.: MMI EEPROM Explained
Purpose: The purpose of this document is to dump and share my and the original Authors knowledge that has been gained by experimenting and spending countless hours and many nights trying to reverse engineer my MMI units.
Scope: This page will cover the physical location and specification of the EEPROM, highlighting known sections of the EEPROM content that maintain MMI details such as part and serial number, Component Protection, available languages and some other cool hex data.
Objective: This page is intended to provide the AudiEnthusiasts a general knowledge in MMI EEPROM, with the aim to help in-house projects to be more entertaining and successful.
Cost: This information is provided for free, however, donations to the original author (Keldo at Keldo . com) or this site as a token of appreciation is not a bad idea.
What is EEPROM?
EEPROM (pronounced e-prom) stands for Electrically Erasable Programmable Read-Only Memory and is a type of non-volatile memory used in MMI's motherboard to permanently store details. Normally the content of this memory can only be modified by Audi. Note that an EPROM is not the same thing although they sever the same function. Original EPROM's could only be altered after being erased and re written using ultraviolet light if they chip was made with that ability.
The chip is manufactured by Atmel specifically for Automotive industry as a 2-Wire EEPROM. It has a capacity of 64Kb.
The full part number is AT24C64A-10TQ-2.7 but it's labeled as Q3, A, AT64A.
You can find more information about the chip by performing a search here:Data-sheet
Of course you have to take your motherboard out to see it ;)
Of course one method is to read and write to the EEPROM directly using a programmer like this:
That of course is just one example of thousands of programmers out there capable of reading and writing an EEPROM, and a programmer like that would still need an adapter to hold the EEPROM chip once removed.
You can find them on eBay for $30 but you have to remove the chip from the board in order to do that.
if you’re not very familiar with electronics and removing micro components… this is not an option for you..
Alternatively you can use OBD-II port to access module 5F, login as an engineer with appropriate security code, and read and write to the EEPROM. VCDS and VAS cables will not do this job… you need a special cable and software to perform this. So for most attacking the EEPROM will not be an option unless your ready to make an investment.
The EEPROM in MMI only uses 8192 bytes of the chip, when opening the content with Hex-editor such as XVI32 it looks like this:
Name |
Address |
Pos Start |
Pos End |
Data Type |
Example |
HW Part Number |
0x0040 |
65 |
74 |
ASCII |
8R2035754B |
SW Part Number |
0x0040-50 |
76 |
85 |
ASCII |
8R2035754C |
HW Version |
0x0050 |
88 |
89 |
ASCII |
H45 |
VW Module Num |
0x0050 |
91 |
94 |
ASCII |
J794 |
DVD Drive Num |
0x0050-60 |
96 |
102 |
ASCII |
JTB-074 |
MMI Manuf Date |
0x0060 |
103 |
109 |
ASCII |
05.03.13 |
Compat Screen |
0x0070 |
117 |
126 |
ASCII |
D7 |
Serial Number |
0x0080-90 |
130 |
154 |
ASCII |
DS1E8622290H-BN-RW |
Conv. Module |
0x0150 |
344 |
353 |
ASCII |
8K0909545A |
Display Unit |
0x19B0-E0 |
6587 |
6625 |
ASCII |
DU9466,Front,M,0,0,5 |
Languages:
The EEPROM holds a list of languages that can be permitted to be install during firmware updates, the NAR (North American Region) units only have English, Spanish and French. Whilst European units have English GB, German, Dutch, French, Spanish, Italian, Portuguese, Russian, Turkish, Swedish etc..
This section is better illustrated with a screen-shot, please see below:
Of course there are a few other variations of this such as Chinese or Japanese units.
If you need to install languages, you have to modify EEPROM first and then then re-apply the appropriate firmware files. The language setup is introduced by EEPROM, referenced by root-ifs.ifs file on the flash and the actual language files are saved on the hard drive.
As part of the security and anti-theft strategy, VW has introduced a cool way to protect its clients. They have implemented the so called “component protection”. This is a mechanism dedicated to prevent exchange of modules between different vehicles without central authorization from the VAG online database.
In MMI the component protection is save between 0x0640 and 0x0770, please see below:
You can transfer\duplicate\remove this section between all different MMI 3G and MMI 3G Plus units. When you upgrade MMI 3G to 3G plus this is the section that you will need to transfer.
As of this minute (when typing this) there isn't an easy way to translate or generate the above code. It's not based on VIN only, it's also based on several other variables that get pulled from CAN gateway.
Firmware details are located on 0x910 between pos 2314 and 2332.
A lot of other configurations are encoded in none human readable format unfortunately are saved on address 0x0B00 between 2823 and 6540.
I know this is just enough information to drive you crazy and want to try and learn more and get into the EEPROM. Be patient. Read the other articles to see what else can be done and get your feet wet. The purpose of these aren't DIY but for your understanding. If you have the experience then
you know enough to get started. If you don't have the experience then I don't have to worry about you harming your system just yet.
Please note: AudiEnthusiast.com is in no way associated to Audi or VW in any way shape or form. All brand names and manufacturers listed here are for informational purposes only and are in no way endorsed by AudiEnthusiasts.com unless stated other wise.
WARNING!! All modifications and changes are done at your own risk. This site in no way approves the modifications performed here for your vehicle. Please check with your dealer before performing any changes as they may void portions of your factory warranty.