I have xprog5.55 only. Seems to be too much of a haste for just a hobby project. But I would like to try to update with WinKFP.It will depend on the version of FW that the CAS is running.
But probably yes.
You should be able to flash the CAS to a non elv version (I could never get that working BTW, i ended up using a chip dump to flash it (from an r270) to get it working).
I have a spare working elv if you want it somewhere, or you could get one of the cheap elv emulators from ebay.
I think i may have a spare CAS with key that runs the non elv version (I could change the vin for you as well).
Or if you have a r270 i could send you an working non elv version of the fw in flash form.
Its possible to dump CAS chip with Xprog5.55 also. But if I dump it what do I need to change in dump to remove ELV?Which is what used to happen to me, so i gave up.
I bought a cheap r270 and dumped the chip. did this a few times, but then I modded the bench CAS so that I can inject any VIN i want by just hooking the r270 up directly to the cas (I made an interface on the cas for this), this is really handy for checking FSC loading (as I can match the Vin in the cas to the retrofitted cic).
Dont bother updating the CAS, newer versions will encrypt the key data, you may need this open if you are having a bench setup.
Its possible to dump CAS chip with Xprog5.55 also. But if I dump it what do I need to change in dump to remove ELV?
I think xprog might be able to do 2 dumps too. The CAS vin is WBAVF92020VG40588.It does not work that way, you would need to replace the dump with a firmware that does work.
the r270 will give you 2x dumps, 1x flash (the firmware) and 1x eeprom (this is the coding).
so what I did was use a non evl flash to upgrade the CAS to the correct FW and then edit the eeprom to change the vin and the mileage.
here you go firmware.I think xprog might be able to do 2 dumps too. The CAS vin is WBAVF92020VG40588.
I can try to flash it and see, but what about keys information? it exist in EEPROM? So I guess I need to flash just flash memory.
Could you provide firmware dump without ELV?
Simply in hexeditor copy adr. 0-3FFFh from 512kB file and paste it to 8000-BFFFh to 2MB file.
4000-7FFF to 18000
8000-BFFF to 28000
C000-FFFF to 38000
10000-13FFF to 48000
7C000-7FFFF to 1F8000
I thought I'd put together whats needed to have a working bench setup for things like flashing, coding and general testing of modules.
First thing you need is the CAS module, you will need to get the CAS, with the corresponding Key and key holder/lead and start button, if you can get the connector plug too, that would be ideal.
The CAS will allow you to power on a module (and keep it powered on). If the CAS is from Europe will also need a ELV module/emulator
You will also need a JBBR (junction box relay electronic), this will act as a gateway to the many modules that are in a car that use different CAN busses and bus speeds. Most cars have a k-can, pt-can and f-can, all of these are available in the JBBR (the f-can is a passthough though), K-CAN is 100bps, PT-CAN and F-CAN are 500bps
So in the JBBR there are 3 CAN buses:-
PT_CAN = for DDE, DSC, EPS, EKP, EDC.
K-Can = for CAS, KOMBI, CIC, CID, ZBE, KLIMA, MRS, FRM, PDC, FZD, COMBOX, TV ...
F-CAN = (SZL) requires connection to the DSC as the DSC is the gateway.
K-Can, is also shown in the TIS as just CAN, where you see CAN it means K-Can.
I also use a KOMBI on my bench so that i know that the system is powered on and at what stage (on, s1, s2 and start).
You will need a OBD port to connect your icom or k-can usb lead (inpa, nscexpert, ISTA-D, Winkftp etc).
Here are the basic pinouts of each module for minimum communication between modules.
CAS X13376 black 41pin plug
Pin 21 <----- +12v Batt Connector Block
Pin 34 <----- +12v Batt Connector Block
Pin 12 <----> GND Connector Block
Pin 25 <----> GND Connector Block
Pin 8 <----> wakeup (ignition)
Pin 26 <----> K-bus low
Pin 35 <----> K-bus high
JBBR x14270 ( the long black plug)
Pin 23 <----- GND Connector Block
JBBR x4010 23pin plug (thats connected to the fusebox base)
Pin 3 <----- +12v Batt (source) Connector Block
Pin 22 <----- +12v Batt (source) Connector Block
JBBR x14271 (the 54pin blue plug)
Pin 10 = K-bus low <----> CAS X13376 pin 26 = K-bus low
Pin 46 = K-bus high <----> CAS X13376 pin 35 = K-bus high
Pin 45 wakeup <----> (ignition) also connected to Pin 1 OBD
Pin 1 <----> GND Connector Block
Pin 2 <----> CAS EL + pin 23 CAS
Pin 3 <----> CAS EL - pin 24 CAS
Pin 4 <----> CAS PA-bus pin 30 CAS
------------------------------------------------------------------ Above is the basic to power on units -- Below is pins for connecting some modules.
Pin 18 <----- GND Connector Block
Pin 9 <----- 12v Connector Block
Pin 7 <----> K-bus low Connector Block
Pin 6 <----> K-bus high Connector Bloc
1: Ignition Connector Block (wakeup)
4: Gnd Connector Block
5: Gnd Connector Block
6: K-bus high (pin 17 on blue 54 pin JBBR plug, x14271)
7: I have this connected to pin 30 (PA-BUS) of the CAS (not sure if this is correct???
9: F_TD this goes to the DME)
14: K-bus low (pin 33 on blue 54 pin JBBR plug, x14271)
16: +12v Batt Connector Block
If you want an Ethernet connection to the cic
3: Ethernet connection to cic quadlock pin 37 (black plug)
8: Ethernet connection to cic quadlock pin 29 (black plug)
11: Ethernet connection to cic quadlock pin 38 (black plug)
12: Ethernet connection to cic quadlock pin 31 (black plug)
13: Ethernet connection to cic quadlock pin 32 (black plug)
JBBR x14271 (the 54pin blue plug)
Pin 17 K-bus high <----> OBD Pin 6
Pin 33 K-bus low <----> OBD Pin 14
Pin 1 PT-CAN high <---->
Pin 2 PT-CAN low <---->
Pin 3 F-CAN low <----> this is passthough only
Pin 21 F-CAN high <----> this is passthough only
CIC CID 8 Pin plug
+12v -----> Power to CID Pin 1
GND -----> GND to CID Pin 3
JBBR x14272 Pin 29 <----> K-bus high CID Pin 5
JBBR x14272 Pin 31 <----> K-bus low CID Pin 6
CIC Controller 4 Pin plug
+12v -----> Power to Controller Pin 1
GND -----> GND to Controller Pin 2
JBBR x14272 Pin 11 <----> K-bus high Controller Pin 3
JBBR x14272 Pin 30 <----> K-bus low Controller Pin 4
CIC Base 40pin quadlock Plug
Pin 9 CAN Low
Pin 11 CAN High
Pin 12 GND
Pin 13 Radio ON (CIC)
Pin 15 +12V Power (20Amp)
Pin 29 ETH_A (OBD 8)
Pin 31 ETH_TX+ (OBD 12)
Pin 32 ETH_TX- (OBD 13)
Pin 37 ETH_RX+ (OBD 3)
Pin 38 ETH_RX- (OBD 11)
NOTE: Always check the pins with https://www.newtis.info/tisv2/a/en/ some modules vary depending on year, so always double/tripple check before you plumb in a new unit, these are the pins that worked on my setup....
Always Always try to get the OEM plugs for the modules you buy it makes it so much easier to connect them together.
For Power i use a 33a, 12v power supply and a small self made switch box.
Here is a pic of the loom i have.
View attachment 38400
View attachment 38401