Research and restoration of an Audi A4 SRS unit: locked CPU and glitch technology

We published an article on restoring an Audi A4 SRS unit (8W0959655J) that developed an unrecoverable internal error B2000-00 after a failed software update.

The challenge was the board’s read-protected Renesas V850E2 processor. To bypass the protection we studied the single-wire UART bootloader protocol and applied voltage glitch technology: an overclocked Raspberry Pi Pico (250 MHz) controlled the CPU flash supply pin (FVDD), injecting microsecond power dips at the right moment.

After a successful glitch attack we dumped both Code-flash and Data-flash. The firmware was restored with our odx.py script, and the EEPROM was sourced from a donor 104-version unit. The internal error cleared and the unit again responds correctly to diagnostics.

Read the article on Habr →

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes:

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>