VVDI MB BGA feedback on Mercedes W212 All Keys Lost

Yesterday try to replaced EIS in W212 with other used one by using Mercedes VVDI MB BGA Tool key programmer, not exactly the same part number, but with help of EPC was replaceable.

Original EIS + 1 key functional (original EIS have some malfuctionals, sometime ok, sometime not, but all keys data readable yet)

calculation key password online, get erase password success - all data saved

other used one EIS from scrapyard, no any keys, then through step: W212 all key lost to get key password, get erase password - all success
then renew this EIS with all valid passwords - success

read all EIS data from orig part and as first write VIN, then write all key data ( the process is almost the same as when teaching ELV or Emulator unit to W204)
use orig key and NEW EIS is success activated

all work with both EIS are on the table, without car !!!

put new(used) EIS back to the car and need little time wait for key recalculating to car, then turn to first ignition position and again wait for recalculating....
at end turn to 2nd ignition lights OK, again wait for recalculating in ECU, after message away try turn key to start - car start, all okey
remote lock/unlock work, no any problems...

all work was on W212 from 2009 year with ELV steering locking unit via VVDI MB Tool. 


Repair Mercedes BGA Key (Customer DIY Guide)

This is a solution from David Sun who successfully repaired the Mercedes-Benz BGA keys. Post here JUST share!!
Some time, you may encounter a Benz, the key remote control function is normal, but can not start the car, or remote control function does not work.
Please open the BGA key (please carefully open), check the BGA chip.
In many cases, Is the BGA solder ball, there is a problem, you will IC removed, the use of steel mesh, re-ball, welding to the original location, the majority can solve this failure.
Note 1: repair this pcb key isn’t so much cost-effective
normal soldering iron and hot air sure not enough when you will have 100% re-ball work Big Grin
and orig BGA key shell are not openable, then is needed a new key shell:
There are many MB BAG key available online from China, but most cannot work well with VVDI Mercedes. Some can work with Benz key IR Code Reader, some with CKM100, CKM200, DigiMaster-III. But the key above with a better board can work well with VVDI MB Tool. Users have good reviews of it.
Note 2: VVDI MB BGA Tool for mercedes key programming
BIG THANKS to David Sun from mhhauto forum.


VVDI2 Program 5th IMMO Audi A4 Remote Key via OBD2

To program Audi 5th immo key with Xhorse VVDI2 key programmer via OBD2, you need to openVVDI2 Audi 5th IMMO authorization first. Here is an example on programming a new remote key on Audi A4 B8 5th immobilizer system. Follow steps below.

Step 1. Read BCM Data
Connect VVDI2 key programmer with car and open VVDI2 software.
Choose “Audi”.
Select “Key Learn” and choose “5th immobilizer system”.
Click “Read BCM Data (OBDII)” function
Insert a working key to turn on ignition before continue.
If the key is already in car, you also need to remove it then insert it again.
If you lost all keys, you need to open car headlight and step on the brake before continue.
After read data success, name and save the eeprom bin file.
Step 2: Make Dealer Key
Click “Make Dealer Key” button.
Tip 1:
If car is A4/A5/Q5, press YES button to continue, no need working key.
If car is A6/A7/A8/VW Touareg, press NO button because it needs working key. Click “YES”.
Tip 2:
If you want to program an OEM key, make sure the new key support change ID. Click “YES”.
Choose “Program normal dealer key” option, click “Next” and “OK” to load the BCM file.
Put the new key into VVDI2 key programmer.
Click “OK” and VVDI 2 start to program new key.
Wait a minute and VVDI2 make new dealer key successfully!
Step 3: Key Learning
Change key number from 1 to 2.
Click “Key Learning” button then press “OK” to load the BCM bin file.
VVDI2 start learn key.
Use the working key to turn on ignition then insert the new key to learn
After key learning, the new key is working! VVDI2 make new remote key on Audi A4 B8 successfully!
Done! Test the new key.


Free Download Xhorse VVDI2 Key Programmer V3.0.3

Xhorse VVDI2 VAG/BMW/Porsche/PSA key programmer latest version V3.0.3 software released.

VVDI2 V3.0.3 software update feature:
*** 2017-02-15
*** Require firmware V3.0.0

===== VAG V3.0.3 =====
1. Add BCM2 dump tool, support change immodata in EEPROM dump. Menu->Special Function->BCM2 Dump Tool
2. Bugfix

===== Transponder Programmer V3.0.3 =====
1. Improvement for copy transponder: Support copy Roewe 750
2. Prepare Remote: show Roewe 750, 360, MG3 learn code
3. Immobilizer data tool: Renault Kangoo 2001 93C46 bugfix
4. Bugfix

Free Download Xhorse VVDI2 Key Programmer V3.0.3 software

Unlock BMW CAS4 5M48H via VVDI Prog Programmer

There are several programmers that can read and write BMW CAS4 5M48H, i.e Xprog V5.5 up, R280 and VVDI prog etc. see here. But there are no many tools can unlock 5m48h. You have unlocked it once you can write back to it .. to make it unsecured .. so easy to read next time. Dialprog 100% works, but it is 2000 euros.

Here is the test report via VVDI Prog by DK forum expert. You are at your risk.

First try with UPA-S using the Tomsad supplied CAS4 cable and software.

steps to unlock and read this CAS4 module (5M48H)
Things look good, there is some sort of Coax cable and CAS-4 listed on the menu....
Wait, this doesn't look good, there is only 1 connection photo and it's not the same as our CAS!
I guess we are dead in the water before we even set sail, NEXT!
Next try using Xhorse VVDI Prog with software V4.4.4.(latest goes to V4.5.54)

I see 3 options I can select. Backup, R/W/unlock and unlock.
This seems a little confusing, I'm guessing we should start with Backup.

