean Windows VM, passed the adapter through, downloaded an original copy of VCDS 22.10 (x86) and Kolimer patches² for it.

STC Chip¹: https://mhhauto.com/Thread-VCDS-VAG-COM-REPAIR?page=137
VCDS/Kolimer²: https://sidicer.lt/vcds/