2/26/2019

CG Pro Read Porsche 1N35H BCM and Write Key Success

Report: 
A friend was trying to Read BCM porsche 2015 1N35H.
MDP can Read but can not Write
Xhorse VVDI Prog can not crack the MCU
Finnaly he decided to test the CG Pro 9s12 programmer and here is the result.

Step 1: Backup PFLASH
Connect CG Pro with BCM follow the wiring diagram
First need to read PFLASH and back it up
In CGPro software, select Immobilizer->Porshce ->BCM-1N35H (PFLASH Backup), press READ
cgpro-porsche-1n35h-bcm-1
cgpro-porsche-1n35h-bcm-2

cgpro-porsche-1n35h-bcm-3
Read PFLASH success, save data
cgpro-porsche-1n35h-bcm-4
You can see the whole dump of PFLASH
cgpro-porsche-1n35h-bcm-5
Step 2: Read DFLASH
Now we will read the DFLASH where other devices failed
Select Porsche->BCM-1N35H, check wiring diagram and connect
cgpro-porsche-1n35h-bcm-6

cgpro-porsche-1n35h-bcm-7
press READ
cgpro-porsche-1n35h-bcm-8
cgpro-porsche-1n35h-bcm-9
cgpro-porsche-1n35h-bcm-10
Read DFLASH success, save data for key adding
cgpro-porsche-1n35h-bcm-11
Step 3: Write DFLASH
Now we try to write on 1N35H where other devices failed either
Open DFLASH just saved
cgpro-porsche-1n35h-bcm-12
cgpro-porsche-1n35h-bcm-13
Press WRITE
cgpro-porsche-1n35h-bcm-14
cgpro-porsche-1n35h-bcm-15
Writing data completed
cgpro-porsche-1n35h-bcm-16
Step 4: Test if other devices can decryt this MCU
For example with Xhorse VVDI Prog
In VVDIProg software, read DFLASH
vvdi-prog-porsche-1n35h-bcm-1

vvdi-prog-porsche-1n35h-bcm-2

vvdi-prog-porsche-1n35h-bcm-3
Chip crack failure. VVDI cannot decryt this MCU.

Step 5: Read DFLASH & PFLASH again
Back again to CG pro
Read DFLASH again and make a key
Read PFLASH again to double check if our attempt with vvdi damaged anything
cgpro-porsche-1n35h-bcm-17
Data is fine, not damaged.
cgpro-porsche-1n35h-bcm-18
Now the DFLASH final reading to see if we can make a key.
This time save DFLASH data, i.e key test.bin
cgpro-porsche-1n35h-bcm-19
Step 6: Write key
Go to CGPro Key making->Porsche->BCM-1N35H, open Key Function
cgpro-porsche-1n35h-bcm-20
cgpro-porsche-1n35h-bcm-21
Open DFlash finally saved
cgpro-porsche-1n35h-bcm-22
You can see the keys and program new key
cgpro-porsche-1n35h-bcm-23
Select Write key and follow CG-Pro prompts until succeed. The last steps are easy.