There is 4 different connection diagrams available and our CAS is listed.
It appears we don't have to remove any of the components but have to cut 2 tracks instead.
Also, if it fails to unlock, we have to heat the thing up to 70 degrees and try again.

Time to get the microscope out and get my solder on...
Ok, so the cutting and wiring is all done, it was pretty easy under the scope but i think you would have trouble trying to do it with the naked eye.
The purple wire does not match the color code on the connection diagram but it was the only one left over, so it had to be the right one.
The three fine connections were also made under a microscope, so no telling me it was my dodgy soldering if this thing bricks the CAS!
First up, we are going to back up the D-Flash.
We click "new" and "read" and the programmer goes through some sort of initialization and checks the chip ID.
First issue I get is "FFFF" displayed for chip ID, not good.
I do some reading and watching youtube videos and apparently this is normal.
I click ok and it tries to unlock the chip.
After about 10 seconds it says success and starts to read.
The read finishes after about 30 seconds and says "operation success", HURRAH!
I look at the screen dump and all I see are F's everywhere, BOO!
I flick through the entire dump and I see data, HURRAH!

It seems the D-Flash read OK.
Next up is the P-Flash.
I don't reset the programmer or anything, I just click on P-Flash, new and read.
It goes through the same initialization and FFFF on the chip ID, I click OK with confidence.
The unlocking take about the same time and then it starts to read.
1%..... 20 seconds later, still 1%......
Sweat starts to bead on my forehead as I am now sure this has just bricked the CAS.
2%...... Wait, it's moving!
It was a very long process to get to 100%, 28 minutes to be exact.

Operation success and the screen fills with lovely, lovely data and it looks like it was another win on the P-Flash.

So it appears that VVDI Prog was able to read this CAS ok, even though the read time was very long on the P-Flash.
Mind you, when I read CAS-3 using VVDI Prog, I get a very long read time on the flash.
Other people say that their unit only takes about 5 mins to read a full flash, not sure why my unit takes longer.

All the dumps are here guys, let me know if you want me to do any special tests with this thing before I put it away.

P-Flash by VVDI Prog
Tempted to try and read this with UPA-S using the same wire up.
Once this CAS has been unlocked though, I think it makes it easier to be read again. Unless VVDI-Prog locks it again?

Yes you must lock it again to test if upa s can unlock and read.
Last time I load cas4 dump to tango it needed the isn to decrypt it. Looks like vvdi has decrypt function also.

So I am going to look at the R/W/Unlock menu and see what happens.
There is not many instructions, so I can only assume that this is the section where you can unlock, read, write and then re-lock the MCU.
I select D-flash and click "Reset Sec", it goes through the same initialization, and tells me "Chip is Crypt FF" then operation Success.
This does not seem to be what we want, I can only assume we want "DE-crypt" or something along those lines.
I hit Reset Sec again and it produces "Chip is not crypt FE", this looks better.
I can now also get the correct chip ID when I ID it.

I can read the D-flash and i'm reading the P-flash as I type (another 30 mins).
The D-Flash is the same as the backup version.
I wonder why it had to unlock the chip as I though it was unlocked when we read the backup?

After the D-flash has been read, I will try and write back the D-Flash from PremierD and see if it works.
Yes when Chip shows again FF Security is set to ON.

When try for eg now xprog it will show you that mcu is secured.

Ok, wrote another D-flash to it ok, verified ok.
Locked the MCU with "set sec" and used the bytes "FF" to lock it.
Then unlocked the MCU again, read it and all was good.
Wrote my original D-Flash back and once again locked it.
When it's locked, you cant ID the chip, you get "FFFF", when its unlocked, you get the correct ID.


VVDI MB BGA unlock W212 ELS with NEC adapter

Today tried to unlock Mercedes-Benz W212 ESL with vvdi mb bga tool v2.1.7
Blocked ESL renew succeed
Get pass online BGA key first attempt
EIS renew then personalize ESL successful
All working great
Now unlock W212 ELV unit NEC chip in 27 min
Someone feedback I had it once with a W212 fatal AA error flag unlock in under 10 min.

*** Require firmware V2.1.7
===== BENZ V2.1.7 =====
Attention: All user update device to firmware v2.1.7, software v2.1.7
User manual v1.7 released, overview v1.7 released
BGA password calculation: bugfix for lost all key W216, W164 2009-
Exchange W204 ESL without renew EIS. In ESL Tools, write EIS with password (Select Auto clear TP and personalized)
Activate key: Change key status from unuse to used
Bugfix for read v57 version password from key with NEC key adaptor

Xhorse vvdi mb tool v2.1.7 download:
Password: 123456



VVDI MB BGA Tool Unlock W204 ESL without renew EIS

Mercedes VVDI MB BGA Tool key programmer latest software 2.1.6 allow to unlock  w204 Faulty ESL without renewing EIS. 

Vvdi mb tool 2.1.6 update info about W204 esl:
Exchange W204 ESL without renew EIS. In ESL Tools, write EIS with password(Select Auto clear TP and personalized)

As for w204 Faulty ESL unlock and renew all works fine + when rematching to EIS there is no need to Get Erase Pass or Renew EIS any more since the latest update (v2.1.6), just get Key Pass and paste it to the EIS dump close go to ESL use Load Vvdi ESL Data + tick Auto Clear TP + Write all set to go.
without renew EIS

We as resellers for Vvdi MB tool confirm so, all of our many customers were able to do 908 based EIS's read Pass via I.R no issues at all, there has been issues with w211 HC912 based EIS's via OBD it's not possible to accomplish Data Accusation fully, our advise which has been tested and confirmed many times to preform all Via I.R it worked like a charm。

Some operation picture attached: