[cammy25]

Does anybody have done a pairing NVC + NVE manually?


I have a E60 from a customer and he replaced NVC (cam) from a donor car. He doesnt have the old broken NVC anymore.
Now i have read that NVE and NVC are paired with serial number from NVC in NVE.
In module is a MC9S12 secured. Dump is attached. Problem is also that i dont have serial number from original NVC. Donor NVC serial is 029DAE236 and can be read by tool32.
In dump i see seomething similar in 0x391 starting from second nibble. i already changed that and still nothing.
in tool32 you can see if NVC is accepted (FSC status : FSC4= NVE->CCC .FSC5=NVC->NVE ). in my situation is FSC4 ok and FSC5 Nok.

thnx

[keddy_ovi]

Hello . did you manage to do the fsc? I also made a retrofit, the camera and the module are from the same car. I've coded it with winkfp it's all right , but it asks for activation code .
I looked into the eprom you posted and saw two different chassis series CU58270 , CS89303

[inspi1981]

You need emulator after install of second hand NVC and NVE to get it work

[inotherwords]

FSC5 is always not ok, that's normal. It exists until the camera serial number is not written to ECU. After that FSC5 will be removed automatically.

---

I looked into the eprom you posted and saw two different chassis series  CU58270 , CS89303

That's because the module was coded and flashed with the second VIN. It's ok, but doesn't affect SWT VIN.

---

In module is a MC9S12 secured. Dump is attached. Problem is also that i dont have serial number from original NVC. Donor NVC serial is 029DAE236 and can be read by tool32.

What tool you've used to make this dump? X-Prog?

I think you need to find dump with known serial, otherwise it's hard to find the address. Looks like it's stored as is in 4 bytes, not in ASCII representation.

[m.nyck]

---

In module is a MC9S12 secured. Dump is attached. Problem is also that i dont have serial number from original NVC. Donor NVC serial is 029DAE236 and can be read by tool32.

[/quote]What tool you've used to make this dump? X-Prog?[/quote]

Also with R270, R280, R290 BDM Programmer can be read the mask 3L40K. 

It's interesting to find out which MCU is in NVK and whether it can be read and modified.

[inotherwords]

---

[quote="cammy25" pid='301949' dateline='1512726750']
It's interesting to find out which MCU is in NVK and whether it can be read and modified.

It's MC9S12DG128. As I can understand, it's secured, but it could be read using X-Prog or R270.

[Spitfire555]

"nivi_eeprom.bin" .... adr 0x644h - 0x647h .... serial no. (backward)