Hello,
after several tests, mostly according to the motto trial and error, I tried to clone a Skreem module or its processor.

Here are all my test objects or victims:





First of all I noticed that although the Skreem modules from Crossfire and the immobilizer from Mercedes have the same part number 170 820 17 26 and the same processor from Motorola MC68HC05 1D69J but they are not the same.
The processor has three (or even four) areas where data is stored. One is an EEPROM which can be read and written again. Then a ROM and ROMB1 which can only be read and be written during production or by Mercedes.
And the ROM and ROMB1 of SLK and Crossfire are different, so that you can copy the EEPROM data from the Crossfire to the SLK processor, but it can't be the same.

For copying I used an Orange5 programmer.

How do I distinguish the Skreem from Crossfire and SLK?

As you can see, the modules are 100% identical from the top:





The only difference between the modules is that the Crossfire Skreem has a sticker on the back:

 

A hot air soldering station must be used for desoldering.
Mine is a very cheap (approx. 40€ from ebay) model name you can see on the photo. I have set it to 320°C:


On this picture I tried to build a heat shield with a piece of aluminium foil to protect the other parts. But this proved to be not so advantageous, because the hot air is moving under the foil and the nearby components are desoldered. So it is better to work without aluminium foil.
The hot air is used to heat the "feet" of the processor (and thus also the circuit board) in circular movements until the solder is liquid (approx. 5 min).





And can then remove the processor:


The next step is to place it on the programming adapter and solder it on:




Then check if there are no solder bridges or unsoldered pins:

 

Now the processor with the adapter board is plugged into the Orange 5 programmer:



First unlock the processor by clicking SEC:



Then read out the EEPROM and save it as a file:




Here you can switch to the ROMB1 area:




And here is the ROM area:

 

You align the processor on the board. It has a recess in one corner which I have always marked white. I also made a white dot on the board before desoldering.
Now the processor has to be aligned so that all pins are on the right solder pads, that's a fumbling.
Then I always soldered the pins in the corners first to fix the processor.
Here I show you the soldering technique with which I achieved the best results. I have neither added new solder nor flux.


Then check for solder bridges or unsoldered legs. To do this, set the multimeter to continuity test, so that a sound is heard when the test probs make contact.

 

The test in the Crossfire showed that the gelonte Skreem module doesn't work like the original. You can open and close the car with the key, but the immobiliser doesn't work.
The PCM has saved the following error:




This is what the original Skreem reports:




And so the clone:



Identical.

And also the other parameters were identical:








The only difference I could find was the VIN stored on the modules.
Original:



Clone:



This must also be stored somewhere on the processor. When repairing Uwe's Skreems, I simply soldered the processor from the Crossfire to a module from the SLK, so all relevant information must be on the processor.

Since I have no idea how to change the VIN in the processor I declare the project Skreem Cloning to failed.

 

Nice post , good information.

 

Very interesting work you have documented here
Thank you for your efforts digging deep into this and sharing with the rest of us here

 

Thank you for your hard work and excellent documentation. Your desoldering and soldering skills are impressive, too.

it is strange that the VIN can’t be reprogrammed to the clone.

 

Cant change the vin? Unless the vin is stored on a different part of the board, you should be able to modify it

 

If the VIN is really stored on the board not on the processor this would not have any afford to the immobilizer because I have also "repaired" a Skreem were I only resolder a prozessor from the Crossfire Skreem to one from a SLK no other changes where to do.
But I think the VIN is stored in the prozessor.

 

Thank you, but my soldering skills are not so good, but its good enough to put some parts together

 

Can you use that program to modify any setting within the skreem?

 

In general, the program can write anything you want in the EEPROM area.
But it doesn't help you to change anything useful.
And because I don't know where and what is there at the moment, I didn't change the data.
I only wrote the data I read from one Skreem processor 1:1 to the other.

 

Can you find a way to eliminate the module 100%? Someday these are going to be extinct so maybe that should be a direction to explore?

 

After over 30 years in electronics, much of it component-level repair, I would certainly say he's way better than I am.

By

Far

 

Another explanation in a comment on Facebook

 

Maybe this works with the analyse of the CAN transfer between Skreem and ECU. My first goal is, to have a universal set of Skreem, ECU and Transponder for the Key.

Many thanks for your praise

That is not entirely true, I have already cloned ECU so it work for a skreem.
The yellow area shows the data who is important for the skreem, the red area the data for the equipment (automatic, manual, etc.).
The VIN in the ECU can be changed freely - nothing happens.

 

The VIN of the Skreem could be in the RAM I or RAM II area of the processor.
But I have no idea how to read it. The Orange 5 doesn't give me the possibility to read or write this area.

 

May I put in my 2 cents??? sony playstation mod chips

 

Sure - we are waiting.